Module 1 - Configure Azure Active Directory

Question 1

What is Microsoft Entra ID?

Answer 1

It is a cloud based directory and identity management service that supports user access to various resources and applications.

Question 2

Microsoft Entra Benefits and Features

Answer 2

A cloud based suite of identity management capabilities that enables you to securely manage access to Azure services and resources for users.

Provides application management , authentication , device management and hybrid identity.

• Allows uses to access the azure portal and Microsoft office 365 and Azure apps
• Uses SAML ,OAUTH , Open ID ( Not authentication)
  WS -federation - Allows you to use an exiting account such as Google to access Microsoft services

SSO - Allows for users to access web apps on the cloud and to on premises apps. Users can sign in with the same credentials to access all there apps

Multiple platform support such as mac OS , IOS, Android and windows devices with a common experience across all platforms

Secure remote access- can include MFA , conditional access policies and group based management.

Cloud Extensibility - Helps to extend to the cloud

Self service support

Question 3

Describe Microsoft entra ID concepts

Answer 3

1. Identity is an object that can be authenticated

2. Microsoft Entra ID account - An identity created through Microsoft entra id or another could service .

3. Tenant/Directory - A dedicated and trusted instance. A tenant is auto created when your sign up for Microsoft cloud service subscription.
- Tenant is a signal instance representing a single organization

4. Azure subscription - Used to pay azure cloud services

Question 4

Compare Microsoft entra ID to Active directory

Answer 4

1. Microsoft entra is primarily an identity solution
2. Queried using REST API ( which allows any user or device will be able to access azure) over HTTP and HTTPS.
3. Uses HTTP and HTTPS protocols such as SAML , WS federation , Open ID connect for authentication and Oauth for authorization.
4. Includes federation services and many 3rd party services like Facebook
5. The user and groups are created in a flat structure and there are no OU or GPO’S.

Question 5

Select Microsoft Entra plans and pricing

Answer 5

Free:
1.Single sign on( Unlimited)
2. Cloud and federated authentication
3. Self service account management portal
4. MFA

P1:
1. Single sign on( Unlimited)
2. Cloud and federated authentication
3. Advanced group management
4. Self service account management portal
5. MFA
6. Conditional access
7. Automated user and group provisioning to apps

P2:
1. Single sign on( Unlimited)
2. Cloud and federated authentication
3. Advanced group management
4. Self service account management portal
5. MFA
6. Conditional access
7. Risk based conditional access ( sign in risk, user risk)
8. Automated user and group provisioning to apps
9. PIM ( Privileged identity management)

Governance:
1. Automated user and group provisioning to apps
2. PIM ( Privileged identity management)

Question 6

Implement Self Service Password Reset

Answer 6

Remember the security best practice:

1. Determine who can use self service password
2. Choose the number of authentication methods required and methods available
   - email
   -phone
   Mobile app code
   Security question - 3/4/5
3. You can require users to register for SSPR ( same process as MFA).