Azure AD Refresh of new features and options released during Ignite and afterward. A look into new future features to enforce governance upon cloud applications and service principals

1. “Something about the Cloud”
- EWUG.DK - Level 200-300
Peter Selch Dahl - Cloud Architect and Microsoft Azure MVP

2. Microsoft MCSA: Cloud Platform - Certified 2018,
Microsoft MCSA: Office 365 - Certified 2018,
Microsoft MCSE: Cloud Platform and Infrastructure - Certified 2018
Microsoft MCSA: 2016 Windows Server 2016,
Microsoft MCSA: 2012 Windows Server 2012,
Microsoft MCITP: 2008 Server and Enterprise Administrator,
Microsoft MCSA: 2008 Windows Server 2008,
Microsoft MCSA/MCSE : 2003 Security,
Microsoft MCSA/MCSE : 2000 Security,
VMWare Certified Professional VI3/VI4/VI5,
CompTIA A+, Network+,
EC-Council: Certified Ethical Hacker (CEH v7),
And more
Peter Selch Dahl
Cloud Architect, Azure MVP
Twitter: @PeterSelchDahl
www: www.peterdahl.net
Blog : http://blog.peterdahl.net
Mail : psd@apento.com

3. • Enterprise Admin Consent Request Management
• Service Principals permissions and monitoring
• Microsoft Graph scope policies
• Staged rollout of CloudAuth
• Azure AD Connect Cloud Provisioning
• Azure AD Join support in Azure VM
• And more 

4. Consent of principals
JANUARY 14, 2020
@EWUGDK
4
http://blog.peterdahl.net/2018/05/14/azure-ad-v2-apps-vs-the-brick-wall/

5. Consent of principals
JANUARY 14, 2020
@EWUGDK
5
•Application permissions — are permissions given to
the application itself. In this scenario, the resource given
access to does not have any knowledge of the
permissions of the end user. In earlier literature from
Microsoft patterns and practices, this model is also
referred to as the “trusted subsystem” model where the
idea is that the API resource trust the caller system to do
the proper authorization of end users. For example, for
web applications this has “always” been the model used
for calling an SQL server.
•Delegated permissions — are permissions that the
end-user delegates to the application for access to the
user’s data/resources. For instance, the application can
be given access to the end user’s mailbox. This is
analogue to what in earlier literature is referred to as
“impersonation”, meaning that the
application impersonates the end user when calling the
API resource. The application acts on behalf of the end
user, for instance a third party application might post on
your Twitter timeline.

6. Consent of principals
JANUARY 14, 2020
@EWUGDK
6
https://portal.cloudappsecurity.com/#/app-permissions/
Delegated Access
Will soon be available within the Azure Portal as well.

7. Public Preview: Admin consent workflow
JANUARY 14, 2020
@EWUGDK
7
• Users can request access when user consent
is disabled
• Users can request access when apps request
permissions that require admin consent
• Gives admins a secure way to receive and
process access requests
• Users are notified of admin action
https://aka.ms/adminconsentworkflow/

8. https://azure.microsoft.com/da-dk/blog/managing-azure-secrets-on-github-repositories/

9. Conditions
Allow access or
Block access
Actions
Enforce MFA per
user/per app
User, Group, App sensitivity
Device state
LocationUser
NOTIFICATIONS, ANALYSIS, REMEDIATION,
RISK-BASED POLICIES
CLOUD APP DISCOVERY PRIVILEGED IDENTITY MANAGEMENT
MFA
IDENTITY
PROTECTION
Risk
CLOUD-POWERED PROTECTION

10. Service principals consent - Refresh
JANUARY 14, 2020
@EWUGDK
10
Application Access

11. Service principals consent - Refresh
JANUARY 14, 2020
@EWUGDK
11
Application Access
Philippe Signoret – PM, Azure AD: https://gist.github.com/psignoret/9d73b00b377002456b24fcb808265c23

12. Service principals monitoring - Refresh
JANUARY 14, 2020
@EWUGDK
12
https://feedback.azure.com/forums/223579-azure-portal/suggestions/33867259-azure-ad-sign-in-activity-log-should-record-and-sh

13. JANUARY 14, 2020
@EWUGDK
13
Microsoft Graph scope policies

14. Microsoft Graph scope policies
JANUARY 14, 2020
@EWUGDK
14

15. Conditional access for MS Graph
JANUARY 14, 2020
@EWUGDK
15
Issue:
Gitlab doesnt play well with Azure AD Conditional Access compliant device policy
Cause:
“Conditional access policy was applied because the GitLab app calls Windows Azure Active
Directory and a policy has been applied to this resource. The policy requires a compliant
device.”
Conditional access policy was applied because the GitLab app calls Windows Azure Active
Directory and a policy has been applied to this resource. The policy requires a compliant
device.
A policy with a location condition was evaluated:
- InsideCorpnet claim was not set
- IP allowed due to tenant strong auth policy: False
Policy Name: All Apps: Require Domain Joined device (Specific Groups, Apps
Exempted/Excluded)
Policy Id: 10c9a77e-d561-4cdf-ab7e-75681f957dbf
Application Name: GitLab
Application Id: ddf3c150-4813-4e90-b73b-72ba13224c0a
Action: RequireCompliantDevice
Solution:
Since the Conditional Access Policy is configured to apply to all applications, will apply
to Windows Azure Active Directory blocking the access.
Unfortunately, Windows Azure Active Directory is not an app that we can select at the moment
to be excluded. For a possible solution, you can change the Conditional Access Policy to target
only the required applications instead of all applications, exclude the user or change the access
controls to require for example MFA

16. Conditional access for MS Graph
JANUARY 14, 2020
@EWUGDK
16
Current behavior
• Policy applied to MS Graph if it is set on EXO or SPO
Future
• Apply policy directly to permissions
• Example use case : An org can apply policy to mail access
without restricting access to contacts, tasks etc…

18. JANUARY 14, 2020
@EWUGDK
18
Azure: Windows 10 / server 2019 Azure AD join

19. Azure: Windows 10 / server 2019 Azure AD join
JANUARY 14, 2020
@EWUGDK
19
https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-authentication-to-windows-vms-in-
azure-now-in-public/ba-p/827840
 https://feedback.azure.com/forums/169401-azure-
active-directory/suggestions/32995456-support-azure-
ad-domain-join-for-windows-server-20
 https://windowsserver.uservoice.com/forums/295047-
general-feedback/suggestions/32995450-support-
azure-ad-domain-join-for-windows-server-20

20. Cloud Drivers

21. Cloud Drivers

22. JANUARY 14, 2020
@EWUGDK
22
AzureAD: Cloud Provisioning

23. AzureAD: Cloud Provisioning
JANUARY 14, 2020
@EWUGDK
23
• Disconnected Active Directory forests
provisioned to a single Azure AD tenant
• Sync complexity and data transform logic
moved to the cloud
• No heavyweight, on-premises sync server
Azure AD
Active Directory
Disconnected
Active Directory
forests

24. JANUARY 14, 2020
@EWUGDK
24
AzureAD: Staged rollout of CloudAuth

25. Staged rollout of cloud authentication
JANUARY 14, 2020
@EWUGDK
25
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-staged-rollout
• Configure groups of users
to use cloud authentication
instead of federation

26. Do I really need ADFS?
JANUARY 14, 2020
@EWUGDK
26
• 99% of companies doesn’t need ADFS anymore! What about the 1% of companies?
• The 1% is REALLY difficult! Very advanced technical scenarios require ADFS mostly for better
hybrid support.
• https://docs.microsoft.com/en-us/archive/blogs/pie/do-i-really-need-adfs
• https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-
business/hello-feature-remote-desktop

27. T: +45 82 32 32 32
F: +45 82 32 32 22
M: info@proactive.dk
W: www.proactive.dk

28. A shift in IT focus…..