10.8Recommendations

• Leave new credentials at Guarded unless you have a reason to change it. It lets an integration do everyday account work while keeping deletions and access changes in front of a person.
• Use Supervised for a new or untested agent, then relax it once you trust what it does.
• Reserve Act without asking for well-understood automation owned by someone who can approve operations, and combine it with protected containers for your most sensitive organisational units.
• Add your tier-0 organisational units (domain controllers, privileged accounts, administrative workstations) to each connection's protected containers, so that no agent can change them without a person, whatever its level.
• Pin Always ask agents on operations that machines should never perform unattended in your organisation, and use per-directory overrides to be stricter on production directories than on test ones.
• Keep Auditable on for every Destructive and Sensitive operation, so that the operations log, the volume brake and the change-history panels have something to read.
• Make sure someone receives the Agent Slowed Down notification.
• Keep the installed Exchange attribute rules unless you have a reason to remove them, and add Read only rules for any other attribute that a system of record (an HR or identity system, for example) writes and that nobody should change by hand.
• Prefer Read only to Blocked. Block an attribute only when its value must not be seen, and check first that no search, report or integration relies on it.
• Use the Test box after adding an exception or an expression, rather than reasoning about the order of rules by eye.

Permissions used in this chapter

For the complete list of permissions, see Chapter 11, Users, roles and permissions.