Who will be contacted for processes when flows and apps are owned by Service Accounts? (ex inactivity, compliance)

microsoft / coe-starter-kit

Other

737 stars 216 forks source link

Who will be contacted for processes when flows and apps are owned by Service Accounts? (ex inactivity, compliance) #8258

Open Chitusnair opened 3 months ago

Chitusnair commented 3 months ago

Does this question already exist in our backlog?

[X] I have checked and confirm this is a new question.

What is your question?

Will the flows and apps for which the owners are Service Accounts be marked as Orphaned apps/flows by CoE?

What solution are you experiencing the issue with?

Core

What solution version are you using?

No response

What app or flow are you having the issue with?

No response

What method are you using to get inventory and telemetry?

None

AB#3230

ClaudioRWS commented 3 months ago

Hello,

I'm going to use the example I have here in my tenant, no matter how long the app or flow has the service account, the flow searches for inactivity.

What you can do is mark the environment to not run the automation

Chitusnair commented 3 months ago

Thanks, However, my question is around Orphaned apps and Flow rather than inactivity. In the Set Flow permission app, I have noticed that flows which are having SVC account as owners are marked as Orphaned.

Jenefer-Monroe commented 3 months ago

No, service accounts behave as regular accounts, and are present from the O365 connect just as a regular user. For service principles (app registrations) these are also correctly shown as non-orphan as we do know how to look for those as users too.

Chitusnair commented 3 months ago

Thanks for the reply. So if any Inactivity alerts / Compliance emails etc will be sent to the Service account mail box? Is it possible to send it to Co-owner in such cases? We want users to follow the best practice of Service accounts as Owners of the resources, but not sure how to manage the communications to an actual user. (using service principal is not an option for us now in place of SVC accounts)

Jenefer-Monroe commented 3 months ago

Hello, today there is no such concept in the kit, but we do have a feature area in place to reconsider "ownership" in the kit. I can add this to that for consideration when we get there. Target is early autumn.