Azure On-Demand Cloud Access

With Kion 3.14.1, Azure Role Assignments can be created when a user federates into Azure using a Cloud Access Role, rather than being created ahead of time for all eligible users. This change allows organizations to ensure least permissive access based on time duration regardless of their Microsoft Azure license tier.

You control this behavior in Settings > System Settings > Azure Settings > Azure Access:

• Allow Indefinite Access (on by default). Role assignments are created and maintained for all eligible users. They don't expire and persist until the user stops having access to the Cloud Access Role on the account.

• When Allow Indefinite Access is turned off, role assignments are created when a user federates into Azure using the Cloud Access Role. They automatically expire after the Session Duration you set (15-720 minutes) and are recreated the next time the user federates.