Plan Your Identity & Authentication Solution (part 2)

By Ashwin Venugopal -

 



To read part 1, please click here 
To read part 3, please click here




Directory Synchronization

It is known as the synchronization of directory identities or objects (users, groups, contacts, and computers) between two different directories, like your on-premises AD environment and Azure AD which can easily support online services like Microsoft 365. Although in Microsoft 365 directory synchronization is generally used to synchronize in one direction (i.e. from on-premises to Azure AD), but some features in Azure AD Connect permits it to write-back specific objects and attributes to the on-premises directory creating a sort of two-way synchronization. 

If you integrate your on-premises directories with Azure AD, it will allow your users to enhance productivity by reducing the amount of time spent in typing passwords for accessing both cloud and on-premises resources. The users and organizations can take following advantages from this integration:

  • Hybrid identity- A common hybrid identity can be offered across on-premises and cloud-based services along with a consistent group membership by leveraging AD and then connecting to Azure AD.

  • AD policies- The AD policies set through AD can be used by the administrators to help provide conditional access according to an application resource, device and user identity, network location, and multi-factor authentication without performing any additional task in the cloud.

  • Leverage identity- Users can readily leverage their common identity with the help of their accounts in Azure AD to Office 365, Intune, SaaS apps, and non-Microsoft applications.

  • Single-sign-on (SSO)- Users identities and information are protected as all the servers as well as services used in SSO are mastered and controlled on-premises, giving confidence to security.

  • Multi-factor authentication (MFA)- Security will have more confidence if they have the option to use strong authentication also known as multi-factor authentication (MFA), with the cloud service. 

  • Common identity model- Applications that can leverage the common identity model can be build with the help of developers integrating applications into on-premises AD while it is done (for examples, Azure AD App Proxy or Azure for Cloud-based applications).









To read part 1, please click here 
To read part 3, please click here





Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more