Managing Access to Resources Using Azure Active Directory

This chapter aims to give you a brief overview of the Identity and Access Management (IAM) capabilities you can leverage using Azure Active Directory, also known as Microsoft Entra ID, including step-by-step configurations to properly secure identities and access to resources in your organization.

This chapter will address key components related to IAM, such as Azure Active Directory, and the most relevant and recently released features and components, such as Azure Active Directory Connect, Azure Active Directory Application Proxy, Azure Active Directory Conditional Access, and Privileged Identity Management.

In this chapter, we’ll cover the following main topics:

• Understanding the need for IAM
• Understanding Azure Active Directory (now Microsoft Entra ID)
• Understanding the capabilities of Microsoft Entra ID
• Hybrid identity – integrating your on-premises directories (Azure AD Connect sync...

Understanding the need for IAM

Having controls and mechanisms to successfully manage access to resources and applications, while managing control over the identities of the people who are a part of our organization, has been a major business need for the past few years.

Undoubtedly, we all have seen a significant change in the field since 2020, where organizations have sped up the process to broaden their digital transformation initiatives. And, more often than not, identity management and identity protection are overlooked as components, with the only purpose to provide user credentials and manage access to SaaS applications such as Office 365 and a few familiar others.

During the COVID-19 pandemic, we were all impacted to some level in carrying out our daily work, and organizations needed to accommodate remote management and remote working for staff. A clear strategy to enable a hybrid work approach became critical to organizations of different sizes and verticals.

Organizations...

Understanding Azure AD (now Microsoft Entra ID)

Authentication and authorization are the two pillars of an IAM solution, and therefore, organizations need to adopt a compelling identity framework that helps them improve their security posture.

Identity has become the core control plane of security for organizations to securely access resources on-premises and in the cloud. Microsoft was named a leader in the 2022 Gartner Magic Quadrant for Access Management for Microsoft Azure AD (now Microsoft Entra ID).

Figure 2.1 – The Magic Quadrant for Access Management

Microsoft Entra packages Microsoft’s rich IAM features, including Azure AD, permissions management, identity governance, workload identities, and Microsoft Entra Verified ID.

Azure AD, a cloud-based service for IAM, is suitable for different types of users, such as the following:

• IT admins looking to control access to applications while protecting user identities and credentials...

Understanding the capabilities of Microsoft Entra ID

To better understand Azure AD’s potential (now Microsoft Entra ID), we will perform a series of exercises with practical examples that you can follow step by step. Despite the recent renaming of the product, we will stick to the name Azure AD for the following exercises. We will perform the following tasks:

• Task 1: Create a new Azure AD tenant using the Azure portal and activate the Azure AD Premium P2 offer
• Task 2: Create and configure Azure AD users
• Task 3: Create an Azure AD group with dynamic membership

Let’s begin!

Task 1 – creating a new Azure AD tenant using the Azure portal

To create a new tenant, take the following steps:

1. First, we will go to the Azure portal and select Azure Active Directory. Then, we will create a new Azure AD tenant, as shown here:

Figure 2.4 – Create a tenant – the Basics tab

2. Now, we will provide...

Hybrid identity – integrating your on-premises directories (Azure AD Connect sync and cloud sync)

Organizations can leverage their existing Active Directory on-premises and Azure AD to modernize their identity infrastructure. Integrating on-premises directories with Azure AD gives organizations a common identity to access cloud and on-premises resources.

A prevalent practice is establishing directory synchronization, which helps organizations synchronize their identities or objects, including users, groups, contacts, and devices, between different directories. This is typically configured between an on-premises Active Directory environment and Azure AD.

This approach, commonly referred to as a hybrid identity, helps organizations provide users with a common identity across on-premises or cloud-based services.

Microsoft provides two main tools to achieve the configuration of a hybrid identity approach – Azure AD Connect Sync and Azure AD Connect Cloud Sync.

...

Summary

In this chapter, we reviewed the most relevant features of the IAM capabilities you can leverage using Azure AD. You should now have a better understanding of how you can implement mechanisms to protect access to resources and manage users inside and outside your organization.

In the next chapter, we will address security controls that can be implemented to protect your organizations from potential attackers, who use accounts to gain access to sensitive resources in your network.