Add a script to report Safeguard license usage#647
Open
DanPeterson wants to merge 4 commits into
Open
Conversation
Read-only, non-interactive script that reports how many identities fall into each licensed Safeguard category (Privileged, LimitedPrivileged, NHI, and the Workforce add-on), with a README and sanitized sample output. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…equence The inline section headers skipped letters (5 -> 5b -> 5c, no 5a) and mixed lone sub-steps (1a, 6a) with full stages. Flatten to plain sequential integers 1-13, fold the orphan partition-ownership note into the ownership step, and update all cross-references. Comments only; no behavior change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Name the underlying capability (Personal Password Vault / Enterprise Password Vault, now the Workforce Password Vault) instead of the vaguer 'personal accounts (web-privilege / self-service)', and keep the note that the add-on is applied independently so an otherwise-Uncounted user still consumes it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Show connecting with Connect-Safeguard -Browser and then running the script with -UseExistingConnection, for callers who need MFA at sign-in or want to keep credentials out of their scripts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
samples/license-accounting/— a read-only script,Get-SppLicenseAccounting.ps1,that reads a running SPP cluster and reports how many identities fall into each
licensed category (Privileged, LimitedPrivileged, NHI, and the Workforce add-on),
so an admin can compare real usage against what they're licensed for. It's built on
safeguard-ps, only reads from the appliance, and writes a few CSVs you can open ina spreadsheet.
Privileged sessions are counted per access request rather than per connection event,
de-duplicated per user per month. The README walks through what gets counted and how
to run it (password prompt, non-interactive PKCE, or a browser login for MFA), and
sample-output/shows a real run across every category with the identifying detailsswapped for generic examples.