3. Resource App Resource

6. App Resource authorization server authorization endpoint token endpoint A A R

7. Dir Sync

8. App Resource App Resource

15. OS Windows Runtime (WinRT) AAL for Windows Store.WINMD C# Windows Store App JS/HTML5 Windows Store App Application System

16. AuthenticationContext aCtx = new AuthenticationContext("https://login.windows.net/contoso.onmicrosoft.com"); AuthenticationResult result = await authorizationContext.AcquireTokenAsync("http://host.com/shipmentservice", clientID); Authenticate the user to get a token HttpClient httpClient = new HttpClient(); httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken); //... Use the token to invoke a REST service

20. ValueKey Authority ClientID Resource User Access Token Refresh Token Expiration

21. [authority], resource, clientid, user matching cache entry? valid access token? refresh token? success? return cache entry use the refresh token to refresh the access token prompt the user via WebAuthenticationBroker cache access token, refresh token, validity replace cache entry return error info YESNOYES NO YESNO

25. 25 IT can publish access to corporate resources with the Web Application Proxy based on device awareness and the users identity. Multi-factor authentication can be used through Windows Azure Active Authentication. Users can register BYO devices for single sign-on and access to corporate data with Workplace Join. As part of this, a certificate is installed on the device Users can enroll devices which configure the device for management with Windows Intune. The user can then use the Company Portal for easy access to corporate applications As part of the registration process, a new device object is created in Active Directory, establishing a link between the user and their device Data from Windows Intune is sync with Configuration Manager which provides unified management across both on- premises and in the cloud

30. App Resource Windows Azure Authentication Library