Microsoft Windows Azure Active Directory (Windows Azure AD)

How does Windows Azure Active Directory work?

Azure AD is a cloud-based service for identity and access management (IAM). It is a secure online authentication store for individual user profiles and groups of user profiles, and it falls into the identity as a service (IDaaS) category. Azure AD is intended for managing access to cloud-based applications and servers that use modern authentication protocols such as SAML 2.0, OpenID Connect, OAuth 2.0 and WS-Federation.

Azure AD manages access through user accounts, which carry a username and a password. Users can be organized into different groups, which can be granted different access privileges for individual applications. Identities can also be created for cloud applications, which may be from Microsoft or third-party software as a service (SaaS), to grant user access through.

Azure AD uses SSO to connect users to SaaS applications. This allows each user to access the full suite of applications they have permission for, without having to repeatedly log in each time. Azure AD creates access tokens which are stored locally on employee devices; these tokens may be created with expiration dates. For important business resources, Azure AD can require multifactor authentication (MFA).

Security in Azure AD

Azure AD contains a number of features to secure and protect organizational data. Azure AD's security features include MFA, SSO for cloud-based SaaS applications, context-based adaptive policies, Identity governance, an application proxy to secure remote access and protective machine learning (to guard against stolen credentials and suspicious log-on attempts).

A feature called Security Defaults in Azure AD was released recently, which, when turned on, will block legacy authentication protocols, require MFA for administrators and users and require MFA for valuable organizational resources. The purpose of security defaults is to better secure digital assets, as baseline access policies in Azure AD are designed to accommodate organizations with legacy clients and added on third-party security features. Security defaults are designed against common types of attacks such as phishing, password spray and session replay. If not disabled, malicious attacks can use legacy protocols to authenticate, whilst bypassing multifactor authentication.

Windows AD vs. Azure AD

Azure AD is not to be confused with Windows Active Directory, another Microsoft service with a similar name. Active Directory consists of several services that run on Windows Server, managing user access to networked resources, such as printers. Though Azure AD and Windows AD both manage user accounts, they use completely different authentication protocols and code bases. Therefore, Azure AD is not simply the cloud-based counterpart of Windows AD.

Key differences include the following:

• Unlike Windows AD, Azure AD is designed for web-based services. Azure AD supports services that use REST (Representational State Transfer) APIs for online cloud-based apps such as Office 365.
• Azure AD uses different protocols from Windows AD. Azure AD uses protocols such as SAML and OAuth.2.0. It does not support NTLM, Kerberos or LDAP (Lightweight Directory Access Protocol).
• Azure AD uses Azure Policy, as opposed to Group Policy in Windows AD.
• Azure AD does not use OUs (organizational units) or forests. It has a flat directory structure.
• Azure AD Join, which links to PCs (personal computers), can only be used with Windows 10.

Azure AD features and licensing

Azure AD comes in four different licensing tiers: free (lowest), Office 365 Apps, Premium P1 and Premium P2 (highest).

The free licensing tier has a 500,000-object limit for directory objects. It contains all of the business-to-business, core identity and access management features. It does not include IAM for Office 365, premium features, hybrid identities, conditional access, identity protection, identity governance or advanced group access management. According to Microsoft, features included in the free tier are:

• Unlimited single sign-on
• User provisioning
• Federated Authentication (Active Directory Federation Services or third-party identity provider)
• Users and group management
• Device registration
• Cloud authentication (Pass-Through Authentication, Password Hash synchronization, Seamless SSO)
• Azure AD Connect sync, which extends an organization's on-premises directories to Azure AD
• Self-service password change
• Azure AD Join (desktop SSO and administrator BitLocker recovery)
• Password protection
• Multifactor authentication
• Basic reporting for security and usage
• Azure AD features for guest users

The second-lowest tier of Azure AD services is accessible for subscribers to Office 365 apps. It is accessible for subscribers of the E1, E3, E5, F1 and F3 levels. This tier has no directory object limit. It includes all of the features offered in the free tier, plus identity and access management for Office 365 apps, such as:

• Customized company branding of access panels and logon/logout pages
• Service-level agreement (SLA)
• Self-service password reset for cloud users
• Two-way synchronization of device objects between Azure AD and on-premises directories

The Premium P1 tier grants the second-highest level of access to Azure AD. Premium P1 access costs $6 per month, per user. It includes full functionality of Azure AD, except for identity protection and identity governance. Specific features in Premium P1 include everything offered in the Office 365 tier, plus:

• Premium password protection, self-service password reset with on-premises write-back
• Advanced group access management
• Azure AD Join with mobile device management (MDM) auto enrollment, local admin policy customization, self-service BitLocker recovery, enterprise state roaming
• Advanced security and usage reports
• Hybrid identities
• Conditional access

The Premium P2 tier costs $9 per month, per user and includes the full suite of Azure AD functionality. It includes everything offered in P1, as well as identity protection and identity governance features.