Plan Your Identity & Authentication Solution (part 3)

By Ashwin Venugopal -

 



To read part 1, please click here
To read part 2, please click here





Azure AD Connect

The Azure Active Directory Connect or Azure AD Connect tool, which was once known as Windows Azure Active Directory Synchronization or DirSync, is an officially recommended directory synchronization tool for Microsoft 365. It is built up of three parts viz. the synchronization services, the optional Active Directory Federation Services piece, and the monitoring piece done with the help of Azure AD Connect health. It can easily operate as a software-based tool that after configuring once can run automatically in the background without any user interaction. 

Using Azure AD Connect for Directory Synchronization

If you are using Azure AD Connect for Directory Synchronization:
  • Although new user group, and contact devices in an on-premises Active Directory are added to Microsoft 365, but the licenses are not assigned to these objects automatically.

  • The modified on-premises AD attributes of existing user, group, and contact objects are also modified in Microsoft 365 but not all of them can be synchronized to Microsoft 365.

  • The deleted on-premises AD's existing user, group, and contact objects are also deleted from Microsoft 365.

  • Similarly, the disabled on-premises existing user objects are also disabled in Microsoft 365 without any automatic unassigned licenses.  

Azure AD Connect also supports the following scenarios:

  1. Multiple Active Directory forest environments
  2. Multiple exchange organizations to one Microsoft 365 tenant

There are two things required to be understood:

  1. The source of authority is on the on-premises AD.
  2. You are mastering objects from within your on-premises AD with the help of whatever management tools being used today, like AD Users and Computers or Windows PowerShell. 

Azure AD Connect Cloud Provisioning

It is a new Microsoft agent designed to meet and accomplish your hybrid identity goals for synchronization of users, groups, and contacts to Azure AD. You can use it along with Azure AD Connect sync and get different benefits:
  • Support for synchronizing to an Azure AD tenant from a multi-forest disconnected AD forest environment- commonly, scenarios include merger and acquisition in which the acquired one's AD forests are isolated from the parent company's AD forests and companies having history contains multiple AD forests.

  • Easy installation with light-weight provisioning agents- the agents acts as a bridge from AD to Azure AD with all the sync configuration managed in the cloud. 

  • Multiple provisioning agents helps to simplify high availability deployments, particularly critical for the organization dependent on password hash synchronization from AD to Azure AD.

An organization only have to deploy a lightweight agent acting as a bridge between Azure AD and AD, in their on-premises and IaaS-hosted environment.  










To read part 1, please click here
To read part 2, please click here





Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more