12/1/2018 2:29 AM How Microsoft does IT: Empower your teams with secure devops in the cloud Seth Malcolm IT Showcase © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

“Companies looking to digitally transform need a trusted cloud “Companies looking to digitally transform need a trusted cloud.” -Satya Nadella code build test plan release monitor operate deploy

Enterprise Cloud Security IT SECURITY Sets security, compliance and privacy expectations for the enterprise Monitors and responds to threats CLOUD SERVICE PROVIDER - Manages life cycle of secure and compliant infrastructure + services - Provides automation, tools and guidance to enable customers to run and operate securely CLOUD SECURITY

IT Capability Readiness for Azure Microsoft Inspire 12/1/2018 2:29 AM IT Capability Readiness for Azure Cloud security is the combination of provider and IT capabilities Azure IT Enterprise Cloud Security Azure Platform Security Azure Services + Features Governance + Policy Central IT Security Operations DevOps | App Team Readiness © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Secure DevOps Kit for Azure Subscription Security (Policy, ASC Config, Alerts, RBAC, etc.) Provision security in subscription 1 Telemetry Dashboard Make data-driven improvements to security 6 Security IntelliSense, Security Verification Tests (SVTs) Develop securely, spot check security via scripts 2 OMS Solution for Alerting & Monitoring Single security dashboard across DevOps stages 5 CICD Build/Release Extensions Deploy securely from VSO build/release pipeline 3 Continuous Assurance Runbooks Periodically scan in production to watch for drift 4

1- Secure your cloud subscription Microsoft Inspire 12/1/2018 2:29 AM 1- Secure your cloud subscription Resource Locks Contact Phone ARM Policy RBAC Alerts © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2- Empower developers – code, compile, prototype Microsoft Inspire 12/1/2018 2:29 AM 2- Empower developers – code, compile, prototype SVTs © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3-Bake security into cloud deployments (CICD) Code Complete Dev Envmt Test Envmt ? Prod Envmt Test Envmt Prod Envmt ?

4- Setup continuous security coverage Microsoft Inspire 12/1/2018 2:29 AM 4- Setup continuous security coverage Azure Automation © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4- Continuous security coverage (a peek) Microsoft Inspire 12/1/2018 2:29 AM 4- Continuous security coverage (a peek) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5- Monitor security across dev ops stages Single dashboard for security in Operations Management Suite Secure DevOps Kit for Azure CICD CC SDL OMS Solution Packs OMS Agents

5- Get actionable alerts from cloud resources

6- Be data-driven about cloud security Microsoft Inspire 12/1/2018 2:29 AM 6- Be data-driven about cloud security © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6- Be data-driven about cloud security

Secure DevOps Kit for Azure Subscription Security (Policy, ASC Config, Alerts, RBAC, etc.) Provision security in subscription 1 Telemetry Dashboard Make data-driven improvements to security 6 Security IntelliSense, Security Verification Tests (SVTs) Develop securely, spot check security via scripts 2 OMS Solution for Alerting & Monitoring Single security dashboard across DevOps stages 5 CICD Build/Release Extensions Deploy securely from VSO build/release pipeline 3 Continuous Assurance Runbooks Periodically scan in production to watch for drift 4

Secure DevOps Kit – Impact at Microsoft 462 subscriptions scanned 4245 Azure resources secured 95000 controls scanned till date 8000+ hours of manual effort saved 250+ security controls across 25 Azure services 40+ enterprise LOB apps across IT

Coverage of Azure Services Microsoft Inspire Coverage of Azure Services 12/1/2018 2:29 AM Blobs © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12/1/2018 2:29 AM Resources Case study https://www.microsoft.com/itshowcase/Article/Content/919/Building-cloud-apps-using-the-Secure-DevOps-Kit-for-Azure  GitHub http://aka.ms/azsdkossdocs © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

<Event Name Here> 12/1/2018 IT Showcase We offer what no one else can—the inside story of how Microsoft does IT. Our early adopter experiences, best practices, and proof points offer an inside view of the Microsoft enterprise in order to help inform your most crucial IT implementer decisions. Technical content Case studies and white papers Productivity guidance Videos and webinars Adoption suites How Microsoft does IT Content Courses Productivity microsoft.com/ITShowcase

IT Showcase sessions (Mon, Tue) 12/1/2018 2:29 AM View our session list at: aka.ms/itshowcaseignite2017 Code Day Time Location* Title Session Type THR1092 Monday 1:15PM - 1:35PM Microsoft Theater 12 How Microsoft does IT: Learn from our IT experiences by exploring content resources from IT Showcase Theater | 20 minutes THR1095 1:45PM – 2:05PM How Microsoft does IT: WorkSmart@Microsoft, a playbook to empower and inspire your employees THR1094 4:35PM – 4:55PM How Microsoft does IT: Top tips for service managers transforming to a cloud-based world THR2278 5:05PM – 5:25PM How Microsoft does IT: Digitally transforming the Microsoft manufacturing supply chain THR1088 6:35PM – 6:55PM How Microsoft does IT: Accelerate adoption and productivity with quality communications THR2290 7:05PM – 7:25PM How Microsoft does IT: How Microsoft is embracing and building modern SharePoint experiences internally BRK3113 Tuesday 9:00AM – 9:45AM OCCC West Hall F3-4 How Microsoft used Windows 10 and Windows Server 2016 to implement privileged access workstations internally Breakout | 45 minutes THR1093 11:35AM – 11:55PM THR2287 12:35PM – 12:55PM How Microsoft does IT: Meet our IT experts in SharePoint and Office 365 (panel) THR1091 1:05PM - 1:25PM How Microsoft does IT: How our IT experts are transforming to build modern skills in a cloud world THR2276 1:35PM – 1:55PM How Microsoft does IT: All aboard for the Microsoft journey to the cloud THR2274 2:10PM – 2:30PM How Microsoft does IT: Achieve your cloud-first vision with modern cloud networking THR1090 3:35PM – 3:55PM How Microsoft does IT: Empower your organization to embrace a data culture with Power BI THR2284 4:05PM -4:25PM How Microsoft does IT: How Microsoft modernized and improved its existing intranet portals THR1096 5:05PM - 5:25PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

IT Showcase sessions (Wed, Thu) 12/1/2018 2:29 AM IT Showcase sessions (Wed, Thu) View our session list at: aka.ms/itshowcaseignite2017 Code Day Time Location* Title Session Type THR2282 Wednesday 10:20AM – 10:40AM Microsoft Theater 12 How Microsoft does IT: Empower your teams with secure devops in the cloud Theater | 20 minutes THR2281 11:35AM – 11:55AM How Microsoft does IT: Drive resource and cost efficiencies with Microsoft Azure optimization THR2279 12:35PM - 12:55PM How Microsoft does IT: Digitally transforming the Microsoft manufacturing supply chain BRK3124 12:45PM – 1:30PM OCCC W240 Manage Microsoft Azure at enterprise Scale: The Microsoft internal story Breakout | 45 minutes THR3091 1:05PM – 1:25PM How Microsoft does IT: Deploy an Office 365 groups expiration policy to enable lifecycle management THR2289 1:35PM – 1:55PM How Microsoft does IT: Our journey to internal customer success with Microsoft Teams THR2288 2:10PM – 2:30PM How Microsoft does IT: Modern cloud management with Microsoft Operations Management Suite (OMS) BRK3047 2:15PM – 2:30PM OCCC West Hall B4 How Microsoft deploys Windows 10 and implements Windows as a service internally BRK2060 3:15PM – 4:00PM How Microsoft uses Windows Defender ATP: Welcome to a SecOps world THR2275 4:05PM – 4:25PM How Microsoft does IT: Achieve your cloud-first vision with modern cloud networking THR2285 5:35PM – 5:55PM How Microsoft does IT: Key takeaways from the Windows 10 deployment at Microsoft THR2283 Thursday How Microsoft does IT: Get out of your users’ way while still protecting the enterprise THR2277 How Microsoft does IT: All aboard for the Microsoft journey to the cloud THR2280 12:05AM - 12:25PM THR1089 1:10PM - 1:20PM How Microsoft does IT: Digital transformation at Microsoft THR2286 How Microsoft does IT: Key takeaways from the Windows 10 deployment at Microsoft   © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session Your feedback is important to us! 12/1/2018 2:29 AM Please evaluate this session Your feedback is important to us! The slide will be replaced onsite through Silver Fox Productions with an updated QR code. This slide is required. Do NOT delete or alter the slide. From your PC or Tablet visit MyIgnite at http://myignite.microsoft.com From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting https://aka.ms/ignite.mobileapp © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12/1/2018 2:29 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.