1. 11/8/2018 5:23 PM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Azure AD: Do’s and Don'ts
11/8/2018 5:23 PM
BRK3408
Azure AD: Do’s and Don'ts
Tarek
Sean Ivey
Program Managers
Identity
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Agenda & Goals Secure your environment! Block Legacy Authentication
11/8/2018 5:23 PM
Agenda & Goals
Secure your environment!
Focus on three technologies that are easy to implement and can have a huge impact on improving your security posture!
Block Legacy Authentication
Deploy Hybrid Azure AD Join (HAADJ)
Turn on Password Hash Sync (PHS)
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Go Do #1: Block Legacy Auth Protocols
11/8/2018 5:23 PM
Go Do #1: Block Legacy Auth Protocols
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. What is Legacy Authentication?
11/8/2018 5:23 PM
Azure AD
Some IdP
Exchange Online
Mail Service
IMAP
POP
Basic Auth SMTP
SMTP over TLS
Basic Auth SMTP
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Legacy Authentication examples with Azure AD
11/8/2018 5:23 PM
Basic Auth or MSOnline Sign-in Assistant!
Clients that use legacy authentication
Office 2010 and older
Office 2013 by default (can use modern auth with reg key and patch)
Clients using older mail protocols: POP, IMAP, SMTP, etc.
Older PowerShell modules
Anything NOT using modern authentication
Client behavior depending on settings
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Why Block Legacy Authentication?
11/8/2018 5:23 PM
350K compromised accounts in April 2018 due to password spray, 200K in the last month.
Nearly 100% of password spray attacks we see are from legacy authentication
Blocking legacy authentication reduces compromise rate by 66%
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Rollout plan: Blocking legacy authentication 11/8/2018 5:23 PM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. 11/8/2018 5:23 PM
Step 1: Understand the usage of Legacy Authentication in your organization
Use sign in logs to examine current usage. Filter by Client App (add column if you do not see it)
POP, IMAP, MAPI, SMTP and ActiveSync go to Exchange Online
“Other Clients” shows SharePoint and Exchange Web Services
You can export/download the sign in logs, sort by Client App and identify the top offenders
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Step 1.5: What will you find in there?
11/8/2018 5:23 PM
What will you find?
Mail apps (upgrade)
Middle Tier and Backend apps (exclude then rewrite)
The one mail client that this one exec cannot possible live without (exclude, then show him this session, then upgrade)
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Step 2: Block legacy authentication for those not using it
11/8/2018 5:23 PM
Add legacy auth users to a group.
Select all users in the Include groups
Put the legacy auth group in the Exclude set
Under conditions, select only that client apps are “Other clients”
Under apps choose all apps or at least Exchange Online and SharePoint Online
Under Controls choose Block
This protects accounts that do not need legacy auth from attacks that use legacy auth
For ADFS, see guidance here:
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Step 2.5: Perform Regular Access Reviews for those still allowed to use it.
11/8/2018 5:23 PM
If you own P2/EMS E5:
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Step 3: Upgrade to modern auth clients
11/8/2018 5:23 PM
Make sure Modern Auth is enabled for your organization per:
PC:
Office 2013: Modern auth needs to be enabled
HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Identity\EnableADAL
HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Identity\Version
REG_DWORD 1
Office 2016
Modern auth enabled by default
Mac:
Office 2016 for Mac
Mobile:
Shameless plug: Use Outlook Mobile, it does Modern Auth and proper Conditional Access
iOS 11+ Native mail client
Don’t forget the old MSOnline PowerShell module! Upgrade to the newer one here or the AzureAD cmdlets here.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Step 4: Block legacy authentication for ALL users
11/8/2018 5:23 PM
Remove the legacy auth group from the exception in the Conditional Access policy.
Is that it?
Blocking legacy authentication on the Azure AD level is to deny access after the authentication.
This means it can leave your users susceptible to lockouts from Legacy Auth attacks.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. Step 5: Block Legacy Auth at the Service Level
11/8/2018 5:23 PM
To prevent the Legacy Auth attempt from even happening, shut down the protocol on the Exchange side.
To disable a protocol per user:
In preview, coming soon to a tenant near you, Authentication policies in EXO: (This article is very valuable in showing which client uses which legacy protocol.)
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Go Do #2: Use Hybrid Azure AD Join
11/8/2018 5:23 PM
Go Do #2: Use Hybrid Azure AD Join
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Why deploy Hybrid AADJ? Intermediate step to Azure AD Join
Better user experience
Fewer MFA prompts
Better SSO experience (no HRD in Win 10)
Secure despite network location
Support for older (Win 7/8.1) clients

18. Associating Devices with Computers (with Devices)

19. Azure AD Hybrid Join Do’s and Don’ts
Follow the steps for deployment!
Update Azure AD Connect and use the wizard
Does not work if single forest is syncing to multiple tenants except for one tenant (one SCP in the forest)
When registering down-level clients (older than Win 10/Server 2016):
Do NOT use with roaming profiles
Do NOT use with credential roaming
Seamless SSO is required for down-level clients
Do not sysprep and image an already registered computer
Plan for shared environments (VDI/RDP)
Block access to, or require MFA for non-HAADJ’ed devices to sensitive apps/data

20. Go Do #3: For the love of all your users: ENABLE PASSWORD HASH SYNC
NOW!

21. Enable Password Hash Sync
Password Hash != Password
You don’t have to change your authentication
You get Leaked Credentials Report as part of Azure AD P1
Pull this and all Azure AD reports into your SIEM system
If everything goes down, this might end up saving your job
Turn on Password Hash Sync!
Enabled for 82% of Azure AD active tenants
57% of Azure AD active users
650K compromised credentials detected in 2 years in over 50 million accounts scanned.
If your security team argues, ask them if the on-premises hashes are safer than this:

22. Resources
Identity Blog where all the Ignite announcements are:
Detailed walkthroughs to deploy Azure AD features:
Azure AD Data Whitepaper on how data is handled in the service:
Password Spray attack prevention best practices:

23. Identity Session List – Part 1
Monday September 24
Track
Code
Title
Time
Microsoft 365
GS008
Microsoft security: How the cloud helps us all be more secure
16:00
17:15
Modern Devices
THR2238
Joining devices to Azure Active Directory in a hybrid world
16:35
16:55
THR3044
Maximizing business value available with identity in the cloud
17:45
18:05
Tuesday September 25
Microsoft 365
BRK2254
Azure Active Directory: New features and roadmap
9:00
10:15
THR3042
How ML helps Microsoft provide better and more secure Identity experiences
9:35
9:55
WRK2006
Deploy SaaS apps in record time
10:45
12:00
THR3047
Ensure all your users have strong passwords with Azure AD Password Protection
11:20
11:40
THR3041
Staying secure with Azure AD and Microsoft Secure Score
11:55
12:15
THR3043
Secure administration across Office and Azure clouds
12:05
12:25
BRK3031
Getting to a world without passwords
12:30
13:45
BRK2369
Get apps out the door faster and easier: Microsoft's unified programming model for authentication, app management, and securely accessing APIs
BRK2252
Taking steps one, two and three to a zero-trust network
12:45
13:30
WRK2034
Extend access to your partners and customers using Azure AD B2C
14:15
15:00
BRK3238
Introduction to identity standards
15:15
16:00
THR3045
Apps for a hybrid world
15:25
15:45
BRK3242
Govern access to your resources with Azure Active Directory Identity Governance
17:15
BRK3239
How to delegate administration in Azure AD
16:30
Wednesday
September 26
Microsoft 365
WRK2034R
Extend access to your partners and customers using Azure AD B2C (REPEAT)
9:00
10:15
BRK2157
Ensure comprehensive identity protection with Microsoft 365
THR3124
Govern access with Entitlements Lifecycle Management
11:20
11:40
BRK3241
Enable Azure AD Conditional Access to secure user access while unlocking productivity
12:30
13:45
BRK3401
Azure AD security insights with Conditional Access, Identity Protection and reporting
12:45
13:30
BRK3236
Step up your identity infrastructure with a native CASB integration
15:15
16:00

24. Identity Session List – Part 2
Wednesday
September 26
Track
Code
Title
Time
Modern Devices
BRK3037
Windows devices and Azure Active Directory: What’s new and what’s upcoming
16:00
17:15
Microsoft 365
BRK3248
Protect the keys to your kingdom with Azure AD Privileged Identity Management
16:30
THR3046
Choosing the right authentication method
16:35
16:55
THR2064
Leveling up on identity-driven endpoint security with Conditional access based on device
17:40
18:00
Thursday
September 27
Microsoft 365
WRK2006R
Deploy SaaS apps in record time (REPEAT)
9:00
10:15
BRK3243
Hybrid identity and access management best practices
Azure
BRK2265
Architecting your app’s access and security with identity as the control plane
11:00
BRK3251
Shut the door to cybercrime with identity-driven security
10:45
12:00
BRK2253
What's new for Windows Hello for Business
11:30
12:15
BRK3244
Modernize your identity lifecycle management with Azure Active Directory
12:30
13:45
BRK3240
Secure Customer Identity and Access Management using Azure Active Directory B2C
15:15
16:00
THR3048
Replace passwords with new options from Microsoft
16:20
Friday
September 28
Azure
BRK3226
Secure access to Office 365/Azure Active Directory with new features in AD FS in Windows Server 2019
9:00
9:45
Microsoft 365
BRK3249
Granting Partners and Suppliers access to resources using Azure Active Directory B2B collaboration
10:45
12:00
BRK3383
Lock down access to Azure using identity
BRK3030
What's new in Active Directory Federation Services (AD FS) in Windows Server 2019
12:30
13:45
BRK3408 
Azure Active Directory best practices from around the world
10:15
11:00

25. Please evaluate this session Your feedback is important to us!
11/8/2018 5:23 PM
Please evaluate this session Your feedback is important to us!
Please evaluate this session through MyEvaluations on the mobile app or website.
Download the app:
Go to the website:
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. 11/8/2018 5:23 PM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.