Hello, I'm Nasos Kladakis.
I'm the Product Markets Manager of Azure Active Directory.
And I'm here with Alex Simons,
Director of Program Management of Microsoft Identity Division.
Alex.
>> Hey, Nasos, nice to be here.
>> So, today,
we're gonna cover common identity in the context of hybrid Cloud,
and how we can help you be consistent across your business.
Let's see.
We have that concept of hybrid Cloud among very different
parts of your business, like Development and
DevOps, Integrated Management and Security, of course,
Identity will be our focus today, and Consistent Data Platform.
So today in this specific video,
we are gonna focus on common identity, as I said.
And common identity is the integration between on-premises
Active Directory and
the Cloud version of it, Azure Active Directory.
So Alex, why don't you tell us what we have here?
>> Yeah, so the thing to understand is as the world becomes more and
more Cloud centric, right, what's happening is in the old world,
you used to have maybe some servers and devices, and
your Windows Server AD and your firewall.
And that kind of represented all of the compute that your company did
but now what's happening they're moving to world like this,
where there are lot's of nodes of compute all over.
You're gonna have some of nodes of compute in Azure, in Office 365,
and Amazon and sales force and
some nodes of compute back on-premise, right?
And you're gonna have lot's of customers and
partners who wanna do business with you digitally and
who are gonna use lots and lots of devices to do this.
So, in this world, what you need in a hybrid identity model that gives
you a control plane that stretches from your on-premise deployments to
your Cloud and with the same users and groups and policies, control who
can access which kind of application from where on what device.
>> Perfect, and do
you see any common scenarios that these identities projects use?
>> We really see these hybrid identities
used in three common areas.
The first is kind of the end user experience, the ability for your
employees or your partners to login one time, using one username and
password and get to all the different applications,
all the Cloud apps, like Office 365 and
Salesforce and Box but also on-premise applications as well and
just get that nice single sign-in experience across all of them.
>> So, what about management access scale, or identity protection?
>> Yeah, well, so this is another really common thing we see, right?
So, especially in very large companies, it's a ton of work
to make sure that when a new employee joins the company,
they get access to all the applications they need.
And then when they leave the company,
that they lose access to your corporate data is protected.
And that those identities are secure and
you know they haven't been hacked.
That's one of the main things that people use Azure AD for.
And then finally, the third thing people use it for
is they wanna be able to take their custom line of business apps or
the apps that they're building for others and
make them tied into the identity system.
So again, that you get the same security and access benefits for
a corporation, even from your homegrown apps.
>> Nice, let's see a few more details about these scenarios, Alex.
>> Yeah, let's take a look.
So for instance,
if you're talking about one identity in thousands of applications,
it's really a very, very broad set of things that you can do here.
So for instance, we have connections to over 2,700 different Cloud
applications, and not Microsoft Cloud applications, but
all the applications like Google, and Facebook, and Salesforce, and
Docusign, and Slack, lots and lots of Cloud applications, right?
The ability, though, to also use our app proxy to get back to your
on-premise applications, right?
So now, no matter where I am, if I'm an employee,
I can get to all my apps.
And so I can take my iPad to Starbucks, and
I can get back to an on-premise app, or salesforce.com,
all with that same username and identity.
And then finally, our B2B service, which lets you invite your partners
in the Cloud to come do business with you.
So if, for instance, you have a SharePoint document,
you wanna share with a partner in another company,
we make it really easy to invite them.
And using the same username and password at their own business, then
they can come and get access to your documents but in a very secure way.
>> That's really cool.
>> Let's talk about the next one.
So, managing access and protecting identities.
The first part of managing access is really
what I think of as the Identity Lifecycle, right?
So when someone enters the company, how do you make sure that they
are automatically provisioned into the right applications?
So if I work in sales, I need email and I need a SharePoint site.
And I need a OneDrive, but
I also need access to Salesforce.com the order entry app, right?
How do we automate that process to make sure that as I do that job,
I can get up and running really fast but as I move to new jobs,
the new applications I need are automatically available and
the old ones are closed down?
So that's the first really big thing.
The second one is the ability to then decide who should be able to
get to what depending on the sensitivity of an application.
So for instance, if I'm at home on my home PC, you probably don't want
me to be able to download all of the documents from SharePoint.
But you might let me read them, but when I'm back on the corp net and
I'm on a managed device and you know it's in a good shape it's domain
joined, then I can download documents and do work on them there.
And so conditional access let's us take care of those different types
of kind of context and conditions to let you set corporate policy
to make sure that you're secure, right?
Then in addition for every single login,
we give you a risk score for that login.
So a really good idea about whether that user is really who they say
they are or if they're a hacker, right?
So now your policy can take into account all those different
things about where you're coming from and the device you're on and
all that, but also a risk score for
how likely is it that that person is who they say they are?
And then you can use all of this in combination with our
Privileged Identity Manager and our Advanced Threat Analytics, right,
to really secure down your corporation and
make sure that you're aware of all of the risks that are going on.
And that people can only get to the things they're supposed to, even
super highly privileged accounts like admins, or managers, right?
Who you wanna make sure maybe have to do an extra multi-factor
authentication before they can perform a high-risk action.
>> That's great.
>> Then let's talk about our developer story, right?
Our developer story is one of the more
exciting pieces of the platform.
What we've done here is we've completely bet on open standards and
they are consistent across the Cloud and on-premise.
So whether you're writing an application that you wanna
authenticate using Azure AD or the AD FS server on-premise, you can
use the same libraries and the same protocols in either place, right?
So that makes it really easy.
For instance, maybe you wanna write an app in Azure and test it there,
and then run it on-premise.
Or you wanna take an app that you were running on-premise and
move it up into Azure.
Because of the consistent protocol support and the open source
libraries that we make available, you can easily do that, right?
So that's a really, really great thing and
then, the fact that's consistent across the hybrid identity, right?
So again, users get single sign on to those applications you've built,
no matter where they are on the Cloud or on-premise.
>> That's a great story for our developers for sure.
And I think we have great stories from customers.
>> Yeah.
>> And I know I have been involved in this specific case study
where it's coming from Marc with KGaA and
this case study is about an organization, a health
industry organization that has a lot of infrastructure on-premises.
But also they moved many workloads in Azure.
And they start the project by nailing identity.
So with that common identity, they started that journey in the hybrid
Cloud and they're able to access on-premises and
Cloud applications just like that.
>> Merck is one of the coolest ones cause now,
they get that great single sign on across Office and
all of their apps running in Azure.
>> Great, and we have one more I believe.
So Whole Foods is another big customer of ours.
They use Azure Ad for all of their store floor employees,
which is the first time that those employees at the cash register or
who stocked the shelves have actually had digital identities.
And what they do is they log into Azure Active Directory from
a shared kiosk in the store.
And they can go to services like Workday and to SharePoint
to get all the information to get their jobs done but
also to report their working hours and schedule their shifts.
>> I think it's time for our demo, Alex.
>> Okay, great. I'll tell you what,
let's go ahead and take a look at the end user experience.
So, this is what an employee maybe would see as they're
trying to use Azure Active Directory to login to lots of
different Cloud applications.
We're in the My Apps panel.
So, this is showing me all of the different applications that have
been assigned to me.
And this is nice because it gives me a consistent place to go,
whether I'm on-premises, or on my home PC, or on my phone.
There's always one place I can go find all my apps, right?
So I'm gonna show you a bunch of different apps and they all have
conditional policies that are a little bit different on them, okay?
So let's start with mail.
So mail is kind of the lowest common denominator and
we're not to worried about that.
So I'm gonna click on it and
you'll see I just get logged into Outlook right away.
There's my mail, right?
>> Yes. >> You can do exactly the same with
third-party apps, right?
So it's not just Microsoft apps, it's also others.
So let's take a look at Box.
So I'm just gonna click.
I'm gonna get single-signed on into Box.
I confirm that I'm part of the Cantoso company.
And boom, I'm in.
I'm ready to start using Box to get work done.
So this is really cool, right?
That's that one username and
password experience across all these applications.
But you might also have very sensitive or
more sensitive applications in your company.
So let's take a look at two of those.
So, down here at this one,
you can see I've got a sensitive on-premise application.
Now this is an app that's using the Azure AD app proxy so
that we can authenticate a user in the Cloud.
Maybe they're at Starbuck's or they're a partner.
But I want them to get back through the app proxy to an on-premise
application, but it's a sensitive app.
So I want the machine to be like in a managed state.
Maybe it's an iOS device and I wanna have MDM on it or
something like that, right?
So here, I'm gonna click on the Sensitive On-Premise app, and
because I'm on an unmanaged-tone laptop, you can see here,
it won't let me get in.
I can't get there from here.
This has been blocked,
which is exactly what my administrator would want, right?
>> Yeah. >> So even though single
sign-on worked,
it stopped be from being able to get to the sensitive on-premise app.
And then let's take a look at Salesforce, so
another third-party app, right?
And in this case, in the Salesforce one, it's kind of medium risk, so
what I want is, we've set up the policy so that when I login,
I have to do a second factor authentication to prove who I am.
And I'm gonna use my phone to do that.
So here, I'm gonna go ahead and click on Sales Force.
It's gonna start trying to log me in, and
you'll see up here on the screen, it's now redirecting to say,
hey Alex, you need to go answer your phone.
Phone.
So my phone's here.
It's gonna light up in a sec, there we go. And-
>> Using Microsoft sign in
verification system.
>> All I have to do is just click to prove who I am.
This sends a signal back to our servers in the Cloud.
And now, you'll see that once that's complete, that second factor
which really proved who I was, since I have my phone with me.
And now, there you go.
I'm single signed on into sales force.
So now you've seen how you get that nice single sign-on experience
with the combination of the power of conditional access.
But, in addition, let's show you one more thing, which is how,
when we add identity risk scores in.
So identity risk scores are a way that your security team, or your
admin team, can make sure, that the hackers can't get in while you can.
So let's take a look.
I'm gonna now go over to a tour browser.
So you can see up here, see the little onion.
And you can see that I'm coming in.
This one is going two hops through France and
then the Netherlands, before it comes back out to the Internet.
And normal employees don't do this.
>> Yeah, most probably.
>> But I'm gonna go ahead and
try to sign in as a normal employee using that route.
And what you'll see is that our identity protection system is is
gonna kick in and recognize that wow that's weird.
Why would you be coming from an anonymous browser address, right?
And here we go.
It's basically gonna now make me go through and
do some steps to prove who I really am.
Yeah, all right, so
you can really see the power here of that hybrid model, right?
I was able to try to login to some on-premise apps and
a whole bunch of Cloud apps, both Microsoft and non-Microsoft.
But also our conditional access system and how,
depending on the state of my device and my risk score and things like
that, we're able to determine, is it compliant with corporate policy?
Now, hey let's switch over and look at the admin view of this.
So here we are.
We're in the admin view in the Microsoft Azure portal.
This is my tenant, my Azure ID tenant and I'm gonna go ahead and
take a look at the conditional access policies in it.
And you can see here I have a lot of different policies, and
this is a new capability.
So I can have multiple policies per application.
I can have multiple applications grouped together in policies and
I can have default policies for every application in my tenant.
So it's really become much more powerful.
And here, let's take a look.
This is our high business impact policy and what this does is it says
hey, I can take all the applications that I think would have
a really high negative impact on my company if that information leaked.
And I could have one consistent policy for all of them.
So here, you can see, for instance, the groups that it applies to.
So this is for administrators.
So if you're the administrator trying to get to important
application, this is gonna catch you.
It tells you for which applications, right, and so
I can specify exactly which application I wanna protect.
So let's go ahead and
get that Sensitive App that we were talking about earlier.
That's one of our high sensitivity applications obviously.
I'm gonna save that.
I can then specify the conditions under which this will fire.
So if the risk level is either High or Medium, right, no matter,
then I wanna include all platforms.
So I don't care what device you're coming on but
I could specify different policies per platform if I wanted.
I can specify a location so, for instance,
if I have a set of trusted IP's like they represent my corporate network,
especially for administrators, we see customers do that a lot.
They want admins to have to be on-premise on the corporate network
before they can make changes to corporate policy.
All right, so let's go ahead, we'll do that.
We'll say it has to be from a trusted device,
I mean a trusted IP address.
And then finally, because how sensitive these apps are,
I don't want anything to be able to be downloaded.
So I'm gonna insist that they have to use a browser to do this.
There we go.
So now, I've got my policy.
I can click done and let's just select the controls, right?
So this is, what does it take to get in?
And because this is sensitive,
I'm gonna say it has to have multi-factor auth and
it has to be domain joined, right?
And then I'm all set.
I can go ahead and enable this policy and now,
I have protected all those applications.
In that case the sensitive app, right?
Or any other high business impact application is now protected
by this very strict policy.
But all of the other apps, the mail and all that,
continue to be much easier to get to.
Because that fits our corporate strategy and our risk tolerance.
And this policy's hybrid,
right, both on-premises and Cloud, I believe.
>> Yeah, that's a great point.
It works awesome for all of the Microsoft apps in the Cloud,
all of the third-party apps in the Cloud.
But also for your on-premises applications
using the Azure AD App Proxy.
>> I think that's super cool.
So with that, I think we are at the end of our video.
And if you want to know more about common identity or
any other workload under the Hybrid Cloud of Microsoft,
please visit microsoft.com/hybrid.
Thank you so much, thank you Alex.
>> Thank you.