The Four Pillars of Identity: A Solution for Online Success Tom Shinder Principle Writer and Knowledge Engineer, SCD iX Solutions Group Microsoft Corporation AAP302

IT CONSTRAINTS BUDGET REDUCTIONS PROLIFERATION OF DEVICES EXPLOSIVE DATA GROWTH 20% 66% run grow 14% transform Companies are under pressure to do more with less

ALLOW CUSTOMERS & PARTNERS ROLE & DEVICE DRIVEN PRIVILEGES AVAILABILITY ENABLING DEVICES Companies must facilitate productivity without impacting security

PROLIFERATION OF GROUPS & USERS MERGERS & ACQUISITIONS RAPID ON-BOARDING OF SERVICES ADAPTING TO CLOUD Management must adapt rapidly to changing business needs

REPORT & AUDIT CENTRALIZE & STANDARDIZE PROTECT WHILE EXTENDING RAPID RESPONSE Companies need an integrated security strategy 

Incorporating Identity into your environment can transform your business PLAN FOR THE FUTURE TAKE CONTROL EMPOWER USERS

Identity Spans Environment USERS & DEVICESINFRASTRUCTUREAPPS & SERVICES IDENTITY

USERS & DEVICESINFRASTRUCTUREAPPS & SERVICES IDENTITY PUBLICPRIVATE TRADITIONAL IT HYBRID CLOUD

AUDITINGAUTHORIZATIONAUTHENTICATIONADMINISTRATION o Track who does what, when, where and how o Focused Alerting o In-Depth Collated Reporting o Governance o Single View Mgmt. o Application of Business Rules o Automated Requests, Approvals, and Access Assignment o User Sign-on Experience o Trusted Source o Standard and Secure Protocols o Level of Assurance o How and where are authorizations handled o Can a user access the resource and what can they do when they access it?

ADMINISTRATION AUDIT AUTHORIZATION AUTHENTICATION Provision & De-provision Identity Updates Change Control Synchronization Identity Proliferation Interface Selection Administration Provides Group Management

Flexible Sign-on Methods Assurance Methods Security Protocols Supported Sources AUTHENTICATION AUDIT AUTHORIZATION ADMINISTRATION Authentication Provides

Enforcement Strategy Access Policies Entitlement Type AUTHORIZATION ADMINISTRATIONAUTHENTICATION AUDIT Authorization Provides

Collection of data Governance methods Alerting Reporting AUDIT ADMINISTRATIONAUTHENTICATION AUTHORIZATION Audit Provides

BasicStandardizedRationalizedDynamic Administration Provisioning Manual Creation Automated Creation in one or more ID stores Automated Creation in all ID Stores DeprovisioningNo Deprovisioning, Adhoc Manual Deprovisioning in All ID Stores Automated Deprovisioning in one or more ID Stores Notifications to Others Automated deprovisioning in all ID Stores Group Management Manual by Help DeskOwner Managed w/o Approvals Dynamic/Attribute Based Owner Managed with Approvals Identity Updates Manual by Help DeskSelf-Service w/o verificationSelf-Service with Approvals Password Reset Performed by Help Desk Self-Service Password Reset Synchronization None Synchronization among some ID Stores Synchronization amongst all ID Stores Identity ProliferationNo Enterprise ID Store Enterprise ID Store + Application Specific Stores Single Enterprise ID Store User Interface Help DeskInternal User PortalInternal/External User Portal Change ControlNone Call Help Desk / Manual Workflow Call Help Desk / Some Electronic Workflow Self-Service Request with Electronic Workflow Authentication Sign-On Method Multiple Passwords, Multiple Logons One Password, Multiple Logons One Password, One Logon to Company Resources One Password, One Logon to all Resources SourceNo central sourceCentral + Application CentricCentral, Multiple External ID'sCentral + Federation ProtocolsMultiple Week Protocols Multiple Strong Protocols, No Transition Multiple Protocols with TransitionSingle Protocol AssuranceNo Assurance, Shared ID'sPassword-BasedSoft CertificatesMultifactor Authorization Entitlement TypeApplication Centric AD Integrated (Group based) + Some Application Centric Role or Attribute BasedCentralized Policy Based Access Policies NoneWrittenCentrally Enforced Enforcement Strategy Manual Agent, API, Proxy based Audit ReportingNone Manual Collation and Report Generation of Log Data Automated Report Generation on Some Systems Automated Attestation Report Creation AlertingNo Alerting Reactive/Event Driven Alerting Proactive Alerting + Event Based Alerting Governance No Governance No DLP, Manual Enforcement of Governance Centralized DLP in Use Collection of Data Disjoint, Manual Collection of Log Data Disjoint, Automated Collection of Logs Automated Collection of Log Data

Assess Build a Plan Innovate

TECHNOLOGIES Workshops are designed to introduce Identity and help customers understand how an identity solution could help their enterprise. Customer Benefits Include: Introduction to core tenants of Identity Discussion around recommended practices Detailed explanation of Microsoft identity solutions Business Value modeling One Day Workshop Education Hybrid DESIRED END STATES Identity Solutions Deployment Planning Assess Business Assess InfrastructureDefine Roadmap 2 Week Assessment and Roadmap Public PrivateTraditional IT Partners

Assessment designed to help the you understand your current state within identity and to provide a roadmap towards maturity based upon business needs and goals. Customer Benefits Include: Detailed assessment report and recommended path forward Logical roadmap based on assessment, experience and recommended practices 1-3 Day Workshops Education Identity Solutions Deployment Planning Assess Business Assess InfrastructureDefine Roadmap 2 Week Assessment and Roadmap One Day Workshop TECHNOLOGIES Hybrid DESIRED END STATES Public PrivateTraditional IT Partners

TECHNOLOGIES Identity Solutions Deployment Planning 1-3 Day Workshops Education One Day Workshop Microsoft Services Identity Offerings Include: Enterprise Identity Management using Forefront Identity Manager 2010 Enterprise Identity Federation using Active Directory Federation Services Access Enablement Gateway and Identity Service Solution Application Identity Assessment for Windows Azure Hybrid DESIRED END STATES Public PrivateTraditional IT Partners Assess Business Assess InfrastructureDefine Roadmap 2 Week Assessment and Roadmap

Application Owners Application Users AEGIS Solution

AAP201 Hybrid Computing is the New Net Norm SIA202 Microsoft Trustworthy Computing Cloud Security, Privacy and Reliability in a Nutshell SIA204 Cloudy Weather: How Secure is the Cloud? SIA207 Windows Server 2012 Dynamic Access Control Overview SIA312 What's New in Active Directory in Windows Server 2012 SIA313 Self-Service Password Reset for Active Directory with Microsoft Forefront Identity Manager 2010 R2 SIA316 Windows Server 2012 Dynamic Access Control Best Practices and Case Study Deployments in Microsoft IT SIA318 Managing and Extending Active Directory Federation Services SIA321 What's New in Windows Identity Foundation in Microsoft.NET Framework 4.5 SIA341 Windows Server 2012 Dynamic Access Control Deep Dive for Active Directory and Central Authorization Policies SIA21-HOL Using Dynamic Access Control to Automatically and Centrally Secure Data in Windows Server 2012 SIA01-TLC Microsoft Identity and Access SIA02-TLC Windows Server 2012 Active Directory Dynamic Access Control

Connect. Share. Discuss. Learning Microsoft Certification & Training Resources TechNet Resources for IT Professionals Resources for Developers

Evaluations Submit your evals online