docs(accessanalyzer): note effective permissions limitation for AD trusts - #1393
Open
nexusphi wants to merge 13 commits into
Open
docs(accessanalyzer): note effective permissions limitation for AD trusts#1393nexusphi wants to merge 13 commits into
nexusphi wants to merge 13 commits into
Conversation
…nitoring plan (#1204) Generated with AI Co-authored-by: Claude Sonnet 4.6 <ai@netwrix.com>
…ifier (#1219) Add a dedicated page documenting gMSA support for PEN in Auditor 10.9: - Required AD permission (GenericRead — a note explains that Authenticated Users typically already grants it) - How to specify the gMSA in the monitoring plan (trailing $, locked Password field, scheduled task under NT AUTHORITY\SYSTEM) - UI limitations for Select OUs / Select Groups / Generate (LDAP from the interactive session) - Troubleshooting table Link the new page from passwordexpirationnotifier/overview.md — the "Review the following" list and the User name/Password row of the monitoring plan configuration table. Refs #440770 Generated with AI Co-authored-by: Claude Code <ai@netwrix.com>
…iles State-in-Time Add a "Configuring Active Directory integration (optional)" section covering the on-premises AD credentials feature added for group expansion and SID resolution in permission reports, and replace the static limitation note with a link to the new section. AB#444015 Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com>
- Add a "Collect data for state-in-time reports" step, mirroring the FSA article, linking into the AFA State-in-Time configuration guide - Split the vague exclusions bullet into Subscription-level (omit storage accounts) vs Storage-Account-level (omit list) guidance, matching what the item's Scope tab actually does per item type - Remove "Step 5: Test Connection", which doesn't exist in the product - Fix step numbering gap and inconsistent 10_8/10.9 doc version links Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com>
Document Active Directory integration for Azure Files State-in-Time
Document requirement for Application.Read.All permission
Align AFA SIT description with FSA articles
…1335) * fix(auditor/10.9): editorial fixes and TLS setting for API docs Fix style guide violations in Integration API prerequisites and security pages (numbered steps, active voice, sentence-case headings, spelled-out acronyms), and document the minTlsVersion setting in the APIAdminTool command table. * fix(vale): auto-fix style issues (Vale + Dale) * docs(auditor/10.9): clarify default minimum TLS version for new installs Co-Authored-By: Claude claude-sonnet-5 <noreply@anthropic.com> Co-Authored-By: Claude Code <ai@netwrix.com> --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Claude claude-sonnet-5 <noreply@anthropic.com> Co-authored-by: Claude Code <ai@netwrix.com>
…usts Effective permission calculations aren't always accurate across trust relationships between domains or forests. Ref ticket 450424 / bug 449357.
Denis-A-Netwrix
force-pushed
the
release/auditor_10.9_U1
branch
from
August 19, 2026 10:44
3e0f2f3 to
fca4c0f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a documentation note that Access Analyzer's effective permissions calculation for Active Directory isn't always fully accurate when a trust relationship spans domains or forests, specifically when group membership includes principals from a trusted domain in another forest.
Changes
docs/accessanalyzer/2601/overview/keyconcepts.md - Added a note under the Identities and Entitlements section, where effective permissions is first introduced conceptually.
docs/accessanalyzer/2601/connectors/activedirectory.md - Added a new Limitations section on the Active Directory connector page, documenting the same caveat in the context of the connector's requirements.
Why
The collector can't always reliably resolve effective permissions across trust relationships between domains or forests, for example when EntraID doesn't see group members that exist on-premises via a trust from another forest. Docs need to set accurate expectations for this scenario rather than imply full precision.
Related bug: AB#449357, "[AFA][SIT] Does not account for groups where EntraID does not see members, but on-premises they exist - principals from another trust forest"
AB#450424
Test plan
Dale linter run on both files, passive-voice and wordiness findings addressed for the newly added text (pre-existing findings elsewhere in keyconcepts.md are out of scope)
Vale will be auto-fixed by the CI vale-autofix workflow on this PR
Editorial review via the doc-pr workflow