1. Single Sign-On with Microsoft Azure
4/22/2017
Single Sign-On with Microsoft Azure
Julian Soh
Mark Ghazai
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Azure Active Directory
Your Directory in the Cloud
Cloud authentication
A comprehensive identity and access management cloud solution
It combines directory services, advanced identity governance, application access management and a rich standards-based platform for developers
Azure Active Directory Premium includes Multi-Factor Authentication, and server and user CALs for Identity Manager

3. Difference between Directory Sync and AD FS
Directory Synchronization is an identity propagation workload and does not require AD FS.
AD FS is responsible for authentication by being the claims middleman. It generally requires some kind of directory synchronization first.
AD FS works with AD DC to facilitate authentication.

4. 1a – Simple Configuration Password Sync
Lync
Online
Central AD
Forefront Identity Manager (DirSync)
Provisioning
platform
Password Sync
IdP
Azure Active Directory
Office 365 Portal/
PowerShell
Authentication platform
Exchange
SharePoint
Exchange Hybrid
Portal
Support implications: Standard deployment model that is supported by Office 365 support.
The portal is an optional component that can be used for group management or delegation of administration. Depending on what is used, it would be supported via Paid Microsoft support or the product vendor.
Information is provided as examples with no assumption of support expressed or implied. Deployment recommendations should be obtained through consulting services.

5. 1b – Simple Configuration Federated Authentication
ADFS Federation
Trust
Authentication platform
Lync
Online
Central
IdP
AD Federation
Services
Office 365 Portal/
PowerShell
IdP
SharePoint
Online AD
Azure Active Directory
Provisioning
platform
Forefront Identity Manager (DirSync)
Exchange
Online
Support implications: Standard deployment model that is supported by Office 365 support. Adds ADFS for federated authentication.
The portal is an optional component that can be used for group management or delegation of administration. Depending on what is used, it would be supported via Paid Microsoft support or the product vendor.
Exchange Hybrid
Portal
Information is provided as examples with no assumption of support expressed or implied. Deployment recommendations should be obtained through consulting services.

6. 2 Password Sync for Same-Sign-On
Agency
IdP AD
Authentication platform
Lync
Online
FIM w/ Password Sync
Office 365 Portal/
PowerShell
IdP
SharePoint
Online
Central
Azure Active Directory
Provisioning
platform
Forefront Identity Manager
Exchange
Online
Support implications:
The ‘Central’ environment is configured as a standard deployment model that is supported by Office 365 support.
The complexity is abstracted from the O365 portion through a FIM sync that also replicates password from the ‘Agency’ AD. That FIM implementation or other solution would be supported by paid Microsoft support or the product vendor.
The portal is an optional component that can be used for group management or delegation of administration. Depending on what is used, it would be supported via Paid Microsoft support or the product vendor.
Notes:
This model could also use ADFS out of central. If ADFS is used single-sign-on would only be available for users whose desktops exist in the ‘Central’ AD.
This solution is useful where a customer:
Is planning to do an AD consolidation bring ‘Agency’ into ‘Central’
Wants to use a single namespace for authentication
This solution can keep the management of the ‘Central’ environment as a standard deployment
Password Sync
IdP
Central
Exchange Hybrid
Portal
Information is provided as examples with no assumption of support expressed or implied. Deployment recommendations should be obtained through consulting services.

7. 3 Agency Single Sign-On w/ Central ADFS
IdP AD
Two-way Trust
ADFS Federation
Trust
Authentication platform
Lync
Online
Central
IdP
Office 365 Portal/
PowerShell
IdP
SharePoint
Online AD
AD Federation
Services
Azure Active Directory
FIM Server
Provisioning
platform
Forefront Identity Manager
Exchange
Online
Support implications:
The ‘Central’ environment is configured as a standard deployment model w/ FIM+Connector. The main components are supported by Office 365 support. For FIM+Connector, the connector is provided by Microsoft and supported by Office 365 support. The rest of the FIM implementation would need to be maintained by the customer and supported by paid Microsoft support.
The complexity is abstracted from the O365 portion through a FIM sync that stamps a custom immutable identifier on users in both forests that is used for ADFS authentication. That FIM implementation or other solution would be supported by paid Microsoft support or the product vendor.
The portal is an optional component that can be used for group management or delegation of administration. Depending on what is used, it would be supported via Paid Microsoft support or the product vendor.
Notes:
My understanding is that you can now customize DirSync to pull the immutable ID from a custom attribute. If that is the case DirSync could be used instead of FIM+Connector.
This solution is useful where a customer:
Already has a FIM sync in place
Has a central authority to run the Office 365 solution, but the ‘Agency’ organization wants to remain as autonomous as possible.
Does not want to use a single namespace for authentication
‘Agency’ desires single-sign-on
There is a potential for a forest consolidation in the future.
Exchange Hybrid
Portal
Information is provided as examples with no assumption of support expressed or implied. Deployment recommendations should be obtained through consulting services.

8. 4 Agency Single-Sign-On w/ Agency Provided ADFS
IdP AD
AD Federation
Services
ADFS Federation
Trusts
ADFS Federation
Trusts
Authentication platform
Lync
Online
FIM Server
Central
IdP
Office 365 Portal/
PowerShell
IdP
SharePoint
Online AD
AD Federation
Services
Azure Active Directory
Provisioning
platform
Forefront Identity Manager
Exchange
Online
Support implications:
The ‘Central’ environment is configured as a standard deployment model w/ FIM+Connector. The main components are supported by Office 365 support. For FIM+Connector, the connector is provided by Microsoft and supported by Office 365 support. The rest of the FIM implementation would need to be maintained by the customer and supported by paid Microsoft support.
The complexity is abstracted from the O365 portion through a FIM sync that stamps a custom immutable identifier on users in both forests that is used for ADFS authentication. That FIM implementation or other solution would be supported by paid Microsoft support or the product vendor.
The portal is an optional component that can be used for group management or delegation of administration. Depending on what is used, it would be supported via Paid Microsoft support or the product vendor.
Notes:
This is very similar to the previous example, but is useful where a two-way forest trust is not possible.
Requires ADFS multiple ADFS farms
My understanding is that you can now customize DirSync to pull the immutable ID from a custom attribute. If that is the case DirSync could be used instead of FIM+Connector.
This solution is useful where a customer:
Already has a FIM sync in place
Has a central authority to run the Office 365 solution, but the ‘Agency’ organization wants to remain as autonomous as possible.
Does not want to use a single namespace for authentication
‘Agency’ desires single-sign-on
‘Agency’ or ‘Central’ are opposed to a trust.
There is a potential for a forest consolidation in the future.
Exchange Hybrid
Portal
Information is provided as examples with no assumption of support expressed or implied. Deployment recommendations should be obtained through consulting services.

9. Run these in Azure? Why?
How these would look like when running in Azure
Connectivity (s2s VPN or ExpressRoute)
Why? Uptime, SLA, redundancy

10. DC
Web Server/Application
443
443

11. 443 DC
Web Server/Application
443
443

12. MIM enables consistent IAM policies
4/22/2017
On-premises and private cloud
Azure Active Directory
Azure AD App Proxy
Microsoft Identity Manager vNext
Your apps
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Identity Manager Capabilities
4/22/2017
Identity Manager Capabilities
Clients
Identity Manager Platform Scenarios
Portal
Outlook
Windows
Custom
Role
Management
Certificate Management
Policies and Workflow
Request
Permission
AuthN
AuthZ
Service DB
Action
Group
Management
Password
Reset
Identity Stores
Cloud Services
Identity
Synchronization
Databases
Directories
Applications
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Azure AD Connect Demo

15. Azure Calculator Demo Typical VM Sizes Description
Typical VM Sizes
Description
1x AAD Sync Server with internal database (1 x A2 Basic VM)
1x R/W Domain Controller (1 x A2 Basic VM)
2x AD FS Proxy Servers (optional) (2x A2 Standard VM)
2x AD FS Servers (2 x A2 Standard VM)

17. Azure AD as an IDaaS demo…

18. Resources Azure Active Directory Connect
Office 365 and ADFS…Active Directory Federation Service Installation
service-installation.aspx