Understand Identity and Access Management Solutions

In the previous chapter, you saw the importance of protecting the identity of users, as users can potentially access cloud services from anywhere with an internet connection.

Traditionally, identity has been managed internally with directory services such as Microsoft Active Directory (AD) and Microsoft Entra ID (formerly Azure Active Directory or Azure AD). When incorporating cloud services into your organization’s infrastructure and service portfolio, you’ll need to understand how to provide access to those cloud resources. Ideally, you’ll want to use a single sign-on (SSO) capability that enables the users to authenticate with a single identity across multiple platforms and services.

In this chapter, you’re going to learn about the kinds of identity models available, their applications, and some of the ways to protect the identity of users. You will cover the following topics:

• Describe...

Describe the Identity and Access Management Capabilities of Microsoft 365

Entra ID provides a full suite of identity and access management capabilities, including the provisioning, role and privilege assignment, delegation, and retirement of identity. In addition to acting as an identity store, Entra also enables policy-based access, secure authorization, auditing, and entitlement management.

The key features of Entra ID’s access, security, and entitlement management include the following:

• Conditional Access
• Multi-factor authentication
• Role-based access control
• Privileged Identity Management
• Access reviews

These features can be used to both secure and help automate identity processes.

Introducing Entra ID

Microsoft has recently rebranded the identity and access control features of the Microsoft 365 platform from Azure Active Directory to Entra ID. The exam may reference either product name. They are interchangeable. Microsoft’s...

Describe Identity Concepts

When describing how users access Microsoft 365 services, the identity and authentication processes are the key concepts to understand. In this section, you will learn three core identity models (as well as some sub-features of each) and how they work in the context of Microsoft 365. The three models are as follows:

• On-premises identity
• Cloud identity
• Hybrid or synchronized identity

You will now look at each in detail.

Directory Services

Directory services is a broad term that can be used to describe the identity storage and authentication system in an organized computer environment. It stores information regarding objects and resources and enables other users, devices, and services in a type of custom database called a directory. It also enables other users, devices, and services to access this information.
A directory may have policy and configuration information stored in it. This policy and configuration information is used...

Describe the Purpose and Value of Implementing Entra ID Features

Once you have chosen an identity and an authentication model, you should think about securing the identity in question as well as how to handle common end-user management tasks such as password reset.

In this section, you will learn about multi-factor authentication—one of the tools available to all users of the Microsoft 365 platform for securing identities and logons.

Multi-Factor Authentication (MFA)

Users typically provide login credentials (usually a username and a password) for most authentication or login attempts. The methods of authenticating a user’s identity typically fall into one of the following three categories:

• Something the user knows: A password is the most common example of this method.
• Something the user has: This can be some kind of login device, such as a smart card or token, or it can be a text or phone call to a phone number previously registered with the system...

Describe the Purpose and Value of Conditional Access

Conditional Access is an Entra ID feature that helps enforce company access policies. For instance, a company policy may require end users to sign in only from specific geographic or network locations. Conditional Access can be configured so that when an end user is within that location boundary, access is granted. Otherwise, access is blocked. Core Conditional Access features are available as part of Azure AD Premium P1 (or Entra ID Premium P1). Entra ID Premium P1 is also included as part of Enterprise + Mobility and Security (EMS) E3.

With AAD Premium 2 (also included as part of EMS E5), organizations can enforce risk-based sign-in policies for MFA, as well as use leaked-credential detection to determine whether compromised user credentials are available on the dark web. Administrators can set up PIM workflows as well to help manage a least-privileged access model.

Summary

As you’ve seen, there is a multitude of configuration options available to help organizations of all sizes meet their identity, authentication, and security needs.

In this chapter, you have learned the differences between cloud, synchronized, and federated identity, as well as the security controls available with EMS and Azure AD premium, such as Conditional Access and access reviews. You learned which identity model can be used to help meet specific requirements—for example, if your organization needs on-premises identity authentication to comply with your security needs, you now know that you should choose between pass-through authentication and federated identity.

You also learned about some of the commonly implemented features of the Microsoft 365 platform, including SSPR and multi-factor authentication.

In the next chapter, you’re going to look at technologies that enable endpoint security control and management.

Exam Readiness Drill - Chapter Review Questions

Benchmark Score: 75%

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That’s why, working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

Before You Proceed

You need to unlock these resources before you start using them. Unlocking takes less than 10 minutes, can be done from any device, and needs to be done only once. Head over to the start of Chapter 9, Describe the Threat Protection Solutions of Microsoft 365 in this book for instructions on how to unlock them.

To open the Chapter Review Questions for this chapter, click the following link: https://packt...