Azure Active Directory Uday Hegde 2016 Redmond Summit | Identity Without Boundaries May 26, 2016 Group Program Manager, Azure AD

Customers Azure AD as the control plane On-premises Partners Azure Cloud Public cloud Microsoft Azure Active Directory BYO Windows Server Active Directory A modern identity management system spanning cloud and on-premises, providing federation, identity management, device registration, user provisioning, application access control & data protection.

10 M organizations >1.3 B Authentications a day 78 K active 3 rd party apps 700 % YoY growth 696 M users Azure Active Directory

Secure the EnterpriseIncrease ProductivityManage at scale 1000s of Apps, 1 identity Protect apps, users and devices On-Premises and the Cloud Empowering users and organizations at scale

AAD “LOCAL” DATACENTERS AAD GLOBAL DATACENTERS

Azure Active Directory Active PrimaryPassive PrimarySecondary Replica’s … Handle Reads Writes Data center boundary

Azure Active Directory

Manage at scale 9 Strong governance on protecting customer data Protection of directory data at rest Supporting rapid failover, with no loss of data

Increase Productivity SaaS Apps, 1 Identity

Web apps (Azure Active Directory Application Proxy) Integrated LOB apps SaaS apps HR and Other Directories popular SaaS apps Connect and sync on-premises directories with Azure Easily publish on-premises web apps via Application Proxy + Custom apps through a rich standards-based platform Microsoft Azure Increase Productivity SaaS Apps, 1 Identity Cloud HR

Manage your account and groups Company branded, personalized application Access Panel: + iOS and Android Mobile Apps Increase Productivity SaaS Apps, 1 Identity Self-service password reset Application access requests Integrated O365 app launching

Increase Productivity SaaS Apps, 1 Identity 1.Create a security group 2.Configure the rule on the group 3.Assign the group to applications 4.Verify that the right users have access New group All users where... RULE

Increase Productivity SaaS Apps, 1 Identity Logical operators: Value operators: (depends on value type) Rule syntax  One or more conditions  conditions contain a claim/value pair Simple rules  single condition  E.g. All users where department = “Sales” Complex rules  A combination of conditions  All sales managers worldwide and all marketing users in Greece

Increase Productivity SaaS Apps, 1 Identity ( () ) )(() condition Designing the rule All Sales Managers worldwide and all Marketing users in Greece

“We needed to quickly and cost effectively stand up new IT infrastructure, including extranet applications for thousands of business partners. Azure AD B2B collaboration provides a simple and secure way for partners, large and small, to use their own credentials to access Kodak Alaris systems.” partners Increase Productivity SaaS Apps, 1 Identity Share without complex configuration or duplicate users Partners use their own credentials to access your org Users lose access when leaving the partner org No external directories No per partner federation You manage access You control partner access in your directory: app assignment group membership custom attributes Partners of all sizes Bulk invite 1000s at a time Partners with Azure AD sign in to accept invite Other partners simply sign up to accept invite

Increase Productivity SaaS Apps, 1 Identity Windows Server Active Directory Other Directories Microsoft Azure Active Directory Cloud and Web Applications Graph Applications To Azure AD From multiple sources Inbound provisioning Outbound provisioning, SSO and licensing Write back to on-premises AD

Increase Productivity SaaS Apps, 1 Identity 19  Automatically add, update, and disable user accounts in applications  Configure attribute mappings per application  Provisioning and usage reports Microsoft Azure

Increase Productivity SaaS Apps, 1 Identity 20 Import Workday users and groups into Azure AD  Automatically import new employees when hired.  Groups can be provisioned and managed from Workday provisioning groups. Ongoing synchronization:  Groups  Users  Group membership Writeback users to AD:  Attribute authority remains with Workday  Password authority in AD

2016 Redmond Summit Sponsors

Thank you!

Subscribe to SaaS applications Switch to using SaaS versions of the app eg. Office 365 Leverage Azure AD for SaaS app management SaaS application gallery Easy provisioning, conditional access control Rewrite existing applications Rewrite apps to leverage Azure PaaS Leverage Azure AD OAuth/OpenID Connect for modern authz. Ubiquitous developer libraries. Graph API – modern directory API Lift-and-shift on-premises applications to IaaS Move existing legacy ISV or LOB applications to Azure IaaS May not have access to source code or vendor support.

What about identity in the cloud? My apps depend on AD Domain Services 1 I can’t modify some ISV apps – I don’t have source code. 1 AD Domain Services Domain join Group policy LDAP bind/authentication Kerberos, NTLM LDAP read/write

1 - VPN Gateway/ExpressRoute connection2 - Domain Controller VM in Azure

Contoso’s Virtual Network Azure AD Domain Services AAD Connect Contoso’s Azure IaaS workloads/apps Contoso premises Managed domain