Chapter 3.  Planning and Designing Authentication and Application Access

Now that we have finished going through the relevant architecture and the principal identity management capabilities of Azure Active Directory, it's time to move on to authentication and authorization. This chapter will discuss the essential topics for using Azure AD as an identity provider and for providing flexible and secure access to SaaS applications. Furthermore, we will get to know the rich authentication reporting functionality. This chapter deals with the following topics:

• Using Azure AD as an identity provider

• User and group-based application access management

• Managing authentication reporting capabilities

Using Azure AD as an identity provider

In the new cloud era, the externalization and consumerization of IT is playing a main role. Users need to access all their data and resources from many different places and devices without thinking about where the application is actually installed. SaaS applications are very useful for meeting this demand. Here enters another issue, however, because purchasing and using SaaS applications is easier than ever and various departments are bypassing their IT departments. Shadow IT is born - application usage without central management. This trend called Shadow IT will be seen more often as more companies try to adopt cloud-based SaaS apps.

Typical questions we hear in our projects are as follows:

• How can I arrange collaboration without managing foreign users? (management)

• How do I monitor the usage of these applications? (management)

• How do I enforce the correct set of permissions to these applications? (access control)

• How do I ensure that only legitimate users...

User and group-based application access management

For authorization, Azure Active Directory delivers many methods. As we already discussed in Chapter 2, Planing and Designing Cloud Identities groups are a preferred way of providing users with the correct permissions and access to their applications. It's good practice that users work with the Access Control Panel UI and access their applications, change the password, and add verification options. With this option, you can also allow the user to build his own preferred workplace. For example he can add his own applications and leave the passwords secure in Azure Active Directory, benefitting from SSO.

Generally, Azure Active Directory provides three main concepts for authorization:

• Direct: The user will be directly authorized

• Group-based: Rule based or Delegated

• Role-based: The developer can publish his own application roles

The following figure shows the complete context:

The following section describes the different methods for these...

Managing authentication reporting capabilities

You can use access and usage reports to gain visibility into the integrity and security of your organization's Azure Active Directory tenant. With this information, you can identify security risks and be able to adequately plan for mitigating those risks.

In the Azure Management Portal, reports are categorized in the following ways:

• Anomaly Reports: Contains sign-in events that were found to be anomalous

• Integrated Application Report: Provides insight into how cloud applications are being used in your organization

• Error Reports: Indicates errors that may occur when provisioning accounts to external applications

• User-specific Reports: Displays device/sign in activity data for a specific user

  Note

  Some advanced anomaly and resource usage reports are only available when you enable Azure Active Directory Premium and Basic. Advanced reports help you improve access security, respond to potential threats, and gain access to analysis on device access and...

Summary

After reading this chapter you should be able to explain and design the authentication and authorization capabilities of Azure Active Directory. You should know which functions, protocols, and interfaces Azure AD provides as an identity provider and you should be able to design a flexible and secure application workplace for the business to improve its productivity. Additionally, you will have seen the different reports for monitoring your solution. This will help you to design a proactive security solution and to mitigate security issues. Let's move on to implementing a designed example solution - see you in the next chapter!