Chapter 7.  Designing Hybrid Identity Management Architecture

After reading the business-relevant aspects for hybrid identity management architecture, we will start to take advantage of managing common identities with Microsoft Identity Manager 2016 and build the cloud identities with the Azure AD Connect utility. We will also explore all the various functions of identities building a solid hybrid identity management solution. Additionally, we will discuss the bigger picture of hybrid architecture, and all its relevant features, at the beginning of this chapter to get a better overview and understanding. We will also use this architecture throughout the following chapters as a reference. The key points that we are going to go through in these chapters are:

• Key design concepts

• Management of common identities with Microsoft Identity Manager and Active Directory

• Choosing the best directory synchronization scenario for cloud identities

• Delivering password management capabilities

• Using multiple identity...

Key design concepts

As promised in the chapter overview, we will start with a bigger picture of the hybrid identity and access management features that are provided by Microsoft. From talking to customers, we found that many of the features in this technology field are not known of or not assigned correctly. This is not surprising, because the speed and breadth of this specialized area is extremely high and large. This led us to create a blueprint with all the actual features and relations to provide users with a better understanding.

In the following figure, you will find our ideas and the key components of a hybrid environment.

The blueprint consists of two main actors: your on-premises infrastructure and the Azure hybrid identity and access management services in the right box of the blueprint. Let us briefly discuss the main actors in the following section.

On-premises features overview

Active Directory is your core directory service and mostly your primary identity provider. With this...

Management of common identities with Microsoft Identity Manager and Active Directory

The classic Identity Management service deals with the life cycle of an identity within, or in conjunction with, an organization. Furthermore, it manages identities across different directories, databases, and applications in On-premise environments based on business processes and the employee lifecycle. Microsoft Identity Manager (MIM) 2016 is the latest Identity Management product from Microsoft that focuses on this field of technology. For hybrid identity and access management strategies, the management of On-premise identities becomes more and more relevant.

General capabilities of MIM 2016 in a hybrid world

In particular, the usage of MIM 2016, or other Identity Management services, provides the capability to prepare identities stored in the local Active Directory for the cloud synchronization tool AAD Connect so it can be used in Azure Active Directory for SaaS application access. The main advantage...

Choosing the best directory synchronization scenario for cloud identities

To integrate or extend the local Active Directory to the cloud, we need a rich set of capabilities to address all the different requirements of our customers. In the following figure, we see the three most common synchronization and two extension scenarios we can use.

• Synchronization scenarios:

  • Directory and password synchronization

  • Federation and directory synchronization

  • Federation, directory, and password synchronization

• Extension scenarios:

  • Stretching your local Active Directory to Azure IaaS

  • Using Azure Active Directory Domain Services to bring legacy authentication LOBs to the cloud

  

Synchronization scenarios

With the creation of a new Azure Active Directory tenant, directory information is managed independently from the On-Premises Active Directory forest by default. A new on-board user must be created in both the Azure Active Directory and the local Active Directory. Unless you drive a cloud-only company, you always...

Delivering password management capabilities

For providing password management capabilities, there are four main feature sets available in a hybrid scenario:

• Self-Service Password Reset and Account unlock, MIM 2016

• Password Change Notification Service to synchronize the actual AD password to different repositories, MIM 2016

• Password Update functionality, ADFS 3.0 and ADFS 4.0

• Password Self-Service Change, Reset and Account unlock, and AAD

The following figure shows the different capabilities in solution architecture:

What happens when a user resets their password in the cloud?

1. Check if password write-back services are running. If yes, proceed

   Tip

   The service checks that a user has a valid license assigned.

2. The user reaches the password reset screen and then enters the new password

3. The password is encrypted with a public key created for the process

4. The password is sent through HTTPS to the tenant bus relay

5. The connector password reset endpoint looks for the user object in the AD Connector Space through...

Using multiple identity providers and authentication scenarios

Users can log into the accounts and access applications that are integrated with Azure AD.

Using multiple identity providers

There are two options for signing users into Azure AD:

• Authenticating to Azure AD.

• Authenticating to an On-premises Identity Provider.

In the following figure, you can see a simple example of a combination of these two modes. If you are a user of msazure.ch, you use AAD as your identity provider and a user from idam.ch the local Active Directory with a configured ADFS infrastructure.

AD FS architecture including the Web Application proxy (AD FS proxy)

The Web Application proxy, or the AD FS proxy in older versions, is used for the following reasons:

• Used to enhance the security and performance of the AD FS installation

• The proxy service is exposed over HTTPS and client connections terminate at the proxy

• When installing AD FS proxy, a trust is created between the proxy and the AD FS farm

• It is included in the web...

Enabling strong authentication scenarios

Initially, a user signs in from any device using their existing account credentials. If a user is signing into an on-premises application, the Multi-Factor Server that is installed at the customer's site intercepts the authentication request.

Tip

Authentication requests can be differentiated based on the location and the device trust level, such as managed (isManaged) or compliant (isCompliant).

First, it checks the username and password against the user directory. If the correct credentials are entered, a request is sent to the MFA cloud service. The service sends the authentication request to the user's phone. Once the user has been authenticated, they are instantly signed into the application. There are a number of ways to configure the service to secure cloud apps. First, the on-premises multi-factor server can be used with Active Directory Federation Services, or any other SAML application for single sign-in to cloud applications.

For apps that use...

How does advanced identity and authentication reporting work?

With MIM hybrid reporting, you receive a unified view of the most common identity management activities that happen in your Azure AD or in the on-premise identity management solution, from password self-service reset to group management. To include the On-premise data, you need to install the reporting agent on all the MIM Service servers that need to be included. The agent uploads data from service requests in the MIM service to the tenant-specific reporting service in Azure Active Directory. When using this scenario, there is no dependency to the MIM SCSM Reporting.

Note

You will still need to implement a local reporting infrastructure if you want to hold data for auditing purposes for longer than one month. The Azure Active Directory reports are kept for no longer than one month. The hybrid reporting feature is an Azure AD Premium licensed feature.

Additionally, the reporting data uploaded to your Azure Active Directory can be...

Summary

After having worked through this chapter, you will now be able to design common and cloud identities. Furthermore, you are in the position to build identity management architecture, including MIM 2016 and the Azure AD Connect utility with the necessary considerations. Additionally, you will be able to construct a blueprint with different authentication scenarios including MFA. You are also well-equipped to take the necessary decisions regarding reporting functionalities and usage scenarios. In the next chapter, we will go ahead with the planning of authorization and information protection. We will take an in-depth look into risk-based access control mechanisms and offer you insight into Microsoft rights management services.