In any identity infrastructure attack, attackers are going after the "privileges". The more privileged account they own, the more damage they can do. There can be privileged accounts in a system that only used once a month to do a privileged task. In any IT system, we used to believe administrators are trustworthy people. Therefore, most of the time we do not really worry about what they are doing with given privileges. what if they misuse the permissions? how we can ensure they only doing what they supposed to do? also if a privileged account got compromised, how we identify genuine activity from a malicious activity? 

Privileged access management in Azure AD & Office 365 provides an answer to all of the aforementioned challenges and protect cloud resource from identity attacks. With this solution, users will not have privileges attached to their accounts all the time. instead, they have to request privileges when they required. Then a workflow attached to it will decide if it should grant or not. Once permissions are granted, users can do the relevant privileged task. The permissions, however, will not be available for the users all the time. It is time-bounded. After the approved time, permissions will be removed automatically. In one of my previous blog post series, I demonstrate how to set this up with Azure AD. You can find it here http://www.rebeladmin.com/2016/07/step-step-guide-azure-ad-privileged-identity-management-part-1/ 

In this blog post, I am going to demonstrate how to do the same with office 365. 

As the first step, we need to create a group to approve the privilege access requests. If you already have an IT admin/management group, you can 

Create Admin Group

1. Log in to Office 365 Admin panel as a global administrator

2. Then go to Groups | Groups

3. Then click on Add a Group

4. In the new group window, select mail-enabled security as the group type. Then provide a name for the group. you also can add a description if you like. At the end click on Add to proceed. 

In order to manage Azure AD, we use Azure Active Directory option in https://portal.azure.com. By default, any user under Azure AD can access this option event they do not have a Directory role. In my demo setup, I have a user called "Emily Braun". She doesn't have any Directory role assigned. 

Then I log in to Azure portal https://portal.azure.com as the user and then go to Azure Active Directory option. It didn't block me accessing it. 

I can go to All users and see user account details. 

I even can see the Groups memberships details. 

Also, can view application assignments. 

As an end user I also can see the Azure AD Connect details. 

Finally, the long wait is over and Microsoft virtual desktop infrastructure (VDI) solution "Windows Virtual Desktop" preview is now available in Azure. If you ever worked with on-premises VDI solutions such as Microsoft RDS or Citrix solution, you may already know how much planning, management involve with it. It is costly as performance & availability of the solution depends on so many things such as networking, hardware resources, skills, connection, etc. But now with a cloud-based solution, we can create a robust, scalable VDI solution with few clicks. 

According to Microsoft we can do following with Windows Virtual Desktop,

• Set up a multi-session Windows 10 deployment that delivers a full Windows 10 with scalability
  
• Virtualize Office 365 ProPlus and optimize it to run in multi-user virtual scenarios
  
• Provide Windows 7 virtual desktops with free Extended Security Updates
  
• Bring your existing Remote Desktop Services (RDS) and Windows Server desktops and apps to any computer
  
• Virtualize both desktops and apps
  
• Manage Windows 10, Windows Server, and Windows 7 desktops and apps with a unified management experience
  

Source: https://docs.microsoft.com/en-gb/azure/virtual-desktop/overview 

Windows Virtual Desktop's Key capabilities are recognized as following,

• Create a full desktop virtualization environment in your Azure subscription without having to run any additional gateway servers.
  
• Publish as many host pools as you need to accommodate your diverse workloads.
  
• Bring your own image for production workloads or tests from the Azure Gallery.
  
• Reduce costs with pooled, multi-session resources. With the new Windows 10 Enterprise multi-session capability exclusive to Windows Virtual Desktop and Remote Desktop Session Host (RDSH) role on Windows Server, you can greatly reduce the number of virtual machines and operating system (OS) overhead while still providing the same resources to your users.
  
• Provide individual ownership through personal (persistent) desktops.
  

Source: https://docs.microsoft.com/en-gb/azure/virtual-desktop/overview 

Windows Virtual Desktop preview setup required following,

1. Azure Active Directory – Windows Desktop Machines must join to the Azure AD in the stranded method. It can't be Azure AD-Join
2. Virtual Desktop only should be Windows 10 Enterprise multi-session or Windows Server 2016/2019
3. OS should have one of the following licenses – Microsoft E3, E5, A3, A5, Business Windows E3, E5, A3, A5 
4. VM should be using subnet which has a connection to the same virtual network as Azure AD. 
5. Azure AD & VM should be in the same region. 

As same as any other VDI solution, user experience has a huge impact from "connectivity". Therefore Microsoft says,

• Round-trip (RTT) latency from the client's network to the Azure region where host pools have been deployed should be less than 150 ms.
• Network traffic may flow outside country borders when VMs that host desktops and apps connect to the management service.
• To optimize network performance, we recommend that the session host's VMs are collocated in the same Azure region as the management service.

There are few new terms related to the Windows Virtual Desktop setup, let's see what are they.

In this blog post, I am going to demonstrate how to set up a desktop application group. before start let's see how is the environment looks like.  

In my demo setup, I have Azure AD Domain Service enabled for tenant rebeladmlive.onmicrosoft.com

This is set up under resource group called AAD and it is using subnet called AAD-vnet 

I also set up a subnet called AAD-VM for session hosts. 

Corporate applications may also hold critical operation data related to the company. By doing regular reviews, we can make sure only the relevant people have access to corporate applications. However, if we just use the native method, it will be mainly based on Enterprise app Sign-ins and audit log data. the only problem with this method is, it is so time-consuming. As it is all manual process, the result may not be that accurate either. But now with Azure AD Access reviews, we can do this by setting up a simple access review job. Here is why it is good rather than a typical audit. 

Automated – It is all automated. You do not need to go through logs and do anything manually. 

Actions – we can also attach predefined action to execute at the end of a successful access review job. If required, we also can manually decide what to do with the findings (approve or deny access)

Schedule – Access reviews jobs can be scheduled to run periodically. It helps to do it more frequently than the manual method.

Recommendation – Access review job itself provides recommendations based on findings. It helps reviewers to decide. 

Delegations – Access reviews job allows delegation. We can assign someone else in the team to decide what to do with the findings. It helps to get more accurate results. 

So, let's go ahead and see how it works. In my demo environment, I have linkedin application assigned to different groups and users. I like to know who has access to it and do permission changes if required.

 1. To start, log in to Azure portal as Global Administrator

2. Then make sure Access reviews onboarding process is completed. More info about this can be found in one of my previous blog posts http://www.rebeladmin.com/2019/02/step-step-guide-review-privileged-accounts-using-azure-pim/

3. To create a new access review job, go to Access Reviews | Controls

4. Then click on + New Access Review 

Azure VM now have serial console access via Azure portal. It is not depending on the virtual machine’s network or operating system state. This is ideal for recover machines/data, modify system configurations & troubleshooting. Azure serial console access is only available via Azure portal. It is using COM1 port of the virtual machine. This works for both Windows & Linux VMs. In my demo I am going to show how we can access windows VM via serial console. 

Prerequisite 

1. A VM created via New portal. This feature is not available for classic deployment model. 

2. A user with minimum of Virtual Machine Contributor role

3. Password based account for the VM

Once prerequisites are in place, we can start the configuration. In my demo setup, I am going to use a VM with Windows server 2019 datacenter version. 

1) Log in to the Azure portal as Global Administrator

2) Go to Virtual Machines and click on the selected VM. 

3) Then click on Boot diagnostics under Support + troubleshooting

4) In new window, Click on Settings and make sure Boot diagnostics are turned on. 

Azure AD B2B allows organizations to share company applications and other services/resources with external users. Before, this external user should have one of following to initiate connection with the organization who sents the B2B inivitation. 

1) Azure AD Account

2) Microsoft Account

3) Google Federation ( More info : http://www.rebeladmin.com/2019/02/step-step-guide-setup-federation-google-azure-ad-b2b/ )

Email one-time passcode authentication (OTP) feature now allow B2B users to authenticate using one time passcode if they cant use one of the above methods. Once OTP is issued it is only valid for 30 minutes. If user didn’t use it with in 30 minutes, he/she need to request new OTP code for authentication. Once authenticated, session will be valid for 24 hours.  

This feature is still under public preview. OTP users must use the https://myapps.microsoft.com/?tenantid=<tenant id> , https://portal.azure.com/<tenant id> or https://myapps.microsoft.com/<verified domain>.onmicrosoft.com when they authenticate. In above <tenant id> should replaced with the organization’s tenant ID. <verified domain> should replace using the default domain details. 

You can find the tenant id using, 

Azure Portal | Azure Active Directory | Properties | Directory ID  

Let’s see how we can enable this new OTP feature. 

To do that,

1) Log in to Azure portal as Global Administrator

2) Go to Azure Active Directory | Organizational relationships 

3) Then go to Settings

Microsoft recently released the new combined registration experience for MFA and SSPR. This steamlined the registration experience and users can sign up by following up step-by-step process. This new portal also improve experience of managing user profile data. 

 To enable this new experience, 

1) Log in to Azure portal as Global Administrator

2) Then go to Azure Active Direcotry | User Settings

3) Then click on Manage settings for access panel preview features under Access panel

4) Click on All under Users can use preview features for registering and managing security info – refresh to enable preview features for all users. If needed we can apply this to selected group of users by using Selected option. 

Azure AD has near 35 different Directory roles. Each of these roles have different level of privileges. Using Azure PIM access reviews, we can review access and activities of member’s in these privilege groups and adjust their memberships accordingly. let’s see why it is important to review access of privilege accounts periodically. 

• Too much administrators – How many of you aware of all the administrators (including local admins) of your local AD infrastructure? I got you isn’t it! in local AD environment it is handful of privilege user groups, but Azure AD have near 35 roles. So, yes it will be difficult to keep track of the administrator with out proper review. 

• Not doing what they supposed to do – Azure AD roles have predefined level of privileges. you may assign a higher privilege role to member as he/she can’t match privilege available under existing roles. How we know they are only doing what they supposed to do? using access reviews we can track down their activities and make sure they not misuse the privileges. 

• Audit takes time – We can review the group memberships & their activities manually. But it takes time. if its manual tasks and also if it takes time most probably administrators will not do it more regularly. PIM access review is fully automated so you can schedule it run according to your requirements.  

Now it is time to look in to implementation. In my demo I am going to create an access review for Global administrator role. To do this, 

1. Log in to Azure portal as Global Administrator

2. Go to All Services and search for azure ad PIM then click on it.

 

 

3. If this is your first-time using PIM, you need to click on onboard and complete the process. 

 

 

 

4. Then click on Azure AD Roles under Manage

In on-premises Active Directory environments, we use “trusts” to establish identity infrastructure collaboration between businesses. In that way, partner organization can use their own user accounts to authenticate in to trusted organization resources. When it comes to cloud/hybrid identity, Azure AD B2B allow organizations to establish cross-organization identity connections. Unlike on-premises, it is not required additional infrastructure changes. In my previous article about Azure B2B explains how we can allow external users to authenticate in to cloud app using their own accounts. You can find it here http://www.rebeladmin.com/2018/11/cross-organization-collaboration-azure-ad-b2b/ . However, when external user’s sign up process it is asking to create “Microsoft Account” to continue. 

If users are having Google Accounts, now Azure AD B2B can initiate federation with google to allow users to use their own google accounts to authenticate instead of Microsoft Accounts. In this demo I am going to demonstrate how we can initiate federation with google. 

Prerequisites

• Valid Azure AD B2B Subscription – If the guest users are going to use Azure AD paid services, make sure you have enough licenses allocated. More info about licensing can find here https://docs.microsoft.com/en-us/azure/active-directory/b2b/licensing-guidance

• Shared Google Account – During the setup we need to create credentials at Google APIs. To do that we need to use existing google account. It is recommended to use separate google account for this instead of existing user account. 

To start the configuration,

1. Go to https://console.developers.google.com and log in with the Google account you have selected for the task. 

2. In Dashboard, Click on Create to start new project. 

3. Then in new window, give unique name to project and click on Create.

4. Once project is created, select it from the project drop down box. 

5. Then click on Credentials. 

Last month or so I have done few blog posts which explained about Azure information Protection (AIP)’s capabilities. In there, I mainly talked about how to protect sensitive data in organization when we know the data type, audience and permissions. 

Step-by-Step Guide: Protect confidential data using Azure information protection – http://www.rebeladmin.com/2018/12/step-step-guide-protect-confidential-data-using-azure-information-protection/ 

Step-by-Step Guide: Automatic Data Classification via Azure Information Protection – http://www.rebeladmin.com/2018/12/step-step-guide-automatic-data-classification-via-azure-information-protection/

Step-by-Step Guide: On-premise Data Protection via Azure Information Protection Scanner – http://www.rebeladmin.com/2018/12/step-step-guide-premise-data-protection-via-azure-information-protection-scanner/

Step-by-Step Guide: How to protect confidential emails using Azure information protection? – http://www.rebeladmin.com/2019/01/step-step-guide-protect-confidential-emails-using-azure-information-protection/ 

When we work with information, sometime we have to share information with internal/external peoples, organizations. Usually It is hard to apply strict data protection polices if it’s not sensitive data. With document tracking, we can review who access shared document, when and from where. It also allows to setup notifications so we know when someone access it. if the document is starting to appear in places where it shouldn’t, we can revoke the permissions as well. In this blog post I am going to demonstrate how we can do this. 

Prerequisites 

1. We need supported subscription first. This feature is available under Enterprise Mobility + Security E3 & E5, Office 365 Enterprise plans. Or else it is available as standalone solution https://azure.microsoft.com/en-gb/pricing/details/information-protection/

2. We need Microsoft Azure Information Protection Viewer app https://www.microsoft.com/en-us/download/details.aspx?id=54536&WT.mc_id=rss_alldownloads_all or Azure Information Protection client https://www.microsoft.com/en-us/download/details.aspx?id=53018 installed in the pc. It will allow to view, protect office documents using office apps. 

In my demo pc, I have installed Azure Information Protection client.

Once agent & subscription is ready,

1. Open up document that you like to share using office app (Word, Excel etc.) and then click on Protect | Custom Permissions  

2. It will open up new window, click on protect with custom permission. Then under select permissions, choose the permissions level you like to apply.