Is there a way to automate temporary access for pr...

pborah · ‎01-15-2025

We usually try to set app access by AD groups and not on an individual basis or by a user's email. But every so often, certain employees require temporary access and we are forced to break our own rule and give them access by their work email. Over the last few years these cases have increased in frequency and sometimes we lose track of whose access to revoke. Other times certain employees assume a role-in-acting for a week or two and again we have to do the same thing. However we are never given any information as to when their acting period ends. It's not always possible to manually reach out to the individual and even if we do, goodluck getting a response in time.

We, for better or worse, are unable to depend on our infrastructure team to handle these things in AD in a timely manner even though they will not give us full control of our tenant. We have workspace admin and PowerBI admin in our team but capacity admin and global admin are in the infrsatructure team as they like to have greater control over everything. Is there a way for us to set access for users that expire after a certain time be it in the UI (unlikely as I have not seen anything as such), or by way of powershell? Thank you.

v-csrikanth · ‎02-10-2025

Hi @pborah
Did you got any chance to have a try of suggested solution provided above.

If the above information helps you, please give us a Kudos and marked the reply Accept as a Solution.

Thanks,
Cheri Srikanth

v-csrikanth · ‎01-26-2025

Hi @pborah
We haven't heard from you since last response and just wanted to check whether the solution provided has worked for you. If yes, please accept as solution to help others benefit. If not, feel free to reach out.
Thank you.

v-csrikanth · ‎01-22-2025

Hi @pborah

I wanted to check if you had a chance to try the suggested solution.
Please let us know if you need any further assistance.

Looking forward to your update!

If the above information helps you, please give us a Kudos and marked the reply as a solution.

Thanks,
Cheri Srikanth

v-csrikanth · ‎01-20-2025

Hi @pborah
Thank you for reaching out to the Microsoft Fabric Community.

Please find the below steps to automate:

Self-Service Access Request Form (SharePoint List)

Create a SharePoint list where users/managers submit temporary access requests with details like:

Employee Email
Group/App to access
Start & Expiry Date
This provides a centralized record of requests.

Automated Granting/Revoking Access (Power Automate)

Power automate will read new requests from the SharePoint list.
Trigger PowerShell scripts (run on a VM or local server with Task Scheduler) to add/remove users to/from AD groups.
Send notifications to the user and admin when access is granted/revoked.

PowerShell Script for AD Access Management

Connect to Azure AD using app-based authentication (avoiding manual logins).
Add the user to the specified group.
Schedule the removal of access based on the expiry date.

If the above information helps you, please give us a Kudos and marked the reply as a solution.

Thanks,
Cheri Srikanth

pborah · ‎02-13-2025

Hi @v-csrikanth , I proposed this solution to my boss and while it's ingenious, he feels this is not an efficient solution for us. We will instead be pushing for greater control of AD when it comes to PowerBI for our team and manage access using powershell script and AD. Thank you very much for your help and apologies for the delayed response.

pborah · ‎01-28-2025

Hi @v-csrikanth , thank you for the proposed solution. I will do a test implementation in the coming week and report back here whether that worked. We do have multiple reports in development at any given time so we're not always able to try out a suggested soloutiuon right away. Thank you for your patience.