2018 10-17 J1 3C - Hybrid architectures with Amazon Web Services, Office 365 and Azure AD - Julien Lepine
•
0 likes•81 views
2018 10-17 J1 3C - Hybrid architectures with Amazon Web Services, Office 365 and Azure AD - Julien Lepine
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to 2018 10-17 J1 3C - Hybrid architectures with Amazon Web Services, Office 365 and Azure AD - Julien Lepine
Similar to 2018 10-17 J1 3C - Hybrid architectures with Amazon Web Services, Office 365 and Azure AD - Julien Lepine (20)
More from Modern Workplace Conference Paris
More from Modern Workplace Conference Paris (20)
Recently uploaded
Recently uploaded (20)
2018 10-17 J1 3C - Hybrid architectures with Amazon Web Services, Office 365 and Azure AD - Julien Lepine
- 1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Julien Lépine, Sr. Manager, Solutions Architecture, AWS Hybrid Architectures with Amazon Web Services, Office 365 and Azure AD October 17th , 2018
- 2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
- 3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Active Directory best practices on AWS Availability Zone B Private subnet DC2 Availability Zone A Private subnet DC1 company.local RELIABILITY COMPLIANCEGLOBAL REACH SECURITY Amazon VPC in an AWS Region
- 4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Hybrid integrated enterprise Availability Zone B Private subnet DC4 Corporate Network London DC1 Paris DC2 Cost 100 Cost 100 Cost 50 Availability Zone A Private subnet DC3 Cost 100 Cost 100 company.local company.local VPN AWS Direct Connect Amazon VPC in an AWS Region
- 5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Hybrid with resource forest Availability Zone B Private subnet DC4 Corporate Network London DC1 Paris DC2 Trust relationship Availability Zone A Private subnet DC3 company.local company.cloud VPN AWS Direct Connect Amazon VPC in an AWS Region
- 6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Hybrid with resource forest Availability Zone B Private subnet Corporate Network London DC1 Paris DC2 Trust relationship Availability Zone A Private subnet company.local company.cloud VPN AWS Direct Connect Amazon VPC in an AWS Region AWS Directory Service
- 7. What AWS Managed Microsoft AD Is AWS managed, actual Microsoft Active Directory Windows 2012 R2 domain controllers (DC) • ~3-click setup from directory service console or script through API • 2 DCs each in separate Availability Zones (AZs) • Scale-out with additional DCs • Dynamic DNS • Compliance audited Auth/ LDAP Availability Zone Private Subnet 10.0.2.0/24 EC2 App Server EC2 IIS Server AWS Managed Services D C AWS Managed Microsoft AD Auth/ LDAP Availability Zone Private Subnet 10.0.2.0/24 EC2 App Server EC2 IIS Server AWS Managed Services D C AWS Managed Microsoft AD
- 8. AWS Managed Microsoft AD: Shared Responsibilities Customer—administers • Configure password policies • Configure trusts (resource forest deployment) • Configure certificate authorities (for LDAPS) • Configure federation • Administer users, groups, GPOs, other AD content • Administration via Active Directory Users and Computers (ADUC) and other standard AD tools • Add domain controllers as needed Amazon—operates • Multi-AZ deployment, patch, monitor, DC recovery, snapshot, restore Auth/ LDAP Availability Zone Private Subnet 10.0.2.0/24 EC2 App Server EC2 IIS Server AWS Managed Services D C AWS Managed Microsoft AD Auth/ LDAP Availability Zone Private Subnet 10.0.2.0/24 EC2 App Server EC2 IIS Server AWS Managed Services D C AWS Managed Microsoft AD
- 9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Identity federation Active Directory Users Enterprise Applications Corporate Systems AWS Identity and Access Management (IAM) IAM roles Amazon EC2 Amazon DynamoDB Amazon S3
- 10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark On-premises to IAM identities with ADFS
- 11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Cloud federation with AWS Directory Service
- 12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Demo IAM - AD
- 13. AWS Microsoft AD as a resource directory Amazon WorkSpaces RDS for SQL Server Amazon WorkDocs Amazon WorkMail Amazon QuickSight AWS Management Console Amazon Chime Amazon Connect AWS Apps & Services AWS Microsoft AD Directory Enable, Authenticate, & Authorize Manage, Authenticate, & Authorize Manage, Authenticate, & Authorize .NET Applications Server SharePoint Server AD-aware Workloads SQL ServerRemote Desktop Licensing Manager .NET SharePoint SQL Server RD Licensing Enterprise Certificate Authority Certificate Services On-Premises Microsoft Active Directory On-Premises User Credentials Corporate Data Center SaaS Applications Azure AD SAML Authenticate Synchronize Users VPN Direct Connect or AD FS Server Azure AD Connect Server Trust Authenticate& Authorize Amazon EC2 Amazon Windows EC2 Instances Amazon Linux EC2 Instances
- 14. Manage, Authenticate, & Authorize AWS Microsoft AD as a primary directory Amazon WorkSpaces AWS Microsoft AD Directory RDS for SQL Server Amazon WorkDocs Amazon WorkMail Amazon QuickSight AWS Management Console Amazon Chime Amazon Connect AWS Apps & Services .NET Applications Server SharePoint Server AD-aware Workloads SQL ServerRemote Desktop Licensing Manager .NET SharePoint SQL Server RD Licensing SaaS Applications Azure AD Enable, Authenticate, & Authorize SAML Authenticate Synchronize Users Manage, Authenticate, & Authorize Enterprise Certificate Authority Certificate Services Amazon Windows EC2 Instances Amazon Linux EC2 Instances Amazon EC2 AD FS Server Azure AD Connect Server Federate ADSync AD FS On-Premises Microsoft Active Directory On-Premises User Credentials Corporate Data CenterVPN Direct Connect or AD FS Server Azure AD Connect Server Trust Authenticate& Authorize
- 15. Set Up Environment (Prerequisites) 1. Create AWS Microsoft AD directory 2. Join EC2 Windows server to AWS Microsoft AD domain (admin instance) 3. Install AD Administration tools on EC2* 4. Join EC2 Windows server to AWS Microsoft AD domain (AD FS instance)* 5. Join EC2 Windows server to AWS Microsoft AD domain (Azure AD Connect instance)* 6. Create AD FS service account in AWS Microsoft AD using AD Users and Computers 7. Set up Office 365 account 8. Integrate AD Domain with O365 (tenant) 9. Set up Azure AD domain AWS Microsoft AD AD 1 adfsserver EC2 AD FS Server (Windows Server 2016) 4 adsync EC2 Azure AD Connect 5 Install AD Admin Tools 3 management 2 EC2 AD Administration Tools ADFSSVC 6 Office 365 7 Azure AD 8 *Can be the same instance
- 16. Integrate AD FS with Azure AD (continued) Set context to the AD FS server using the internal FQDN Set-MsolADFSContext -computer adfsserver.awsexample.com Convert Azure AD to use adfsserver for federated authentication to your AD domain Convert-MsolDomainToFederated –domain awsexample.com
- 17. Azure AD Connect 10.0.2.0/24 AWS Managed Microsoft AD DC RDP Synchronize Users to Azure AD Download Azure AD Connect MSI and install with Custom settings On the Connect Directories page choose Active Directory as the directory type, choose your Microsoft AD Forest as your Forest Enter your AWS Microsoft AD admin credentials
- 18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Demo – O365 Login
- 19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Successful enterprises that run Windows on AWS “Amazon Virtual Private Cloud (Amazon VPC) gives us a secure environment in the AWS Cloud with the flexibility and scalability we need to manage our SharePoint environment with zero impact to our on-premises datacenter” - Jeremy Fuchs, Vice President of Financial and BI Systems, Lionsgate “Using AWS, we decreased average network latency from 700 milliseconds to less than 50 milliseconds… Fundamentally, running in AWS enables a 230 percent CPU consumption efficiency in data processing.” - Murari Gopalan, Technology Director, Expedia.com “We didn’t have time to re- design applications. AWS could support our legacy 32-bit applications on Windows Server 2003, a variety of SQL Server and Oracle databases, and a robust Citrix environment.” - Jim McDonald, Lead Architect, Hess Corporation “Dole leverages Amazon VPC technology to turn AWS into a natural extension for our data center, running their our SharePoint deployment, corporate business intelligence and mobile applications. We chose AWS because of cost, efficiency, and to improve operational efficiency.” - Joanna Dyer, Director, IT Solutions, Dole Foods
- 20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Licensing LICENSE INCLUDED LICENSE MOBILITY LEGACY / OS
- 21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Licensing Continuum License Included • Amazon manages the licenses • Pay-as-you-go pricing • Multi-tenant or dedicated • No license management overhead • AWS provides images Hybrid • Baseline in BYOL • Leverage scalability and pay-as-you-go where applicable • Limit management overhead • Import and use some of your OS or software BYOL • Import and use your own OS/software • Reduce your spend if you already pay an ISV for licensing • You manage licensing costs and compliance with your ISV • Committed contracts with your ISVs
- 22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark EC2 Instances: Default and Dedicated Tenancy Default Tenancy Instances Dedicated Instances Dedicated Hosts Customer A Customer B Customer C Customer D Customer E Customer E Licensing options: § License-included Windows Server and SQL Server § License-included Windows Server with your License Mobility- entitled applications Licensing options: • License-included Windows Server and SQL Server • License-included Windows Server with your Microsoft applications— with or without Software Assurance • MSDN (including Windows Server) • BYOL—Windows client OS and Office Licensing options: • BYOL Windows Server—with or without Software Assurance • Maximize virtualization rights for Windows Server Datacenter and SQL Server Enterprise Edition Customer A Customer A + Bare Metal
- 23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Delaware North Moves Data Center to AWS to Save $3.5M Over Five Years • Construction of new headquarters building led company to reevaluate its IT platform • Evaluated several cloud vendors and chose AWS • Reducing its data center server footprint by 91% • Anticipates saving at least $3.5 million over five years with leaner IT • Improving security compliance, disaster recovery, and delivery of new services and solutions From a CIO’s perspective, I looked very closely at the reputation and value proposition that each cloud vendor brought to the table. AWS had a clear lead over the competition. Kevin Quinlivan, Chief Information Officer ” “ Delaware North is $3 billion leader in the food service and hospitality industry. It is based in Buffalo, New York.
- 24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark Thank you!
- 25. MODERN WORKPLACE CONFERENCE PARIS DU 16 AU 18 OCTOBRE 2018 #MWCP18