Enterprise Mobility Security The Microsoft vision Identity Driven

Enterprise Mobility + Security The Microsoft vision Identity Driven Security Users Devices Apps Data Managed Mobile Productivity Comprehensive Solution

Identity as the core of enterprise mobility Windows Server Active Directory Other directories Simple connection Self-service Single sign-on Azure Saa. S Public cloud On-premises Microsoft Azure Active Directory Cloud

• Microsoft “Identity Management as a Service (IDaa. S)” for organizations. • Millions of independent identity systems controlled by enterprise and government “tenants. ” • Information is owned and used by the controlling organization—not by Microsoft. • Evolved to manage an organization’s relationships with its customers/citizens and partners (B 2 C and B 2 B). 90% of Fortune 500 companies use Microsoft Cloud (Azure, O 365, CRM Online, and Power. BI) 33, 000 Enterprise Mobility + Security | Azure AD Premium enterprise customers Azure AD Directories >10 M >110 k third-party applications used with Azure AD each month More than 750 M user accounts on Azure AD >1. 3 billion authentications every day on Azure AD Every Office 365 and Microsoft Azure customer uses Azure Active Directory

Azure Active Directory. Identity at the core of your business 1000 s of apps, 1 identity Provide one persona to the workforce for SSO to 1000 s of cloud and on-premises apps Enable business without borders Stay productive with universal access to every app and collaboration capability Manage access at scale Cloud-powered protection Manage identities and access at scale in the cloud and on-premises Ensure user and admin accountability with better security and governance

• Cloud-connected seamless authentication experience to Saa. S apps • Single sign-on with 1, 000’s of third-party apps + your own apps • Automating user account creation and management

What is Single Sign-On?

63% Data breaches 63% of confirmed data breaches involve weak, default, or stolen passwords.

Single Sign On • Convenience: Don’t remember multiple username and passwords • Security: Password only stored in identity provider (Azure AD) • Management: Centrally manage authentication processes Jim. Bob@contoso. com

Single Sign-On Browse to app Redirect to AAD for sign in App Validates Token User signed into app Sign in occurs

Service Provider • Note: Id. P vs. SP support depends on the capabilities -initiated sign in of the app. Typically SPinitiated is most common. • Users sign in directly from the app’s web page Identity Provider -initiated sign in • Users can’t sign in directly from app site. User must use the Azure AD access panel, Office 365, or an Azure AD deep link to sign in

Identity Provider -Initiated Sign In Browse to Azure AD access panel Sign in occurs App Validates Token Click on app, Azure AD redirects with token User signed into app

https: //portal. office 365. com/myapps https: //myapps. microsoft. com/signin/Se rvice. Now/0919 fd 624056415183 f 77 cfd 3 fa de 8 e 3

Do I still need ADFS?

Cloud and Web Applications Azure Active Directory Federation Services

What if an app doesn’t support federated single sign-on?

What is User Account Provisioning?

User Profile Data • Username • Email address • First name • Last name • Role • Permissions

• No governance, difficult to disable account when users leaves the org • Requires overhead + attention when users transitions or leaves • Does not solve de-provisioning 80% Shadow IT More than 80 percent of employees admit to using non-approved software as a service (Saa. S) applications in their jobs.

Azure AD: Automatic Provisioning • Azure AD provisioning service connects to SOAP/REST user management API provided by app • Automatically add, update, and disable user accounts • Syncing groups also supported • Profiles/roles and assignments can be imported from the app into Azure AD

Azure AD: Automatic Provisioning (Outbound) Azure Active Directory Cloud Identity Sync Engine SOAP/REST User Mgmt. API Syncs every 10 minutes App’s Identity Store

Connecting apps for provisioning

Ok, I’m ready to deploy single sign-on for some apps…

First, check if the app is in the Azure AD gallery…

Pre-integrated Applications ISV/Developer Integrated • • App supports Azure AD natively One-click to setup Automatic certificate maintenance Can call into Microsoft Graph API to read directory data Microsoft Integrated • • • Leverage best SSO protocols and APIs supported by app Step-by-step configuration UI and documentation “Featured” apps support Azure AD automatic provisioning

Thousands of pre-integrated apps and growing!

Useful Links App Gallery on Azure. com https: //azure. microsoft. com/marketplace/active-directory/ Saa. S Application List (with integration capabilities) https: //aadappgallery. azurewebsites. net/M Saa. S Application Tutorials https: //azure. microsoft. com/documentation/articles/active-directory-saas-tutorial -list/ n

I didn’t find my app in the gallery…now what?

“Bring your own apps” • Apps not in gallery but generically support SAML 2. 0, WS-Fed, or password authentication • Added using the ”Custom” category in the app gallery (requires Azure AD Premium) • More info: https: //azure. microsoft. com/enus/documentation/articles/activedirectory-saas-custom-apps/ Developer integrations • Customers can connect apps they are developing using the Azure AD developer model • More info: https: //azure. microsoft. com/enus/documentation/articles/activedirectory-authentication-scenarios/ Request an app • Help the Azure AD team get the apps you want pre-integrated into the app gallery • Request apps here: http: //aka. ms/aadapprequest

Transportation, Logistics, Oil-Gas Construction, Professional Services Retail, Hospitality and Travel Education – Nonprofit Government, Banking, Insurance Health

Next Steps • Engage on Tech. Community (BRK 2067) https: //techcommunity. microsoft. com/ • Learn more about Azure AD Saa. S app integration https: //azure. microsoft. com/documentation/articles/active-directoryappssoaccess-whatis/ • Check out our app integration tutorials: https: //azure. microsoft. com/en-us/documentation/articles/active-directory -saas-tutorial-list/ • Tell us what app integrations you want to see next: http: //aka. ms/aadapprequest

Try Enterprise Mobility + Security for free, today: www. microsoft. com/en-us/cloud-platform/enterprise-mobility-trial Read the CIO’s guide to Azure Active Directory https: //info. microsoft. com/CIOs. Guide. To. Azure. AD. html? ls=Website Explore Identity + Access Management www. microsoft. com/identity Learn more from the Azure AD documentation library https: //docs. microsoft. com/en-us/active-directory/ Discover Password best practices https: //info. microsoft. com/Microsoft. Password. Guidance. html? ls=Website Check out the new Azure AD webinars https: //info. microsoft. com/AADP-Webinar-CLE_AADP-Main-Landing-Page. html? ls=Media Microsoft is a leader in Gartner's IDaa. S MQ 2016 https: //info. microsoft. com/EMS-IDaa. S-MQ-2016. html? ls=Website

BRK 2139 Protect your business and empower your users with cloud Identity and Access Management BRK 3107 Connect your on-premises directories to Azure AD and use one identity for all your apps BRK 3225 Secure access to Office 365, Saa. S, and on-premises apps and files with Azure AD and Intune : BRK 3109 Deliver management and security at scale to Office 365 with Azure Active Directory BRK 3111 Manage productivity at scale with Azure Active Directory BRK 2210 Learn how Unilever modernized IT with Azure Active Directory at the core BRK 3139 Throw away your DMZ – Azure Active Directory Application Proxy deep-dive BRK 3181 Secure your web applications with Microsoft identity BRK 3252 Use managed domain services on Microsoft Azure BRK 3182 Secure your native and mobile applications with Microsoft identity and application management BRK 3110 Respond to advanced threats before they start - identity protection at its best! BRK 3179 Modernize your app’s consumer identity management with Azure AD B 2 C BRK 2067 Manage access to Saa. S Applications With Azure Active Directory BRK 3074 Discover what’s new in Active Directory Federation and Domain Services in Windows Server 2016 BRK 3108 Share corporate resources with your partners using Azure AD B 2 B collaboration BRK 3330 Join your Windows 10 devices to Azure AD for anywhere, anytime productivity

www. microsoft. com/itprocareercenter www. microsoft. com/itprocloudessentials www. microsoft. com/mechanics https: //techcommunity. microsoft. com

http: //myignite. microsoft. com https: //aka. ms/ignite. mobileapp