Azure License Manager is an enterprise-scale, high-security product that can be run on-premise or as Software-as-a-Service run by EmpowerID as Web and Application Server containers in the cloud or on-premise. As shown below, it is comprised of components common to all EmpowerID connectors with several that are specific to the module. A high-level description of these components follows.
...
EmpowerID consists of a large number of jobs for very granular processing of different items such as inventory information, attribute flow, group membership, account lockout detection and even license assignment changes and stores that information in its SQL database or Identity Warehouse. Jobs can run across multiple servers in parallel to support even the largest environments. For Azure License Manager, the relevant jobs include:
Inventory
Resource System Inbox Inventory Inbox
License Pool Compiler
License Pool Change Inbox Processor
License Pool Approval Change Inbox Processor
...
The below image depicts the data inventoried by Azure License Manager.
...
On the right side of the image, we see an Azure tenant with users, groups, subscriptions, and license assignment information. We also see the SCIM App Service. On the left, we see our EmpowerID instance — whether it's on-premise or a SaaS instance. EmpowerID is running as Web and Application Server containers hosting inventory jobs that pull pulls the data from Azure and stores it in the appropriate tables of the Identity Warehouse. Users from Azure Active Directory are stored in the Accounts table, groups in the Group table, and the products to which the tenant has subscribed in the AZLocalServiceBundle table. Additionally, detailed information about which users or groups are assigned to which of these subscriptions, as well as which of product features of the service plans are enabled or disabled on each of these assignments is stored in the AZAssigneeLocalServiceBundleService table. While the image shows just a few of the tables, it allows you to see the overall flow of how EmpowerID could securely communicate to an Azure App service running in your tenant, using a managed identity to talk to the Graph API to retrieve this information and to store it in the identity warehouse.
...
Resource System Inbox
...
Invnetory Processor
This job claims and processes all the data contained in the AzureJSONInbox table in EmpowerID. This table is populated during inventory and stores inventoried information for all Azure-specific information such as license subscriptions, RBAC entities such as management groups, and information about license assignments. The job has two steps:
The first step performed by the Inventory Inbox job is to process the JSON documents received during inventory and insert them into a series of tables in the Identity Warehouse, prefixed with Azure. Examples of these tables include Azure_Subscription, Azure_AccountLicense, Azure_GroupLicense, and Azure_ManagedIdentity.
The second step performed by the Inventory Inbox job is to move the data from the Azure tables to their corresponding EmpowerID tables. These tables, such as the Account and Group tables, are visible in the user interface to provide reporting, delegated administration, and self-service.
License Pool Compiler Job
...
This job claims records from the License Pool Change Inbox Processor that are to be revoked and send them sent for approval. The job claims 100 removal change records in each call that are pending for approval. These removal records are passed to the Approval workflow, which sends them for approval to each person with the RBAC delegations to make that decision.
...
The person making the approval decision , selects the licenses that should be removed and the effective date for the removal to occur. These records are marked as approved and their status is set to open. The License Pool Change Inbox Processor Job claims and processes all approved records and those licenses are revoked from users. Any records not selected for approval continue to be claimed by the License Pool Approval Change Inbox Processor Job until acted upon.
Get License Usage Reports Permanent Workflow
The Get License Usage Reports permanent workflow is responsible for retrieving license usage information from a connected Azure tenant on a scheduled basis. The workflow calls the getOffice365ActiveUserDetail Azure Graph API endpoint to return the following information:
Identity Warehouse
The Identity Warehouse contains a large number of tables for storing and maintaining information about each connected resource system and the objects in those systems, including those within the EmpowerID system itself. These tables are differentiated by resource type and have records corresponding to both inventoried and non-inventoried objects alike. For Azure License Manager, some examples of the former include the Azure_Domain, Azure_AccountLicense, Azure_GroupLicense, and Azure_ManagedIdentity tables, while examples of the latter include the AzLicensePool, AzLocalServiceBundle, AccountStore, Account, and Group tables (these tables correspond to unique objects created in EmpowerID). When EmpowerID inventories an account store like an Azure tenant, it writes all relevant resource objects in those systems—and the important attributes of those objects—to the appropriate table in the Identity Warehouse, adding the attributes of those objects as column values. In this way, Azure tenants are added to the AccountStore table, user accounts in Azure are added to the Account table, groups in Azure are added to the Group table, and so on.
...
For Azure License Manager, these microservices include:
The Azure AD SCIM Microservice — The EmpowerID – The Azure AD SCIM microservice is a SCIM-compliant REST API for inventorying the user, group, group membership, and license information in your Azure tenant. The application calls the Microsoft Graph API to execute operations in Azure AD, such as updating group memberships, in response to your actions in ALM.
IT Shop Microservices — The – The IT Shop microservices provide users access to the IT Shop, where they can request licenses to any Microsoft service for which they are eligible and view current license subscriptions.
The below image shows what the IT Shop looks like to a user requesting a license for which they are eligible. There is one license available to them, “itshoptest05.”
The Azure License Analytics Microservice — The –The Azure License Analytics microservice provides a visual feedback of Azure data that can be used by your organization to quickly gather real-time synopsis of license usage, which can be helpful for making informed business decisions.
The below image shows one of the information panes of the Azure License Analytics microservice. This pane displays a timeline of the status of licensed Azure accounts for the past 12 months. Hovering your mouse over a specific point in the timeline displays data for that moment in time.
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|