Hello. Welcome to unite. Thanks for joining us in these sessions where we are going to speak about Azure AD security and how active roles can help you.
So let's start first with a quick introduction about the situation because nearly every organization that use on prem active directory has blended their AD with Azure AD and Microsoft 365. Whenever an organization has fully embraced a hybrid environment or set up part of their user population as Azure only AD, the security challenges ceated to enable management of the Azure AD environment must be acknowledged. So in this session, we will discuss some of the challenges and [INAUDIBLE] enable the secure management of Azure AD whether it's hybrid or Azure native.
[INAUDIBLE] I'm Raul Dopazo. I'm part of the pre-sales AMIA team based in Spain. And we are going to speak during these sessions about, first of all, what are the challenges for Hybrid and Azure AD management.
Let's-- then we are going to speak how [INAUDIBLE] we can provide a real [INAUDIBLE] less privileged access model, how we can support you managing these objects that are also based on Azure only, and then we will see a quick demo about all our capabilities regarding this environment. So, first of all, I would like to start speaking a little bit about the challenge that all the companies are having when it comes to hybrid and Azure AD management. The first thing we can see is that of course, there are many and complex native tools to manage the different AD environments that we can have in the companies.
At the end, we can see that Azure AD is not alone. Active directory user and computer [INAUDIBLE] on prem active directory are always there. And of course, we need some connectors tools that are required to synchronize between AZ on prem and Azure AD. When we have also an Microsoft [INAUDIBLE] online, we can have the different objects that are not located in on prem, like resources and shared mailbox.
So this means that we are going to find objects that are only in Azure AD, and we will have different challenge in order to manage and delegate the management of these objects in a controlled and segregated way. Many companies are using also homegrown scripts. This means that there are many management operations that are done through scripting with manual processes and also having in mind that these changes sometimes are not easily applied to Azure AD because if you have Microsoft AD Connect tool, you know that there are many attributes that are in green mode because we cannot change directly in Azure. So there are some inconsistencies between management and Azure AD management, also with a lot of complexity with these manual and scripting tools.
We can also observe in many companies that there are in processes of acquisitions or divestitures. We can see that there are many companies using different AD on prem in different forests with or without domain trust or forest trust and also working with different Azure tenants. This means more complexity.
This means more people modifying, changing different environments with or without sync processes. So the result is at the end, we have a lot of inconsistencies, processes. What is also really bad is that if we do massive change in native AD with the AD connect, we can also replicate these errors with big risk implications. I mean, again, if we cannot control what we can do in on prem, this kind of change can be replicated with this risk that we can have.
We can have in mind also that Azure security data model is really complex. We are used to work in on prem AD. We are used to work with organizational units and all the native delegation model that, again, it's not perfect, but we are used to work with it. But the reality is that in Azure AD, objects are in a flat hierarchy. So we cannot, let's say, split or contain objects based on our own criteria.
Now we can see that there is a new feature in Azure AD that is called Azure management unit. And basically, it is something that we were requesting to Microsoft for many time before because we need some kind of virtual containers where we can store objects. But the reality is that these management units are really basic object containers with really limited way to filter and to create rules to add objects to these containers.
There are a lot of Azure AD resources, different kinds of resources, and different Azure AD roles to manage these resources with different, let's say, model or rights templates in order to assign to people different rights to manage these resources. This makes really complex easily, I mean, to really understand what these AD roles mean and how to manage these roles or how to assign these roles to different peoples. As you can see, there are almost 80 different roles to manage many different kinds of resources.
And the difficulty to maintain and the lack of visibility, security visibility, of who has access to which objects is really complex in Azure AD. The reality is that we can see that there are more rights than required assigned to people in order to do basic tasks. We can also see a concept called just in time processes or Azure AD PIM. Maybe you already know what does it mean.
Basically, just in time means that I will request something, and when I need it, when I request it, I get the permissions required for my daily job. And then when I finish doing my stuff, the system will remove. This is something that Microsoft can do it with Azure AD PIM.
But just again, this is a really limited functionality for only Microsoft environments. So it's limited to Azure AD groups and resources. And you also require Microsoft Azure AD premium P2 license. So it's expensive, and it's really limited.
Other topics that come when we need to manage Azure AD is that native tools doesn't cut it when it comes to provisioning. Of course, we have the AD sync to synchronize from on prem to Azure AD. But sometimes, we need to read from other authoritative systems for employees for accounts to be created, modified, or deleted.
Sometimes, we can see that there are hybrid environments or hybrid objects, but there are also other kind of objects that we can have in Azure AD. Like, users get users security groups but are only Azure AD base. So the experience means that there are a lot of delays in provisioning, provisioning with the correct permissions, and also more important sometimes the delays in the provisioning or the provisioning that at the end introduce a risk, as inappropriate access may be retained long after it should be terminated.
So again, limit functionality, complexity. With active roles, with one identity active roles, we can help you to fully implement a real and easy least privileged access model in hybrid on Azure AD environments.
Why it's so easy to make this possible with other roles-- have in mind that active roles, at the end, it's like a management proxy. So it's a real proxy for all administrative tasks that you can do in Azure AD, of course also in on prem environments. But more focus on Azure AD, we have more than 30 out of the box access templates with a real, real clear meaning of what this access template can provide access to, which kind of objects, and which permissions.
Also important is that we have the possibility through active roles management units to store objects with different kind of roles and only see or show to the administrative people what they can manage so only the tasks that they can run is a creation, if it's a modification, if it's just change one attribute, we can only show what they need to see. And of course, we are going to fully audit all the Azure AD changes. Having made that, of course, Microsoft has their own native auditing strategy for on prem for Azure AD.
But at the end, make it easy is because we can provide a single interface for all these changes in a real easy way and fast way to search for these changes. And last but not least, we can really make easy to provide a real just in time privilege using dynamic grouping of the roles. So active role is out of the box, is ready for this kind of automation where we can add a user or remove a user with different rights in the target system, with different service tools, or just because of being a member of one group or just because the user needs some rights at a specific time so we can do this kind of requests in active roles and make it really easy to get access to the resource during the time that I need. And then active roles will remove automatically this user for their groups or for the role that the user is already assigned.
As you can see in active roles, we have again more than 30 access templates, as you can see separated or organized by object type. So you can see here Azure contacts, Azure cloud [INAUDIBLE] users, distribution groups, et cetera, with the proper permissions in order to delegate different tasks to different people over different containers with dynamic roles to show less or more objects in there. So let's speak a little bit more about the capabilities of active roles to manage Azure AD. So, of course, we support a hybrid environment, but we also support management of Azure only objects.
So we can create, read, update, and delete Office 365 groups. We support also resource and shared mailboxes that are only in Azure AD or Microsoft Exchange Online. We support for security and distribution groups.
Also, we support security dynamic groups in Azure AD in order to manage properly these rules from active roles. We by example support also provisioning of remote mailbox for exchange online for new users. And we full support of native cloud only user and get users.
So, we, let's say, support most of the objects that we can see in Azure AD, or now it's called, you know, Azure [INAUDIBLE] AD. But again, most of the companies have a hybrid environment. So we cannot forget this, that we support all users and groups that are sync by the Microsoft tool, Microsoft connector tool.
Of course, active roles can also synchronize this object from on prem to Azure AD. But, well, we used to rely on the AD connector for this task. And we also provide Office 365 license and role management. We also support OneDrive provisioning and de-provisioning in an automated way.
Maybe you know active roles. You know the concept of management units in acting roles. Management unit is-- again, it's a virtual container where we use to store on-prem objects in different ways. Can be based on-- included via use, via objects, or we can include members in a dynamic way using queries.
So again, it's really simple. As you can see, we can create managed units. We can add objects, and you can see in yellow that we can include Azure users, get user security groups, Microsoft 365 groups in this management unit based on the query that we would like.
It can be based on a department query. It can be based on the location value. It can be based in any query over any attribute that the object can have in Azure AD. Once we have this container, when we have the content, all the objects that we want to include in here, it's where we associate an access template to our different user groups, and it's where we can delegate in a really granular way based on management units Azure AD-only objects that we can only have in Azure AD.
This is the web interface. This is how the real user, the administrative user, will see this management unit, the content of this management unit. And based on this delegation, the option or the action that we allow this user to run over this list of objects. So, a complete integration inside our web interface of all these objects that we can only see in Azure AD.
Important is the auditing capabilities. Remember, everything you do can be audited. But if we use a single console in order to manage all on-prem and Azure AD objects, we can easily show which actions have been done over one object, or we can also have a look on all the changes that is going to be-- that is doing a specific user with some rights. So we have two different views about what is done over which objects and how many changes is doing one specific technical [INAUDIBLE].
Let's have a look on one specific video. This is going to be a demo where we are going to show you all these capabilities in a quick view. So again, here, we can see all the access templates that we support for Azure. We can see how we are, let's say, creating different access templates for all the object types that we support and with the more common task that we can delegate.
Of course, we can create custom access templates. So with the specific rights, we can create different containers. There are different ways to create these access templates.
And then second thing is the management unit container. So we can see really easily how we can control which objects we want to include with the membership rules or the management units. We can add and include explicitly or by query, by group members.
When we want to include an object, we have to specify which is the target tenant where are you going to search for the object. And we can also define not only the tenant, also the object class. When we define where to search, it's just a question to create the correct query.
So in this case, let's see an example where we can create a query to include objects. We are going to select which kind of object we want to include. OK, let's see that now selecting Azure users automatically, we can select from which tenant in case we have others.
We can see here all the tenants. And then we can create a search query. So it can be a custom search based on any attribute imported from the object type that we want to search. In this case, it's an Azure AD object, which, as you can see, many different object classes from Azure AD.
In this case, I select the [INAUDIBLE] mailbox container. And then we can just do a query by name, by department, by other attributes. So, adding this query, adding the rule, we can also preview the rule in case it's necessary, and then all the objects that will match this rule will automatically add it to this management unit.
We can have as many as management units as we need with the proper delegation template. When we have done this going through the web interface, first of all, we can have a look that if you are an active roles administrator, you can automatically manage all kinds of objects that we support. So we can see here all the object class, objects like [INAUDIBLE] boxes, [INAUDIBLE] mailboxes, security groups, active user, [INAUDIBLE] user. In this case, I can see everything because this user is an administrator of active roles.
So it is not based on the delegation. Then we will see later that going through the management unit, we will see more properly all these objects. But again, we can have a look on all the properties of the, in this case, room with all the attributes, et cetera. Now, going to the management unit, the more real delegation model, we can see here based on the object container that we can manage these objects, different objects, based on the management units with different delegation model.
Let's do a simple chain in order to showed you all the auditing capabilities. We are going to change a simple attribute value, like in this case the capacity. Save, and then we can easily see the change history of this object where we are going to see all the properties that we have changed with the old value, new value, in a really, really easy way. This can be exported for sure.
But also maybe you know that with active roles, we can control also. I mean, it's not only about delegation. It's also about controlling different behavior of these tenants. So in this case, you can see that how we can create a policy in order to force different licenses for this [INAUDIBLE] that I have in my tenant.
And also, we can apply policies to assign different Microsoft 365 roles and provisioning OneDrive for my users. So as soon as I have a new user in my environment and I have an Azure AD object, I can provision the license. I can provision the OneDrive, and I can, let's say, create different policies to manage correctly the Office 365 object.
You can see also that we also provide different workflows out-of-the-box to create [INAUDIBLE] mailbox to enable Azure roles, to migrate from Azure and hybrid environment, to assign licenses. We have different out-of-the-box scripts to support you in the different common tasks. Of course, you can change.
You can create your own scripts. You can use these scripts within workflows in order to manage security. And the last but not least, the same way in active roles we can control properties or attributes for on prem users, we can do exactly the same for Azure AD-only users. So by example, we can control that for a new user in Azure AD or contact or [INAUDIBLE] user, we want to force that some attributes need to have different values.
So let's search for the object type. Let's choose the attribute that we want to control. And we can enforce that the location must be validated with different kind of values as we want, and we can apply this policy to our scope, to our channel, in order to control also attribute level value to ensure the quality also of our data not only active directory on prem, also in the general line.
So, well, that's all about technical features that we can provide with active roles regarding the AD management and also the Azure AD management in this case. What next in roles about Azure AD? Well, have in mind that we are increasing our features in every single release about the number of objects in the future we are speaking about-- teams management, more improvement regarding license management, et cetera. So it's part of our portfolio roadmap to include more and more and more enhancement regarding Azure AD management.
This is all. Thanks for joining this session. Thank you for listening this Azure AD security sessions.
Thank you, and thanks also to our sponsor for unite. Without them, it's impossible to manage these kind of events. So, well, thanks, and have a good day.