Mastering Identity and Access Management with Microsoft Azure

By : Jochen Nickel

3.7 (3)

Buy this Book

Mastering Identity and Access Management with Microsoft Azure

3.7 (3)

By: Jochen Nickel

Buy this Book

Overview of this book

Microsoft Azure and its Identity and access management are at the heart of Microsoft's software as service products, including Office 365, Dynamics CRM, and Enterprise Mobility Management. It is crucial to master Microsoft Azure in order to be able to work with the Microsoft Cloud effectively. You’ll begin by identifying the benefits of Microsoft Azure in the field of identity and access management. Working through the functionality of identity and access management as a service, you will get a full overview of the Microsoft strategy. Understanding identity synchronization will help you to provide a well-managed identity. Project scenarios and examples will enable you to understand, troubleshoot, and develop on essential authentication protocols and publishing scenarios. Finally, you will acquire a thorough understanding of Microsoft Information protection technologies.

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Free Chapter

Section 1: Identity Management and Synchronization

Building and Managing Azure Active Directory

Implementation scenario overview

Implementing a solid Azure Active Directory

Creating and managing users and groups

Assign roles to administrative units

Protect your administrative accounts

Provide user and group-based application access

Password reset self-service capabilities

Using standard security monitoring

Integrating Azure AD Join for Windows 10 clients

Configuring a custom domain

Configure Azure AD Domain Services

Summary

Understanding Identity Synchronization

Technology overview

Synchronization scenarios

Synchronization terms and processes

Summary

Exploring Advanced Synchronization Concepts

Preparing your lab environment

Understanding declarative provisioning and expressions

Synchronization rules explained

Special considerations in advanced synchronization concepts

Summary

Monitoring Your Identity Bridge

How Azure AD Connect Health works

Azure AD monitoring and logs

Azure Security Center for monitoring and analytics

Summary

Configuring and Managing Identity Protection

Microsoft Identity Protection solutions

Azure ATP and how to use it

Azure AD Identity Protection

Using Azure AD PIM to protect administrative privileges

Summary

Section 2: Authentication and Application Publishing

Managing Authentication Protocols

Microsoft identity platform

Common token standards in a federated world

Security Assertion Markup Language (SAML) 2.0

WS-Federation

OAuth 2.0

OpenID Connect (OIDC)

Pass-through authentication and seamless SSO

Multi-factor authentication

Summary

Deploying Solutions on Azure AD and ADFS

Basic environment installation and configuration

Azure AD authentication deployments

ADFS Authentication deployments

Integrating Azure MFA (YD1ADS01)

Summary

Using the Azure AD App Proxy and the Web Application Proxy

Configuring additional applications for Azure AD and ADFS

Publishing with Windows server and Azure AD Web Application Proxy

Using conditional access

Summary

Deploying Additional Applications on Azure AD

Preparing your lab environment

What defines single- and multi-tenant applications

Deploying a single-tenant application including roles and claims

Moving the single-tenant app to a multi-tenant scenario

Deploying another multi-tenant app with OpenID Connect

Summary

Exploring Azure AD Identity Services

Preparing your lab environment

Understanding Azure AD B2B

Exploring Azure AD B2C

Extending Active Directory solutions with Azure AD Domain Services

AD FS as an on-premise identity service for the cloud

Summary

Creating Identity Life Cycle Management in Azure

Lab environment readiness

Handling the guest user life cycle

Azure services for automation

Summary

Section 3: Data Classification and Information Protection

Creating a Security Culture

Why do we need a security culture?

Pillars of a good security culture

General overview of data classification

Azure Information Protection (AIP) overview

Summary

Identifying and Detecting Sensitive Data

Extending your lab environment

Understanding and using AIP capabilities for data in motion

Understanding and using AIP capabilities for data at rest

Summary

Understanding Encryption Key Management Strategies

Azure Information Protection key basics

How Azure RMS works under the hood

Summary

Configuring Azure Information Protection Solutions

Preparing to configure and manage AIP

Azure RMS management with PowerShell

Configuring AIP

Summary

Azure Information Protection Development

Technical requirements

Microsoft Information Protection solutions

Understanding the Microsoft Information Protection SDK

Preparing your Azure AD environment for tests

Using MIP binaries to explore functionality

Using PowerShell with Azure Information Protection

Overview of the RMS 2.1 and 4.2 SDKs

Summary

Other Books You May Enjoy

Leave a review - let other readers know what you think

Customer Reviews

3.7 (3)

5 star

33.3%

4 star

3 star

66.7%

2 star

1 star

Integrating Azure MFA (YD1ADS01)

In this section, we just integrate Azure MFA into our ADFS farm. We will customize and use this option in Chapter 8, Using Azure AD App Proxy and Web Application Proxy:

First of all, we need to generate a certificate for Azure MFA on each server using the following cmdlet:

# Replace the tenant ID to your value
$certbase64 = New-AdfsAzureMfaTenantCertificate -TenantID 181031inovitdemos.onmicrosoft.com

Next, we set the certificate as the new credential against the Azure Multi-Factor Auth client:

# Connect to the MsolService with your global administrator rights
Connect-MsolService

# Create a new Service Principal Credential the AppPrincipalId is the hardcoded one for Azure MFA
New-MsolServicePrincipalCredential -AppPrincipalId 981f26a1-7f43-403b-a875-f8b09b8cd720 -Type asymmetric -Usage verify -Value $certBase64