User Microsoft Account Ex: User Organizational Account Ex: Microsoft Account Windows Azure Active Directory

Directory store Authentication platform Windows Azure Active Directory Your App

Cloud Identities Synchronized Passwords Single identity suitable for medium and large organizations without federation Federated Identities Single federated identity and credentials suitable for medium and large organizations Single identity in the cloud suitable for small organizations with no integration to on- premises directories

Cloud IDsPassword SyncFederated IDs Same password to access resources on-premises and in cloud Can control password policies on-premises Single Sign-on for no password re-entry if on premises Client access filtering by IP, client type, or by time schedule Authentication occurs and is audited on-premises Can immediately block disabled accounts on-premises Change password available from web Works with Forefront Identity Manager 2010 R2 Can customize the User Sign-in Page Use with cloud based Multi-Factor Authentication Use with on-premises based Multi-Factor Authentication Source:

*For representative purposes only. WS-Trust & WS-Federation WS-Federation (passive auth) SAML (passive auth) Active Directory with ADFS Flexibility to reuse existing identity provider investments Confidence that the solution is qualified by Microsoft Coordinated support between the partner and Microsoft Customer Benefits

Account Directory Exchange OrgsAzure ADSupported?Sync Solution 1 AD Forest1, in AD forest.1 TenantYesDirSync 1 AD Forestn resource forest(s), will retire all Exchange Forests. 1 TenantYesDirSync n AD Forestsn in resource forest(s), will not retire. 1 TenantYesFIM + AAD Connector 1 LDAP DirectoryN/A1 TenantYesLDAP DirSync 1 AD Forestn TenantsYesFIM + AAD Connector OR n DirSyncs Non-AD directoryN/An TenantsYesFIM + AAD Connector n AD Forests + m non-AD N/An TenantsYesFIM + AAD Connector

Azure AD Tenant DirSync Login Forest Resource Forest (migrate data) AD FS (“sync, UPN, ImmutableID”)

Azure AD Tenant DirSync AD Forest Azure AD Tenant DirSync AD FS

Number Active Directory forests Use FIM 2010 R2 Connectors Number Exchange Orgs See consolidation whitepaper Use Single Forest DirSync Want to consolidate single forest? Single (1) Multiple (>1) Yes None (0) Start After consolidation No Single (1)

DirSync Front-Ends GRAPH/PS Front-Ends (workflows) Exchange Online OneDrive Windows InTune Admin portals

Web Clients Office 2010, Office 2007 SP2 with SharePoint Online Outlook Web Application Remember last user Mail Clients Office 2010, Office 2007 SP2 Active Sync/POP/IMAP Entourage Can save credentials Rich Applications (SIA) Lync Online Office Subscriptions CRM Rich Client Office 2013 Can save credentials SSO IDs (from domain joined machines) Cloud IDs No Prompt Username and Password Online ID AD credentials Password Sync (SSO from non-domain Joined machines) Username and Password AD credentials Username Username and Password Online ID AD credentials Username and Password AD credentials Username and Password Online ID AD credentials Username and Password AD credentials

Customer Microsoft Online Services Logon (SAML 1.1) Token Source User ID: ABC123 Auth Token Unique ID:

Customer Microsoft Online Services Logon (SAML 1.1) Token Source User ID: ABC123 Auth Token Unique ID:

Customer Windows Azure Active Directory Logon (SAML 1.1) Token Source User ID: ABC123 Auth Token Unique ID: Basic Auth Credentilas Username/Password

 *Out of band refers to being able to use a second factor with no modification to the existing app UX. Excludes Office 365 dedicated SKU and SMB SKUs. Upgradeable to Azure Multi-Factor Authentication

Multi-Factor Authentication for Office 365 Windows Azure Multi- Factor Authentication Administrators can Enable/Enforce MFA to end-usersYes Use Mobile app (online and OTP) as second authentication factorYes Use Phone call as second authentication factorYes Use SMS as second authentication factorYes App passwords for non-browser clients (e.g. Outlook, Lync)Yes Default Microsoft greetings during authentication phone callsYes Custom greetings during authentication phone callsYes Fraud alertYes Event ConfirmationYes Security ReportsYes Block/Unblock UsersYes One-Time BypassYes Customizable caller ID for authentication phone callsYes MFA Server - MFA for on-premises applicationsYes MFA SDK – MFA for custom appsYes