The document discusses how security is changing in the modern workplace with increased collaboration. It proposes using Azure Active Directory and SharePoint Online to securely manage access for external users. The solution assigns external users to security groups, requires multi-factor authentication, and allows access reviews. This provides security while enabling collaboration. A demo then shows how the technologies work together to identify users, devices, locations and content to ensure the right access.

1. Modern Workplace | Modern Work Management
Microsoft 365 | Azure | Power Platform
Security in an Age of
Collaboration
Thames Valley Azure Group
Alan Eardley
26 March 2019

2. About Me
• Twitter: @al_eardley
• 20 Years in IT
• Prosci© Change Practitioner
• Scrum Master
• PRINCE2© Practitioner
• MCSA: Office 365
• MCSE: SharePoint (2013)
• MCSE: Productivity (2016)
• MCSE: Cloud Platform

3. What will I cover?
• Technologies we can use
• Real-World Scenario
• Solution
• Demo
• Summary

5. Technologies

6. Old mindset
Secure the perimeter
Everything inside is safe
Everything outside is dangerous

7. Security is changing
HR System
Finance
System
CRM
Documents
Service
Desk
Security Barrier

8. Security is changing
HR System
Finance
System
CRM
Documents
Service
Desk
Security Barrier

9. Security is changing
HR System
Finance
System
CRM
Documents
Service
Desk
Security Barrier

10. Security is changing
HR System
Finance
System
CRM
Documents
Service
Desk
Security Barrier

11. New mindset
Identify the user
Identify the content they are accessing
Are they allowed?

12. A brave new world
Before
• Many discrete systems
• Multiple identities
• No direct external collaboration
• Emailed copies of documents
• Access from the office
• Access from a desktop
• Multiple audit logs
• Delayed reaction to threats
After
• Core integrated platforms
• Single identity
• Simple invite for guests
• Single shared document
• Access from anywhere
• Access from anything
• Unified logging and ML analysis
• Pro-Active action to prevent threats

13. Are you allowed?
Allowed?
User
Device
Location
Content

14. Are you allowed?
Allowed?
User
Device
Location
Content
Who are you?
How do we know?

15. Are you allowed?
Allowed?
User
Device
Location
Content
What device are you
using?
Is it secure?
Have you lent it to a
child or friend?

16. Are you allowed?
Allowed?
User
Device
Location
Content
Where are you?
Our network?
Coffee shop?
North Korea?

17. Are you allowed?
Allowed?
User
Device
Location
Content
What are you
accessing?
Finance data?
HR data?
Secret sauce recipes?

18. Are you allowed?
Allowed?
User
Device
Location
Content
What are you
accessing?
Finance data?
HR data?
Secret sauce recipes?
Where are you?
Our network?
Coffee shop?
North Korea?
What device are you
using?
Is it secure?
Have you lent it to a
child or friend?
Who are you?
How do we know?

19. Technologies
Azure AD
•External Users
•Terms of Usage
•Conditional Access
•Access Reviews
SharePoint Online
•Communication
•File storage
•Permissions

20. Real-World Scenario

21. The client
• A client with global collaboration partners
• End of life custom extranet solution
• Not used Cloud technologies before
• Objectives
– Maximum Security
– Minimum overhead

22. Solution

23. Processes
• Add External Users
– Invite external users
– Add them to a security group
– Share the site URL
• Register as External User
– Respond to invite
– Accept Terms
– Add MFA information
– Access URL
• Review Access
– Receive invite to review
– Approve/Deny access

24. Security Groups
EXT-ECP-Projects-Visitors
INT-ECP-Projects-Members
INT-ECP-Projects-Owners
EXT-ECP-Projects-<Project>-
Visitors
EXT-ECP-Projects-<Projects>-
<Partner>-Members

25. SharePoint
Hub Site (External Projects)
Project Site
Documents
Partner (Outlook)
Partner (Personal)
Partner (Work)
Read - EXT-ECP-Projects-Visitor
Read - INT-ECP-Projects-Visitor
Edit - INT-ECP-Projects-Contributor
Admin - INT-ECP-Projects-Owner
Read - EXT-ECP-Projects-<Project>-Visitor
Read - INT-ECP-Projects-<Project>-Visitor
Edit - INT-ECP-Projects-<Project>-Contributor
Admin - INT-ECP-Projects-<Project>-Owner
Edit - EXT-ECP-Projects-<Project>-<Partner>-Contributor
Read - INT-ECP-Projects-<Project>-Visitor
Edit - INT-ECP-Projects-<Project>-Contributor
Admin - INT-ECP-Projects-<Project>-Owner

26. Demo

27. Summary

28. Key Take-Aways
Azure AD can manage external users
External organisations enforce authentication
Additional security can be applied to external users
Access to external users can be automatically removed if not approved
SharePoint security works seamlessly with Azure AD

29. Modern Workplace | Modern Work Management
Microsoft 365 | Azure | Power Platform
Thank-you
Twitter: @al_eardley
LinkedIn: Alan Eardley