Cloud based identity with Azure Active Directory
•
3 j'aime•1,591 vues
An introduction to Azure Active Directory and comparison with on-premises Active Directory Domain Services.
Recommandé
Recommandé
Contenu connexe
En vedette
En vedette (15)
Plus de Morgan Simonsen
Plus de Morgan Simonsen (16)
Dernier
Dernier (20)
Cloud based identity with Azure Active Directory
- 14. WSADDS AAD Security boundary Forest Tenant On-premises Yes No Multi-tenant No Yes Multi-master Yes No Object types User, computer, ou, inetOrgPerson, groupPolicyContainer, serviceConnectionPoint, … AlternativeSecurityId, Application, AssignedLicense, AssignedPlan, Contact, Device, DirectoryObject, DirectoryLinkChange, Group, KeyCredential, LicenseUnitsDetail, PasswordCredential, PasswordProfile, Permission, ProvisionedPlan, ProvisioningError, Role, RoleTemplate, ServicePlanInfo, ServicePrincipal, SubscribedSku, TenantDetail, User, VerifiedDomain Extensible Schema Yes Yes Protocols RPC, ADSI, LDAP/LDAP-S, GC-LDAP HTTP (Graph, OAuth, OpenID Connect, SAML, WS-*) API Win32 Graph (REST) Supports domain membership Domain Join (secure channel) Device registration Cross security boundary Forest or Domain Trust API Access Access Control Access Control List (ACL) Role Based Access Control (RBAC)
- 15. *indicates a feature still in preview
- 16. Connect and Sync on-premises directories with Azure. Azure AD Sync
- 18. Identity Synchronization AD FS User attributes are synchronized using Identity Synchronization services including a password hash, Authentication is completed against Azure Active Directory User attributes are synchronized using Identity Synchronization tools, Authentication is passed back through federation and completed against Windows Server Active Directory Identity Synchronization with password hash sync
Notes de l'éditeur
- Red dog, pink puddle and David Cutler Jeg har vært i dublin!
- Fairly technical talk (300)
- BYOD BYOC Consumerization of IT Shadow IT
- Any discussion always starts with identity since everything is tied to user ID
- Successor to WSAD but for the cloud era Very simplified in comparison with WSAD, but not really
- Backed up every day and authoritative restores can be accomplished Soft delete of objects, recovery via portal or powershell We never pay for geo replication i AAD ISO 27001: Information technology— Security techniques — Information security management systems — Requirements
- Partitions and AD LDS http://blogs.technet.com/b/ad/archive/2014/09/02/azure-ad-under-the-hood-of-our-geo-redundant-highly-available-geo-distributed-cloud-directory.aspx
- Came from Office 365 Foundational technology for cloud; use it any way you like
- Not all features and terminology will match up Graphexplorer 24 object types
- Foundational services free and the same for all. Premium features light up when user is licensed. Both password changes and resets are synced back! 250 users for volume
- DirSync out, AAD Sync in. Still FIM, cannot sync other directories yet, still single tenant.
- Hash of hash PWD fallback
- Preview portal does not yet support AAD
- Get-MsolPasswordPolicy -DomainName langskip.no Show enable register for password reset Then show registering
- Show app integrations here