[MUSIC]
Adwoa Boateng-Kwakye: Welcome back to Azure AD
Architecture Deep Dive Series. I am Adwoa Boateng-Kwakye
and I’m a Program Manager on the Azure AD Engineering
team at Microsoft.
Adrian Paredes: And my name is Adrian Paredes and I’m also a
Program Manager in the Azure AD Engineering team at
Microsoft.
In this video, we will discuss the mechanics of how Azure AD
works when you access a service connected to Azure AD,
such as Office 365 or a line of business application or even a
third party SaaS app when you tie it to conditional access
policy. And instead of using Azure MFA, we will discuss how
this works using device controls, such as Intune compliant
device or a hybrid Azure AD-join as a parameter. This is
done to allow more control into which devices are allowed
to connect to Office 365 or Azure AD based services and
not just rely on MFA for achieving more of a zero trust
configuration.
Adwoa: We’ve had many customers ask how to do just that.
Adrian, can you walk us through how this flows?
Adrian: The first step occurs when the user is attempting to
access application. Let’s say, for example, a user, Ross, is
attempting to access his email using Outlook Mobile from
his Android device and does not have it current at the
token. In this example, let’s assume Ross passed the
authentication phase and is now completing the authorization
phase.
The next steps are very similar to when using Azure MFA
via conditional access. As you see here, Azure AD uses
signals coming from the Microsoft Intelligent Security Graph.
That provides the level of risk of a sign-in and overall risk.
Please note that customers with proper licenses can add
these risk levels as part of the policies.
Adwoa, what is the difference with device controls instead of
Azure MFA?
Adwoa: Great question, Adrian.
The difference between device controls and MFA is that the
conditional access policy would require one or more of an
Intune compliant device or hybrid Azure AD joined device.
Since we have device controls, the authentication service
needs to know what the device is. So, let’s buck up a little
bit. One Ross first enrolled his device using Intune, the
device generates key material to authenticate itself and the
core store has a device object that represents Ross’s phone.
So, what happens here is that the authentication service
sends a challenge to authenticate the device. This challenge
may be different based on the platform or client type.
In this case, Ross is a good employee and he also has the
authenticator app. In this scenario, Outlook will
interact with the authenticator app to authenticate. We will
cover how this works in a separate video.
Now that Ross can satisfy the conditional access policy, he
can get access to the service he requested and now he’s
able to check his email on Outlook Mobile.
Adrian: Thanks for that explanation, Adwoa. So, I get this
flow is using the device instead of multi-factor authentication.
When should we use one or the other?
Adwoa: That’s an important point and leads me to our key
points to remember.
First, the device controls allow you to validate that not only
is the user who they say they are but also that the device
used by the user is approved by the organization and is
in a healthy state. MFA does not give you that.
Second, we recommend that customers use both the MFA
and device as a part of the overall security posture.
One very cool thing about conditional access policies is that
you could combine controls and say, for example, I require
MFA or compliant device or hybrid AD join. Consider that this
also has user experience benefits, as users on compliant
devices will not be prompted for MFA when using that type
of policy.
Adrian: One final important call out here is that the hybrid
join case does not have a direct connection to the health of
the device. The controls to guarantee that a domain joined
device is healthy are all on the customer.
This is contrast with MDM with Intune and Endpoint Manager,
where the compliance is measured on a regular basis.
We hope you found this video useful. Please check out our
other architecture videos located at aka.ms/identityyoutube.
Thank you for joining us.
Adwoa: Thank you.
[MUSIC]