Azure AD Certification Based Authentication (CBA) Public Preview

Azure AD Certification Based Authentication (CBA) is now in Public Preview.  This is really exciting because this will allow customers to meet their PIV/CAC card multi-factor auth requirements without having to maintain ADFS servers for federated authentication.

Reference: https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-certificate-based-authentication-now-in-public-preview/ba-p/2464390

AAD Cross-Tenant Access Public Preview

The AAD team has put in a new public preview for cross-tenant access settings for external collaboration.  With this new feature, you have the ability to trust security claims from external AAD organizations.  A good example is, if an external user from a partner organization has already completed a MFA claim in their tenant, your tenant will trust that claim and allow the user to have access to approved resources in your tenant without requiring the external user to perform an additional MFA check within your tenant.  

Reference: https://techcommunity.microsoft.com/t5/azure-active-directory-identity/collaborate-more-securely-with-new-cross-tenant-access-settings/ba-p/2147077

Important Office 365 Security Recommendations

To mitigate threats consistent with the recent security incidents, here are some really good recommendations organizations should consider with regards to Office 365.  Go here - Protecting Microsoft 365 from on-premises attacks - Microsoft Tech Community

There are strongly recommended configurations that customers should be doing moving forward.

Office 365 Access vs Refresh Tokens

I had to provide a short write-up to some folks to help them with the understanding of how Office 365 and Sessions Tokens worked.  Hope this helps.

Access Token Definition

Clients use access tokens to access a protected resource. An access token can be used only for a specific combination of user, client, and resource. Access tokens cannot be revoked and are valid until their expiry. A malicious actor that has obtained an access token can use it for extent of its lifetime. Adjusting the lifetime of an access token is a trade-off between improving system performance and increasing the amount of time that the client retains access after the user’s account is disabled. Improved system performance is achieved by reducing the number of times a client needs to acquire a fresh access token. The default is 1 hour - after 1 hour, the client must use the refresh token to (usually silently) acquire a new refresh token and access token.

Refresh Token Definition

When a client acquires an access token to access a protected resource, the client also receives a refresh token. The refresh token is used to obtain new access/refresh token pairs when the current access token expires. A refresh token is bound to a combination of user and client. A refresh token can be revoked at any time, and the token's validity is checked every time the token is used. Refresh tokens are reissued every time they are  used to fetch new access tokens.

Access Tokens

• Purpose: Give users access to resources (i.e. Exchange Online, SharePoint Online, Teams).
• Duration: Expire after 1 hour.
• Customer Revoke: Access Tokens cannot be revoked once it has been created.

Refresh Tokens

• Purpose: Alleviate the end user from having to continually input in their credentials and have no context to resources the user is accessing.
• Duration: Expire after 90 days.
• Customer Revoke: Refresh Tokens can be revoked at any time.

Commonality

• Requesting New Token: Whenever a new Access Token is requested, a new Refresh token is also provided to the requesting client (re-starting the 90 day count).
• Evaluation of Conditions: Every time a client presents a Refresh Token to AAD to obtain a new Access Token to resources, AAD Conditional Access will revaluate all conditions defined for the tenant and then provide the client new Refresh and Access Tokens to the client.

Office 365 Identity Posters

I have been getting tons of questions on Office 365 identity.  I definitely recommend people refresh themselves using these new posters.


https://techcommunity.microsoft.com/t5/Microsoft-365-Blog/Get-the-new-Identity-infrastructure-for-Microsoft-365-Enterprise/ba-p/874941

https://docs.microsoft.com/en-us/office365/enterprise/microsoft-cloud-it-architecture-resources#identity

https://docs.microsoft.com/en-us/office365/enterprise/microsoft-cloud-it-architecture-resources#BKMK_O365IDP

Terms of Use with Office 365

There is a new capability in AAD that is available Terms of Use which a lot of Office 365 customers may want to utilize.

An organization will want users to accept a Terms of Use agreement to access their environment.  The Terms of Use solution can:

• Required all users accept a terms of use agreement to access Office 365 services.
• There is a new feature that can be used for B2B scenarios for such services SharePoint Online and Microsoft Teams.  If you invite in an external user that is on AAD, that external user will be required to agree to a Terms of Use.

This is awesome because I find tons of customers who want this type of capability.  Here are some other features that are part of this.

• Can require users sign it once or every time they access.
• Can associate a Terms of Use document that is organization specific for users to review.
• Require users to expand and scroll through entire terms of use before accepting.
• Can expire the Terms of Use agreement after a specific amount of days or associated a frequency for when they must accept the Terms of use.
• Can enforce Conditional Access policies against the Terms of Use policy.
• Access to reports of who accepted and declined a Terms of Use.
• Works for browsers and mobile device scenarios.

Here are some detailed articles about this capability.

https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Updates-to-Azure-AD-Terms-of-Use-functionality-within/ba-p/294822

https://docs.microsoft.com/en-us/azure/active-directory/governance/active-directory-tou

Office 365 and Azure EMS Overlap

I decided to create a simple cheat sheet for folks to help you understand how Office 365 suites such as E3 and E5 relate to Azure Enterprise Security + Mobile Suite (EMS).  There is a lot of cross-over and relationship between these capabilities.

I will assume in this discussion we are an Office 365 customer trying to understand how does EMS overlap and extend Office 365.

EMS Suites

First, we must first understand what is in the EMS Suites.  There are two EMS Suites E3 and E5.  Here is an overview site - https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security-pricing

EMS E3 is made up of:

• Azure Active Directory Premium P1 - Designed to empower organizations with more demanding identity and access management needs, Azure Active Directory Premium edition provides feature-rich enterprise-level identity management capabilities and enables hybrid users to seamlessly access on-premises and cloud capabilities. This edition includes solutions for the information worker and identity administrators in hybrid environments across application access, self-service identity and access management (IAM), and security in the cloud.  Solutions available are: Secure single sign-on to cloud and on-premises apps, Multi-factor authentication, Conditional access and Advanced security reporting.
• Azure Information Protection Premium P1 - Control and help secure email, documents, and sensitive data that are shared outside the customer walls with Azure Information Protection Premium (formerly known as Active Directory Rights Management Service (AD RMS)). From easy classification to embedded labels and permissions, enhance data protection at all times with Azure Information Protection—no matter where it’s stored or who it’s shared with.  Solution provides encryption for all files and storage locations and cloud-based file tracking.
• Microsoft Intune - Microsoft Intune provides mobile device management, mobile application management, and PC management capabilities from the cloud. Using Intune, customer can provide personnel access to corporate applications, data, and resources from virtually anywhere on almost any device, while helping to keep customer information secure.  With the increasing volume and diversity of both ‘bring your own device’ (BYOD) and corporate-owned devices being used in organizations today, a growing challenge for IT departments is keeping corporate information secure. Microsoft mobile application management (MAM) and mobile device management (MDM) solutions help minimize this complexity by offering management capabilities both on-premises and in the cloud, all from a single console.  Solution provides mobile device and app management to protect corporate apps and data on any device.
• Microsoft Advanced Threat Analytics (ATA) - Microsoft Advanced Threat Analytics (ATA) protect customer from advanced, persistent cyber threats.  From detecting known malicious attacks to uncovering abnormal activity with machine learning and behavioral analytics, identify advanced persistent threats to customer quickly and act swiftly with Microsoft Advanced Threat Analytics.  Solution provides protection from advanced targeted attacks by applying user and entity behavior analytics.

EMS E5 is made up of:

• Azure Active Directory Premium P2 - Builds off Azure Active Directory Premium P1, enhanced with advanced identity protection and privileged identity management capabilities.  Solution includes risk-based conditional access and privileged identity management.
• Azure Information Protection Premium P2 - Builds off Azure Information Protection Premium P1 providing intelligent classification policies to classify and label data at time of creation or modification based on source, context, and content. Classification with Azure Information Protection is fully automatic, driven by users or based on recommendation.  Additionally, this services provides Hold Your Own Key (HYOK) that spans Azure RMS and Active Directory RMS for highly regulated scenarios.
• Microsoft Cloud App Security - Microsoft Cloud App Security provides enterprise-grade security for customer cloud applications.  Whether or not you're in the cloud, customer personnel are. Bring the security of on-premises systems to cloud applications—both approved and unapproved—for deeper visibility, comprehensive controls, and enhanced protection against cloud security issues.  Solution provides enterprise-grade visibility, control, and protection for cloud applications.

How does this compare with Office 365 solutions?
There is overlap with Office 365 solutions.  There are tons of good reference articles that show you exactly where deltas are.

Azure AD Overlap
As you know when you have an Office 365 instance, Azure AD is used underneath the hood.

Azure AD Comparison Table - https://www.microsoft.com/en-us/cloud-platform/azure-active-directory-features.  This table shows you the difference Office 365 and the features and capabilities you get with Azure AD Premium Plans 1 and 2.

Azure Information Protection / Rights Management Overlap
If you are an Office 365 E3 customer, you may know you get some Office 365 Rights Management.  However Azure Information Protection Plans 1 and 2 provided extended capabilities.

Information Rights Management Comparison Table - https://www.microsoft.com/en-us/cloud-platform/azure-information-protection-features - Shows you exactly what you get between the different plans.

Office 365 MDM / Microsoft Intune Overlap
Office 365 natively provides some MDM capabilities.  EMS Intune is the enterprise capability for MDM.  Office 365 MDM is just providing a subset of Intune for Office 365 only.

Office 365 MDM and Microsoft Intune comparison table is located here - https://support.office.com/en-us/article/Choose-between-MDM-for-Office-365-and-Microsoft-Intune-c93d9ab9-efb2-4349-9b93-30c30562ee22.

Microsoft ATA and Office 365 Advanced Security Management Overlap
Office 365 Advanced Security Management (ASM) is part of the Office 365 E5 Suite.  Microsoft ATA is part of the Azure EMS E3 Suite.

Unfortunately, there is not a good comparison table like with the other service offerings previously discussed, yet there are some good references.  Just like previously discussed, Office 365 ASM is providing a subset of Microsoft ATA but Office 365 ASM is a subset of capability for Office 365 only.

Office 365 ASM - https://support.office.com/en-us/article/Get-started-with-Advanced-Security-Management-d9ee4d67-f2b3-42b4-9c9e-c4529904990a?ui=en-US&rs=en-US&ad=US – This is a good reference article that describes the types of alerts that you can sign-up for, monitor cloud app usage and set-up SIEM integration for logging.

Azure Threat Analytics (ATA) is a broader approach that extends to on-premises.  Here is the top-level article on it - https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata.

Parnter Sharing with Office 365 and Azure AD B2B

Background
With Office 365 and SharePoint Online, a common question is how can I external sharing with Partners. 

In SharePoint Online, the concept of External Sharing has been around for a while.  You have the ability to identify users you want to share with and administrative capabilities to manage external users.

One challenge people have is doing B2B sharing with SharePoint Online.  SharePoint Online external sharing does have PowerShell, so you can do some automation external sharing, however sometimes you just need a better approach.

Azure AD B2B Collaboration
Another approach to do external sharing with partner organizations is with a feature called Azure AD B2B.

With this capability you can:

• Organizations no longer have to managed a separate directory for external users nor have to go through the complexity of setting up federated auth on a per partner basis.
• Allows partner/external users to use their own credentials to access data you are sharing getting you out of the password management business.
• Removes partner/external user access with the user leaves their organization.  If the partner organization is turning off the accounts when the person leaves, you are assured their access to your data and applications is also being removed.
• Capability allows you to perform bulk invites of partner organizations.
• Partner users are invited and confirmed through an email notification process.
• If the partner organizations do not have Azure AD, no problem.  The partner users will complete the invitation process and have a free Azure AD account created for them that they will use to access shared data and applications.
• Set-up external sharing with partner organizations that goes beyond just Office 365 and SharePoint Online.

References
Azure B2B Collaboration - https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2b-collaboration-overview/

Azure B2B Video - https://channel9.msdn.com/Series/Azure-AD-Identity/AzureADB2B

Learn all about the Azure AD B2B Collaboration Preview - https://blogs.technet.microsoft.com/enterprisemobility/2015/09/15/learn-all-about-the-azure-ad-b2b-collaboration-preview/

Manage external sharing for your SharePoint Online environment - https://support.office.com/en-us/article/Manage-external-sharing-for-your-SharePoint-Online-environment-C8A462EB-0723-4B0B-8D0A-70FEAFE4BE85