Nova Current - User Guide

Examples of authorization policies

Below, you will find some examples of authorization policies in Nova.

Delegating password resets

In this video we see how to delegate the ability to perform password resets.

Delegating out of office administration

In this video we see how to delegate the ability to manage out of office (automatic replies) messages.

Delegating management of MFA

In this video we see how to delegate the ability to manage multi-factor authentication settings for users.

Delegating custom PowerShell scripts

As a System or Account Administrator, you have the ability to delegate the execution of Custom PowerShell scripts to other administrators. Click here for more information on that. Follow to steps below on how to create an authorization policy to delegate custom PowerShell Scripts.

1.Go to Manage administration > Authorization Policies.

2.Click Add.

3.Enter a name for your policy.

4.On the Assignment section, on the Delegate to tab, click Add, and add the user(s) and/or OU(s) you would like to delegate the policy to.

5.Then select Managed Objects and choose which user(s) and/or OU(s) you would like the delegated administrator to perform the actions on.

6.Then select Actions and select Executes Custom PowerShell Script, and click the arrow button.

7.Under PowerShell Commands, and add the PowerShell commands that have been created. Once you have selected them, click Close.

8.Select the properties you would like to apply to your policy, then click Close.

9.Once you are finished creating the policy, click Save.

Exporting and importing policies

To ensure the policy does not become lost or corrupted, you might want to export/save the configuration to a safe location.

Exporting an authorization policy or configuration policy

Follow the steps below to export a policy file.

1.From the left menu bar, select Manage Administration > Authorization policies or Configuration policies (depending on the type of policy you want to export).

2.Either:

oExport all policies by selecting Export > Export All.

oExport a specific policy (or policies) by selecting the check box next to any policies you want to export and selecting Export > Export Selected.

3.      Click OK.

A .zip file containing the policy configuration is saved to your Downloads folder.

Importing an authorization policy or configuration policy

When you are ready to restore a previously exported policy file, follow the steps below.

1.From the left menu bar, select Manage Administration > Authorization policies or Configuration policies (depending on the type of policy you want to import).

2.Click Import.

3.Specify how you want duplicate policy names to be handled.

4.Browse for the policy file, select it, and click Open.

5.Click Import.

The restored/imported policy can now be found in your list of policies.

Policy properties

You can edit details related to actions added to authorization policies using the Properties tab (shown below).

After adding actions to a policy, you can select whether delegates can see or edit information related to the assigned actions.

For example, after assigning the Update Tenant User action to an authorization policy, you might edit the policy's properties so delegates (i.e. members of the help desk) cannot read and/or edit certain information.

 
Here is a video showing more about properties.

Configuration policies

Configuration policies bring standardization to a particular tenant (organizational unit). For example, you could use a configuration policy to grant access to a certain resource for all users within a tenant.

Or, you might manage two tenants. One contains people working in the United States, and the other contains people in the United Kingdom. You can create configuration policies to give users in the United States a Country attribute of US. And, another configuration policy gives users within the United Kingdom a Country attribute of UK.

Once a configuration policy is assigned to a particular tenant (organizational unit), a job is initiated. The job updates all user objects within the tenant, as shown below.

After initial setup, any time a new user is added to the tenant (organizational unit), a job runs to ensure the user object matches all of the tenant's configuration policies.

For a brief overview, check out the video below:

Click here to watch an introductory video on configuration policies.

Supported actions

At this time, any of these actions can be added configuration policies:

·Add User to Groups: add a user to a group

·Assign User License: Manage Microsoft 365 licenses.

·Graph Set Out of Office: Set user's out of office status.

·Set Cloud User Manager: Set a user's manager.

·Set Mailbox Primary SMTP Address: Set a user's primary email address.

·Set User Multi-factor authentication: Set a user's MFA status.

·Update Cloud User: Update Microsoft 365 user attributes.

·Update On-Premises User: Update on-prem user attributes.