Application Management (part 2)

By Ashwin Venugopal -

 



To read part 1, please click here
To read part 3, please click here



Seamless Single Sign-On (SSO)

Azure AD Seamless SSO can automatically sign in the users when they are on their corporate devices connected to your corporate network if enabled i.e. it entirely removes the requirement of typing passwords or even usernames to sign in to Azure AD providing easy access to your cloud-based applications without needing any additional on-premises components.

Although seamless SSO can be combined with either the Password Hash Synchronization or Pass-through Authentication sign in methods but it is not applicable to Active Directory Federation Services (ADFS).

Key Features:

  • Sign-in username can be either the on-premises default username (userPrincipalName) or any other attribute configured in Azure AD Connect (Alternate ID) as Seamless SSO uses the securityIdentifier claim in the Kerberos ticket to look for the corresponding user object in Azure AD.

  • Seamless SSO is an opportunistic feature, but if it fails due to any reason, then, the user sign-in behavior will return to its normal behavior requiring the users to enter their passwords on the sign-in page.   

  • If an application forwards a domain_hint or whr (SAML) parameter, or log-in_hint parameter identifying the user in its Azure AD sign-in request, then the users can be automatically signed-in without any requirement of entering passwords or username. 

  • A silent sign-on experience can also be seen when an application sends sign-in requests to Azure AD's endpoint setup as tenants i.e., https://login.microsoftonline.com/contoso.com/<..> or  https://login.microsoftonline.com/<tenant_ID>/<..> instead of Azure AD's common endpoint i.e.  https://login.microsoftonline.com/common/<..> .

  • Sign Out is supported which allows the users to select another Azure AD account to sign in with, instead of being automatically signed with the help of Seamless SSO automatically.

  • Office 365 Win32 clients with versions 16.0.8730.xxxx and above are supported using a non-interactive flow. However, for OneDrive you will have to activate the OneDrive silent config feature for a sign-on experience.

  • It can be enabled via Azure AD Connect.

  • It's a free feature so you don't require any paid editions of Azure AD to use it.

  • Web browser-based clients and Office clients that support modern authentication on platforms as well as the browsers capable of Kerberos authentication supports seamless SSO.   

Azure AD App Gallery

As we all know, Azure AD has a gallery containing thousands of pre-integrated applications generally used by the organizations. After adding an application to your Azure AD tenant, you can:
  1. Configure properties for the app.
  2. Manage user access to the app with a Conditional Access policy.
  3. Configure single sign-on so users can sign in to the app with their Azure AD credentials. 

Prerequisites

If you want to add an application to your Azure AD tenant, you will require:\

  1. An Azure account with an active subscription.
  2. One of the given roles- Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal. 






To read part 1, please click here
To read part 3, please click here

















Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more