{"id":9884,"date":"2026-05-15T11:51:50","date_gmt":"2026-05-15T09:51:50","guid":{"rendered":"https:\/\/www.idstory.com\/?p=9884"},"modified":"2026-05-18T08:53:01","modified_gmt":"2026-05-18T06:53:01","slug":"rizeni-identit-microsoft-entra-idstory","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/rizeni-identit-microsoft-entra-idstory\/","title":{"rendered":"Microsoft Entra a spr\u00e1va identit: role IdStory"},"content":{"rendered":"

IdStory a Microsoft Entra: Kde kon\u010d\u00ed cloud a za\u010d\u00edn\u00e1 \u0159\u00edzen\u00ed identit<\/h1>\n

\u010cl\u00e1nek nen\u00ed srovn\u00e1n\u00edm licen\u010dn\u00edch pl\u00e1n\u016f Microsoft Entra. Vysv\u011btluje roli samostatn\u00e9 IdM vrstvy.<\/p>\n

Pro\u010d st\u00e1le v\u00edce \u0159e\u0161\u00edme napojen\u00ed Microsoft Entra na IdStory<\/h2>\n

\u0158\u00edzen\u00ed identit v hybridn\u00edm prost\u0159ed\u00ed je dnes t\u00e9ma, kter\u00e9 \u0159e\u0161\u00ed st\u00e1le v\u00edc firem. V Microsoft ekosyst\u00e9mu vede tato cesta p\u0159es Entra ID, a\u0165 u\u017e jako roz\u0161\u00ed\u0159en\u00ed lok\u00e1ln\u00edho Active Directory, nebo jako pln\u011b cloudov\u00e9 \u0159e\u0161en\u00ed pro u\u017eivatele Microsoft 365. S t\u00edm p\u0159ib\u00fdv\u00e1 identit, kter\u00e9 se autentizuj\u00ed proti Ent\u0159e, a roste i ot\u00e1zka, kdo je vlastn\u011b spravuje.<\/p>\n

MS Entra a spr\u00e1va identit<\/h2>\n

\u201eMicrosoft cloud sv\u011bt“ v kontextu identit znamen\u00e1 ekosyst\u00e9m slu\u017eeb, kter\u00e9 se autentizuj\u00ed proti Entra ID. Pat\u0159\u00ed sem Microsoft 365 (Teams, SharePoint, OneDrive, Exchange Online), Power Platform, Dynamics 365 a stovky t\u0159et\u00edch stran, kter\u00e9 Entra ID pou\u017e\u00edvaj\u00ed jako identity provider. Mimo tento sv\u011bt pak z\u016fst\u00e1v\u00e1 v\u011bt\u0161ina on-prem syst\u00e9m\u016f, ERP jako SAP nebo Helios, v\u00fdrobn\u00ed a oborov\u00e9 aplikace a lok\u00e1ln\u00ed SaaS bez napojen\u00ed na Entra.<\/p>\n

V mnoha organizac\u00edch existuje rozpor mezi person\u00e1ln\u00ed evidenc\u00ed a realitou v IT syst\u00e9mech. Personalistika vykazuje ur\u010dit\u00fd po\u010det zam\u011bstnanc\u016f, v Microsoft Entra ID (d\u0159\u00edve Azure AD) najdete zpravidla v\u00fdrazn\u011b vy\u0161\u0161\u00ed po\u010det aktivn\u00edch identit. U z\u00e1kazn\u00edk\u016f, kde d\u011bl\u00e1me rozd\u00edlovou anal\u00fdzu, nen\u00ed v\u00fdjimkou, \u017ee po\u010det aktivn\u00edch identit v Entra ID p\u0159evy\u0161uje skute\u010dn\u00fd stav zam\u011bstnanc\u016f o des\u00edtky procent. Rozd\u00edl tvo\u0159\u00ed zapomenut\u00e9 \u00fa\u010dty externist\u016f, b\u00fdval\u00fdch koleg\u016f, servisn\u00ed \u00fa\u010dty a host\u00e9 pozvan\u00ed do MS Teams, o kter\u00e9 se procesn\u011b nikdo nepostaral.<\/p>\n

V\u011bt\u0161ina dne\u0161n\u00edch pr\u016fnik\u016f neza\u010d\u00edn\u00e1 u firewallu, ale u kompromitovan\u00e9 identity. \u00dato\u010dn\u00edk se nemus\u00ed prolamovat zven\u010d\u00ed, sta\u010d\u00ed mu p\u0159ihl\u00e1sit se ukraden\u00fdm nebo zapomenut\u00fdm \u00fa\u010dtem. Gartner proto v IAM predikcich ozna\u010duje identitu za nov\u00fd bezpe\u010dnostn\u00ed perimetr. Ne\u0159\u00edzen\u00e1 identita tak nen\u00ed provozn\u00ed detail, ale m\u011b\u0159iteln\u00e9 byznysov\u00e9 riziko.<\/p>\n

Role, kter\u00e9 nelze zam\u011bnit: z\u00e1mek vs. recep\u010dn\u00ed<\/h2>\n

Microsoft Entra ID je \u0161pi\u010dkov\u00e1 infrastruktura pro autentizaci. Odpov\u00edd\u00e1 na ot\u00e1zku: \u201eM\u016f\u017ee se tento u\u017eivatel p\u0159ihl\u00e1sit a sm\u00ed k tomuto zdroji?“ Je to dokonal\u00fd z\u00e1mek, kter\u00fd prov\u011b\u0159uje kl\u00ed\u010de, hesla, MFA, biometrii.<\/p>\n

IdStory odpov\u00edd\u00e1 na jinou ot\u00e1zku: \u201eKdo by v tomto syst\u00e9mu v\u016fbec m\u011bl b\u00fdt a na z\u00e1klad\u011b jak\u00e9 ud\u00e1losti?“ Rozhoduje o tom, komu se kl\u00ed\u010d vyd\u00e1, kdy se mu odebere a pro\u010d. Bere data z person\u00e1ln\u00edch syst\u00e9m\u016f jako zdroj pravdy a propisuje zm\u011bny do Entra ID, on-prem Active Directory a dal\u0161\u00edch c\u00edlov\u00fdch syst\u00e9m\u016f v r\u00e1mci jednoho auditovateln\u00e9ho procesu.<\/p>\n\n\n\n\n\n
Vrstva<\/strong><\/td>\nOdpov\u00edd\u00e1 na ot\u00e1zku<\/strong><\/td>\n<\/tr>\n
Microsoft Entra ID<\/td>\n\u201eM\u016f\u017ee se tento u\u017eivatel p\u0159ihl\u00e1sit a sm\u00ed k tomuto zdroji?“ \u2014 z\u00e1mek prov\u011b\u0159uj\u00edc\u00ed kl\u00ed\u010de, hesla, MFA, biometrii.<\/td>\n<\/tr>\n
IdStory<\/td>\n\u201eKdo by v tomto syst\u00e9mu v\u016fbec m\u011bl b\u00fdt a na z\u00e1klad\u011b jak\u00e9 ud\u00e1losti?“ \u2014 rozhoduje, komu se kl\u00ed\u010d vyd\u00e1, kdy se odebere a pro\u010d.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Entra je infrastruktura. IdStory je \u0159\u00edzen\u00ed. Zat\u00edmco Microsoft nab\u00edz\u00ed glob\u00e1ln\u00ed \u0161ablonu, IdStory se p\u0159izp\u016fsobuje realit\u011b \u010desk\u00e9 organizace, od napojen\u00ed na lok\u00e1ln\u00ed personalistiku (Vema, OKBase, Helios) a\u017e po v\u00edce\u00farov\u0148ov\u00e9 schvalov\u00e1n\u00ed podle vnit\u0159n\u00edch pravidel firmy. Bez \u0159\u00eddic\u00ed vrstvy m\u00e1te sice skv\u011bl\u00fd trezor, ale nem\u00e1te recep\u010dn\u00edho, kter\u00fd kontroluje, komu d\u00e1v\u00e1te kl\u00ed\u010de od budovy.<\/p>\n

T\u0159i sc\u00e9n\u00e1\u0159e, kde procesy chr\u00e1n\u00ed va\u0161i integritu<\/h2>\n

1. Onboarding: produktivita od prvn\u00ed hodiny<\/h3>\n

V b\u011b\u017en\u00e9m setupu IT odd\u011blen\u00ed ru\u010dn\u011b zakl\u00e1d\u00e1 \u00fa\u010dty v lok\u00e1ln\u00edm AD, \u010dek\u00e1 na synchronizaci a pak ru\u010dn\u011b p\u0159i\u0159azuje licence v Microsoft 365. Cel\u00e9 to trv\u00e1 dny. IdStory na\u010dte data z personalistiky a p\u0159es Microsoft Graph API vytvo\u0159\u00ed identitu, p\u0159id\u011bl\u00ed licence a za\u0159ad\u00ed u\u017eivatele do spr\u00e1vn\u00fdch Teams skupin. U\u017eivatel pracuje ihned, IT se zbavuje mechanick\u00e9 pr\u00e1ce.<\/p>\n

2. Extern\u00ed identity a strojov\u00e9 \u00fa\u010dty: konec \u0161ed\u00e9 z\u00f3ny<\/h3>\n

V MS Teams m\u016f\u017ee hosta pozvat prakticky kdokoliv, co\u017e je dlouhodob\u00fd zdroj frustrace bezpe\u010dnostn\u00edch t\u00fdm\u016f. K tomu p\u0159istupuje n\u00e1r\u016fst strojov\u00fdch identit, servisn\u00edch \u00fa\u010dt\u016f, API kl\u00ed\u010d\u016f, technick\u00fdch integrac\u00ed a nov\u011b i AI agent\u016f, kte\u0159\u00ed maj\u00ed p\u0159\u00edstupy do firemn\u00edch dat bez jasn\u00e9ho garanta.<\/p>\n

IdStory navazuje ka\u017edou identitu, a\u0165 lidskou nebo strojovou, na konkr\u00e9tn\u00edho vlastn\u00edka a datum platnosti. Po vypr\u0161en\u00ed role nebo smlouvy se p\u0159\u00edstup automaticky zablokuje. Manu\u00e1ln\u00ed recertifikace p\u0159es e-maily a sd\u00edlen\u00e9 Excely p\u0159est\u00e1v\u00e1 b\u00fdt udr\u017eiteln\u00e1 ve chv\u00edli, kdy po\u010det spravovan\u00fdch identit p\u0159es\u00e1hne n\u011bkolik set.<\/p>\n

3. Audit: dolo\u017eiteln\u00e1 n\u00e1le\u017eit\u00e1 p\u00e9\u010de<\/h3>\n

Auditor se pt\u00e1, kdo schv\u00e1lil p\u0159\u00edstup k citliv\u00fdm dat\u016fm p\u0159ed rokem. V prost\u0159ed\u00ed e-mail\u016f a ticket\u016f je dohled\u00e1v\u00e1n\u00ed prakticky nemo\u017en\u00e9. IdStory uchov\u00e1v\u00e1 auditn\u00ed stopu o ka\u017ed\u00e9 zm\u011bn\u011b identity od vzniku po z\u00e1nik, pou\u017eitelnou pro ISO 27001 i regulatorn\u00ed audity podle nov\u00e9ho z\u00e1kona o kybernetick\u00e9 bezpe\u010dnosti.<\/p>\n

Re\u00e1ln\u00e9 dopady na IT provoz<\/h2>\n

Nasazen\u00ed IdStory jako procesn\u00ed vrstvy nad Entra m\u011bn\u00ed ka\u017edodenn\u00ed realitu IT t\u00fdm\u016f ve t\u0159ech oblastech.<\/p>\n

Sn\u00ed\u017een\u00ed z\u00e1t\u011b\u017ee helpdesku. <\/strong>Reset MFA nebo obnoven\u00ed p\u0159\u00edstup\u016f lze bezpe\u010dn\u011b delegovat na oper\u00e1tory prvn\u00ed linie p\u0159es API, ani\u017e by museli dostat siln\u00e1 administr\u00e1torsk\u00e1 pr\u00e1va v Entra ID.<\/p>\n

Konec licen\u010dn\u00edho pl\u00fdtv\u00e1n\u00ed. <\/strong>Licence M365, Salesforce a dal\u0161\u00edch SaaS se uvoln\u00ed ve chv\u00edli, kdy \u010dlov\u011bk odejde nebo zm\u011bn\u00ed roli. U firem s n\u011bkolika stovkami u\u017eivatel\u016f to v sou\u010dtu b\u00fdv\u00e1 zaj\u00edmav\u00e1 ro\u010dn\u00ed \u00faspora.<\/p>\n

Konzistence nap\u0159\u00ed\u010d ekosyst\u00e9my. <\/strong>IdStory hl\u00edd\u00e1 stav identit v Microsoft prost\u0159ed\u00ed i mimo n\u011bj, v ERP, v\u00fdrobn\u00edch syst\u00e9mech a dal\u0161\u00edch aplikac\u00edch bez napojen\u00ed na Entru.<\/p>\n

\"\"<\/a><\/p>\n

Integrace p\u0159es Microsoft Graph API<\/h2>\n

IdStory komunikuje s cloudem p\u0159es modern\u00ed rozhran\u00ed Microsoft Graph API. Je to v\u00fdrobcem podporovan\u00fd a modern\u00ed zp\u016fsob, jak v cloudu prov\u00e1d\u011bt granul\u00e1rn\u00ed zm\u011bny bez nutnosti udr\u017eovat rizikov\u00e9 skripty na lok\u00e1ln\u00edch serverech. D\u00edky tomu lze nap\u0159\u00edklad bezpe\u010dn\u011b resetovat v\u00edcefaktorov\u00e9 ov\u011b\u0159ov\u00e1n\u00ed (MFA) na helpdesku.<\/p>\n

Bez t\u00e9to vrstvy m\u00e1te n\u00e1stroje, ale nem\u00e1te kontrolu.<\/strong><\/p>\n

Odpov\u011bdnost managementu a \u0159\u00edzen\u00ed rizik<\/h2>\n

Kybernetick\u00e1 bezpe\u010dnost se p\u0159esunula do agendy statut\u00e1rn\u00edch org\u00e1n\u016f. Pokud firma nedok\u00e1\u017ee dolo\u017eit, kdo m\u00e1 p\u0159\u00edstup k citliv\u00fdm dat\u016fm a z jak\u00e9ho d\u016fvodu, vystavuje se management riziku. IdStory slou\u017e\u00ed jako kl\u00ed\u010dov\u00fd d\u016fkaz n\u00e1le\u017eit\u00e9 p\u00e9\u010de, kter\u00fd auditor\u016fm potvrzuje existenci kontrolovan\u00fdch a auditovateln\u00fdch proces\u016f.<\/p>\n

Kdy IdStory ned\u00e1v\u00e1 smysl<\/h2>\n

Ne ka\u017ed\u00e1 firma IdStory pot\u0159ebuje. Otev\u0159en\u011b:<\/p>\n