Identity and Access Administrator Associate Flashcards

Question

What is Microsoft External Identities B2B collaboration.

Answer 1

Collaborate with external users by letting them use their preferred identity to sign in to your Microsoft applications or other enterprise applications (SaaS apps, custom-developed apps, etc.). B2B collaboration users are represented in your directory, typically as guest users.

Answer 2

Establish a mutual, two-way trust with another Microsoft Entra organization for seamless collaboration. B2B direct connect currently supports Teams shared channels, enabling external users to access your resources from within their home instances of Teams. B2B direct connect users aren't represented in your directory, but they're visible from within the Teams shared channel and can be monitored in Teams admin center reports.

Answer 3

Provides managed domain services with a subset of fully compatible traditional AD DS features such as domain join, group policy, LDAP, and Kerberos / NTLM authentication.

Answer 4

Cloud-based identity and mobile device management that provides user account and authentication services for resources such as Microsoft 365, the Azure portal, or SaaS applications.

Answer 5

authentication is validating the identity user or app or device is who they proclaim to be

Answer 6

federation is a collection of domains that have established trust. The level of trust varies but typically included authentication and almost always authorization

Answer 7

federation allows you to apply existing identities from trusted sources like an existing on premise active directory

Answer 8

Open standard for exchanging authentication and authorization data between an identity provider and a service provided.

Answer 9

Generally a user or device

Answer 10

Identity Provider

Answer 11

Service provider

Answer 12

OpenID connect (OIDC) is an authentication protocol built on OAuth 2.0. This protocol enables a user to securely sign in a user to an application. OpenID connect extends the OAuth 2.0 authorization protocol for use as an authentication protocol so that you can do single sign on using OAuth.

Answer 13

OpenID connect introduces the concept of an ID token. Which is a security token that allows the client to verify the identity of the user. The ID token also gets basic profile information about the user.

Answer 14

When a user signs in Entra ID send an ID token that contains a set of claims about the user. A claim is simply a piece of information expressed as a key/value pair. For example email=bob@yo.com

Answer 15

1. the user authenticates 2. the identity provider or IDP sends a set of claims 3. the app normalizes the arguments for the claims (optional) 4. the app uses the claims to make authorization decisions

Answer 16

Entra ID authenticates users and provides security tokens, such as access token, refresh tokens, and ID tokens. Security tokens allow a client application to access protected resources on a resource server. There are three commons types of tokens access tokens, refresh tokens and ID tokens.

Answer 17

an access token is a security token that issued by an authorization server as part of an OAuth 2.0 flow, it contains information about the user and the resource for which the token is intended. The information can be used to access web API's and other protected resources.

Answer 18

because access tokens are valid for only a short period of time, the authorization servers will sometimes issue a refresh token at the same time the access token Is issued. The client application can then exchange the refresh token for a new access token when needed.

Answer 19

ID tokens are sent to the client application as part of an OpenID connect flow. They can be sent alongside or instead of an access token. ID tokens are used by the client to authenticate the user.

Answer 20

A JSON web token is a compact and self contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWT's can be signed using a secret or public private key pair.

Answer 21

a value pair of data within a security token. There are multiple claims transferred within the token from the claim that defines the type of the token to the encryption method. Here is an example: Header { "alg": "HS256", "typ": "JWT" } Content payload { "sub": "1234567890", "name": "John Doe", "aud": "https://jwt.io" }

Answer 22

Assertion - a package of data, usually in for form of token that share the identity and security information about a user or account across security domains.

Answer 23

Attribute - a value pair of data within a token.

Answer 24

Augmentation - the process of adding other claims to the user token to provide extra detail about the user. This could include data from human resource (HR) systems, from an application like SharePoint, or other systems.

Answer 25

Authorization covers what an identity can access and what they are allowed to do once they gain access.

Answer 26

Access policies focus on a set of applications, data, and which users and groups can perform activities. Think of it as the set of rules around getting your job done. Focus on the least access you need.

Answer 27

an explicit list of specific entities who do or don’t have access to a resource or functionality, offers fine control over resources but often becomes difficult to maintain with large groups of users and resources.

Answer 28

the most common approach to enforcing authorization. Roles are defined to describe the kinds of activities an entity can perform. Grant access to roles rather that to individual entities. An admin can then assign roles to different entities to control which ones have access to what resources and what functionality.

Answer 29

Attribute based access control ABAC – rules are applied to attributes of the entity, the resources being accessed, and the current environment to determine whether access to some resources or functionality is permitted.

Answer 30

The following is an example of Attribute based access control ABAC - An example might be only allowing users who are managers to access files identified with a metadata tag of “managers during working hours only” during the hours of 9AM - 5PM on working days. In this case, access is determined by examining the user’s attribute (status as manager), the resource’s attribute (metadata tag on a file), and also an environment attribute (the current time).

Answer 31

Policy based access control PBAC – a strategy for managing user access to one or more systems where the business role of the user is combined with policies to determine what access the user has.

Answer 32

OAuth 2.0 is really about authorization not authentication

Answer 33

It uses things like OIDC which is authentication for modern applications

Answer 34

It also uses OAuth 2.0, this allows me to do authorization

Answer 35

AAD connect or Azure AD connect helps us manage our on-prem identities and bring them up to the cloud, this replication only goes from on-prem AD up to the cloud not from the cloud back to on-prem AD

Answer 36

In Microsoft Entra ID if one of your users needs permission to manage Microsoft Entra Resources, you must assign them to a role that provides the permissions they need.

Answer 37

Global administrator role – manages access to all admin features in Microsoft Entra ID and services that federate to Microsoft Entra ID, this role allows you to assign admin roles to others, reset the password for an user and all other admins.

Answer 38

User Administrator Role – this role allows you to create and manage all aspects of users and groups. Also allows you to manage support tickets as well as monitor service health, change passwords for users.

Answer 39

Biling administrator role – allows you to make purchases, manage subscriptions, manage support tickets, monitor service health.

Answer 40

Microsoft Entra ID --> Roles and Administrators --> Select a role --> Add Assignment

Answer 41

using the portal using powershell using the Microsoft Graph API using PIM

Answer 42

Administrative units are Microsoft Entra ID resources that can be containers for other Microsoft Entra resources. An Administrative unit can contain only, users, groups and devices.

Answer 43

Administrative units restrict permissions in a role to any portion of your organization that you define. You could for example use administrative units to delegate the helpdesk administrator role to regional support specialists. So they can manage users only in the region that they support. In Microsoft Entra ID, using a single tenant if you assign a user any administrator role there now an admin over every user in the tenant. Administrative units are containers created to solve for this challenge in Microsoft Entra ID. If you want a user administrator to be able to manage only a specific set of users and groups, say only manage users in the research department of a hospital. You could set up an administrative unit.

Answer 44

- Authentication Administrator - Groups Administrator - Help Desk Administrator - License Administrator - Password Administrator - User Administrator

Answer 45

You can use administrative units to logically group Microsoft Entra resources. To create administrative units you have to have the role of global administrator or a privileged role administrator After we create the administrative unit we then want to add users or groups to it. Users can be part of multiple administrator units. You cannot nest administrative units. You can apply roles at the administrative unit level so they don’t have that whole role over the whole tenant.

Answer 46

- Restricting who can create applications and manage the applications they create. By default in Entra ID all users can register application registrations and manage all aspects of applications they create. You can restrict to only allow selected people that permission - Assigning one or more owners to an application. A simple way to grant someone the ability to manage all aspects of Microsoft Entra ID configuration for a specific application. - Assigning a built-in administrative role that grants access to manage configuration in Microsoft Entra ID for all applications. The recommended way to grant IT experts access to manage broad application configuration permissions without granting access to manage other parts of Microsoft Entra ID not related to application configuration. - Create a custom role to define specific permissions. Then assign the role to a user to assign a limited-owner. Or you could assign at the directory scope - all applications - as a limited-administrator.

Answer 47

- Define the roles you need - Delegate app administration - Grant the ability to register applications - Delegate app ownership - Develop a security plan - Establish emergency accounts - Secure your administrative roles - Make privileged elevation temporary

Answer 48

- The application administrator role, which grants the ability to manage all applications in the directory. Including registrations, single sign on settings, users and group assignments and licensing. Application proxy settings and consent. It doesn’t grant the ability to manage conditional access. - The cloud application administrator role which grants all the abilities of the application administrator except it doesn’t grant access to application proxy settings

Answer 49

1. the user requests a web page via the cloud proxy 2. the cloud service identifies the users account, a) for local users this is based on IP address b) for roaming users this typically requires the user to enter an email address 3. the service redirects the user's browser to the identity provided configured for the account. 4. the users browser makes an authentication request to the identity provider. 5. the identity provider authenticates the user. 6. an authentication token is posted to the users browser. 7. The token is forwarded to the Forcepoint cloud service. 8. The token is validated against the identity provider’s metadata, and the user is identified. Policy settings for the user are checked, and the request is permitted or blocked. 9. The cloud service redirects the user’s browser back to the requested URL. 10. Account identification and authentication cookies are set in the user’s browser. The next time the user accesses the service, the user’s account is identified and the session authenticated via the cookie, without redirecting to the IdP 11. The browser requests the URL for the second time. 12. The URL is retrieved and served to the user.