The security frontier has evolved from a network to an identity. Now, rather than solely focusing on securing our network, security is more about protecting our data, apps, and users. Automating identity governing processes can minimize the burden on IT teams. With a centralized and automated identity governance solution, we can quickly deploy standard processes at scale. We can also govern user access—including employees, contractors, partners, and vendors—to all resources, apps, and data, with controls to maintain compliance and automate IT tasks to improve operational efficiencies and reduce costs.
With identity as our control plane in Azure AD, we can unlock various new governance capabilities, such as automatic account provisioning and de-provisioning, conditional access controls, access reviews, entitlement management and compliance policies, secure collaboration with partners, and more. Let’s dive in!
User Identity Lifecycle
Every organization needs to ensure quick user, partner, or vendor onboarding and provide them access to the resources they legitimately need to be productive. But, this also needs to be done without compromising access to systems beyond the necessary requirements. To balance the security and productivity requirements, IT needs to keep track of a user’s identity throughout its lifecycle. The user identity may change over time based on the user’s role and status in the organization. For example, a user or partner might be hired as a contractor, then become a full-time employee, and finally leave the organization. Across all these stages, the organization’s identity should be updated. Even after retirement, a record of the account should exist for auditing purposes. The manual process for managing this identity lifecycle scenario is not effective at scale. IT should automate the lifecycle and provisioning process to ensure it remains accurate even as user communities, applications, and business requirements change.
Simplify the User Identity Lifecycle with Microsoft Azure
Azure offers Azure AD Business-to-Business (B2B) collaboration without losing control of corporate data. Azure AD B2B capabilities simplify how users from other companies—including partners, contractors, and vendors— access an organization’s resources. An employee can invite a guest user for collaboration, or the guest user can request access and be approved through a workflow. Once invited or approved, the guest user can sign in with their own Azure AD identity, their organization’s identity provider, or a social account— meaning they don’t need to remember and maintain yet another password.
Directed by the organization’s security policy, Azure AD admins can also set multi-factor authentication (MFA) policies for guest users and can enable self-service guest user provisioning from another non-Azure AD tenant using federation. Users can be automatically provisioned across applications, teams, and sites, while access is regularly reviewed. This helps to ensure collaboration remains effective and inactive guests are removed from the directory when access is no longer needed.
Azure AD offers tools like dynamic groups that allow IT admins to automate the critical task of granting, modifying, and removing users’ access to connected apps and systems based on user profile data. This not only ensures users have correct permissions but also reevaluates user profile changes.
Using Azure AD, we can enforce policies that implement automated access control decisions for accessing apps based on various conditions like sign-in risk, network location, and more. Azure AD conditional access policies can include displaying terms of use to end-users as well as ensuring users have agreed to those terms before being able to access applications and data. This approach ensures that users see relevant disclaimers for legal or compliance requirements.
With Azure AD access reviews, organizations can ensure that only users who need access actually have access. IT can enable recurring or one-time access review campaigns for guests and employees who have a continued need for access to groups, enterprise applications, and administrative role assignments. Reviews can be delegated to the resource owner or specific people, users can even be allowed to self-attest their need for access. Further, reviewers receive intelligent recommendations on whether to approve or deny users.
Azure AD Privileged Identity Management (PIM) helps to manage and control privileged administrative roles across Azure AD and Azure resources. It provides solutions for Just-in-Time access, such as limiting the duration of privileged access operations in which users receive temporary permissions to perform privileged tasks. PIM enforces request approval workflows of a privileged role with fully integrated access reviews, such that potentially malicious activities that might occur while in privileged roles can be identified, uncovered, and prevented in real-time.
Azure AD for your Business
Azure AD Identity Governance and PEI can help your organization develop a conceptual architecture and detailed roadmap for identity governance adoption. We can improve the overall user experience, streamline technology-focused processes, and migrate identity programs to simplify the automation of your Identity Lifecycle. For help with Azure AD implementation or even streamlining your Identity Lifecycle, contact PEI today!
Brandon Stuart, PEI
