1. Follow OCG Learning Twitter Facebook LinkedIn
Get the latest offers, details of new courses, events, webinars, white papers, news and technical opinion you can trust.
Facebook
facebook.com/ oxfordcomputergroup
linkedin.com/company/ ocg-learning
and James Cowling - Identity Management Specialist
LinkedIn

2. MIM Service Pack 1
Webinar
James Cowling
CTO
20th October 2016

3. Agenda Quick summary of MIM 2016 Features in MIM 2016 Service Pack 1
Future Additions to MIM 2016 SP1
Upcoming Events
Please note: this session will be recorded

4. Microsoft Identity and Access
Microsoft Identity Manager 2016
Service and Portal (Workflows, Approvals, UI)
Synchronization Service (Data flows and transformations, password sync)
Certificate Management (Cert Enrolment, Renewal, Expiry workflows, UI)
Reporting (Data Warehousing with System Center Service Manager)
Roles Engine (bHold, Role Model Management and Role Assignment)
Privileged Access Management (Protection for Admin Credentials)
Azure Active Directory (AAD)
Cloud directory with many IAM functions
Sync with on-prem AD using AADSync
Hybrid Identity implementations involve both major components

5. Service Pack 1 Features JIT groups for Priv domain
PAM PowerShell Deployment
Customer Reported Bug Fixes
PAM Single forest deployment
Cross Browser Support
requests and approvals
with Exchange Online
Hardened Security
Updated Platform Support

6. Bug Fixes Rollup of all fixes since RTM SP1 is version 4.4.1237.0
(KB ) – incl. Localization and ECMA fixes
(KB ) – incl. PAM Fixes
(KB ) – incl. CM updates, Perf Counters fix
SP1 is version
Fixes a couple of additional PAM issues
Adds Image Format validation for images uploaded to the portal

7. Updated Platform Support
MIM Portals now run under “all major” browsers
Internet Explorer
Edge
Chrome
Safari
Firefox (according to Blog, not specifically in documentation)
Platform components now support modern versions
Windows Server 2016 (not CM or bHold)
SQL Server 2016 (not CM or bHold)
SharePoint 2016
Windows 10 client
See design/microsoft-identity-manager-2016-supported-platforms

8. PAM Overview Production Domain (“CORP”) assumed compromised
Bastion PRIV
Production Domain (“CORP”) assumed compromised
Separate Admin Domain (“PRIV”)
Just-In-Time Admin
Candidates and Escalation
PRIV Credentials not present in CORP
Harder to steal if not present
Admin performed using SIDHistory, One-Way Trust into CORP
User
PRIV.User X
Member of
Security Group
PRIV.Security Group
MIM PAM
PAM Person
Candidate of
PAM Role
Privilege of
PAM Privilege

9. PAM PowerShell Deployment Scripts
Available from MS Download Center
Good documentation – a required read!
Manual pre-configuration required
Some manual intervention required
us/download/details.aspx?id=5394 1

10. PAM Single-Domain Deployment
AKA “PRIVOnly” deployment
PAM Users and Groups are not required to have a corresponding CORP object
Allows PAM Users and Groups to reference objects which are only in the PRIV domain
Supports the protection of PRIV administrator objects
Just in time admin
Implemented using the -PRIVOnly=true switch on all relevant PowerShell cmdLets
Although possible, CORP-only deployment is not regarded as secure, therefore not best practice

11. Hardened Security
Kerberos TGT lifetimes for PAM users now align with TTL of privilege escalation and group membership
Requires Forest Functional Level 2016
If multiple time-bound memberships, ticket uses lowest TTL
PAM uses Expiring Links functionality of ADDS 2016
Requires PAM Windows Optional Feature
PAM Implementation uses Authentication Policy Silos
Allows limitations on Kerberos Ticket Lifetimes without having to make domain-wide changes
PAM can manage PRIV admins (as described already)

12. Exchange Online for Service Mailbox
The MIM Service can now use an Exchange Online mailbox
for approvals and notifications
On-prem Exchange still available with same functionality
Generic SMTP still available for notifications
Access is via Office365 web services

13. Future Additions
There will be a hotfix/in-place upgrade from MIM 2016 to SP1
Currently only full install is available, requires uninstall/reinstall
An issue in Password Change Notification Service has been reported
Rarely, in some environments, PCNS fails to start with root certificate validation error
A fix will be forthcoming when the issue is nailed down
Until then, test!
If in doubt, stay with MIM 2016 RTM PCNS

14. OCG Learning - courses Learn MIM PAM training ocglearning.com/courses
Foundation – Advanced – Expert
Live classroom courses or online, self-paced
PAM training
Next one-day course: 7 November – join the live class via the internet from anywhere in the world
ocglearning.com/courses
We can train your team and offer ongoing support

15. Thank you!
James Cowling
CTO
20th October 2016