Chapter 2.  Planning and Designing Cloud Identities

Having read through the first chapter, you will have realized that Microsoft Azure provides a whole bunch of functionality for Identity and Access Management. Now, after hearing the relevant business information, we will dive into the architecture of Azure Active Directory to understand the relevant concepts and design dependencies for cloud-only identities. Furthermore, we will see that small or innovative companies often follow the cloud-only strategy. This is perfectly normal, as most companies have an existing local IT infrastructure. Often you will find a domain controller and file/print services on-premises, but Azure Active Directory also provides users with important Identity Management as a Service and identity repository features for a more flexible and value added IT ecosystem. After reading this chapter, you will also be able to design and construct roles and administrative units for Role Based Access Control (RBAC) in your...

Understanding the user and group life cycle

One of the basic concepts to understand is the user and group life cycle, so it's very important to understand the different repositories and capabilities where objects are stored and managed. In this section, we will provide you with the necessary information for designing your solution.

Microsoft Azure Identity repositories and capabilities

IAM is a very broad field in technology. Internet threats are becoming more intelligent and effective, so IAM solutions must constantly evolve to keep up. In particular, these solutions must address the four most important fields in order to be successful. The four main topics are the administration, authentication, authorization, and auditing of identities. With Microsoft Azure, you get several options for leveraging identity and access management solutions.

Azure Active Directory is the central and main identity repository for the whole Microsoft Azure landscape. The existence of an Azure AD directory is a...

Employee life cycle (word smart)

The relationship starts when a new employee joins the organization and his identity and corresponding information must be provided. Initially, an identification of the employee as a user will be created and an assignment of standard access rights to applications will be implemented.

The following partial processes run in a typical end-to-end process:

• Provisioning

  • Creation of the person and identifier(s)

  • Definition of group and role memberships

  • Definition of the required system and application access

• Authentication and Authorization

  • Validation of the person's identity

  • Determination of the right-to-access

  • Audit and security reporting

  • Management of system authorizations

• Self-Service

  • Registration for Password Reset and maintenance of other verification options

  • Password Reset and Changes, Account Unlock

  • Maintenance of personal information

• De-provisioning

  • Revoking of permissions/authorizations based on current role(s)

  • Deactivation of the user account

  • Deletion of the user account...

Designing roles and administrative units

In this section, we will discuss the designing of roles and administrative units that we can use to provide Role-based Access Control and the delegation of rights to several types of administrative persons.

Roles and RBAC

RBAC is well implemented in the Microsoft Azure platform and has a security model to perform access control of resources by users on a more granular level. Users can access and execute actions on the resources within their scope of work.

Note

There is an actual limit of 200 co-administrators per subscription. RBAC is only available in the new Azure Portal https://portal.azure.com, in addition to the usage of the Azure Resource Manager APIs.

RBAC allows more users to manage their Azure services, and at the same time limits access to only specific resources, rather than the entire subscription.

Practical Notes:

• Administrators and co-administrators: They will see all resources in all portals and through APIs

• Users defined in RBAC: They will...

Managing identity reporting capabilities

Azure Active Directory contains a series of reports that can be used to gain insight into various activities around the user. These reports are broken down into three categories:

• Anomalous Activity: This reports potentially suspicious activity that could be an indicator of a security incident

• Activity Logs: This provides reports on various activities that are taking place within the directory, such as password management or self-service identity activities

• Integrated Applications: This provides statistics regarding which applications are being used

The following figure represents the Azure AD reporting architecture and informs us of the different interfaces and capabilities:

Azure Active Directory Audit Report events

With Azure AD Audit Reports, you can identify the following possible causes:

• User is sharing their password

• User is using a remote desktop to launch a web browser for sign in

• User is using a VPN or going through a proxy in another region...

Summary

After reading this chapter, you should be able to describe the Azure Active Directory architecture and to design a complete user and group life cycle. You should also be able to describe the different roles, administrative units, and the identity reporting capabilities. This chapter has captured the principles, features, and functionality that are integral to the designing and architecture of cloud identities.

In the next chapter, we will plan and design the authentication and application access. You will learn how to use Azure AD as an Identity Provider. Furthermore, we will dive into user and group-based access management, including the associated reporting capabilities. We hope to see you in the next chapter as you learn how to design the authentication and authorization capabilities of Microsoft Azure.