[Music]
Hello and welcome to Microsoft mechanics live.
Coming up were to take a look at how you can protect the data in your SaaS apps
as well as access with cloud up security all without
getting in the way of your users.
We're are gonna show you a cloud of security could extend Azure Active Directory
conditional access controls your cloud apps.
As well as scanning classify files within cloud apps
for sensitive information and apply Azure Information Protection labels
that will enforce things like required protection and encryption.
Today I'm gonna be joined by a Asoff Kashi,
the man behind cloud app security.
Give him a warm welcome.
Thanks, Jeremy it's great to be back.
Alright so for the folks that aren't familiar with cloud up security
it's a solution for people who have discovered the applications in their environments.
white might be very important terms of it mitigating risk from shado IT and once you discover that that good
discovered that the apps are being used it also allows you to set policies detected almost
behavior and also protect corporate data within those apps threat in those protections are
now even stronger that we've integrated with azure active directory right. That's right.
Cloud up stop location security is great for grain visibility and control over your client
applications in using organization. We're now extending azar 80 conditional access which
we all love to allow you to limit access to your specific sass applications directly within
the user session itself. This functionality is going to build on the robust conditions
that we have in as your active directory conditional access such as device type whether or not
you're accessing it from a trust location and user risk levels well as all of the other
conditions so before we get started can we check out the experience for a user and then
look at how to configure yeah so let's take a look at this. So we'll start with arm a
demo for out to users into applications so we're gonna go into sales force. And we're
going to log in. Using. The Assaf. User right here. And as long as I remember my password.
So is important around the Palo wherein the password. Alright and what is not showing
on the screen is the fact that I configured my demo machine to work in 2 modes one where
by default it's unmanaged wishing it doesn't belong to this particular demo 10 and it's
Sarah but in this case I'm being prompted for the certificate and if I click okay I'm
impersonating a management you know basically saying yes I have a certificate this machine
is a good corporate machine so what happened here is the user went straight through to
sales force and what you're seeing is this particular sales force incidents I can browse
around I can get my files etcetera and the U. R. L. is the sales force.com euro now let's
do this are so everything works in that one so now let's take the same demo and we're
going to start again with this sales force and log in but not submit that certificate
and we're going to see what's going to happen in this case. So again this time a little
bit quicker. And we're going to log in again. And I'm prompted again for this it's difficult
I'm hitting cancel know what's happening immediately you can see that are between sales force and
as your active directory I got redirected to the proxy where axis distills words being
monitor is being displayed to the end user I'm still going to continue and. I'm going
to get the same experience from an end user perspective perspective because we're only
monitoring but the Ural that you're seeing already is.cast doubt MS so again cloud up
security is now in the middle here proxy in all the activities of the user and later on
we can take a look at what the admin can see from that experience again I can click on
files I can do whatever I need to do in in sales force I'm not blocked from doing anything
right. So that was our our our demo first know for self worth let's go to the second
demo here and this is going to be over on box because again we want to show you 2 different
applications. I'll start with an incognito tab here I'm going to go to my box account
and I'll use a different user in this case. Okay so again this is configured for single
sign on standard as your active directory functionality and by logging into this as
Sylvia. I'm going to see what happens when I want to protect or to block. So let me take
my password again there are a lot of passwords in these demos now have said alright common
way yes so I'm gonna cancel because this is an unmanaged machine I'm not submitting a
certificate again we saw it we see the same thing access the boxes monitored so you saw
me proxy sales force proxy in box non Microsoft applications this works for any sample application
and partly were informing the user that they're being monitored and then they can kind of
see it through the you are all the address bar up top correct and and and if the organization
does want to do this they don't after so in this case I'm going to start by taking the
day to day work info file here and I'm just going to download that straight to my local
machine so again I imagine this being the unmanaged machine I mean a customer site I'm
working from home not the main joined the file download in this case and I'm going to
click and open that and what you're seeing is word is opening the file locally I saw
some signs for add your information protection already loading up and what you can see here
is that if I look at the permissions this file is authenticated to control so which
happens to be this particular tenant and it is a lock down to view only so what I did
was because it's an unmanaged machine I protected this without your information protection the
user didn't have to take any actions nothing happened for them other than download the
file open it and they're doing the right thing for the business miracle so let's take at
let's take a look about third and final demo up for the user we're going to now take the
confidential file so this file happens to be tagged as a confidential so it's labeled
with that information protection right now again I'm gonna try to download this the same
exact way know what you're seeing here is since this is a confidential file and I've
access this is an unmanaged machine the policy here is saying this is restricted sort of
blocking as you can see that particular information came up for the user this is again configurable
and not only that we allow the user to download a bread crumb and in this case it's a little
text file that shows all of the information in case I ever have to go back. And talk from
a a support person's perspective or if the user says no this is this is that actually
should work let me bring to figure out why right so we we help you trouble shooting case
in case of emergency. Barry calls I would've thought that you can basically only gave access
and authorization of the site level for these types of services we just found box and sales
force. How do you control the actions actually protect the contents in the actions people
take against the contents themselves right so for the user they're just navigating to
that as you can see on the screen their their experience is straightforward everything is
as long as they're authorized it just works just like we saw on that it first sales force
are examples. So behind the scenes we configured as your active directory single sign on for
the same Ole 2.no application that we had that we wanted to apply the session controls
for and then we followed that with very full conditional access policy in as your active
directory that is going to point to cloud apps security we're reconfiguring which action
we wanna take so this particular chain is as you see on the screen going from the user
to the application to abstract directory to conditional to cloud up security son finally
once all of these policies run the users now interacting with the application directly
through the cloud app security proxy so in this case both as your active directory as
well as the cloud apps security policies all get out of the way and it's straight forward
right through the cloud up security proxy really cool how did we actually get all this
up and running how we can figure it. So in this case we're gonna log in as the admin
for this particular tenant and what we're going to take a look is at the azar active
directory blade. And we're going to take a look first a look at the enterprise apps if
I look at enterprise applications here and remember we were doing single sign on with
a box and a sales force so let's take a look at box going to click on that and look at
the properties and what you're gonna see here are all the settings that you've used if you've
ever configured as your active directory sync single sign on with a sample app you'll see
that basically these are the access your LV application ID so this is all standard stuff
for someone who's done that. But they simply redirecting the access and author authentication
stops to go through riser 80 that's right so box nose to go over to to act as your active
directory for access now we're going to click on the conditional access in this is basically
a shortcut that shows me the policies that are playing to this particular to this particular
application to route Sylvia to to cows was 1 of the the names of those and we're going
to take a look at it this is in the conditional access up part of the ads are active directory
configuration and what you're seeing here are 2 sections 1 are the conditions are assignments
in the other 1 is the access controls so if I look at the assignments are pretty simple
for this demo policy here I've I've contributed for Sylvia I've I've checked which I applications
so box was the 1 in in question and I've enabled the session proxy so all I had to do was check
this box and allows me to redirect the clout of security so basically we've done here is
we've we've configured are are out there actively are set about to talk down very deep for authentication
we've then set up all the eyes are the controls and conditional access now it's on to cloud
up security and not console to be able to configure the rest we need to do in terms
of all the activities that we're going to monitor and and blocker what happened exactly
so in here you can see that I have 3 social policy policies in in this case and I'm going
to click on let's take via block 19 so I'm going to actually take a look at the settings
for that right here and walk you right through that's so what you're going to see where monitoring
the activities in this particular case we look for specific user because we wanted again
for double policy you can configure any ads are active directory group or user names around
the king on Sylvia here but it could be the entire marketing team or the entire research
and development its right usually the finance illegal things are my suspect but route you
can use whoever you like in this case we've looked for a device that does not have a valid
claim certificate or as complainers the main joints remember that when I submitted day
clients. Difficult it worked without a this policy when I didn't it basically redirected
me through here friend then I made sure that it wasn't or it was kinda confidential files
in this case the label is equal to a confidential file and then I took the action of blocking
and in writing the block action you can see that the particular message is configurable
right here and you can choose whether or not that message comes up or not at all for this
sob particular use you can also send emails you can send alerts etcetera and before we
move forward I wanted to show one other thing in here so I remember how I mentioned the
admin might be able to see all of this this is where investigating the activity log will
show you in real time all of the actions that I just took it so this is not something that
happened before you can see by the time stamp you can see by the you by the IP addresses
these are items that happened right now so you can see that Sylvia here was redirected
to the proxy there was a lot going on there was a downloaded a file that was protected
and then there was a confidential file that was blocked so get everyone of the actions
that happen is being logged in if I scrolled further back you would see that yes off user
was only monitored again but we don't want to go through every line item here but you
can see this is all in cloud up security and it's all available for you to export to whatever
seem more ticketing system you have writes what I have to do in terms of getting some
of the information protection controls up and running that we saw earlier. Like when
you have the V. ad he bar on the top of the document right so you've heard of the the
information Microsoft's I information protection solution all up so we're leveraging all of
those capabilities in cloud up security where we can scan we can classify and label all
your content including applying a encryption automatically to files so since I'm already
showed you the the user experience we're gonna start here from the admin experience in in
the past I think maybe even in a previous out session with you I've shown you the fact
that I can do manual encryption so I go if I go into the file into the file log here
and find a file that isn't already encrypted I can just click on these 3 boxes and apply
classification label this is something we used to be able to do you know from from day
one or from awhile back. I'll do all that then directly through transport as it goes
into the service or how's that working so in this case we would apply they classification
label in cloud up security and based on the ads or information protection mapping of that
label to protection and encryption it would apply that in whatever file repository it
it it is so if a user upload the file we can we see it here we can apply manually but when
we want to do this automatically we can go over to our our policies and directly apply
that so let's take a look at that other protection policy because it will give us an example
of this. And if I click on the settings here will be able to look at this. Where all school
straight to the bottom and you can see instead of blocking in this one all we had to do was
check the box that says protect and these labels are coming straight from Alger information
protection so this policy whether I apply it at the proxy layer conditional access or
applied at the file upload later this is the same kind of policy that you could use tipper
automatically encrypt files that are uploaded to box if they're sensitive or upload to OneDrive
or any of the good guy G. suite applications again it's all cloud up security applying
our as your information protection labels automatically so amazing so we've been able
to protect files that are outside of the fabric of Microsoft cloud that protection of men
is extending the other third party services in this case he saw a box and sales force
I'm sure you can do more than that's right yeah so let's take a look at how what we're
announcing this week Sir on how people can easily get started so we're going we're going
to do here I've got one final demo that I wanted to show here and we're going to look
to log into a completely new. Cloud up security tenants and this one is going to demonstrate
our discovery so what we've done is we've taken our discovery functionality and we had
a couple different discovery solutions out there we had the Alger cloud up discovery
in as your active directory and we had the discovery solution from cloud up security
what we're doing is we're taking the discover solution from cloud out a story from cloud
application security and we're giving it to those tenants that have clout up discovery
specifically everyone that has a UMass. E. 3 licenses will now get our our. Our discovery
solutions so let me let me show you how this works. Great so anybody with the 3 can can
use the us and it's going to go out and discover the apps that are being used. How's the how's
the design of this work in terms of prerequisites anything to do now so anybody that has you
messy 3 if you've got a new tenant today it will already get this discovery I application
you don't need to go to E. 5 purely for discovery obviously if you want the full functionality
of of cloud of security and you want to take action on all of the discovered applications
you will need to go to the premium askew of E. 5 but as I've logged in here. Your tenant
as any 3 tenant it looks exactly like the discovery page and we have over in and the
full cloud of security but the investigation you notice that we only have the customer
reports for controls policies and templates were very focused just on discovery now the
one thing that we don't put in the E. 3 solution is the risk so as you start going down to
risk detail it will prompt you to go to the E. 5 solution or the stand alone cows license
very very cool survey should be trying cloud up security and they're using the discovery
now that's part of basically any 3 and above tan and very very cool stuff that you've shown
Where would you recommend people go to get started?
So obviously you can go to cloudappsecurity.com
to sign up for trial or to added to existing tenant.
Our conditional access enhancement for limited session are coming this coming month.
Very cool, awesome set of technologies protecting the apps
and services outside of the Microsoft fabric.
So, very very cool stuff.
How to get that all configured.
That's all the time we have for this show, thanks for joining us Assoff.
Of course you can stay up to date with all latest tech a Microsoft mechanics.
Thanks for watching and we'll see next time.
[Music]