Microsoft Azure Active Directory Identity Solutions Kaido Järvemets Senior Enterprise Architect, Microsoft MVP CT Global Services John Marcum Managing Consultant, Microsoft MVP CT Global Services

Kaido Järvemets John Marcum Kaidja I don’t tweet Microsoft MVP: Enterprise Mobility Microsoft MVP: Enterprise Mobility Level 13 Level 17 I hate mushrooms Grits and cornbread

Identity services K

Azure Active Directory services Azure AD Identity Protection Azure AD Privileged Identity Management Azure AD B2B Azure AD B2C Azure AD Connect Health ADFS / WAP / ADDS / Azure AD Connect Azure AD Domain Services Enterprise Mobility & Security E3 Versus E5 Azure AD Premium P1 Versus P2 K

Identity concepts J

Concepts Synchronized Identity Federated Identity NEWEST! Pass-through Authentication Cloud only Identity J

Synchronized Identity Use Cases Everything that you “think” you need ADFS for Pros Single identity Uses same password as on-prem Same Sign On Cons Authentication happens in cloud J *Also required for Pass-through and ADFS

Hybrid Identity J

Directory Synchronization J Step 1 – Import from AD Step 2 – Export to Azure AD

Preparing for Synchronization J Azure AD Connect Installation and Configuration

What is Azure AD Connect Primary tool to onboard to Azure AD Express Settings gets customers connected in a matter of minutes Provides install & configuration of password sync/ADFS for sign-in All future investments will only be available with Azure AD Connect Azure AD Connect DirSync Azure AD Sync Sync FIM + Azure AD Connector ADFS J Health ADFS

Preparation is key Get the binaries: http://bit.ly/CTAADC SQL: Instance vs 2012 Express LocalDB Service Account Virtual Service Account, Group Managed Service Account, Standard User Account Sync Groups Administrators, Operators, Browse and Reset Password group are builtin Sign-in method: Sync, Federated, Pass-through J

Preparation is key #2 Global admin account and password Sync Account Do not use an account in a domain you will enable for federation. Use an account in the default onmicrosoft.com domain, which comes with your Azure AD directory. Sync Account Regular user account w read permissions Domain and OU filtering Default: all domains and OUs are synchronized Unselect domains and OUs not to be synched Group Filtering Sync small subset of objects (pilot purposes) J

Post Install Add sync admins Assign Licenses to users Default: only user who installed and local administrators Additional: membership of ADSyncAdmins local group. Assign Licenses to users AADPremium EMS Change the default configuration Deletion threshold, etc. Install ADFS & ADDC Azure AD Connect Health Agents J

Installation and Configuration Azure AD Connect Installation and Configuration Demo K

Synchronized Identity Demo J

Federated Identity Use Cases Pros Cons Conditional access Single Sign On No password hash sync Regulations Pros Cons Complex infrastructure Single point of failure K https://support.office.com/en-us/article/Understanding-Office-365-identity-and-Azure-Active-Directory-06a189e7-5ec6-4af2-94bf-a22ea225a7a9#bk_federated

ADFS is NOT REQUIRED for Exchange Online etc. Big announcement ADFS is NOT REQUIRED for Exchange Online etc. K

why folks do use AN ADFS? Office 365 requires an ADFS infrastructure False I need an ADFS because it is more secure I need an ADFS because I cant sync my password hashes True K

High level overview K

Federated Demo K

Pass-through Authentication Use cases Another way to do everything you “think” you need ADFS for ;-) Reduce complexity Pros No password hash sync Single sign-on Cons Complex infrastructure Single point of failure K *Still in preview

HIGH Level Overview

Pass-through Authentication Demo K

Cloud only Use cases Pros Cons Grant vendor access to online resources No infrastructure Can be converted to synchronized Near 100% uptime Cons Does not use on-prem credentials Limited access to on-prem resources J

Cloud Only Demo J