Protecting cloud identities using EMS and Azure MFA. Event: Azure Saturday 2017, Copenhagen - Introduction to EMS - Office 365 Secure Score - Azure AD Privileged Identity Management - Azure AD Identity Protection - Azure AD Multi-factor Authentication - Conditional Access

1. Protecting Cloud Identities
- Using Enterprise Mobility + Security (EMS) and Azure MFA
RONNI PEDERSEN
MICROSOFT MVP: ENTERPRISE MOBILITY
1© RONNIPEDERSEN.COM

2. Ronni Pedersen
Freelance Cloud Architect
Microsoft MVP: Enterprise Mobility (10 years)
Founder: System Center User Group Denmark
Microsoft Certified Trainer
Microsoft TechNet Moderator
Contact Me
Twitter: @ronnipedersen
Blog: https://www.ronnipedersen.com/
Mail: mail@ronnipedersen.com
Phone: +45 2085 9452About me...

3. Key Takeways
EMS Overview
Office 365 / Risk Score
Privileged Identity Management
Identity Protection
Multi-factor authentication
Conditional Access
3© RONNIPEDERSEN.COM

4. Enterprise Mobility + Security
Overview

5. The world has changed…
5© RONNIPEDERSEN.COM

6. Office 365 Secure Score
State of the Union…

7. Office 365 Secure Score
Get your Secure Score
Analyzing Your Score
Take Action (Improve Your Score)
7© RONNIPEDERSEN.COM

8. Office 365 Secure Score:
- Mailbox Auditing in Office 365
Step 1: Connect to Exchange Online
Step 2: Get the current state of audit logging
Step 3: Enable mailbox audit logging
Step 4: Set the age limit for mailbox audit logging
Step 5: Automate the process using Azure Automation
https://www.ronnipedersen.com/2017/07/29/automate-mailbox-auditing-office-365/
8© RONNIPEDERSEN.COM

9. Azure AD Privileged Identity Management
Manage, control, and monitor access within your organization

10. Azure AD Privileged Identity
Management
10© RONNIPEDERSEN.COM

11. Azure AD Privileged Identity
Management
Manage, control, and monitor access within your organization
Includes resources in Azure AD, Office 365 or Microsoft Intune
Goal: minimize the number of people who have access to
secure information or resources
Enable on-demand, "just in time" administrative access to
Microsoft Online Services like Office 365 and Intune
Privileged identity management requires:
Azure AD Premium P2
Enterprise Mobility + Security (EMS) E5
11© RONNIPEDERSEN.COM

12. Azure AD Identity Protection
Protect and monitor identities…
Proactively prevent compromised identities from being abused!

13. Low
User sign-in from infected Device
Medium
User sign-in from unfamiliar locations
Impossible travel to atypical location
Sign-in from anonymous IP addresses
High
User with leaked credentials (up for sales)
Risky Sign-in
13© RONNIPEDERSEN.COM

14. 14© RONNIPEDERSEN.COM

15. Multi-factor authentication

16. Modern Authentication
Modern Authentication is the key to success when activating MFA !!!
Turned off for Exchange Online by default.
Turned on for SharePoint Online by default.
Turned off for Skype for Business Online by default.
OFF = App Password (Bad End User Experience)
Enable modern authentication for Skype for Business Online
 https://www.ronnipedersen.com/2017/07/11/enable-modern-authentication-for-skype-
for-business-online/
16© RONNIPEDERSEN.COM

17. Modern Authentication
- Exchange Online
Enables authentication features like
 Multi-factor authentication (MFA) using smart cards
 Certificate-based authentication (CBA)
 Third-party SAML identity providers
Modern authentication is based on the ADAL and OAuth 2.0
Set-OrganizationConfig -OAuth2ClientProfileEnabled $true
17© RONNIPEDERSEN.COM

18. Basic vs. Modern Authentication
18© RONNIPEDERSEN.COM

19. Azure Automation (Runbook)
- Enable Azure MFA
Runbook Overview
Connect to the Tenant
Set Custom MFA Settings
Get all users with a license
Enable MFA for the user
Schedule Recommendation:
 Every day
Look out for new blog post!
19© RONNIPEDERSEN.COM

20. Conditional Access

21. “Limited Access”
- SharePoint and OneDrive
Enabling productivity while securing data
 Secure, Productive Enterprise
Allow access to SharePoint and OneDrive
 Unmanaged Device
 Browser-Only Access
 Download, Print, and Sync Disabled
Announcement:
 https://blogs.technet.microsoft.com/enterprisemobility/2017/03/0
9/conditional-access-limited-access-policies-for-sharepoint-are-
in-public-preview/
21© RONNIPEDERSEN.COM

22. Device Registration / Compliant
DJ++
 Hybrid Identity (Domain Joined + Device Registered in Azure AD)
Azure AD Joined
 Cloud Only (Azure AD Joined)
Workplace Joined
 ”Workgroup” (No Domain or Azure AD Joined)
22© RONNIPEDERSEN.COM

23. Azure AD Joined (Example)
Command: dsregcmd /status
My Work PC: 6cec6a69-ea4d-4618-b903-98acc2e6d446
23© RONNIPEDERSEN.COM

24. Device Trust Type
24© RONNIPEDERSEN.COM

25. 25© RONNIPEDERSEN.COM

26. Thank you!
26© RONNIPEDERSEN.COM