README.md

Design for identity and security (20-25%)

AZURE ACTIVE DIRECTORY DEVELOPER SUPPORT TEAM

Design identity management

• choose an identity management approach

  • Identity and access management

  • Azure Identity Management and access control security best practices

  • Deep Dive: The Four Pillars of Identity - Identity Management in the Age of Hybrid IT

    • 

• design an identity delegation strategy

  • Service-to-service calls that use delegated user identity in the On-Behalf-Of flow

  • UNDERSTANDING AZURE AD’S ON-BEHALF-OF FLOW (AKA OBO FLOW)

• design an identity repository

  • TODO: All Link

• design self-service identity management

  • requires premium Azure Active Directory account

  • Azure Active Directory -> Password Reset

  • Quickstart: Configure Azure Active Directory self-service password reset

• design user and persona provisioning

  • Automatic user provisioning to AD

• define personas

  • TODO: All Link

• define roles

  • Built-in roles for Azure resources

  • Custom roles for Azure resources

• recommend appropriate access control strategy

Design authentication

• choose an authentication approach

  • What are authentication methods?

Authentication Method	Usage
Password	MFA and SSPR
Security questions	SSPR Only
Email address	SSPR Only
Microsoft Authenticator app	MFA and SSPR
OATH Hardware token	Public preview for MFA and SSPR
SMS	MFA and SSPR
Voice call	MFA and SSPR
App passwords	MFA only in certain cases

• design a single-sign on approach

  • Single sign-on to applications in Azure Active Directory

  • Azure Active Directory Seamless Single Sign-On

• design for IPSec authentication

  • IPSec = Internet Protocol Security

• design for logon authentication

• design for multi-factor authentication

  • How it works: Azure Multi-Factor Authentication

  • Configure Azure Multi-Factor Authentication settings

• design for network access authentication

  • SECURE YOUR NETWORK ACCESS WITH AZURE MULTI-FACTOR AUTHENTICATION

• design for remote authentication

Design authorization

• choose an authorization approach

  • Use RBAC, define user groups and assigns users to user groups to manage access to resources

  • Take adventage of built in Azure roles

    • ReadOnly
    • Contributor
    • Owner

• define access permissions and privileges

  • Access persmissions can be defined for users directly or via user groups or also to applications

• design secure delegated access

  • Delegate administration in Azure Active Directory

• recommend when and how to use API Keys

  • Use API Keys to carry claims and ohter authorozation info between APIs, for this leverage Azure API Management

Design for risk prevention for identity

• design a risk assessment strategy

  • Azure Active Directory risk detections

  • Take adventage of Users flagged for risk report and Risky sign-ins report to be aware and asses risk to identity integrity

• evaluate agreements involving services or products from vendors and contractors

• update solution design to address and mitigate changes to existing security policies, standards, guidelines and procedures

Design a monitoring strategy for identity and security

• design for alert notifications

  • Use predefined, but configurable Azure AD Privileged Identity Management alerting notifications to check fules of accessing important resources

• design an alert and metrics strategy

  • Secure access into applications using identity by synchronize your on prem AD with Azure AD Connect

  • Use Azure AD Connect Health to monitor identity synchronization between Azure AD and on-premises identity

  • Enable integration with Azure Log Analytics to monitor identity related logs in detail

• recommend authentication monitors

  • Use Azure Identity Protection to detect and remediate identity based risks

  • Configure and get notifications from Azure Identity Protection