Protect your data Enable your users Desktop Virtualization Information protection Mobile device & application management Identity and Access Management

Active Directory: the vision

Research & Preparation First Workstation Compromised Hours Domain Admin Compromised Data Exfiltration (Attacker Undetected) months Attack Discovered

Prepare Which users have privileged access rights? Protect Lifecycle and AuthN protection Operate Users can request elevation Monitor Additional auditing, alerts & reports

14 "This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate [to] the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers..."

15

16 "Microsoft acquires Aorato to give enterprise customers better defense against digital intruders in a hybrid cloud world"

Enter-PSSession –ComputerName Server1 –ConfigurationName JustBackup

Existing AD Forest(s) Existing Apps existing trust Group “Resource Admins” User

Existing AD Forest(s) Privileged Access Management trust for admin access Microsoft Identity Manager Configured for PAM AD DS Existing Apps access requests User existing trust User: PRIV\JenAdmin Group memberships: CORP\Resource Admins Refresh after: 60 minutes

Admin Jen is assigned to a role The role is pending an elevation process for Jen Jen asks for elevation into the role Elevation process is preparing Role is active Admin Jen gets permissions for the asset Automatic approval Pending MFA Pending Role Owner approval... Lee / Admin Jen / Admin Elevation period ends Role is not active for Jen anymore Automation

MIM Service AD DS AuthZ WF Action WF MPR New-PAMRequest MIM Service DB User Group PAM Role Event Log PAM Request Microsoft Identity Manager 2016 PowerShell SOAP and REST APIs

In March CTP: "PRIV" forest AD can be either Windows Server Technical Preview or 2012 R2 PowerShell cmdlets, events and elevation via the sample web portal In April CTP: PAM workflow on elevation performs manual approval or Azure MFA Users can cancel their elevation requests Users can elevate to a role with a group in the "PRIV" forest More PowerShell cmdlet options, and more monitoring