We live in a rapidly evolving security landscape π π‘ with new challenges every day. Even after the pandemic, our work continues to be blended with remote work where many organizations enabled the BYOD policies to increase productivity of the people.
Growing landscape of cybersecurity attacks
Relaxed controls on IT assets, welcomed potential vulnerabilities, and attack surfaces are also expanded adding layers of complexity to corporate IT to perform their task to defend and enable organizational services.
Zero Trust model aligned services
Zero Trust model offered by leading industry players likeΒ MicrosoftΒ offers comprehensive solutions to our security challenges. Let’s consider those services and their benefits that are listed below:
β Security Posture Management It is enhanced with Azure Policy and Azure Blueprints by defining and enforcing compliance and control guardrails on Azure resources
β Identities Are strengthened using Entra ID (aka, Azure AD) providing robust authentication and authorization.
β Endpoint Management Services like Microsoft Intune and Entra ID Join manage the corporate and BYOD devices with strict compliance
β Web App protection Azure Defender for Cloud & Azure Web Application Firewall (WAF) protects app services by using bleeding-edge security features
β Data security Remains top priority in transit and rest with advanced security features of Azure Storage services by providing encrypted, reliable, and scalable solutions
β Infrastructure security Secrets and certificates are protected with Azure Key Vault services and Microsoft Defender for Cloud offers comprehensive threat protection from day zero
β Network Security Azure network services like Azure Firewall and Virtual Networks are ensuring traffic is secure and segmented
β Conditional Access & Controls App and data access is guarded by Microsoft Defender for Cloud Apps and Conditional Access services by enforcing specific access controls and providing visibility of your SaaS app landscape to help protect your apps.
β Modern SIEM and SOAR solution The Azure Sentinel stands as a cloud-native solution that combines capabilities by centralizing threat detection and response.
In Summary
In summary, Microsoft Azure provides tools and services that are specifically designed to address growing concerns of vulnerabilities that your IT and Security team are tasked to deal with by following Zero Trust principles.
[π Credit] Microsoft Zero Trust & Conditional Access docs
Subscribe to the #cloudmarathoner LinkedIn #tag ππ Stay tuned for more Cloud, Automation & Security-related posts.
π Check out the LinkedIn post π https://www.linkedin.com/posts/elkhanyusubov_cloudmarathoner-tag-cloudmarathoner-activity-7106249128782749696-4k0j #sharingiscaringΒ β€οΈ
The following post is going to be covered in the Azure Spring Clean 2022 event’s website too. Thus, you might be wondering what the Azure Spring Clean is?
Azure Spring Clean 2022 Overview
The Azure Spring Clean is a community-driven event focused on Azure management topics and gradually publishes content from March 14-18, 2022.
I would like sincerely Thank – Joe Carlyle and Thomas Thornton for putting time and effort in organizing this event. From a #cloudmarathoner βs perspective itβs been enjoyable to contribute and be a part of this event. This topic specifically outlines how to understand the pros and cons of your initial Azure AD settings that will be aligned with your project’s expectations.
Indeed, this is a very legit question and I would like to address it with the following quote from Alex Weinert:
…our telemetry tells us that more than 99.9% of organization account compromise could be stopped by simply using MFA, and that disabling legacy authentication correlates to a 67% reduction in compromise risk (and completely stops password spray attacks, 100% of which come in via legacy authentication)…
Alex Weinert – Director of Identity Security at Microsoft
The main purpose behind these default settings is to make sure that all organizations using Azure AD have a basic level of security, and it is enabled at no extra cost according to Microsoft.
Azure AD security defaults are something you need to enable at the tenant level. Once you do this, the rules will apply to all users in your tenant without any exceptions.
If you are looking for enforce rules more selectively ( or exclude some users ) then security defaults wonβt be a fit solution for you. For this scenario, you would need to look at getting some P1 or P2 licenses and use the conditional access instead.
How can I set up my Azure AD Security Defaults?
The Microsoft Azure AD team did a fantastic job by simplifying this option. You need to navigate int0 Azure AD -> Properties -> and click on link Manage Security defaults.
You will end-up with the following window on the right panel of Azure portal:
Enabling Security Defaults in Azure AD
What is baked inside the security defaults in azure ad?
There are a number of things baked into the “Security Defaults” by Azure AD team. You could read about an official and detailed description here – Security defaults in Azure AD.
One of the BIG incentives for the security defaults is that it brings Multi-Factor Authentication (MFA) to your users for #free. Of course, there are some limitations around this which I will cover later on, but this option does allow you to get an MFA with no additional cost.
Previously, you would have to have either Azure AD P1 licenses, or pay per use for MFA functionality. Thus, this is a big game changer benefit that you are getting for free in your tenant and will bring a significant extra level of security. And this defaults includes both Azure and Office 365 services.
Along with MFA, security defaults are enforcing several policies that make your tenant more secure:
Requiring all users to sign up for MFA (for free)
Requiring those in Azure administrator roles to perform MFA
Blocking legacy authentication protocols – this includes clients that donβt use modern authentication and so donβt support MFA, and older mail protocols like IMAP, SMTP and POP3
Requiring MFA authentication when undertaking privileged actions using the Azure portal, PowerShell or CLI
Will Security Defaults replace my Azure AD licenses ?
In short, the answer is No. Your Azure AD licenses provide more security protection services than what you get from “Security Defaults”.
Think of a “Security Defaults” as a security design approach for users on a free Azure AD tier. Because, if you are already using P1 or P2 licenses you would want to look at using conditional access to perform this (and more) rather than security defaults.
What you need to know before deploying the Security Defaults?
Based on Microsoft security guidelines, every organization should have at least two emergency access accounts configured. These accounts are intended for use when your regular administrator account’s can not be used. A typical example is: when person with the most recent Global Admin access has left your company.
What are the emergency access accounts ? Well, following three criteria defines it pretty well:
Aren’t used on a daily basis
Are protected with a long complex password
Has an assigned Global Administrator rights in Azure AD
These emergency access accounts and credentials are very sensitive and should be stored in a secure location like a fireproof safe. And only authorized people in your organization should have access to these accounts.
What to do when switching from Security Defaults to azure ad Conditional Access Policies?
In order to provide more productivity and better security to your users, you could replicate the policies created by Azure AD Security Defaults. First, your customerβs tenant must be licensed with Azure AD Premium P2. However, the majority of policies can also be accomplished using the Azure AD Premium P1 license.
Check out the following Microsoft documented guides on how you can use Conditional Access to configure equivalent policies to the once that get set by the security defaults:
All these policies could be implemented with Premium P1 license, except the last one. The last policy requires Azure AD Identity Protection feature of the Azure AD and could be provided via Premium P2 license.
Summary
Thank you so much for reading this post and learning about the Azure AD Security defaults. I tried my best to provide my perspective on this important topic while using availiable Microsoft docs and resources.
Please, keep up the good work by securing your and customer’s cloud environments!
This is the continuation (Part 2/12) of blog post series to help you get ready for the latest AZ-305 exam. As title says – our focus will be on understanding and designing Authentication and Authorization Solutions in Microsoft Azure.
Feel free to check the previous post (Part 1/12) if you did not look into it yet π
Table of content (blog series)
*** Design Identity, Governance, and Monitoring Solutions ***
To put it in plain English language, authentication is the process of verifying who someone is, where as authorization is the process of verifying what specific applications, files, and data a user has access to.
To relate these concepts to a real-world scenarious, you may think about your airport access and on-boarding to the plane experience. Thus, when you go through the security in an airport, you are required to show your ID to authenticate your identity. Then, you proceed and arrive at the gate, you present your boarding pass to the flight attendant, so they can authorize you to board your flight and allow access to your assigned seat.
WHAT YOU CAN DO WITH Authentication and Authorization?
The Authentication sometimes shortened to ‘AuthN’. The Microsoft identity platform uses the OpenID Connect protocol for handling authentication. On the other hand, Authorization sometimes shortened to ‘AuthZ‘. The Microsoft identity platform uses the OAuth 2.0 protocol for handling authorization.
In Microsoft Azure your authentication and authorization is delegated to Azure Active Directory (Azure AD). By using this centralized identity provider you can enable following secure workflows for your business:
Conditional Access policies – that require a user to be in a specific location.
Enabling a user to sign in once and then be automatically signed in to all of the web apps that share the same centralized directory. This capability is called single sign-on (SSO).
Part 2: Designing Authentication and Authorization solutions
The references below are taken from official Microsoft docs and focused on designing Azure Authentication and Authorization solutions. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below π
This collection of links is gathered with a focus on the exam objectives of the AZ-305 certification exam.
