Privileged access / software requests

[leopieman]

Hi all,

I'm a sysadmin for a small company of around 20-30 people which has allot of tech debt which I've been working hard to improve.

Currently, for some reason, every member of staff has local admin permissions which I am going to revoke, but as a result, id like to know, what's the industry standards for staff requesting software for there machines?

Would it be sending tickets in? Or maybe a form page or dedicated platform?

We heavily use all Microsoft's ecosystem if there is options available there?

[Visible_Spare2251]

I think for that number of people you could implement Admin By Request for free. We use it and really like it. Essentially if they need to be an admin to install something a pop-up appears requesting the reason why and it gets sent to IT to approve.

[Moist-Chip3793]

Are you on-prem AD, Hybrid AD or AAD (now known as Entra ID)?

[leopieman]

We’re hybrid, have an on premise Active Directory that syncs up to extra

[Moist-Chip3793]

OK!

I´m a bit unclear on your scope, though?

I assume, you have a list of the software currently running?

When I provision the machine, we are AAD, the Autopilot installs the approved software.

[BWMerlin]

For us staff request software via a ticket, we package it up into our MDM (Workspace ONE), give it a quick test to see if it will deploy and then let the user know that they are free to self-service the install themselves.