Administrators have two tough tasks to oversee on an ongoing basis: optimizing security and managing permissions. The two go hand in hand and finding the balance between them is key. Security must be watertight. But users must be able to access everything they need to work productively.
Authentication is part of the solution. That way, administrators can help protect user identities and credentials and meet all governance requirements. To do this, administrators need to use Microsoft Azure Active Directory (Azure AD) as the primary identity provider to improve ease of access for users and better protect their organization.
But simply deploying it and sitting back isn’t an option. Governance is an ongoing practice, and you need to know how to administrate it, to really get the most out of it.
What is Azure AD?
Azure Active Directory is Microsoft’s cloud-based identity and access management service. It simplifies your employees’ access to internal and external resources, such as Microsoft 365, and many other SaaS applications, through one set of credentials.
For example, when a new employee starts at your company, they’ll need to be given access to all the relevant systems for their role. If your company doesn’t use Azure AD as the central identity provider, then they could get overwhelmed with the different usernames and passwords for each system.
With Azure AD companies have the option to integrate with virtually every business system which there is and by doing so issue only one set of credentials which can give your users access to everything. This brings simplicity to your employees and more streamlined management for the administrators who are responsible for identity management.
5 ways to control Azure AD
To ensure you get the most out of Azure AD and manage it properly, here are a few tips:
Limit the scope permissions
Permissions don’t just extend to your employees, but to other administrators too. Within Azure AD there are limited admin roles that can be assigned to other admins to limit their access and responsibilities.
By reducing the number of permissions that everyone has access to, you can help to limit sensitive resources from being compromised. But there are times when you’re going to have to extend access and privileges for certain tasks.
For example, there may be a time when a member of staff outside the finance department may need to access the payroll data sheet. When this happens, there’s Privileged Identity Management (PIM) an Azure AD premium feature. With PIM administrators can set just-in-time or time-bound access to resources, giving users access to documents and files – or anything which can use security groups to grant access – for a set period. After that, they will no longer have access, ensuring greater security.
Use multi-factor authentication for EVERYTHING
If I’d be writing this bullet point in 2016, I’d write this: Safeguarding vital docs needs more than a one-step verification. Think of personal records, budgets and all the rest. Not everyone should be privy to such information.
On Azure AD, administrators can implement multi-factor identification to add another layer of protection for sensitive resources. When a member of the HR team wants to access personal records or pay slips, they will need more than the right username and password. The same can happen for other admins. If their admin role is limited, they will also need to go through the same multi-factor identification process.
Administrators can set up a special code to be sent out, for example, to the account holder, or another form of “conditional access”. Every layer helps to safeguard your valuable information and make sure it doesn’t fall into the wrong hands.
But since I am writing this in December 2022: Turn on MFA!
Turn on MFA for admins all the time. Turn on MFA for the users when they are not working from the office. With Azure AD Premium P2, you can use Azure AD Identity Protection to detect risky sign-ins and enforce strong authentication.
You can use Microsoft Authenticator not only for MFA but for password-less authentication as well. At the time of writing these words I had not used my password for 6 months. I don’t even remember what my password was!
Review access to revoke unneeded permissions
Audits are essential. As team members move around the company, their responsibilities change. Administrators need to factor this in when granting permissions for employees and other admins who might get new opportunities in different roles. Also, malicious cyber attackers could try to compromise those accounts that still have access to sensitive material.
That’s why it’s best to review and see who has collected too many permissions and cut back where needed. This allows you to give team members everything they need while also making sure you aren’t compromising your security. By utilizing Azure AD access reviews, you can create an access review of Azure AD roles and groups to filter out any unnecessary permissions with ease.
Restrict the number of Global Administrators
In Azure AD, Global Administrators control everything. They are the force of power that have enormous responsibility… and you don’t want to hand that out to too many people, also you don’t want these admin accounts to be used day by day. Please make sure everyone who requires Global Admin (GA) access for their work are using dedicated privileged accounts which are only used when needed. Also, Microsoft recommends 5 or less people to have GA access but depending on organization size and locations on the globe you might need more to help keeping a healthy work life balance for your admins.
Keeping the secrets of the castle well-guarded and not in too many hands makes it easier to respond to threats when they arise. Not only does this delegation help you pinpoint which of your admins has the greatest responsibilities, but it can help you to assign other admin roles to greater manage everyday workload.
Privileged Identity Management can also help here, there are cases where lesser roles are enough to do a task and only those should be activated which are needed limiting the use of the Global Admin role as much as possible.
Don’t forget about the Azure AD Admin center
The Azure AD admin center recently renamed Microsoft Entra admin center gives administrators full view of apps, logins, users and groups, roles and all the essential details that allow Azure AD to function as the best identity provider for company use and vital resource protection.
Stay in control of Microsoft Azure Active Directory
Having the tools to bring better authentication to your organization is paramount, but controlling it is a different matter. Governance can be difficult when there’s so much data that needs to be collected and reported. Azure AD is no different. You need to stay on top of user logins, user roles, application permissions, expiring application secrets, and more.
Rencore Governance keeps you in control by bringing together all your Microsoft 365 data on a single platform. Enjoy full oversight of your entire Microsoft 365 environment, including Azure AD. By having essential data in one place, you can act swiftly and safely to secure your valuable resources and keep your organization running smoothly.
I also highly recommend reading the following whitepaper: Complete visibility across Microsoft 365. This whitepaper provides a framework built on best practices to help you compile a modern governance strategy for Microsoft 365 technologies, including Azure AD, SharePoint, OneDrive, Teams, Exchange, Yammer and the Power Platform.
