Identity And Access Management Presented by Microsoft and Atidan
-
Upload
razor-technology-llc -
Category
Technology
-
view
163 -
download
1
Transcript of Identity And Access Management Presented by Microsoft and Atidan
* Forrester Research: “BT Futures Report: Info workers will erase boundary between enterprise & consumer technologies,” Feb. 21, 2013** http://www.computing.co.uk/ctg/news/2321750/more-than-80-per-cent-of-employees-use-non-approved-saas-apps-report*** Verizon 2013 data breach investigation report
61 percent of workers mix
personal and work tasks in
their devices*
61% >70%
>70 percent of network
intrusions exploited weak or
stolen credentials ***
>80 percent of employees
admit to using non-approved
software-as-a-service (SaaS)
applications in their jobs**
>80%
Mobile and cloud: challenging security paradigms
Is it possible to keep up?
Is it possible to stay secure?
Employees
Business partners
Customers
Apps
Devices
Data
Users
Data leaks
Lost device
Compromised identity
Stolen credentials
Is it possible to keep up?
Microsoft’s vision
Employees Business partners Customers
Access everything from everywhere
Manage and secure productivity
Integrate with what you haveApps
Devices
Data
Users
Enterprise Mobility Suite
Microsoft Azure Active Directory Premium
Microsoft Azure Rights Management Premium
Advanced Threat Analytics
Single sign-on to 1000s of
cloud and on-premises
applications.
Identity protection with
notifications, analysis,
recommended remediation, &
risk-based conditional access.
Leverage PC management,
MDM, and MAM to protect
corporate apps and data on
almost any device.
Encryption, identity, and
authorization to secure
corporate files and email across
phones, tablets, and PCs.
Identify suspicious activities
and advanced threats in near
real time with simple,
actionable reporting.
Behavior-based
threat analytics
Information
protection
Identity and access
management
Device and app
management
Microsoft Intune
System Center
Configuration Manager
Single sign-on
Microsoft Azure Active Directory
Self-service
Simple connection
On-premises
Other directories
Windows ServerActive Directory
SaaSAzure
Publiccloud
Cloud
Identity as the core of enterprise mobility
1 trillionAzure AD
authentications
since the release of
the service
>80kthird-party
applications used
with Azure AD
each month
>1.3
billion authentications every
day on Azure AD
More than
600 Muser accounts on
Azure AD
Azure AD
Directories
>9 M
86% of Fortune 500
companies use
Microsoft Cloud
(Azure, O365, CRM
Online, and PowerBI)
Every Office 365 and Microsoft Azure customer uses Azure Active Directory
Azure Active Directory
Microsoft’s “Identity Management as a Service
(IDaaS)” for organizations.
Millions of independent identity systems
controlled by enterprise and government
“tenants.”
Information is owned and used by the
controlling organization—not by Microsoft.
Born-as-a-cloud directory for Office 365.
Extended to manage across many clouds.
Evolved to manage an organization’s
relationships with its customers/citizens and
partners (B2C and B2B).
Azure Active Directory. Identity at the core of your business
Identity and access management in the cloud
1000s of apps, 1 identity
Provide one persona to the workforce for SSO to 1000s of cloud and on-premises apps
Manage access at scale
Manage identities and access at scale in the cloud
and on-premises
Cloud-powered protection
Ensure user and admin accountability with better security and governance
Enable business without borders
Stay productive with universal
access to every app and
collaboration capability
Azure Active Directory Connect and Connect Health
*
MIM
*
Microsoft AzureActive Directory
HR apps
OTHER DIRECTORIES
PowerShell
SQL (ODBC)
LDAP v3
Web Services ( SOAP, JAVA, REST)
1000s of apps, 1 identity
Connect and sync on-premises directories with Azure
1000s of apps, 1 identity
Web apps
(Azure Active Directory Application Proxy)
Integrated
custom appsSaaS apps
OTHER DIRECTORIES
2500+ pre-integrated popular
SaaS apps and self-service integration via
templates
Connect and sync on-premises directories
with Azure
Easily publish on-premises web apps via
Application Proxy + custom apps
Microsoft Azure
Microsoft AuthenticatorA mobile authenticator application for all platforms
1000s OF APPS, 1 IDENTITY
Converges the existing Azure Authenticator and all
consumer Authenticator applications.
MFA for any account, enterprise or consumer and
3rd party : Push Notifications/OTP
Device Registration (workplace join)
SSO to native mobile apps - Certificate-based SSO
Sign in to a device (Windows Hello), app, or
website without a password
AzureActive Directory
Lift-and-shift on-premises
apps to Azure IaaS
On-premises
Azure AD Connect
Windows Server Active Directory
Your Azure IaaS workloads/apps
Azure AD
Domain Services
Your virtual network
Azure
Azure Active Directory Domain Services
1000s OF APPS, 1 IDENTITY
Your domain controller as a service
Kerberos
NTLM
LDAP
Group Policy
Manage your account, apps and groups
Company branded, personalized application Access Panel:
http://myapps.microsoft.com
+ iOS and Android Mobile Apps
Self-service password reset
Application access requests
Integrated Office 365 app launching
Making the lives of users (and IT) easier
ENABLE BUSINESS WITHOUT BORDERS
“We needed to quickly and cost effectively stand up new IT infrastructure, including extranet applications
for thousands of business partners. Azure Active Directory B2B collaboration provides a simple and
secure way for partners, large and small, to use their own credentials to access Kodak Alaris systems.” 3000+ partners
Collaborate with partners: B2B collaboration
Share without complex
configuration or duplicate users
Partners use their own credentials to access
your org
Users lose access when leaving the
partner org
No external directories
No per partner federation
You manage
access
You control partner access in your
directory:
• app assignment
• group membership
• custom attributes
Partners of
all sizes
Bulk invite 1000s at a time
Partners with Azure Active Directory sign
in to accept invite
Other partners simply sign up to
accept invite
ENABLE BUSINESS WITHOUT BORDERS
Intune/MDM
auto-enrollment
Azure Active Directory Join makes it possible
to connect work-owned Windows 10 devices
to your company’s Azure Active Directory
Enterprise-compliant services
SSO from the desktop to cloud and
on-premises applications with no VPN
Support for hybrid environments
MDM auto-enrollment
Windows 10 Azure AD joined devices
Enabling anytime,anywhere productivity: Azure Active Directory Join for Windows 10
ENABLE BUSINESS WITHOUT BORDERS
Superior economics
Identity experience engine
Connecting with consumers: Azure Active Directory B2CConsumer identity and access management in the cloud
Cross-platform
Identity management for consumers
“By using Azure Active Directory B2C we were able to build a fully
customized login page without having to build custom code.
Additionally, with a Microsoft solution in place, we alleviated all
our concerns about security, data breaches, and scalability."
- Rafael de los Santos, Head of Digital, Real Madrid
ENABLE BUSINESS WITHOUT BORDERS
Centralized access administration for pre-integrated SaaS apps and other cloud-based apps
Dynamic groups, device registration, secure business processes with advanced access management capabilities
Comprehensive identity and access management console
IT professional
Managing identities
MANAGE ACCESS AT SCALE
Connect Health
MANAGE ACCESS AT SCALE
Monitor and gain insights into the identity infrastructure used
to extend on-premises identities to Azure Active Directory and
Office 365.
Monitor:
The Azure AD Connect sync engine health
ADFS infrastructure health
On-premises AD DS health
Conditions
Allow access or
Block access
Actions
Enforce MFA per
user/per app
User, App sensitivity
Device state
LocationUser
NOTIFICATIONS, ANALYSIS, REMEDIATION, RISK-BASED POLICIES
CLOUD APP DISCOVERY PRIVILEGED IDENTITY MANAGEMENT
MFA
IDENTITY PROTECTION
Risk
Identity-driven security
CLOUD-POWERED PROTECTION
Azure Active Directory Identity Protection
CLOUD-POWERED PROTECTION
Identity Protection at its best
Risk severity calculation
Remediation recommendations
Risk-based conditional access automatically protects against suspicious logins and compromised credentials
Gain insights from a consolidated view of machine learning based threat detection
Leaked credentials
Infected devices Configuration
vulnerabilities Risk-based
policies
MFA Challenge Risky Logins
Block attacks
Change bad credentials
Machine-Learning Engine
Brute force attacks
Suspicious sign-in activities
Azure Active Directory Identity Protection
CLOUD-POWERED PROTECTION
Use the power of Identity Protection in PowerBI, SIEM and other monitoring tools
Security/Monitoring/Reporting SolutionsNotifications
Data Extracts/Downloads
Reporting APIs
Apply Microsoft learnings to your existing security tools
Microsoft machine - learning engine
Leaked credentials
Infected devices Configuration
vulnerabilities Brute force
attacksSuspicious sign-
in activities
Privileged Identity Management
CLOUD-POWERED PROTECTION
Discover, restrict, and monitor privileged identities
Enforce on-demand, just-in-time administrative access when needed
Use Alert, Audit Reports and Access Review
Global Administrator
Billing Administrator
Service Administrator
User Administrator
Password Administrator
Privileged Identity Management
CLOUD-POWERED PROTECTION
How time-limited activation of privileged roles works
MFA is enforced during the activation process
Alerts inform administrators about out-of-band changes
Users need to activate their privileges to perform a task
Users will retain their privileges for a pre-configured amount of time
Security admins can discover all privileged identities, view audit reports and review everyone who has is eligible to activate via access reviews
Audit
SECURITY ADMIN
Configure Privileged
Identity Management
USER
PRIVILEGED IDENTITY MANAGEMENT
Identity
verificationMonitor
Access reports
MFA
ALERT
Read only
ADMIN PROFILES
Billing Admin
Global Admin
Service Admin
CLOUD-POWERED PROTECTION
Removes unneeded permanent
admin role assignments
Limits the time a user has admin
privileges
Ensures MFA validation prior to
admin role activation
Reduces exposure to attacks targeting admins
Separates role administration
from other tasks
Adds roles for read-only views
of reports and history
Asks users to review and justify
continued need for admin role
Simplifies delegation
Enables least privilege role
assignments
Alerts on users who haven’t
used their role assignments
Simplifies reporting on admin
activity
Increases visibility and finer-grained control
Benefits: Privileged Identity Management
Detect threats fast
with behavioral
analytics
Adapt as fast as
your enemies
Focus on what is
important fast using
the simple attack
timeline
Reduce the fatigue
of false positives
No need to create rules or policies,
deploy agents, or monitor a flood of
security reports. The intelligence
needed is ready to analyze and is
continuously learning.
ATA continuously learns from the
organizational entity behavior (users,
devices, and resources) and adjusts
itself to reflect the changes in your
rapidly evolving enterprise.
The attack timeline is a clear, efficient,
and convenient feed that surfaces the
right things on a timeline, giving you
the power of perspective on the “who,
what, when, and how” of your
enterprise. It also provides
recommendations for next steps.
Alerts only happen once suspicious
activities are contextually
aggregated; not only comparing the
entity’s behavior to its own behavior,
but also to the profiles of other
entities in its interaction path.
Microsoft Advanced Threat Analytics
CLOUD-POWERED PROTECTION
Introducing Microsoft Cloud App Security
CLOUD-POWERED PROTECTION
Extending visibility and control to
cloud apps
Create policies for access, activities,
and data sharing
Automatically identify risky activities,
abnormal behaviors, and threats
Prevent data leakage (DLP)
Minimize risk and automated threat
prevention and policy enforcement
Intune
Azure Rights
Management and
Secure IslandsProtect your users, devices, and apps
Detect problems early with visibility
and threat analytics
Protect your data, everywhere
Extend enterprise-grade security
to your cloud and SaaS apps
Manage identity with hybrid
integration to protect application
access from identity attacks
Enterprise mobility + security
Advanced Threat Analytics
Microsoft Cloud App Security
Azure Active Directory
Identity Protection
Customer StoriesTRANSPORTATION, LOGISTICS, OIL-GAS RETAIL, HOSPITALITY AND TRAVEL GOVERNMENT, BANKING, INSURANCE
CONSTRUCTION, PROFESSIONAL SERVICES EDUCATION – NONPROFIT HEALTH
Identity and access management in the cloud
• Advanced user lifecycle
management
• Low IT overhead
• Monitor your identity bridge
• Cloud-connected seamless
authentication experience
• Single sign-on to 1000s pre-
integrated apps/ Your own apps
• Secure remote access to on-premises
apps
• SSO to mobile apps
• Support for lift-and-shift to the cloud
• Control access to resources
• Safeguard user authentication
• Respond to advanced threats with
risk-based policies and monitoring
• Mitigate administrative risks
• Governance of on-premises and
cloud identities
• Ease of use for end users
/Integration with Office
• Cross-organization collaboration
• Any time, any place productivity
with Windows 10
• Support for consumer facing
applications
1000s of apps, 1 identity
Provide one persona to the workforce for SSO to 1000s of cloud and on-premises apps
Manage access at scale
Manage identities and access at scale in the cloud
and on-premises
Cloud-powered protection
Ensure user and admin accountability with better security and governance
Enable business without borders
Stay productive with universal
access to every app and
collaboration capability
Identity as the core of enterprise mobility
Single sign-onSelf-service
Simple connection
On-premises
Other directories
Windows ServerActive Directory
SaaSAzure
Publiccloud
CloudMicrosoft Azure Active Directory
FastTrack will:
Retain control of sensitive documents locally and
over email
Automatically protect mail containing privileged
information
Ensure files stored in SharePoint are rights
protected
Microsoft FastTrack for Enterprise Mobility Suite provides remote deployment assistance for Azure Active
Directory Premium, Intune, and Azure Rights Management Premium.
Azure Rights Management Premium
FastTrack will:
Set up users and groups
Enable management of test devices
Optionally connect on-premises Microsoft
System Center Configuration Manager to Intune
for a single pane management experience
FastTrack will:
Get organizational identities to the cloud
Set up single sign-on for test apps (including
Azure Active Directory Application Proxy apps)
Configure self-service options like password
reset and Azure Multi-Factor Authentication in
the MyApps site
Azure Active Directory Premium
Microsoft Intune
FastTrack for EMS: Deploy it Right
Now included with all EMS services
Top ISV solutions in Identity & Access Management
Soha Cloud
Soha’s security service ensures that you can continue to develop, test and
deploy applications on public clouds with maximum agility – while giving
management the assurance they need. It provides the security missing in
public cloud infrastructures.
Key Use Cases/ Benefits
• Eliminate VPNs, Whitelists, Access Lists and Security Groups
• Enable micro-granular access to only the applications users are
authorized to use – and nothing else
• Simple to use – Easy and fast to deploy
• Lower operating cost and no hardware or network changes required
Availability: Global
Average Deal Revenue: $5K/Quarter
Link to AppCatalog
Link to Marketplace
Enterprise Random Password Manager
Lieberman Software proactively mitigates cyber threats that bypass
traditional enterprise defenses by delivering automated intrusion
remediation in real time. Controls privilege access across data center and
cloud assets by continuously changing privileged credentials and SSH
keys. Deploy on-premises or as Azure Certified VMs (hybrid or cloud only).
Key Use Cases/ Benefits
• Proactive Cyber Defense
• Simplified Compliance
• Next Generation Privilege Management
• Enhanced IT Ops. Security and Efficiency
Availability: Global
Average Deal Revenue: $45K
Link to AppCatalog
Link to Marketplace
© 2016 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market
conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.
MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
Contact us for demonstration, briefing and deployment planning:
1-215-825-5045 x5001
Directory as a service 500,000 object limit No object limit No object limitNo object limit for Office
365 user accounts
User/group management (add/update/delete)/user-based provisioning, device
registrationYes Yes Yes Yes
Singe Sign On
10 apps per user (pre-
integrated SaaS and
developer-integrated
apps)
10 apps per user(free
tier + Application proxy
apps)
No limit (free, Basic
tiers +Self-Service
App Integration
templates 1)
10 apps per user (pre-
integrated SaaS and
developer-integrated apps)
User-based access management/provisioning Yes Yes Yes
Self-service password change for cloud users Yes Yes Yes
Connect (sync engine that extends on-premises directories to Azure Active Directory) Yes Yes Yes
Security reports/audit 3 basic reports 3 basic reportsAdvanced security
reports3 basic reports
Premium
+ basic
features
Group-based access management/provisioning Yes Yes
Self-service password reset for cloud users Yes Yes Yes
Company branding (logon pages/access panel customization) Yes Yes Yes
Application Proxy Yes Yes
SLA Yes Yes Yes
Premium
features
Self-Service Group and app Management/Self-Service application additions/ Dynamic
GroupsYes
Self-service password reset/change/account unlock with on-premises write-back Yes
Advanced usage reporting Yes
Multi-factor authentication (cloud and on-premises (MFA server)) YesLimited cloud only for Office
365 apps
MIM CAL + MIM server Yes
Cloud app discovery Yes
Automated password rollover Yes
Connect Health Yes
Azure Active Directory editions GA feature comparison + Office 365 IAM features
Yes Yes Yes Yes
MDM auto-enrollment, Self-Service Bitlocker recovery, Additional local administrators
to Windows 10 devices via Azure AD JoinYes
Microsoft Intune
Mobile device settings
management
Mobile application
management
Selective wipe
Microsoft Azure Active Directory Premium + Microsoft Identity Manager
Security reports, audit reports,
Multi-Factor Authentication
Self-service password reset
and group management
Connection between Active
Directory and Azure Active
Directory
Microsoft Azure Rights Management Service
Information protection Connection to
on-premises assets
Bring your own key
Microsoft enterprise mobility management
Challenge: identities live in too many places
HR system
LDAP
Oracle DB
Finance
Web apps
Windows Server Active Directory Hybrid
identity
User identities from
multiple repositories
LDAP v3
Windows
PowerShell
Web services
(SOAP, Java,
REST)
Generic SQL
via ODBC
Windows Server Active Directory
Microsoft Azure
Active Directory
VS.
Microsoft’s IAM solution
Apps in
Azure
Third-party
apps &
cloudsMicrosoft Cloud
Microsoft Identity
ManagerApps on-
premises
AAD App
Proxy
Spans cloud and on-premises
Provides full spectrum of services
• Federation
• Identity management
• Device registration
• User provisioning
• Application access control
• Data protection
Modern identity management system
The combination of Windows Server Active
Directory, Microsoft Identity Manager, and
Microsoft Azure Active Directory enables
better security for today’s hybrid enterprise.
Microsoft AzureActive Directory
Introducing Microsoft Identity Manager 2016
MANAGE EVERYTHING
Cloud-ready
identitiesPowerful user
self-service
Enhanced
security
Automatic preparation of
Active Directory identities for
synchronization with Azure
Active Directory
Password reset with Azure Multi-
Factor Authentication
Dynamic groups with approvals and
redesigned certificate management
Hybrid reporting and privileged
access management to protect
administrator accounts
Support for new security protocols
Microsoft Identity Manager 2016 features
MANAGE EVERYTHING
Cloud-ready
identitiesPowerful user
self-service
Enhanced
security
• Standardized Active Directory attributes
and values
• Partitioned identities for synchronization
to the cloud
• Easier-to-deploy reporting connected to
Azure Active Directory
• Preparation of user profiles for Microsoft
Office 365
• Self-service password reset with Multi-
Factor Authentication
• New REST-based APIs for AuthN/AuthZ
• Self-service account unlock
• Certificate management support for multi-
forest and modern apps
• Privileged user and account discovery
• New Windows PowerShell support and
REST-based API
• Workflow management: elevated just-in-
time administrator access
• Reporting and auditing specific to
privileged access management
IAM evolution
MANAGE EVERYTHING
ON-PREMISES HYBRID CLOUD
Managed: Microsoft System
Center Configuration
Manager
On-premises LOB
applications, traditional
productivity
iOS, Android, Windows
Phone, BYOD
Mobile apps, shadow IT SaaS
solutions
Managed: Microsoft Intune
connected to System Center
Configuration Manager
On-premises LOB applications,
managed SaaS, Office 365
hybrid deployment, Azure
Active Directory
implementation
Deployment of cloud-enabled
rich clients
Managed cloud identities with
Multi-Factor Authentication
Managed by EMS:
Combination of mobile clients
(iOS, Android) and cloud-
enabled clients (Windows 10)
Managed SaaS and Office 365
Enterprise, full Azure IAM
Event - Mobility Event-Win 8.x/10
Microsoft Identity Manager 2016
Architecture: hybrid identity with MIM
MANAGE EVERYTHING
MIM
Microsoft Identity Manager 2016
Azure AD App Proxy
Azure AD Connect
IAM
On-premises applications
Microsoft AzureActive Directory
Microsoft Azure
Scenario: self-service password reset
Username
?
Forgot your password?
User
Cloud
On-premises applications
•••••••••••••
IT
User’s identity
Self-service
experiences
Scenario: Collapse multi-forest Active Directory into one Active Directory
Microsoft Identity Manager 2016
Collapse directories
Map multiple identities
Transform usernames and
other attributes
Scenario: Implement privileged access management
UserExisting apps
Existing FIM
Existing AD
forests
WS 2003 or later
User: PRIV\JenAdmin
Groups: CORP\Resource Admins
Refresh after: 60 minutesGroup “Resource Admins”
Privileged access management
AD DS
Microsoft Identity Manager
Configured for PAM
Group: Resource
Admins
Domain: CORP
Candidate: Jen
Time-based
memberships
User “JenAdmin”
Access
requests
Existing trust
Trust for admin access
Access
requests
Deep dive: DirSync, Azure AD, and MIM Sync
DirSync
Azure Active Directory Sync
FIM Sync(+ Azure Active Directory Connector)
Azure Active Directory
Connect
MIM Sync(+ Azure Active Directory Connector)
Azure Active Directory
Connect
Deep dive: migrate to Azure Active Directory
Connect and sync on-premises directories with Azure
Azure Active Directory Connect
Microsoft AzureActive Directory
Other directories
PowerShell
LDAP v3
SQL (ODBC)
Web services (SOAP, Java, REST)
Azure Active Directory Microsoft Identity Manager
Password reset/management YES YES
Group management YES, not dynamic YES
Provisioning, deprovisioning NO YES
Certificate management NO YES
Role-based access control NO YES
Deep dive: IAM in MIM vs. Azure Active Directory
Microsoft Identity Manager 2016 is also included with Azure Active Directory Premium, which is
part of the Enterprise Mobility Suite.
Microsoft Enterprise Mobility Suite is the most cost-effective way to acquire all included cloud
services: Azure Active Directory Premium, Azure Rights Management, and Intune.
Purchasing
Microsoft Identity
Manager 2016
Licensed on a per-user basis
Client Access License (CAL) Required for each user whose identity is managed
Windows Server license with active
Software Assurance
Required to use the Microsoft Identity Manager 2016 server software as a
Windows Server add-on
Introducing Microsoft Identity Manager 2016
Cloud-ready
identitiesPowerful user
self-service
Enhanced
security
Automatic preparation of
Active Directory identities for
synchronization with Azure
Active Directory
Password reset with Azure Multi-
Factor Authentication
Dynamic groups with approvals and
redesigned certificate management
Hybrid reporting and privileged
access management to protect
administrator accounts
Support for new security protocols
Microsoft Identity Manager 2016 features
Cloud-ready
identitiesPowerful user
self-service
Enhanced
security
• Standardized Active Directory attributes
and values
• Partitioned identities for synchronization
to the cloud
• Easier-to-deploy reporting connected to
Azure Active Directory
• Preparation of user profiles for Microsoft
Office 365
• Self-service password reset with Multi-
Factor Authentication
• New REST-based APIs for AuthN/AuthZ
• Self-service account unlock
• Certificate management support for multi-
forest and modern apps
• Privileged user and account discovery
• New Windows PowerShell support and
REST-based API
• Workflow management: elevated just-in-
time administrator access
• Reporting and auditing specific to
privileged access management