2. Protect your data Enable your users Desktop Virtualization Information protection Mobile device & application management Identity and Access Management

3. Active Directory: the vision

6. Research & Preparation First Workstation Compromised 24-48 Hours Domain Admin Compromised Data Exfiltration (Attacker Undetected) 11-14 months Attack Discovered

10. Prepare Which users have privileged access rights? Protect Lifecycle and AuthN protection Operate Users can request elevation Monitor Additional auditing, alerts & reports

14. 14 "This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate [to] the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers..."

15. 15

16. 16 http://blogs.microsoft.com/blog/2014/11/13/ "Microsoft acquires Aorato to give enterprise customers better defense against digital intruders in a hybrid cloud world"

17. Enter-PSSession –ComputerName Server1 –ConfigurationName JustBackup

22. Existing AD Forest(s) Existing Apps existing trust Group “Resource Admins” User

23. Existing AD Forest(s) Privileged Access Management trust for admin access Microsoft Identity Manager Configured for PAM AD DS Existing Apps access requests User existing trust User: PRIV\JenAdmin Group memberships: CORP\Resource Admins Refresh after: 60 minutes

24. Admin Jen is assigned to a role The role is pending an elevation process for Jen Jen asks for elevation into the role Elevation process is preparing Role is active Admin Jen gets permissions for the asset Automatic approval Pending MFA Pending Role Owner approval... Lee / Admin Jen / Admin Elevation period ends Role is not active for Jen anymore Automation

25. MIM Service AD DS AuthZ WF Action WF MPR New-PAMRequest MIM Service DB User Group PAM Role Event Log PAM Request Microsoft Identity Manager 2016 PowerShell SOAP and REST APIs

26. In March CTP: "PRIV" forest AD can be either Windows Server Technical Preview or 2012 R2 PowerShell cmdlets, events and elevation via the sample web portal In April CTP: PAM workflow on elevation performs manual approval or Azure MFA Users can cancel their elevation requests Users can elevate to a role with a group in the "PRIV" forest More PowerShell cmdlet options, and more monitoring