CONDITIONAL ACCESS FROM A TO Z

Transcription

1 CONDITIONAL ACCESS FROM A TO Z Peter Daalmans PeterDaalmans.com, pds@ctglobalservices.com, Senior Consultant CTGlobal Jörgen Nilsson Ccmexec.com, jorgen.nilsson@onevinn.se, Principal Consultant Onevinn

2 Peter Daalmans Enterprise Mobility MVP Enterprise Mobility MVP 20 years Beers, burgers and soccer Soccer, friends, beer

3 Conditional access

4 AGENDA Why Conditional Access? Where to find Conditional Access? Different layers of Conditional Access Conditional Access in action Notes from the field

5 WHY CONDITIONAL ACCESS? Future for all access scenarios

6 TRADITIONAL IT Azure Application Proxy

7 IDENTITY DRIVEN SECURITY: CONDITIONAL ACCESS User attributes User identity Group memberships Authentication strength Devices Authenticated MDM Managed (Intune) Compliant with policies Not lost/stolen Application Allow Enforce MFA Block Business sensitivity Other Inside corp. network Outside corp. network Risk profile On-Premises applications

8

9 EMS E5 EMS E3 ENTERPRISE MOBILITY + SECURITY LICENSES Identity and access management Identity Driven Security Managed Mobile Productivity Information Protection Azure Active Directory Premium P1 Microsoft Advanced Threat Analytics Microsoft Intune Azure Information Protection Premium P1 Single sign-on to cloud and onpremises applications. Basic conditional access security Identify suspicious activities & advanced attacks on premises. Mobile device and app management to protect corporate apps and data on any device. Encryption for all files and storage locations. Cloud based file tracking Existing Azure RMS capabilities Azure Active Directory Premium P2 Microsoft Cloud App Security Azure Information Protection Premium P2 Advanced risk based identity protection with alerts, analysis, & remediation. Bring enterprise-grade visibility, control, and protection to your cloud applications. Intelligent classification, & encryption for files shared inside & outside your organization Secure Islands acquisition

10 DIFFERENT WAYS OF CONDITIONAL ACCESS Active Directory Federation Services Microsoft Intune versus Azure Active Directory Azure Active Directory Different flavours Exchange ActiveSync Access Rules Intune app based conditional access Azure App Proxy

11 Demo Conditional Access

12 DIFFERENT LEVELS OF CONDITIONAL ACCESS FIT TOGETHER 1 2 Claim Rules via Active Directory Federation Services Conditional Access by Intune / Azure AD for Office 365 (Exchange, SharePoint, Skype for Business, CRM, and more) Device + User based Device based 3 Exchange ActiveSync Rules App Based CA App based

13 ACTIVE DIRECTORY FEDERATION SERVICES Part of Windows Server 2012/2016 In 2016 more fine grained options for device registration AD FS can be used to allow or block legacy protocols AD FS can be used to bock or allow the native mail apps on devices AD FS can be used to check if a device is enrolled (device write back needs to be configured)

14 CLAIMS IN AZURE AD IN AN AD FS SCENARIO User Azure Active Directory Integrated Application Active Directory Domain Services On Premises 6 IdP relationship Active Directory Federation Services (as STS) Azure AD Connect Active Directory Federation Trust (WS-FED) Claim rules Internet Relying Party Trust Azure Active Directory Conditional Access Redirect Action Infrastructure action Infrastructure relation

15 AD FS

16 INTUNE VERSUS AZURE AD Intune CA = Azure AD CA CA versus Exchange On-premises CA versus Office 365

17 INTUNE COMPLIANCE Intune compliance versus CA Check if the device is compliant Compliance check options Threat protection (Lookout)

18 ARCHITECTURE 1. Lookout is federated with Azure AD, authentication is done via Azure AD or AD FS Device compliance state is shared between Azure AD and Microsoft Intune. 3. Lookout gets device and user information based in AAD Group membership via Intune Connector. Lookout is able to retrieve and set the device compliance state in Microsoft Intune Device is managed by Intune (gets compliance policy + mandatory Lookout for Work app) 5. Lookout for Work is activated and is managed by Lookout MTP

19 L4W NOT INSTALLED/ACTIVATED Device is marked as non compliant in Intune and Azure AD 2. Office 365 gets compliance status from Azure AD and access to Office 365 is prohibited 3. After installing and/or activating L4W compliance device is marked as compliant 3 4. Office 365 retrieves new compliance status and access to Office 365 is allowed

20 L4W DETECTS VIRUS 1. Device has access to Office Threat detected by Lookout, compliance state set to non compliant and access to Office 365 is prohibited 3. User fixes issue(s), Lookouk for Work reports state device. 4. Lookout MTP shares device compliance state with Intune (/Azure AD). 5. Office 365 gets compliance states from Azure AD. If okay access to Office 365 is allowed

21 Compliance

22 APP BASED CONDITIONAL ACCESS Exchange Online Microsoft Outlook for Android and ios. SharePoint Online Microsoft Word for ios and Android Microsoft Excel for ios and Android Microsoft PowerPoint for ios and Android Microsoft OneDrive for Business for ios and Android Microsoft OneNote for ios

23 App based CA

24 NETWORK ACCESS CONTROL Cisco Aruba (coming) Juniper (coming) Citrix F5 (coming) Pulse (Coming) Access Citrix Netscaler

25 MODERN AUTHENTICATION What is modern authentication? Active Directory Authentication Library, ADAL Required.

26 SERVER SIDE SUPPORT (O365) Modern Authentication: Turned off for Exchange Online by default. See Enable Exchange Online for modern authentication to turn it on. Turned on for SharePoint Online by default. Turned off for Skype for Business Online by default. See the Microsoft Connect form to request for your Skype for Business Online service to be enabled for modern authentication.

27 ONPREMISES CA

28 CONDITIONAL ACCESS SCENARIOS THAT REQUIRES ADFS Conditional Access for PC (Windows 7, Windows 8.1) Conditonal Access for PC where we want more than Domain Joined Windows and later GPO (NO ADFS requirements) Windows 7 & Windows 8.1 requires an agent installed(msi) Windows 7 & Windows 8.1 also requires ADFS to be able to register in Azure AD

29 CONDITIONAL ACCESS FOR PC (SCCM) Required for PC to be marked as Compliant and not only domain joined. Compliance policy deployed in SCCM Requires Intune in Hybrid

30 Conditional access PC

31 Troubleshooting Device Registration

32 NOTES FROM THE FIELD / LINKS Graph api troubleshooting Intune CA for EAS is the best way CA video - Limited CA for SharePoint - Conditional access troubleshooting flow-chart when using Intune connected with Configuration Manager -

33 Dutch bank IBAN: NL87INGB HOUSE OF TAILS 70 dogs!!! Safety, food, water, health, blankets, shade, love, fun $15 = 1 month food Donation box near registration area and participate in the raffle for huge rewards!

34

35