Better credentials for changes management

neilr

The "enter credentials" requirement seems to be implemented with some variance. Some operations allow creds entered previously and saved, Others require every time - maybe because they are considered significant events like account deletion.

Allow this requirement to be managed by user or group. Options should include overriding the requirement, allow credentials to persist for certain operations for longer periods of time. Also for it to default or be fixed to the user's login credentials. Also allow the domain to be filled in by default, a dropdown if there are multiple domains

Experienced admins get frustrated by this feature especially for repeated operations. It needs to be streamlined for those not needing such granular control

bjoern-cusatum

I think you have not configured ARM correctly. All change credentials can be set in the appropriate change configuration (scan configuration for AD; old setting still not migrated to the change configuration).

The appropriate setting is using a service account to make the changes.

If it asks you for credentials in the UI, you don't have set them in the configuration.

If you don't want to set a service account permanently in the change configuration, this is how it works. You can save credentials you entered for your session.

For the domain filling: how should the system know which to use? It could use the domain the ressource is located in, but that's not always the case.

If you set up everything with a service account as change account, you don't need to worry about credentials anymore. Worried about people changing ressources they are not allowed to? Then use the Data Owner configuration to limit them to the ressources they actually need.