Authentication and Security

Now that you have implemented your hybrid identity model, it is equally important to be able to assign access to applications and resources within your Microsoft 365 environment in a manner that is safe and secure but also user friendly. Azure AD Premium allows you to do this.

By the end of this chapter, you will be able to create Azure AD groups with dynamic membership rules and configure user authentication and registration, as well as Self-Service Password Reset (SSPR) capabilities for users. In addition, you will cover the setup of Multi-Factor Authentication (MFA) and understand how to implement device authentication methods such as Windows Hello.

This chapter covers the following topics:

• Implementing Azure AD dynamic group membership
• Implementing password management
• Implementing and managing external identities
• Implementing and managing MFA
• Planning and implementing device authentication methods

Note

Many of...

Implementing Azure AD dynamic group membership

Before diving into the principles of Azure AD dynamic groups, it is important to take a step back and ensure you have an overall appreciation of the methods available for assigning access rights to your users in Azure AD. These methods are as follows:

• Direct assignment: Permissions to Azure AD resources are granted by manually assigning access for the resource to an Azure AD object that has a credential.
• Group assignment: Permissions to Azure AD resources are granted by manually assigning access for the resource to an Azure AD group containing a set of Azure AD user objects. These objects are added or removed from the group manually.
• Rule-based assignment: Permissions to resources are granted by dynamically assigning users to a group. The rules for membership are defined based on specific user object attributes (such as the department field).
• External authority assignment: Permissions to resources are granted by creating...

Implementing password management

One of the common challenges faced by IT administrators is responding to user requests to reset forgotten passwords. This issue is addressed in Azure AD by SSPR.

SSPR allows Azure AD users to reset their passwords without having to contact the IT department. In order to use this feature, users must complete a registration process during which they need to choose one or more authentication methods set up by the administrators in Azure AD.

When planning for SSPR, you need to consider the different types of user identities within your Microsoft 365 tenant and how SSPR will behave when users wish to reset their own passwords. These are as follows:

• In-cloud users only
• Hybrid identity users

Both user types can register for and use SSPR, but the experience and license requirements will differ. For in-cloud users only, passwords are stored within Azure AD. On the other hand, hybrid identity users need to have password writeback enabled...

Implementing and managing external identities

There will often be situations where you need to invite guest users to collaborate within your organization’s Microsoft 365 environment. This can be achieved with Azure AD B2B collaboration. The external identities feature allows you to securely share your organization’s apps and services with external users and maintain complete control.

This is achieved with an invitation process that allows external users to access your Microsoft 365 environment with their own credentials. When the invitee accepts the invitation, they are set up in Azure AD as a B2B user object as a Guest.

While B2B collaboration is enabled by default, admins have significant control over the settings. The following steps deal with how a guest user is created:

1. Go to the Azure portal at https://aad.portal.azure.com or the Entra admin center at https://entra.microsoft.com and log in with admin privileges. Navigate to Azure Active Directory ...

Implementing and managing MFA

In the modern workplace, users are increasingly accessing their data from almost anywhere in the world and from multiple devices. This increases the burden on Microsoft 365 administrators, who not only need to support this modern and more agile way of working but also need to ensure that users, resources, and data are secure and protected. By default, Microsoft 365 user accounts authenticate to Azure AD with only a user ID and password. In the modern security landscape, this simply does not provide enough protection from threats such as phishing attacks.

As was briefly highlighted in Chapter 1, Planning for Hybrid Identity, MFA within Microsoft 365 can help protect your organization by providing two-step verification to Microsoft services via approved authentication methods. As a quick reminder, these authentication methods can be based upon the following aspects:

• Something you know, such as your password
• Something you own, such as your...

Planning and implementing device authentication methods

With Azure AD MFA deployed in your environment, you need to consider the available authentication methods. There are many options available and they are all listed briefly in this section. Links to more detailed information and instructions on each of these methods are included in the Further reading section at the end of this chapter.

In Azure AD, a password is still typically the primary means of authentication. However, passwordless authentication methods are available and include Windows Hello, FIDO security keys, and the Microsoft Authenticator app (all of which are described briefly in Chapter 1, Planning for Hybrid Identity). These methods provide the most secure sign-in experience for users in Microsoft 365, and Microsoft recommends replacing passwords with a passwordless method where practical and possible.

The following table presents the different authentication methods available in Azure AD and the level of security...

Summary

This chapter dived into the process of assigning access rights to users and groups by using Azure AD dynamic groups. You will now be able to configure dynamic groups, membership rules, and rules syntax for more advanced rules. You also learned how SSPR and MFA can provide authentication security within a Microsoft 365 environment, as well as how these services can be enabled via the combined registration portal.

Additionally, the principles of external user access to Azure AD with B2B users were covered, and finally, you learned how to plan for the available device authentication methods within Azure AD.

The next chapter focuses on Azure AD Conditional Access policies and how they can be used in conjunction with features such as MFA to promote compliance.

Questions

1. True or False: The New-UnifiedGroup PowerShell command is used by admins to create dynamic membership groups within Azure AD.
   1. True
   2. False
2. Where would you go to configure the combined MFA/SSPR registration experience in the Azure portal?
   1. Azure Active Directory | Password reset | Registration
   2. Azure Active Directory | Password reset | Properties
   3. Azure Active Directory | Users | User settings
   4. Azure Active Directory | Users | Password reset
3. Which of the following is not a method of passwordless authentication?
   1. Windows Hello for Business
   2. FIDO2 security key
   3. Microsoft Authenticator
   4. Enabling MFA
4. With Azure AD dynamic groups, how many expressions can be set in a dynamic query before you will need to use the textbox?
   1. Three
   2. Ten
   3. Five
   4. Fifteen
5. True or False: Microsoft B2B guest access is enabled by default in Microsoft 365 tenants.
   1. True
   2. False
6. Which of the following PowerShell commands could you use to create an Azure AD Dynamic Security group?
   1. New-AzureADMSGroup
   2. New-AzureADGroup
   3. New...

Further reading

Please refer to the following links for more information regarding the topics covered in this chapter:

• Creating a basic group and adding members via Azure AD: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal?context=azure/active-directory/users-groups-roles/context/ugr-context
• Creating or updating a dynamic group in Azure AD: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-create-rule
• Dynamic membership rules for groups in Azure AD: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership
• Azure AD version 2 cmdlets for group management: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-settings-v2-cmdlets
• Using the Set-UnifiedGroup command in PowerShell: https://docs.microsoft.com/en-gb/powershell/module/exchange/users-and-groups/Set-UnifiedGroup?view=exchange-ps
• Planning...