Microsoft Azure Advanced: Managing Identities and Authentication

Name: Microsoft Azure Advanced: Managing Identities and Authentication
Author: Steven Burnley

Learn about the advanced features of Azure Active Directory

Preview the first lesson free — get full access to all 3 lessons.

Course: On-Demand

In this lesson, I will show you how to use the Active Directory to create user accounts, create group accounts to organize those users, assign users to groups and then assign those groups to roles, and finally, how to reset user passwords. Let's get started. In order to use the Azure Active Directory administrative tools, we must first search for Azure Active Directory in the search bar at the top of the screen. Let's do that now. You can see Azure Active Directory shows in the suggestions with the blue pyramid icon to the left. Let's select Azure Active Directory now. You can see that we now have the ability to view and manage the user and group accounts in our environment. On the left -hand side of the screen, I'm going to select the user icon. My Azure subscription only includes one user account by default. This cloud user account was created at the time my subscription was created. This is the first administrative account. In order for other administrators to have access to this subscription or for me to provide access to resources in the subscription for users or other applications, you will need to create additional user accounts. Let's take a look at the interface for creating or inviting users to your Azure Active Directory subscription by clicking the new user button at the top of the screen. Here we can see the basic option to create new users, as well as the advanced option to invite external users. Let's take a look at both of these options. If we click create new user, you will see that the user account to be created will have a brand new user account name that will end in at and then the name of your Azure Active Directory domain name. In this case, our domain is called cmp1506outlook . onmicrosoft .com. This is a unique domain name on the internet that has been assigned to the Azure Active Directory and therefore all user accounts created in this subscription will end in that domain name. Organizations do have the option to purchase domain names in order to replace this built -in default name. Let's take a look at that option now. If I navigate back to the Azure Active Directory, we can see the option to apply a domain name to our subscription. In the left -hand side menu, you can see a red icon that says custom domain names. If we click on custom domain names, you see here is an option with an add button at the top of the screen to assign a domain name that has been purchased through a domain name provider and use that for your user accounts. Many organizations will purchase a domain name from a domain name registrar, add that domain name here by proving their ownership, and when you return to the user administration screen, you will see user accounts will end in your new domain name rather than the built -in name that came from your default subscription. Let's go back to the user administration and view that screen one more time. Let's enter in a valid name for another administrator for our environment. I'm going to click in the username box and type in otheradmin for a sample. You can see now that this has essentially created what looks like an email address, otheradmin at cmp1506outlook . onmicrosoft .com. That will be the username associated with this user. Let's type in a friendly name. Now you can see down at the bottom of the screen, an option for determining the password for this initial user account. You can see the option to auto -generate a password is the default, and this initial password has been created in this box. We can click the show password option to see what this looks like. You can see now this system -generated password could be provided to the person that we want to use this account. If we do not wish to use the default passwords created by Azure, we could click let me create the password. This allows you, the administrator, to control the password that you wish to assign this user the first time they log in. In addition to this, you see the option to put them in group accounts or assign them roles. A good rule to remember is that groups do not give users permission. Groups are used to organize people together. We then assign users or groups to roles. That way we have an easy way to combine people by a similar job role and then only assign permissions to the groups that they are a member of. Let's take a look at the advanced option for managing users, which would be to invite an existing user rather than create users in the Azure Active Directory. If we return to the user administration screen and click new user, this time we'll click the advanced option to invite an external user. This is an appropriate way to interact with users who already have a Microsoft account. Users can get Microsoft accounts by signing up for services such as Outlook .com or converting any existing email address into a registered Microsoft account. You also may have a Microsoft account from a different Azure Active Directory. It's very common for organizations to have more than one Azure subscription. If that's the case, an administrator will not have to sign in to multiple subscriptions with different accounts. It's a good practice to use your main account for your organization to control or have permissions for your several or many Azure subscriptions. So, in other words, don't create additional user accounts for users who already can authenticate with a Microsoft subscription through another solution such as Office 365. If your organization has already purchased authentication services from Microsoft, I can simply click on the email address field here and type in an existing Microsoft account email address and click invite. This will send an invitation to the existing Microsoft account, allowing the user to accept the invitation for your environment and set up their initial username and password. In addition to using user and group accounts, we would also like to review the concept of roles. Roles can be assigned to both local Azure Active Directory users and invited users. This allows us to look at some of the many built -in permissions that you can grant to people or groups to allow you to have other administrators do work on portions of the subscription or assign things like reader permissions for those that need to analyze subscriptions from a support standpoint. There are also roles built in here for managing costs and managing quotas, so there are many users who might need to be granted permissions to an Azure subscription beyond the actual engineers that do the work. Thanks for watching. Stay tuned for the next lesson, where I will show you how to integrate your Azure Active Directory with an existing on -premises traditional Microsoft Active Directory, allowing organizations with an investment in an on -premises data center to replicate accounts to the Azure Active Directory as a way to define all the users in your organization only once.

Advanced Provider : Steven Burnley 3 Lessons · 23m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

Azure Active Directory is the directory of user accounts created in your cloud subscription to identify users. User end group accounts can be created directly in the Azure Active Directory or synchronized from an on-premises Active Directory. This is called single sign-on, and it provides a single credential for users when they access local and cloud resources. This can be accomplished by implementing a tool called AD Connect. Authentication to cloud resources can also include multi-factor authentication, which consists of asking users for an additional credential when logging in. Implementing multi-factor authentication is an emerging standard used to improve the security of your cloud resources.

In this course, you will learn how to use the advanced features of Azure Active Directory. This includes how to create users, synchronize users with an on-premises Active Directory, and implement multi-factor authentication.

What You'll Learn

Create user and group accounts in Azure Active Directory
Manage users and roles with Azure Active Directory
Deploy AD Connect to synchronize users with an on-premises Active Directory
Integrate Azure Active Directory with Microsoft Active Directory
Implement multi-factor authentication for cloud resources

Key Takeaways

Azure Active Directory is the directory of user accounts created in your cloud subscription to identify users.
User and group accounts can be created directly in Azure Active Directory or synchronized from an on-premises Active Directory, which is called single sign-on and provides a single credential for accessing local and cloud resources.
Synchronizing users with an on-premises Active Directory is accomplished by implementing a tool called AD Connect.
Multi-factor authentication asks users for an additional credential when logging in, and is an emerging standard used to improve the security of cloud resources.
The course covers the advanced features of Azure Active Directory, including creating users, synchronizing them with an on-premises Active Directory, and implementing multi-factor authentication.

Frequently Asked Questions

What will I learn in this course?

You will learn how to use the advanced features of Azure Active Directory, including how to create users, synchronize users with an on-premises Active Directory, and implement multi-factor authentication.

What is AD Connect used for in this course?

AD Connect is the tool used to synchronize users with an on-premises Active Directory, enabling single sign-on so users have a single credential when accessing local and cloud resources.

What is multi-factor authentication as covered in this course?

Multi-factor authentication consists of asking users for an additional credential when logging in. It is an emerging standard used to improve the security of your cloud resources, and the course shows how to implement it.

What topics do the lessons cover?

The lessons cover managing users and roles with Azure Active Directory, integrating with Microsoft Active Directory, and implementing multi-factor authentication.

What skills does this course relate to?

The course relates to Azure Active Directory, Azure Security, Microsoft Azure, Microsoft Forefront Identity Manager, Microsoft Azure Certification, and the Microsoft Certified: Azure Administrator Associate certification.