Module 2 Describe the concepts & capabilities of Microsoft identity and access

12. Difference between System assigned and user assigned managed Identity

There are two types of managed identities. There is a system assigned and a user assigned. Well, you already know this from the previous lesson, that there is system assigned and there is user assigned. Let's talk about the use cases of this and what the properties of each one of them are. When we think about system-assigned managed identities, they are created when you create a resource, for example, when you create an Azure App service or when you create a virtual machine. At that time, the systemassign managed identity is created. But when it comes to user-assigned managed identity, it has to be created as a standalone. So it is separate from the resource. And that also means that the system's assigned managed identity shares its life cycle with the Azure Resource. So, when the resource is deleted, the managed identity is also deleted. But when it comes to user-assigned managedentities, they have an independent life cycle and must be explicitly maintained or deleted. The system's assigned managed agencies cannot be shared. So you have to associate with a single Azure resource. Once you associate it with, let's say, a virtual machine or an app service, you cannot share it with other resources. And that's not the case with the user-assigned managed guarantees. You can share it with more than one Azure resource.

So, what do you think the most common usecases for system-assigned and user-assigned managed entities will be? Well, workloads that are contained within a single Azure Resource. So that means workloads for which you need independent identities, such as an application that runs on a single virtual machine. And that's when you would use the system's assigned managed entity. Now, when it comes to user-assigned workloads that run on multiple resources and that need to be shared with a single identity, you need a user-assigned managed identity because it can be created explicitly. Now, for workloads that need pre-authorization to access secure resources as part of the provisioning flow, you need a managed entity of user-assigned kind and also for workloads where resources are recycled frequently, but permission should stay consistent. For example, a workload where multiple virtual machines need to access the same resource, right? So that's when you use user-assigned managed identity, so these are the key differences between system-assigned and user assigned. Keep in mind that system assignment is tied to that resource in the Azure subscription. When the resource is deleted, the system's assigned identity also gets deleted. And that's by design. When it comes to user-assigned identities, you need to explicitly create them and assign them to the resource. All right, so that brings to an end our discussion of the comparison between system assigned and user assigned. Let's go ahead and talk about different types of external identities in the next lesson. Thanks for watching so far. I'll see you in the next lesson.

13. Describe the types external identities

Today's world is about collaboration. It's about working with people both inside and outside your organization. And that means that you sometimes need to provide access to your organization's applications or data to external users. Azure Active Directory ExternalIdentities is a feature. It's a set of capabilities that enables organisations to allow access to external users. It could be your customers or partners, or your customers, partners, or consultants, and other guests can bring their own identities. And why would they bring their own identities? Well, they would bring their own user ID and credentials to access your resources and your subscription. Now, this ability for external users to use their own identities to sign in is enabled through Azure Active Directory support of external identity providers. It supports Azure Active Directory tenants.

Of course, then it also supports third-party identity providers like Facebook, Google, or other enterprise identity providers. Admins can set up federation with identity providers so your external users can sign in with their existing social accounts or enterprise accounts instead of creating a new account just to access the application. Now, there are two different Azure identities. It's called "B to B" or "B to C." The B2B collaboration allows you to share your applications and resources with external users. It could be your external customers, vendors, consultants, et cetera. BTC is an identity management solution for consumers or your customer-facing applications. Let me explain each one of them in detail, one by one, starting with the B2B collaboration. Like I said, B2B collaboration allows you to share your organizations, applications, and services with guest users from other organizations. That way, they will be able to maintain control over their own data. The B2B collaboration uses an invite-based process. So from the Azure Portal, you have to invite the individual where the external user or invited person has to accept the invite. Thereafter, they will be able to access the resources in your organisation with their own set of credentials. The developers can customise the invitation and the redemption process using AzureActive Directory Business to Business APIs. With BTB collaboration, external users are managed in the same directory as the employees of the organization, but they are typically called guest users.

These guest users can be managed in the same way as the employees of your tenant. So that means they can be added to the groups. You can apply for policies. So, B to B is supported by multiple applications that are hosted on your Azure Active Directory. Now, when it comes to B and C, b to Cis, a customer identity access management solution also called CIAM. So Azure ads B to C will allow external users to sign in with their preferred, let's say, social accounts or enterprise accounts. And thereby, you'll be getting a single sign on to the application. Azure ADB to C will now support millions of users and billions of authentications per day. So it handles scaling, authentication platform security, monitoring, and dealing with various types of attacks or threats, such as denial of service, password spray attacks, or brute force attacks, correct? So when you think about Azure B to C, external users are managed in Azure ADB to see Directory, which is separate from the organizations' employees and partners. Directory. Now, with Azure ADB to CSSO to the customer-ownedapplications within Azure, ADB to See Tenant is supported. So you've got a lot of benefits going on here. So BTC is a type of authentication solution that you can brand and customise so that it blends in with your web and mobile applications. Finally, let's talk about the pricing for this Azure Active Directory. External latencies are a feature of premium POne and P2 Azure ad additions. The pricing is monthly for the active user talking about different kinds of identities, B to C, B to B. We also need to talk about the concept of hybrid identities. Let's get started with that in the next lesson. Thanks for watching.

14. Describe the concept of hybrid Identities

The concept of hybrid identities If you're thinking that a hybrid identity is a user account or a group that exists on your premise and somehow also exists in Azure Active Directory, then you're fully correct. Organizations will be using the hybrid identity model or also the Cloud Identity model in order to serve applications both on-premise and in the cloud. In the hybrid model, identities are created on Windows Active Directory on your premise, or they could also be on any other identity provider. And then these identities are synchronised with Azure Active Directory. In the cloud model, only identities are created and wholly managed in Azure Active Directory. Now, whether identities are created on premises or in the cloud, users can access cloud and on premise resources.

And that's the beauty of this. With the hybrid model, users accessing both on-premises and cloud-based applications are hybrid users. They are managed in an on-premise active directory. So when you make an update on your premise, for example, you change the telephone number, or you change the organization or department of the user group or contacts, They are then synchronized to Azure Active Directory. The synchronization is managed with a tool called "Your ad Connect." When using this kind of hybrid model, authentication can be done by Azure Active Directory, which is known as Managed Authentication, or Azure Active Directory redirects the client requesting authentication to another identity provider, which is known as Federated Authentication. Now, we are talking about three authentication methods that are possible with this kind of setup. Let's talk about that.

There is password hash synchronization pass-through authentication, also called PTA, and there is federated authentication. And these three are kind of important from the understandability perspective. As a result, password hash synchronization is the most straightforward method of enabling authentication for on-premise directory objects. Users can use the same set of credentials that they always used on premises without requiring any kind of additional infrastructure. So, passwords have a synchronisation is type of managed authentication. That means Microsoft will take care of authentication for your user accounts, whether that is passed through authentication or PTA. Now this provides a simple password validation for Azure Active Directory authentication services by using a software agent that runs on one or maybe multiple on-premise servers. Now, these servers validate the users directly with an on-premise Active Directory, which means that the password validation just doesn't happen only in the Cloud, right? PTA is thus a type of federated managed authentication. Now, Azure Active Directory hands off the authentication process to a separate trusted authentication system, what's called Azure Active Directory Federation Services (ADFS). And then ADFS will validate the user's password. So, what's the major difference in terms of password synchronization? Authentication is done by Azure Active Directory. In the event of a pass through authentication, it does not happen in the cloud, but on premises. In the case of federated authentication, the authentication is handed off to ADFS Systems.

15. Describe the authentication capabilities of Azure – Introduction

We are here on the next page of this module, which is called the authentication capabilities of Azure Active Directory. Before we start ahead with this chapter and deep dive into the concepts, let's understand what you're going to learn here. In this lesson, you'll learn about the authentication capabilities of Azure Active Directory and also the various password protection and management capabilities of Azure Ad. You already know by now that authentication is the process of verifying an identity to be legitimate, and passwords are commonly used to authenticate users. But they have problems. Passwords are difficult to remember and easy for hackers to guess, because good passwords aren't necessarily difficult to remember. And users often use the same password for multiple applications, providing multiple points of entry for a compromised identity. We'll learn about multifactor authentication to protect that. We'll also see how it will improve your security. You'll also learn about the password protection and management capabilities of Azure Active Directory. So, without any further delay, let's get started.

16. Describe the different authentication methods

Legacy applications have relied on a single form of authentication, mostly passwords. However, passwords are problematic for users. They are easily compromised. Multi-factor authentication will require more than one form of verification to prove that an identity is legitimate. So you could be using an atypical device or a finger scan. That means that even when an identity password has been compromised, the hacker, the attacker, cannot gain entry to the resource. Multi-factor authentication dramatically improves the security of an identity. And moreover, it is simple for users. The additional authentication factor must be something that is difficult for an attacker to obtain or even duplicate. We have a new standard in sign i.e. would also like to mention that we now have a new standard in what's called password less authentication. But then let's take a step back and continue our discussion on multi-factor authentication. So what is MFA all about?

So we've got three of these Something you understand, something you possess, and something you are. So something you know is typically a password or a pin. Something you have is a device, a trusted device that cannot be easily duplicated, like an phone, hardware, or a key. And something you are, which is something that you are not cloned or duplicated. Your attributes, like fingerprints or facial recognition, are part of biometrics, which falls into the category of something you are. The multi-factor authentication verification prompts are configured to be part of Azure ad signing events. As a result, Azure Active Directory requests and processes multifactor authentication without requiring any changes to your app or services. So when a user signs in, they receive a multi-factor authentication prompt and you can choose from one of the additional verification forms when they have registered. What the admin has to do is ensure that the user chooses the verification methods or that the user can access their My account section to add verification methods or even edit verification methods. So what could be those verification methods? A multifactor authentication app, SMS, voice call, or even an OAuth hardware token can be used by the user. We can leave it to the user completely and let them choose what kind of verification option they want to use.

Prepared by Top Experts, the top IT Trainers ensure that when it comes to your IT exam prep and you can count on ExamSnap Microsoft Security, Compliance, and Identity Fundamentals certification video training course that goes in line with the corresponding Microsoft SC-900 exam dumps, study guide, and practice test questions & answers.