1. Protecting your data with Azure AD

2. Arjan Cornelisssen
SharePoint & Office 365 Architect
WorkTogether.tech
@arjancornelis

3. Is the new control plane
Identity
Is the new control plane
De medewerker wordt nu het centrale punt om te beveiligen
On-premises /
Private cloud

4. Top attacks against Azure AD
IAM for employees, partners, and customers
lllllllll
lllllllll
Breach Replay
Password Spray
Phishing
4.6B attacker-driven sign-ins detected in May 2018
200K password spray attacks blocked in August 2018
23M high risk enterprise sign-in attempts detected in March 2018
John Doe
lllllll
Passwords are the problem 4

5. 140+ 75%+ $6T $4M Sobering statistics
4/3/2019 6:35 PM
Sobering statistics
140+
median # days attackers reside within a victim’s network before detection
network intrusions due to compromised user credentials
75%+
$6T
annual cost
of cybercrime to the
global economy
$4M
average cost of a data breach to a company
The frequency and sophistication of cybersecurity attacks are escalating
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Conditions Controls 40TB Microsoft Cloud Cloud SaaS apps
Corporate Network
Geo-location
MacOS
Android
iOS
Windows
Windows Defender ATP
Client apps
Browser apps
Google ID
MSA
Azure AD
ADFS
Employee & Partner Users and Roles
Trusted & Compliant Devices
Location
Client apps & Auth Method
Conditions
Force
password
reset
Require
MFA
Allow/block
access
Terms of Use
******
Limited
Controls
Machine learning
Policies
Real time Evaluation
Engine
Session Risk 3
40TB
Effective policy
Cloud SaaS apps
On-premises apps
Microsoft Cloud App Security
Microsoft Cloud

7. Multi Factor Authentication
Custom Controls

8. Conditional Access with MFA

9. Block legacy authentication
Block legacy auth using Azure AD Conditional access – majority of password spray attacks use legacy auth
Over 5000 tenants block legacy auth using Conditional access

10. Demo Conditional Access Policies -> What If for Twitter
Wazug test user
NL IP:
Afghanistan IP:
Twitter
Google -> Terms of use

11. Microsoft Enterprise Mobility + Security
Technology
Benefit E3 E5
Azure Active Directory Premium P1
Secure single sign-on to cloud and on-premises app MFA, conditional access, and advanced security reporting ●
Azure Active Directory Premium P2
Identity and access management with advanced protection for users and privileged identities
Microsoft Intune
Mobile device and app management to protect corporate apps and data on any device
Azure Information Protection P1
Encryption for all files and storage locations
Cloud-based file tracking
Azure Information Protection P2
Intelligent classification and encryption for files shared inside and outside your organization
Microsoft Cloud App Security
Enterprise-grade visibility, control, and protection for your cloud applications
Microsoft Advanced Threat Analytics
Protection from advanced targeted attacks leveraging user and entity behavioral analytics
Identity and access management
Managed mobile productivity
Information
protection
Threat Detection

12. Admin side

13. Privileged Identity Management
Discover, restrict, and monitor privileged identities
User
Administrator
Administrator privileges expire after a specified interval
User
Enforce on-demand, just-in-time administrative access when needed
Ensure policies are met with alerts, audit reports and access reviews
Manage admins access in Azure AD and also in Azure RBAC

14. Privileged Identity

16. Demo
PIM Role activate
Azure resource demo

17. Identity Secure Score Insights into your
Visibility into your Identity security position and how to improve it
Guidance to increase your security level
Insights into your
Identity security position
Set an ideal score.
Choose controls to achieve ideal score based on impact.
Ignore controls that are not valid for you.
3rd party product support.
Easily compare score against other organizations
View trends
Checkout your Identity secure score

18. Secure Score
Checkout your Identity secure score

19. Azure monitoring

20. Preview features

21. Password-less with Microsoft Authenticator app
Password-less for MSA accounts
Available today
Password-less for Azure AD accounts
In Public preview today
Now in preview
aka.ms/gopasswordless

22. Demo

23. Our Security mindset needs to be updated