Mod 6 - Explore Azure Identity and Security Options

Question 1

what two things do both On Prem and AZ AD have

Answer 1

• Can sync users, groups, and passwords
• Can enable device login via AD credentials

Question 2

what two things can only On Prem AD do

Answer 2

• Allows for full use of all AD features ex. Users, Groups, Devices, GPOs
• Used for enforcing GPO on various systems and endpoints

Question 3

what are the 4 unique things about AZ AD

Answer 3

• Limited as identity store
• Can’t use GPOs
• Can config computers to login via Azure AD, but usually don’t because can’t enforce GPO
• Azure AD is used to help Cloud-based apps to authenticate against always-on identity stores ex. On-prem AD

Question 4

Can AZ trust external identity stores such as Google GSuite?

Answer 4

Yes

Question 5

What is a main use of az ad

Answer 5

• Azure AD is used because it is a cloud store and can be used to authenticate users who need to access cloud resources. Ex. User who logins to office.com to access Excel uses Azure AD to do AAA OR App

Question 6

Azure AD Domain Services

Answer 6

: Azure resource that enables you to use managed domain services—such as Windows Domain Join, group policy, LDAP, and Kerberos authentication—without having to deploy, manage, or patch domain controllers.

Question 7

Is Azure AD Domain Services seperate or on same domain as On-Prem Domain and Azure AD Domain

Answer 7

Seperate

Question 8

Describe the three steps of how you setup and use Azure AD Domain Services

Answer 8

1. Azure spins up cluster of Domain Controllers(multiple VMs)that are PaaS(managed by Azure),
2. Then deploy you jumpbox VM or edge server in Azure cloud which can connect to DC’s and manage these servers and the domain services environment ex. GPOs.
3. Now you can join other IaaS VMs you’ve deployed that rely on GPOs or other domain services, to this cloud-hosted domain(Azure AD DS domain). Purpose of this resource is to allow you to manage and deploy on-prem VM workloads, which rely on GPO, in an IaaS environment like Azure.

Question 9

Why use Azure AD Domain Services

Answer 9

Migrate servers into Azure that rely on a Domain Controller

Extra: For IaaS deployments that rely heavily on Group Policies and need these GPOs to come from the cloud. Don’t want to manage any of the Operating System env so the DC’s are PaaS

Question 10

Azure AD Connect

Answer 10

This is a Microsoft application that is installed on an ON-Prem server in your on-prem datacenter. When running, the app syncs On-prem and Azure AD data

Question 11

Describe the three steps of how you setup and use Azure AD Connect

Answer 11

1. Install app on VM, Microsoft Azure AD Connect.
2. After install, get wizard that prompts for on prem Domain creds to login to on prem domain controller.
3. Then prompts for you to login to Azure AD with admin credentials that can create and update users in AD. Now every few minutes, it will sync changes in either ADs

Question 12

Will azure manage pwds from external identities connected to AZ?

Answer 12

No, can connect with external identity stores ex. Gsuite, FB, github and allow accounts to be created in azure AD, but azure won’t manage the account pwd. Will show as a Guest type in Users section of Azure AD

Question 13

what is RBAC?

Answer 13

Role Based Access Controls(RBAC),

Question 14

What level can you set RBAC on

Answer 14

Assign roles at User Level and within these, gives them explicit permissions on what they can and can’t do on a specific type of resource.

Can also assign roles to a Subscription, Resource Group, or Management group

Question 15

what two questions does RBAC answer

Answer 15

o What can I do?
o What resources can I do that with?

Question 16

what is RBAC * Owner ROLE

Answer 16

Person can do anything on a resource and assign roles to others

Question 17

what is RBAC * CONTRIBUTOR ROLE

Answer 17

Person can do anything on a resource, but add/remove people from resource

Question 18

what is RBAC * READER ROLE

Answer 18

Views all resources, but can’t make changes to resource

Question 19

HOW DO YOU ACCESS AND SET RBAC IN GUI

Answer 19

• Go to resource page
• Select Access Control(IAM) section)
• Can add users and set roles

Question 20

what is Download role assignments option in IAM section

Answer 20

Download JSON file containing all roles currently set for a resource

Question 21

what is Add option in IAM section

Answer 21

Upload custom JSON file with role assignments you want to set for resource

Question 22

Can you use MFA on Azure

Answer 22

You can setup MFA on user accounts in Azure AD
MFA is not an extra cost monthly, comes with Azure AD

Question 23

how do you enable MFA in GUI

Answer 23

Go to Users»Select “Per User MFA”»Check users to enable this on

Question 24

Windows Hello

Answer 24

MFA feature that allowed you to use fingerprint and MFA code to enter into device

Question 25

Conditional Access

Answer 25

Provide Access to Azure by evaluating where they are, what they are accessing, what device being used etc by installing an agent on device which will check for parameters ex. OS, Device type, User account, Geo Location/IP

Question 26

how do you enable Conditional Access

Answer 26

Azure AD»Security»Under Documentation, select Azure AD Conditional Access

Question 27

what is AZ Policy

Answer 27

Governs how resources can be deployed and configured in Azure

Question 28

what format is AZ policy written in

Answer 28

o Written in JSON format, If-Then statements

Question 29

what is an Initiative

Answer 29

Group of AZ Policies that combine together and you can assign the initiative

Question 30

what can an AZ Policy be applied to

Answer 30

Individual Azure Policy to apply to resource groups, subscription, or management groups

Question 31

how do you create an AZ Policy

Answer 31

1. Search for Policy resource in Azure portal
   a. Click Definitions
   i. Create Custom Policy
2. Set a policy definition that defines an az policies
3. Use Pre-made AZ Policies
   b. Click Assignments
   i. Assign policies to specific resource groups, subscription, or management groups