What you need to know about Azure AD security defaults?

Hello Cloud Marathoners,

The following post is going to be covered in the Azure Spring Clean 2022 event’s website too. Thus, you might be wondering what the Azure Spring Clean is?

Note: This post is not finalized yet πŸ˜‰ and will include a video session too.
Thus, please be patient with ongoing progress. Thanks!

Azure Spring Clean 2022 Overview

The Azure Spring Clean is a community-driven event focused on Azure management topics and gradually publishes content from March 14-18, 2022.

I would like sincerely Thank – Joe Carlyle and Thomas Thornton for putting time and effort in organizing this event. From a #cloudmarathoner ’s perspective it’s been enjoyable to contribute and be a part of this event. This topic specifically outlines how to understand the pros and cons of your initial Azure AD settings that will be aligned with your project’s expectations.

Azure Spring Clean 2022
Azure Spring Clean 2022 site

WHY azure ad security defaults are important?

Indeed, this is a very legit question and I would like to address it with the following quote from Alex Weinert:

…our telemetry tells us that more than 99.9% of organization account compromise could be stopped by simply using MFA, and that disabling legacy authentication correlates to a 67% reduction in compromise risk (and completely stops password spray attacks, 100% of which come in via legacy authentication)…

Alex Weinert – Director of Identity Security at Microsoft

The main purpose behind these default settings is to make sure that all organizations using Azure AD have a basic level of security, and it is enabled at no extra cost according to Microsoft.

New Azure AD Bug Lets Hackers Brute-Force Passwords Without Getting Caught

Azure AD security defaults are something you need to enable at the tenant level. Once you do this, the rules will apply to all users in your tenant without any exceptions.

If you are looking for enforce rules more selectively ( or exclude some users ) then security defaults won’t be a fit solution for you. For this scenario, you would need to look at getting some P1 or P2 licenses and use the conditional access instead.

How can I set up my Azure AD Security Defaults?

The Microsoft Azure AD team did a fantastic job by simplifying this option. You need to navigate int0 Azure AD -> Properties -> and click on link Manage Security defaults.

You will end-up with the following window on the right panel of Azure portal:

Enabling Security Defaults in Azure AD

What is baked inside the security defaults in azure ad?

There are a number of things baked into the “Security Defaults” by Azure AD team. You could read about an official and detailed description here – Security defaults in Azure AD.

One of the BIG incentives for the security defaults is that it brings Multi-Factor Authentication (MFA) to your users for #free. Of course, there are some limitations around this which I will cover later on, but this option does allow you to get an MFA with no additional cost.

Previously, you would have to have either Azure AD P1 licenses, or pay per use for MFA functionality. Thus, this is a big game changer benefit that you are getting for free in your tenant and will bring a significant extra level of security. And this defaults includes both Azure and Office 365 services.

Along with MFA, security defaults are enforcing several policies that make your tenant more secure:

  • Requiring all users to sign up for MFA (for free)
  • Requiring those in Azure administrator roles to perform MFA
  • Blocking legacy authentication protocols – this includes clients that don’t use modern authentication and so don’t support MFA, and older mail protocols like IMAP, SMTP and POP3
  • Requiring MFA authentication when undertaking privileged actions using the Azure portal, PowerShell or CLI

Will Security Defaults replace my Azure AD licenses ?

In short, the answer is No. Your Azure AD licenses provide more security protection services than what you get from “Security Defaults”.

Think of a “Security Defaults” as a security design approach for users on a free Azure AD tier. Because, if you are already using P1 or P2 licenses you would want to look at using conditional access to perform this (and more) rather than security defaults.

Azure Ad Premium P1 | Azure Active Directory Premium Pricing & Licensing -  USA | IOTAP Online US
Azure AD Premium licenses

What you need to know before deploying the Security Defaults?

Based on Microsoft security guidelines, every organization should have at least two emergency access accounts configured. These accounts are intended for use when your regular administrator account’s can not be used. A typical example is: when person with the most recent Global Admin access has left your company.

What are the emergency access accounts ?
Well, following three criteria defines it pretty well:

  • Aren’t used on a daily basis
  • Are protected with a long complex password
  • Has an assigned Global Administrator rights in Azure AD
Break the Glass Admin no longer compliant? - Microsoft Partner Community

These emergency access accounts and credentials are very sensitive and should be stored in a secure location like a fireproof safe. And only authorized people in your organization should have access to these accounts.

You are also encouraged to disable password expiration to for these accounts using Azure AD PowerShell.

Check out this Microsoft article – Manage emergency access accounts in Azure AD, as it provides more detailed information about emergency access accounts.

What to do when switching from Security Defaults to azure ad Conditional Access Policies?

In order to provide more productivity and better security to your users, you could replicate the policies created by Azure AD Security Defaults. First, your customer’s tenant must be licensed with Azure AD Premium P2. However, the majority of policies can also be accomplished using the Azure AD Premium P1 license.

Check out the following Microsoft documented guides on how you can use Conditional Access to configure equivalent policies to the once that get set by the security defaults:

All these policies could be implemented with Premium P1 license, except the last one. The last policy requires Azure AD Identity Protection feature of the Azure AD and could be provided via Premium P2 license.

Summary

Thank you so much for reading this post and learning about the Azure AD Security defaults. I tried my best to provide my perspective on this important topic while using availiable Microsoft docs and resources.

Please, keep up the good work by securing your and customer’s cloud environments!

Study Guide for AZ-305: Part 2 – Design Authentication and Authorization Solutions

Hi Cloud Marathoners!

This is the continuation (Part 2/12) of blog post series to help you get ready for the latest AZ-305 exam. As title says – our focus will be on understanding and designing Authentication and Authorization Solutions in Microsoft Azure.

Feel free to check the previous post (Part 1/12) if you did not look into it yet πŸ™‚

Table of content (blog series)

What is the Authentication and Authorization?

To put it in plain English language, authentication is the process of verifying who someone is, where as authorization is the process of verifying what specific applications, files, and data a user has access to.

To relate these concepts to a real-world scenarious, you may think about your airport access and on-boarding to the plane experience. Thus, when you go through the security in an airport, you are required to show your ID to authenticate your identity. Then, you proceed and arrive at the gate, you present your boarding pass to the flight attendant, so they can authorize you to board your flight and allow access to your assigned seat.

Authentication vs Authorization. Authentication vs. Authorizationβ€” These… |  by Frank D'Amico | Medium

WHAT YOU CAN DO WITH Authentication and Authorization?

The authentication and authorization services are part of the Microsoft’s identity platform.

The Authentication sometimes shortened to ‘AuthN’.
The Microsoft identity platform uses the OpenID Connect protocol for handling authentication. On the other hand, Authorization sometimes shortened to ‘AuthZ‘. The Microsoft identity platform uses the OAuth 2.0 protocol for handling authorization.

In Microsoft Azure your authentication and authorization is delegated to Azure Active Directory (Azure AD). By using this centralized identity provider you can enable following secure workflows for your business:

  • Conditional Access policies – that require a user to be in a specific location.
  • The use of multi-factor authentication, which is sometimes called two-factor authentication or 2FA.
  • Enabling a user to sign in once and then be automatically signed in to all of the web apps that share the same centralized directory. This capability is called single sign-on (SSO).
From AD to Azure AD – Your Hybrid Identity Journey - New Signature

Part 2: Designing Authentication and Authorization solutions

The references below are taken from official Microsoft docs and focused on designing Azure Authentication and Authorization solutions. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below πŸ™‚

This collection of links is gathered with a focus on the exam objectives of the AZ-305 certification exam.

Azure identity management security overview
Azure Identity Management and access control security best practices
Five steps to securing your identity infrastructure
What is Azure Active Directory?
Compare Active Directory to Azure Active Directory
Azure Active Directory B2B best practices
Overview: Cross-tenant access with Azure AD External Identities (Preview)
Identity Providers for External Identities
Authentication and Conditional Access for External Identities
What is Azure Active Directory B2C?
Technical and feature overview of Azure Active Directory B2C
What is Conditional Access?
Plan a Conditional Access deployment

[Tutorial]: Secure user sign-in events with Azure AD Multi-Factor Authentication
[Tutorial]: Enable users to unlock their account or reset passwords using Azure AD self-service password reset (SSPR)
[Tutorial]: Enable Azure Active Directory self-service password reset writeback to an on-premises environment

What is Identity Protection?
What is risk?
Azure Active Directory Identity Protection – Security overview
Identity Protection policies
What are Azure AD access reviews?
What are managed identities for Azure resources?
What is identity lifecycle management?

Microsoft Azure Well-Architected Framework – Security
Authenticate apps to Azure services by using service principals and managed identities for Azure resources
Application and service principal objects in Azure AD
Azure Key Vault basic concepts

Best practices for using Azure Key Vault
Azure Key Vault logging
Virtual network service endpoints for Azure Key Vault
Monitoring Key Vault with Azure Event Grid

SUMMARY

Thank you for visiting the AZ-305 Study Guide and checking the Part 2 – Designing Authentication and Authorization Solutions.

The next blog will cover the Part 3: Design a solution to log and monitor Azure resources.

Festive Tech Calendar 2021 event

Hi Cloud Marathoners,

As you may know, it is that time of a year when great content will be coming to the town! You could enjoy and learn throughout the month of December, as people behind the #festivetechcalendar will be bringing you lots of new content from different communities and people around the globe.

https://festivetechcalendar.com/

This year, I have submitted two sessions and have been nicely surprised yesterday. Both sessions have been accepted and I am looking forward to deliver following sessions for the community:

Session # 1: What you need to know about Azure AD security defaults?

Accepted session – “What you need to know about Azure AD security defaults?


In this session above, we will discuss about how to get started with Azure security on right foot and its challenges. We will focus on importance of a strong Identity and Access in any cloud solution that we are creating for our customers. One simple way to get started is review and adjustment of security default options in Azure AD. We will also look into the set of practices to get you started with Azure AD setup and learn about the benefits of Azure Security Benchmark.

Session # 2: All you need to know about Azure Bicep configurations

Accepted session -“All you need to know about Azure Bicep configurations”

In the second session, we will talk about Azure Bicep – a new language that aims to ease Azure resource authoring and management. This new language comes with a powerful VS Code extension and config file options.
In this session, we will unveil dozens of powerful features in our config file to suit your style of coding on VS Code and cheer up our productivity skills. We will apply our fresh skills by creating several Bicep demos in the process. 

Conclusion

I sincerely hope that these sessions will spark your interest and I am looking forward to see you all during this event. But most importantly, I hope you could have lots of fun during this festive month.

Stay tuned for more Azure AD, Automation & Security related posts.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

How to create a free, Azure Active Directory developer tenant? πŸ€”

Hi Cloud Marathoners!

It is a pretty common situation when as a Developer you are not granted access to work with company Azure AD. And there are many reasons why corporate security / IT would be hesitant to provide that access.

However, this situation should not discourage you from experimenting and prototyping solutions that you have.

Let’s consider following two easy options to create a free Azure Active Directory with Premium (P1 or P2) trial licenses. This will enable you to install/create an app that requires Azure AD license, and start testing and validating your workloads right away:

Azure Active Directory voor Developers - ppt download

Option # 1: Microsoft 365 Developer Program

Join a free Microsoft 365 Developer Program and get a free sandbox, tools, and other resources you need to build solutions for the Microsoft 365 platform. Resources like an Azure AD with Premium licenses, pre-configured users, groups, mailboxes and etc.

Option # 2: Create an Azure trial account

Create a new free Azure AD account with a tenant and activate your Premium licenses in your new tenant. This is a classic option for anyone who is trying to learn Azure for the first time.

The Azure trial account will give you one month to play with Azure and Azure AD services, where you will get certain credits to spend on Azure resources. You will get an option to convert this trial subscription into a paid one at the end of the trial period.

How to Join Microsoft 365 Developer Program

My recommendation would be to sign up for the free Microsoft 365 developer program that gets renewed automatically, if you are using that account. Check out the following instructions on how to set-up one:

1. Click on the Join Now button on the screen

2. Sign in with a exisiting or new Microsoft Account you already have

3. On the signup page, fill the form and accept the terms and conditions of the program, and click next

4. Continue with a subscription set-up. You should specify the region where you want to create your new tenant, create a username, domain and enter a password. This step will create a new tenant and an administrator account of the tenant.

5. Enter the security information which is required to protect the sensitive administrator account. Complete this step by setting up MFA authentication for your admin account.

6. Link your developer account with your GitHub account for an easy renewal. You should see the following GitHub account link blue banner, once the linking operation succeeds.

Congratulations!
You have created a new Azure AD tenant with 25 E5 user licenses. This also includes Azure AD Premium licenses.

As an additional perk, you can also add sample data packs with users, Mail & Events and SharePoint, as sample data for your development environment.

Good Luck on your next M365 project!

Stay tuned for more Azure AD, Automation & Security related posts.

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become α΄€ #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘

What is an Azure administrative unit and its benefits? πŸ€”

The Administrative Units (AU) are Azure AD resources which can contain only users and groups.

AUs could manage permissions πŸ›‘οΈπŸ” in a role to any segment of your organization. For example, you could use AUs to delegate the User Administrator role to regional support specialists, so they can manage users only in the region that they support.

The AUs are especially helpful when an organization whose IT department is scattered across globe and wants to categorize and define relevant geographical boundaries.

Currently, supported scenarious from Azure AD portal are:

  • Create administrative units
  • Add users and groups members of administrative units
  • Assign IT staff to administrative unit-scoped administrator roles.

In addition, assigned users can easily manage their AU users from mystaffΒ MicrosoftΒ website πŸ‘‰ https://mystaff.microsoft.com/

Check out the following Microsoft docs post for more details and use asesπŸ‘‰Β https://lnkd.in/dXMMncJ #SharingIsCaring❀️

Now, if you end up loving this story and want to lean about managing your sers with “My Staff” – then check out this handy post on Micrsoft docs page:

Fᴏʟʟᴏᴑ ᴍᴇ 🎯 α΄€Ι΄α΄… become the #cloudmarathoner β›…πŸƒβ€β™‚οΈπŸƒβ€β™€οΈ – 𝐋𝐄𝐓’𝐒 π‚πŽπππ„π‚π“ πŸ‘