|
1 | 1 | --- |
2 | | -title: Determine your security posture for external collaboration with Azure Active Directory |
3 | | -description: Before you can execute an external access security plan, you must determine what you are trying to achieve. |
| 2 | +title: Determine your security posture for external access with Azure Active Directory |
| 3 | +description: Learn about governance of external access and assessing collaboration needs, by scenario |
4 | 4 | services: active-directory |
5 | | -author: janicericketts |
| 5 | +author: jricketts |
6 | 6 | manager: martinco |
7 | 7 | ms.service: active-directory |
8 | 8 | ms.workload: identity |
9 | 9 | ms.subservice: fundamentals |
10 | 10 | ms.topic: conceptual |
11 | | -ms.date: 08/19/2022 |
| 11 | +ms.date: 02/03/2023 |
12 | 12 | ms.author: jricketts |
13 | 13 | ms.reviewer: ajburnle |
14 | 14 | ms.custom: "it-pro, seodec18" |
15 | 15 | ms.collection: M365-identity-device-management |
16 | 16 | --- |
17 | 17 |
|
18 | | -# Determine your security posture for external access |
| 18 | +# Determine your security posture for external access with Azure Active Directory |
19 | 19 |
|
20 | | -As you consider governing external access, you’ll need to assess the security and collaboration needs for your organization overall, and within each scenario. At the organizational level, consider the amount of control you need your IT team to have over day-to-day collaboration. Organizations in regulated industries may require more IT control. For example, a defense contractor may be required to positively identify and document each external user, their access, and the removal of access. This requirement may be on all access, or on specific scenarios or workloads. On the other end of the spectrum, a consulting firm may generally allow end users to determine the external users they need to collaborate with, within certain IT guard rails. |
| 20 | +As you consider the governance of external access, assess your organization's security and collaboration needs, by scenario. You can start with the level of control the IT team has over the day-to-day collaboration of end users. Organizations in highly regulated industries might require more IT team control. For example, defense contractors can have a requirement to positively identify and document external users, their access, and access removal: all access, scenario-based, or workloads. Consulting agencies can use certain features to allow end users to determine the external users they collaborate with. |
21 | 21 |
|
22 | | - |
| 22 | +  |
23 | 23 |
|
24 | | -> [!NOTE] |
25 | | -> Overly tight control on collaboration can lead to higher IT budgets, reduced productivity, and delayed business outcomes. When official collaboration channels are perceived as too onerous, end users tend to go around IT provided systems to get their jobs done, by for example emailing unsecured documents. |
26 | | -
|
27 | | -## Think in terms of scenarios |
| 24 | + > [!NOTE] |
| 25 | + > A high degree of control over collaboration can lead to higher IT budgets, reduced productivity, and delayed business outcomes. When official collaboration channels are perceived as onerous, end users tend to evade official channels. An example is end users sending unsecured documents by email. |
28 | 26 |
|
29 | | -In many cases IT can delegate partner access, at least in some scenarios, while providing guard rails for security. The IT guard rails can be help ensure that intellectual property stays secure, while empowering employees to collaborate with partners to get work done. |
| 27 | +## Scenario-based planning |
30 | 28 |
|
31 | | -As you consider the scenarios within your organization, assess the need for employee versus business partner access to resources. A bank may have compliance needs that restrict access to certain resources, like user account information, to a small group of internal employees. Conversely, the same bank may enable delegated access for partners working on a marketing campaign. |
| 29 | +IT teams can delegate partner access to empower employees to collaborate with partners. This delegation can occur while maintaining sufficient security to protect intellectual property. |
32 | 30 |
|
33 | | - |
| 31 | +Compile and assess your organizations scenarios to help assess employee versus business partner access to resources. Financial institutions might have compliance standards that restrict employee access to resources such as account information. Conversely, the same institutions can enable delegated partner access for projects such as marketing campaigns. |
34 | 32 |
|
35 | | -In each scenario, consider |
| 33 | +  |
36 | 34 |
|
37 | | -* the sensitivity of the information at risk |
| 35 | +### Scenario considerations |
38 | 36 |
|
39 | | -* whether you need to restrict what partners can see about other users |
| 37 | +Use the following list to help measure the level of access control. |
40 | 38 |
|
41 | | -* the cost of a breach vs the weight of centralized control and end-user friction |
| 39 | +* Information sensitivity, and associated risk of its exposure |
| 40 | +* Partner access to information about other end users |
| 41 | +* The cost of a breach versus the overhead of centralized control and end-user friction |
42 | 42 |
|
43 | | - You may also start with centrally managed controls to meet compliance targets and delegate control to end users over time. All access management models may simultaneously coexist within an organization. |
| 43 | +Organizations can start with highly managed controls to meet compliance targets, and then delegate some control to end users, over time. There can be simultaneous access-management models in an organization. |
44 | 44 |
|
45 | | -The use of [partner managed credentials](../external-identities/what-is-b2b.md) provides your organization with an essential signal that terminates access to your resources once the external user has lost access to the resources of their own company. |
| 45 | +> [!NOTE] |
| 46 | +> Partner-managed credentials are a method to signal the termination of access to resources, when an external user loses access to resources in their own company. Learn more: [B2B collaboration overview](../external-identities/what-is-b2b.md) |
46 | 47 |
|
47 | | -## Goals of securing external access |
| 48 | +## External-access security goals |
48 | 49 |
|
49 | | -The goals of IT-governed and delegated access differ. |
| 50 | +The goals of IT-governed and delegated access differ. The primary goals of IT-governed access are: |
50 | 51 |
|
51 | | -**The primary goals of IT-governed access are to:** |
| 52 | +* Meet governance, regulatory, and compliance (GRC) targets |
| 53 | +* High level of control over partner access to information about end users, groups, and other partners |
52 | 54 |
|
53 | | -* Meet governance, regulatory, and compliance (GRC) targets. |
| 55 | +The primary goals of delegating access are: |
54 | 56 |
|
55 | | -* Tightly control partner access and what partners can see about member users, groups, and other partners. |
| 57 | +* Enable business owners to determine collaboration partners, with security constraints |
| 58 | +* Enable partners to request access, based on rules defined by business owners |
56 | 59 |
|
57 | | -**The primary goals of delegating access are to:** |
| 60 | +### Common goals |
58 | 61 |
|
59 | | -* Enable business owners to govern who they collaborate with, within IT constraints. |
| 62 | +#### Control access to applications, data, and content |
60 | 63 |
|
61 | | -* Enable business partners to request access based on rules defined by business owners. |
| 64 | +Levels of control can be accomplished through various methods, depending on your version of Azure AD and Microsoft 365. |
62 | 65 |
|
63 | | -Whichever you enact for your organization and scenarios you'll need to: |
| 66 | +* [Azure AD plans and pricing](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing) |
| 67 | +* [Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). |
64 | 68 |
|
65 | | -* **Control access to applications, data, and content**. This can be accomplished through a variety of methods, depending on your versions of [Azure AD](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing) and [Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). |
| 69 | +#### Reduce attack surface |
66 | 70 |
|
67 | | -* **Reduce the attack surface**. [Privileged identity management](../privileged-identity-management/pim-configure.md), [data loss prevention (DLP),](/exchange/security-and-compliance/data-loss-prevention/data-loss-prevention) and [encryption capabilities](/exchange/security-and-compliance/data-loss-prevention/data-loss-prevention) reduce the attack surface. |
| 71 | +* [What is Azure AD Privileged Identity Management?](../privileged-identity-management/pim-configure.md) - manage, control, and monitor access to resources in Azure AD, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune |
| 72 | +* [Data loss prevention in Exchange Server](/exchange/policy-and-compliance/data-loss-prevention/data-loss-prevention?view=exchserver-2019&preserve-view=true) |
68 | 73 |
|
69 | | -* **Regularly review activity and audit log to confirm compliance**. IT can delegate access decisions to business owners through entitlement management while access reviews provide a way to periodically confirm continued access. Automated data classification with sensitivity labels helps to automate encryption of sensitive content making it easy for employee end users to comply. |
| 74 | +#### Confirm compliance with activity and audit log reviews |
70 | 75 |
|
71 | | -## Next steps |
| 76 | +IT teams can delegate access decisions to business owners through entitlement management, while access reviews help confirm continued access. You can use automated data classification with sensitivity labels to automate the encryption of sensitive content, easing compliance for end users. |
72 | 77 |
|
73 | | -See the following articles on securing external access to resources. We recommend you take the actions in the listed order. |
| 78 | +## Next steps |
74 | 79 |
|
75 | | -1. [Determine your security posture for external access](1-secure-access-posture.md) (You are here.) |
| 80 | +See the following articles to learn more about securing external access to resources. We recommend you follow the listed order. |
76 | 81 |
|
77 | | -2. [Discover your current state](2-secure-access-current-state.md) |
| 82 | +1. [Determine your security posture for external access with Azure AD](1-secure-access-posture.md) (You're here) |
78 | 83 |
|
79 | | -3. [Create a governance plan](3-secure-access-plan.md) |
| 84 | +2. [Discover the current state of external collaboration in your organization](2-secure-access-current-state.md) |
80 | 85 |
|
81 | | -4. [Use groups for security](4-secure-access-groups.md) |
| 86 | +3. [Create a security plan for external access](3-secure-access-plan.md) |
82 | 87 |
|
83 | | -5. [Transition to Azure AD B2B](5-secure-access-b2b.md) |
| 88 | +4. [Secure external access with groups in Azure AD and Microsoft 365](4-secure-access-groups.md) |
84 | 89 |
|
85 | | -6. [Secure access with Entitlement Management](6-secure-access-entitlement-managment.md) |
| 90 | +5. [Transition to governed collaboration with Azure AD B2B collaboration](5-secure-access-b2b.md) |
86 | 91 |
|
87 | | -7. [Secure access with Conditional Access policies](7-secure-access-conditional-access.md) |
| 92 | +6. [Manage external access with Azure AD entitlement management](6-secure-access-entitlement-managment.md) |
88 | 93 |
|
89 | | -8. [Secure access with Sensitivity labels](8-secure-access-sensitivity-labels.md) |
| 94 | +7. [Manage external access with Conditional Access policies](7-secure-access-conditional-access.md) |
90 | 95 |
|
91 | | -9. [Secure access to Microsoft Teams, OneDrive, and SharePoint](9-secure-access-teams-sharepoint.md) |
92 | | - |
| 96 | +8. [Control external access to resources in Azure AD with sensitivity labels](8-secure-access-sensitivity-labels.md) |
93 | 97 |
|
94 | | - |
| 98 | +9. [Secure external access to Microsoft Teams, SharePoint, and OneDrive with Azure AD](9-secure-access-teams-sharepoint.md) |
0 commit comments