Azure License Manager Components

Azure License Manager is an enterprise-scale, high-security product that can be run on-premise or as Software-as-a-Service run by EmpowerID as Web and Application Server containers in the cloud or on-premise. As shown below, it comprises components common to all EmpowerID connectors, with several specific to the module. A high-level description of these components follows.

EmpowerID Jobs

EmpowerID consists of many jobs that process items in a very granular way, such as inventory information, attribute flow, group membership, account lockout detection, and even license assignment changes. It stores that information in its SQL database or Identity Warehouse. Jobs can run across multiple servers in parallel to support even the largest environments. For Azure License Manager, the relevant jobs include:

Inventory
Resource System Inbox Inventory
License Pool Compiler
License Pool Change Inbox Processor
License Pool Approval Change Inbox Processor

Inventory Job

When you first connect EmpowerID to an account store like Azure Active Directory, EmpowerID discovers the topology of the account store and registers the EmpowerID equivalents of that topology in the EmpowerID Identity Warehouse. For Azure Active Directory, these EmpowerID equivalents include:

A Security Boundary object for Azure Active Directory
An Account Store object for the Azure tenant
A Resource System object to represent the account store

Once these objects have been added to the Identity Warehouse, the tables of the EmpowerID Identity Warehouse will be populated with resource objects like accounts and groups, which will be handled by specific EmpowerID services and the processes or "EmpowerID Jobs" hosted by those services. For account stores like Azure Active Directory, the relevant services and jobs are the EmpowerID Worker Role Windows service and the Inventory Job hosted by the EmpowerID Worker Role.

Job flow

The EmpowerID Worker Role schedules and dispatches the Inventory Job for each connected account store based on the schedule and account store settings. When the scheduled time arrives, the EmpowerID Worker Role instructs the Inventory Job to execute the Inventory method for the account store. In the case of an Azure Active Directory account store with an Exchange resource system, the Inventory Job makes an API call to the appropriate endpoint in Azure, retrieving each new user account and the group discovered in the account store. The information is returned to the EmpowerID Worker Role, which processes the accounts and groups, writing each as a record to the Account and Group table of the Identity Warehouse, respectively. Once this initial inventory is complete, the process repeats itself, discovering any new accounts and groups in the Azure tenant account store and adding them to the appropriate Identity Warehouse tables by the inventory schedule.

Inventory Data

The below image depicts the data inventoried by Azure License Manager.

On the right side of the image, we see an Azure tenant with users, groups, subscriptions, and license assignment information. We also see the SCIM App Service. On the left, we see our EmpowerID instance — whether it's on-premise or a SaaS instance. EmpowerID is running as Web and Application Server containers hosting inventory jobs that pulls the data from Azure and store it in the appropriate tables of the Identity Warehouse. Users from Azure Active Directory are stored in the Accounts table, groups in the Group table, and the products to which the tenant has subscribed in the AZLocalServiceBundle table. Additionally, detailed information about which users or groups are assigned to which of these subscriptions and which product features of the service plans are enabled or disabled on each assignment is stored in the AZAssigneeLocalServiceBundleService table. While the image shows just a few of the tables, it allows you to see the overall flow of how EmpowerID could securely communicate to an Azure App service running in your tenant, using a managed identity to talk to the Graph API to retrieve this information and to store it in the identity warehouse.

Resource System Inbox Inventory Processor

This job claims and processes all the data in the AzureJSONInbox table in EmpowerID. This table is populated during inventory and stores inventoried information for all Azure-specific information, such as license subscriptions, RBAC entities such as management groups, and information about license assignments. The job has two steps:

The first step performed by the Inventory Inbox job is to process the JSON documents received during inventory and insert them into a series of tables in the Identity Warehouse, prefixed with Azure. Examples of these tables include Azure_Subscription, Azure_AccountLicense, Azure_GroupLicense, and Azure_ManagedIdentity.
The second step performed by the Inventory Inbox job is to move the data from the Azure tables to their corresponding EmpowerID tables. These tables, such as the Account and Group tables, are visible in the user interface to provide reporting, delegated administration, and self-service.

License Pool Compiler Job

This job processes each enabled license pool based on the schedule set for that license pool. It evaluates the assignments and the exclusions and compiles the resultant assignments for those who should have that license bundle. This creates entries in the license fulfillment queue, also known as the license inbox, to add or remove user accounts from Azure AD license groups mapped to each license bundle. It calculates who should have that license bundle versus who is currently in that license group because of it. It also puts entries in the license fulfillment queue for who should be added to and removed from a particular license bundle.

License Pool Change Inbox Processor Job

This job reads the entries placed in the license fulfillment queue by the License Pool Compiler. It connects to the SCIM microservice to process those entries in your tenants, adding or removing users to and from license groups.

License Pool Approval Change Inbox Processor Job

This job claims records from the License Pool Change Inbox Processor that will be revoked and sent for approval. The job claims 100 removal change records in each call pending approval. These removal records are passed to the Approval workflow, which sends them for approval to each person with the RBAC delegations to make that decision.

Approval flow

The person deciding to approve selects the licenses that should be removed and the effective date for the removal to occur. These records are marked as approved, and their status is set to open. The License Pool Change Inbox Processor Job claims, and processes all approved records, and those licenses are revoked from users. Any records not selected for approval continue to be claimed by the License Pool Approval Change Inbox Processor Job until acted upon.

Get License Usage Reports Permanent Workflow

The Get License Usage Reports permanent workflow is responsible for retrieving license usage information from a connected Azure tenant on a scheduled basis. The workflow calls the getOffice365ActiveUserDetail Azure Graph API endpoint to return the following information:

Identity Warehouse

The Identity Warehouse contains many tables for storing and maintaining information about each connected resource system and the objects in those systems, including those within the EmpowerID system. These tables are differentiated by resource type and have records corresponding to inventoried and non-inventoried objects. For Azure License Manager, some examples include the Azure_Domain, Azure_AccountLicense, Azure_GroupLicense, and Azure_ManagedIdentity tables. In contrast, examples of the latter include the AzLicensePool, AzLocalServiceBundle, AccountStore, Account, and Group tables (these tables correspond to unique objects created in EmpowerID). When EmpowerID inventories an account store like an Azure tenant, it writes all relevant resource objects in those systems—and the essential attributes of those objects—to the appropriate table in the Identity Warehouse, adding the attributes of those objects as column values. This way, Azure tenants are added to the AccountStore table, user accounts in Azure are added to the Account table, groups in Azure are added to the Group table, and so on.

Azure Microservices

EmpowerID provides a workflow, AzPublishMsAppToAppService, that allows you to publish several Azure-related microservices to a connected Azure tenant. Azure License Manager uses Azure’s App Service technology to host the microservices, allowing for quick deployment and updates if changes occur in your Azure environment.

For Azure License Manager, these microservices include:

The Azure AD SCIM Microservice – The Azure AD SCIM microservice is a SCIM-compliant REST API for inventorying your Azure tenant's user, group, group membership, and license information. The application calls the Microsoft Graph API to execute operations in Azure AD, such as updating group memberships, in response to your actions in ALM.
IAM Shop Microservices – The IAM Shop microservices provide users access to the IAM Shop. They can request licenses to any Microsoft service for which they are eligible and view current license subscriptions.

The below image shows what the IT Shop looks like to a user requesting a license for which they are eligible. There is one license available to them, “itshoptest05.”
The Azure License Analytics Microservice –The Azure License Analytics microservice provides visual feedback of Azure data that your organization can use to quickly gather a real-time synopsis of license usage, which can help make informed business decisions.

The below image shows one of the information panes of the Azure License Analytics microservice. This pane displays a timeline of the status of licensed Azure accounts for the past 12 months. Hovering your mouse over a specific point in the timeline displays data for that moment.