Overview of Functionality
Role based access control (RBAC) provides a mechanism to limit access to functions (e.g. policy, settings, SkopeIT, etc.) along with the level of access (no access, view, manage, and manage+apply). However, it does not currently provide a mechanism to limit access to specific objects within functions (e.g. only to some but not all destination profiles).
Label based access control (LBAC) is a powerful extension of core RBAC functionality that enables object level access control. It provides a method to configure access (via custom roles) to administrators to have access to a subset of objects within a function that they have access to. It achieves this control via attaching labels to roles on the one hand and to configuration objects on the other. Once a label is configured for a custom role, the role has a notion of Zero Trust access to all configuration objects – in other words, an administrator with such a custom role will have access to only those configuration objects that carry the given labels and no access to any other. This achieves a level of separation and isolation that can be of value in large enterprises and service providers. Finally, the labels also support hierarchical management of configuration objects that supports a hierarchy of up to 4 levels down from root.
Use Cases
- Visual separation of configuration for global administration. By simply assigning labels (which also support a color), a tenant administrator can ensure that configuration elements for different entities, business units, departments are easily identifiable even when being viewed at once in a single tenant. This reduces clutter, confusion and risk of making mistakes
- Least privilege access management. As a general principle of Zero Trust it is important that least privilege is configured in order to reduce attack surface. By configuring RBAC along with labels, an enterprise can ensure that only the most limited set of configuration objects are exposed to certain access methods. This can be particularly useful for service accounts used in automation e.g. Cloud Exchange, external API clients etc
- Administrative multitenancy for delegated administration. For large enterprises or some service providers that manage multiple customers in a single tenant, it is advisable to partition their configuration estate between various administrators for better management. This can be managed by assigning appropriate labels to various configuration objects and to various custom roles. This ensures that various administrators only view the configuration relevant to them ensuring operational speed, accuracy and reduction of errors
- Hierarchical configuration management. Certain large enterprises can create configuration hierarchies by creating top level or global configuration that has to be followed by all other entities, business units, departments that are being managed in the given tenant. Using a hierarchy of labels, a tenant administrator can define common profiles and objects that can be used by delegated administrators without the ability to edit them.
Terminology
- Configuration Object: Any object such as Destination Profile, Network Location, DNS Profile, DLP Profile, DLP Rule etc that is used to store configuration information
- Label: A text identifier attached to any configuration object
- Custom Role: A role that a customer can configure with a set of functions and level of access
Labels are supported by the following configuration elements:
- Destination Profiles
- Private Apps
- Publishers
- Policy Groups