The document discusses Microsoft's Identity and Access Management solutions. It describes challenges with current systems that require time-intensive password resets and separate identities. The solutions aim to securely manage access from any device while simplifying administration through features like self-service access management, single sign-on, automated user provisioning and deprovisioning, and identity lifecycle management.

1. Identity and Access Management Business Ready Security Solutions Rune Lystad runel@microsoft.com Enterprise Solution Manager

2. Multiple identities and limited sign-on help Password reset and access requests handled through help desk Different sign–on requirements for applications ON-PREMISES CONTOSO Contoso managing Fabrikam accounts Separate Remote access solution w/ separate identities EMPLOYEES (REMOTE) PARTNERS Fabrikam Fabrikam managing Contoso accounts Current SituationTime and labor intensive process

4. Enable access from virtually any device

5. Extend powerful self-service capabilities to users

6. Automate and simplify management tasks

7. Control access across organizations

8. Provide standards-based interoperabilityIdentity and Access Management Strategy

9. Business Ready Security Solutions Secure Messaging Secure Endpoint Secure Collaboration Information Protection Identity and Access Management

10. Secure Messaging Secure Endpoint Secure Collaboration Information Protection Identity and Access Management Active Directory®Federation Services Business Ready Security Solutions

11. PROTECT Everywhere, ACCESS Anywhere

13. Eliminates the need to connect explicitly to corporate network while remote

14. Facilitates more secure, end-to-end communication and collaboration

15. Uses a policy-based network access approach

16. Enables IT to easily service, secure, update, and provision mobile machines, whether they are inside or outside the networkIntranet Internet Corporate Resources DirectAccess Client DirectAccess Server Internal traffic Internet Servers Internet traffic Windows DirectAccess

17. DirectAccess in Windows 7 IPv4 Devices IPv6 Devices IT desktop management Native IPv6 with IPSec AD Group Policy, NAP, software updates IPv6 Transition Services Internet WinSrv 2008R2 DirectAccess Role Supports variety of remote network protocols Windows 7 Client

18. INTEGRATE and EXTEND security

20. Boost cross-organizational efficiency and communication with more secure access

21. Support the sharing of rights-protected messages between organizationsFirma A Account Forest Firma BResource Forest Federation Trust Business Partners Token and claims Authentication Application Access Post claims AD FS AD FS AD RMS AD DS AD DS Redirect to Security Token Service (STS) SharePoint Server Farm User Account/Credentials Security Token Active Directory Federation Services

24. Signs it with company’s private key

25. Sends it back to the user

26. Access supplied with the tokenPartner Single Sign On with Extended Collaboration

27. SIMPLIFY security, MANAGE compliance

29. Password Reset

30. New EntitlementsRetire Policy Management De-provision identities Revoke credentials De-provision resources Policy enforcement Approvals and notifications Audit trails Change Role changes Phone # or titlechange Password and PIN reset Resource requests

31. Forefront Identity Manager in Action Databases Self-Service integration LOB Applications WindowsLog On FIM Portal Policy Management Credential Management User Management Group Management Custom ISV PartnerSolutions IT Departments Directories

33. Built-in workflow for identity management

34. Automatically synchronize all user information to different directories across the enterprise

35. Automates the process of on-boarding usersActiveDirectory LotusDomino Workflow User Enrollment LDAP FIM SQLServer HR System Approval Oracle DB Manager FIM CM User provisioned on all allowed systems Identity ManagementUser provisioning

37. Built-in workflow for identity management

38. Real-time de-provisioning from all systems to prevent unauthorized access and information leakageIdentity ManagementUser de-provisioning ActiveDirectory LotusDomino Workflow User de-provisioned LDAP FIM SQLServer HR System Oracle DB FIM CM User de-provisioned or disabled on all systems

40. Office integration allows users to manage group membership from within Microsoft Office Outlook® for maximum productivity

41. Enables users to use Outlook to manage approvals while they are offline

42. Automatically add users to either group based on their employee type at the time they are provisioned to Active Directory

43. Group and distribution list management, including dynamic membership calculation in these groups and distribution lists based on user’s attributesAdd-in for Office SharePoint-Based Management Console

45. Controls helpdesk costs by enabling end users to manage certain parts of their own identities

48. Enable access from virtually any device

49. Extend powerful self-service capabilities to users

50. Automate and simplify management tasks

51. Control access across organizations

52. Provide standards-based interoperabilityLearn more at www.microsoft.com/forefront Summary

53. © 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.