Follow OCG Learning Twitter Facebook LinkedIn Get the latest offers, details of new courses, events, webinars, white papers, news and technical opinion you can trust. Facebook facebook.com/ oxfordcomputergroup linkedin.com/company/ ocg-learning and James Cowling - Identity Management Specialist LinkedIn

MIM 2016 Service Pack 1 Webinar James Cowling CTO 20th October 2016

Agenda Quick summary of MIM 2016 Features in MIM 2016 Service Pack 1 Future Additions to MIM 2016 SP1 Upcoming Events Please note: this session will be recorded

Microsoft Identity and Access Microsoft Identity Manager 2016 Service and Portal (Workflows, Approvals, UI) Synchronization Service (Data flows and transformations, password sync) Certificate Management (Cert Enrolment, Renewal, Expiry workflows, UI) Reporting (Data Warehousing with System Center Service Manager) Roles Engine (bHold, Role Model Management and Role Assignment) Privileged Access Management (Protection for Admin Credentials) Azure Active Directory (AAD) Cloud directory with many IAM functions Sync with on-prem AD using AADSync Hybrid Identity implementations involve both major components

Service Pack 1 Features JIT groups for Priv domain PAM PowerShell Deployment Customer Reported Bug Fixes PAM Single forest deployment Cross Browser Support Email requests and approvals with Exchange Online Hardened Security Updated Platform Support

Bug Fixes Rollup of all fixes since RTM SP1 is version 4.4.1237.0 4.3.2064.0 (KB3092179) – incl. Localization and ECMA fixes 4.3.2195.0 (KB3134725) – incl. PAM Fixes 4.3.2266.0 (KB3171342) – incl. CM updates, Perf Counters fix SP1 is version 4.4.1237.0 Fixes a couple of additional PAM issues Adds Image Format validation for images uploaded to the portal

Updated Platform Support MIM Portals now run under “all major” browsers Internet Explorer Edge Chrome Safari Firefox (according to Blog, not specifically in documentation) Platform components now support modern versions Windows Server 2016 (not CM or bHold) SQL Server 2016 (not CM or bHold) SharePoint 2016 Windows 10 client See https://docs.microsoft.com/en-us/microsoft-identity-manager/plan- design/microsoft-identity-manager-2016-supported-platforms

PAM Overview Production Domain (“CORP”) assumed compromised Bastion PRIV Production Domain (“CORP”) assumed compromised Separate Admin Domain (“PRIV”) Just-In-Time Admin Candidates and Escalation PRIV Credentials not present in CORP Harder to steal if not present Admin performed using SIDHistory, One-Way Trust into CORP User PRIV.User X Member of Security Group PRIV.Security Group MIM PAM PAM Person Candidate of PAM Role Privilege of PAM Privilege

PAM PowerShell Deployment Scripts Available from MS Download Center Good documentation – a required read! Manual pre-configuration required Some manual intervention required https://www.microsoft.com/en- us/download/details.aspx?id=5394 1

PAM Single-Domain Deployment AKA “PRIVOnly” deployment PAM Users and Groups are not required to have a corresponding CORP object Allows PAM Users and Groups to reference objects which are only in the PRIV domain Supports the protection of PRIV administrator objects Just in time admin Implemented using the -PRIVOnly=true switch on all relevant PowerShell cmdLets Although possible, CORP-only deployment is not regarded as secure, therefore not best practice

Hardened Security Kerberos TGT lifetimes for PAM users now align with TTL of privilege escalation and group membership Requires Forest Functional Level 2016 If multiple time-bound memberships, ticket uses lowest TTL PAM uses Expiring Links functionality of ADDS 2016 Requires PAM Windows Optional Feature PAM Implementation uses Authentication Policy Silos Allows limitations on Kerberos Ticket Lifetimes without having to make domain-wide changes PAM can manage PRIV admins (as described already)

Exchange Online for Service Mailbox The MIM Service can now use an Exchange Online mailbox for approvals and notifications On-prem Exchange still available with same functionality Generic SMTP still available for notifications Access is via Office365 web services

Future Additions There will be a hotfix/in-place upgrade from MIM 2016 to SP1 Currently only full install is available, requires uninstall/reinstall An issue in Password Change Notification Service has been reported Rarely, in some environments, PCNS fails to start with root certificate validation error A fix will be forthcoming when the issue is nailed down Until then, test! If in doubt, stay with MIM 2016 RTM PCNS

OCG Learning - courses Learn MIM PAM training ocglearning.com/courses Foundation – Advanced – Expert Live classroom courses or online, self-paced PAM training Next one-day course: 7 November – join the live class via the internet from anywhere in the world ocglearning.com/courses We can train your team and offer ongoing support

Thank you! James Cowling CTO 20th October 2016