Having read through the first chapter, you will have realized that Microsoft Azure provides a whole bunch of functionality for Identity and Access Management. Now, after hearing the relevant business information, we will dive into the architecture of Azure Active Directory to understand the relevant concepts and design dependencies for cloud-only identities. Furthermore, we will see that small or innovative companies often follow the cloud-only strategy. This is perfectly normal, as most companies have an existing local IT infrastructure. Often you will find a domain controller and file/print services on-premises, but Azure Active Directory also provides users with important Identity Management as a Service and identity repository features for a more flexible and value added IT ecosystem. After reading this chapter, you will also be able to design and construct roles and administrative units for Role Based Access Control (RBAC) in your...
One of the basic concepts to understand is the user and group life cycle, so it's very important to understand the different repositories and capabilities where objects are stored and managed. In this section, we will provide you with the necessary information for designing your solution.
IAM is a very broad field in technology. Internet threats are becoming more intelligent and effective, so IAM solutions must constantly evolve to keep up. In particular, these solutions must address the four most important fields in order to be successful. The four main topics are the administration, authentication, authorization, and auditing of identities. With Microsoft Azure, you get several options for leveraging identity and access management solutions.
Azure Active Directory is the central and main identity repository for the whole Microsoft Azure landscape. The existence of an Azure AD directory is a...
The relationship starts when a new employee joins the organization and his identity and corresponding information must be provided. Initially, an identification of the employee as a user will be created and an assignment of standard access rights to applications will be implemented.
The following partial processes run in a typical end-to-end process:
Provisioning
Creation of the person and identifier(s)
Definition of group and role memberships
Definition of the required system and application access
Authentication and Authorization
Validation of the person's identity
Determination of the right-to-access
Audit and security reporting
Management of system authorizations
Self-Service
Registration for Password Reset and maintenance of other verification options
Password Reset and Changes, Account Unlock
Maintenance of personal information
De-provisioning
Revoking of permissions/authorizations based on current role(s)
Deactivation of the user account
Deletion of the user account...
In this section, we will discuss the designing of roles and administrative units that we can use to provide Role-based Access Control and the delegation of rights to several types of administrative persons.
RBAC is well implemented in the Microsoft Azure platform and has a security model to perform access control of resources by users on a more granular level. Users can access and execute actions on the resources within their scope of work.
Note
There is an actual limit of 200 co-administrators per subscription. RBAC is only available in the new Azure Portal https://portal.azure.com, in addition to the usage of the Azure Resource Manager APIs.
RBAC allows more users to manage their Azure services, and at the same time limits access to only specific resources, rather than the entire subscription.
Practical Notes:
Administrators and co-administrators: They will see all resources in all portals and through APIs
Users defined in RBAC: They will...
Azure Active Directory contains a series of reports that can be used to gain insight into various activities around the user. These reports are broken down into three categories:
Anomalous Activity: This reports potentially suspicious activity that could be an indicator of a security incident
Activity Logs: This provides reports on various activities that are taking place within the directory, such as password management or self-service identity activities
Integrated Applications: This provides statistics regarding which applications are being used
The following figure represents the Azure AD reporting architecture and informs us of the different interfaces and capabilities:
After reading this chapter, you should be able to describe the Azure Active Directory architecture and to design a complete user and group life cycle. You should also be able to describe the different roles, administrative units, and the identity reporting capabilities. This chapter has captured the principles, features, and functionality that are integral to the designing and architecture of cloud identities.
In the next chapter, we will plan and design the authentication and application access. You will learn how to use Azure AD as an Identity Provider. Furthermore, we will dive into user and group-based access management, including the associated reporting capabilities. We hope to see you in the next chapter as you learn how to design the authentication and authorization capabilities of Microsoft Azure.
© 2016 Packt Publishing Limited All Rights ReservedAuthor (1)
