You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/plan-conditional-access.md
+12-7Lines changed: 12 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ services: active-directory
6
6
ms.service: active-directory
7
7
ms.subservice: conditional-access
8
8
ms.topic: how-to
9
-
ms.date: 12/22/2022
9
+
ms.date: 01/03/2023
10
10
11
11
ms.author: gasinh
12
12
author: gargi-sinha
@@ -32,15 +32,19 @@ Microsoft provides [security defaults](../fundamentals/concept-fundamentals-secu
32
32
* A working Azure AD tenant with Azure AD Premium P1, P2, or trial license enabled. If needed, [create one for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
33
33
* Azure AD Premium P2 is required to include Identity Protection risk in Conditional Access policies.
34
34
* Conditional Access policies can be created or modified by anyone assigned the following roles:
35
-
* Conditional Access Administrator
36
-
* Security Administrator
37
-
* Global Administrator
38
-
* Conditional Access policies can be read by anyone assigned the following roles:
* A test user (non-administrator) that allows you to verify policies work as expected before you impact real users. If you need to create a user, see [Quickstart: Add new users to Azure Active Directory](../fundamentals/add-users-azure-active-directory.md).
42
42
* A group that the non-administrator user is a member of. If you need to create a group, see [Create a group and add members in Azure Active Directory](../fundamentals/active-directory-groups-create-azure-portal.md).
43
43
44
+
### Communication plan
45
+
46
+
Communication is critical to the success of any new functionality. You should proactively communicate with your users how their experience will change, when it will change, and how to get support if they experience issues.
47
+
44
48
## Conditional Access policy components
45
49
46
50
Conditional Access policies answer questions about who can access your resources, what resources they can access, and under what conditions. Policies can be designed to grant access, limit access with session controls, or to block access. You [build a Conditional Access policy](concept-conditional-access-policies.md) by defining the if-then statements like:
@@ -52,6 +56,7 @@ Conditional Access policies answer questions about who can access your resources
52
56
| If your user risk is high | Require a multifactor authentication and a secure password change |
# How To: Plan an Azure Active Directory Identity Protection deployment
18
+
# Plan an Identity Protection deployment
19
19
20
-
Azure AD Identity Protection contributes both a registration policy for and automated risk detection and remediation policies to the Azure AD Multi-Factor Authentication story. Policies can be created to force password changes when there is a threat of compromised identity or require MFA when a sign in is deemed risky. If you use Azure AD Identity Protection, configure the Azure AD MFA registration policy to prompt your users to register the next time they sign in interactively.
20
+
Azure Active Directory (Azure AD) Identity Protection enhances other capabilities like Conditional Access, self-service password reset, and logs.
21
21
22
-
To monitor your Azure multi factor authentication and self service password reset deployment check the Authentication methods activity tab in the Microsoft Entra portal.
22
+
This deployment plan extends concepts introduced in the [Conditional Access deployment plan](../conditional-access/plan-conditional-access.md).
23
23
24
24
## Prerequisites
25
25
26
-
### Engage the right stakeholders
27
-
28
-
CREATE AN INCLUDE BASED ON https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-deployment-plans#include-the-right-stakeholders AND PUT IT HERE
29
-
30
-
When technology projects fail, they typically do so due to mismatched expectations on impact, outcomes, and responsibilities. To avoid these pitfalls, ensure that you’re engaging the right stakeholders and that stakeholder roles in the project are well understood by documenting the stakeholders and their project input and accountabilities.
31
-
32
-
### License requirements
26
+
* A working Azure AD tenant with Azure AD Premium P2, or trial license enabled. If needed, [create one for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
27
+
* Azure AD Premium P2 is required to include Identity Protection risk in Conditional Access policies.
28
+
* Conditional Access policies can be created or modified by anyone assigned the following roles:
* A test user (non-administrator) that allows you to verify policies work as expected before you affect real users. If you need to create a user, see [Quickstart: Add new users to Azure Active Directory](../fundamentals/add-users-azure-active-directory.md).
40
+
* A group that the non-administrator user is a member of. If you need to create a group, see [Create a group and add members in Azure Active Directory](../fundamentals/active-directory-groups-create-azure-portal.md).
33
41
34
-
Azure Active Directory Identity protection requires an appropriate license for the features they use.
35
-
To compare editions and features, see Azure Active Directory Identity Protection license requirement
36
-
For more information about pricing, see Azure Active Directory pricing.
37
-
38
-
### Permissions
42
+
### Engage the right stakeholders
39
43
40
-
Identity Protection requires users be a Security Reader, Security Operator, Security Administrator, Global Reader, or Global Administrator to access. See Azure AD identity protection roles.
44
+
When technology projects fail, they typically do so due to mismatched expectations on affect, outcomes, and responsibilities. To avoid these pitfalls, ensure that you’re engaging the right stakeholders and that stakeholder roles in the project are well understood by documenting the stakeholders, their project input, and accountability.
41
45
42
46
### Communication plan
43
47
44
-
Communication is critical to the success of any new service. You should proactively communicate with your users how their experience will change, when it will change, and how to gain support if they experience issues.
48
+
Communication is critical to the success of any new functionality. You should proactively communicate with your users how their experience will change, when it will change, and how to get support if they experience issues.
45
49
46
50
## Step 1: Review existing reports
47
51
48
-
It is important to understand your current Identity Protection reports before deploying risk based Conditional Access policies. This is to give you an understanding of your environment, investigate suspicious behavior you may have missed and to dismiss or confirm safe user who you have determined are not at risk. We recommend allowing users to self-remediate through policies that will be discussed in Step 3.
52
+
It's important to understand your current Identity Protection reports before deploying risk based Conditional Access policies. This is to give you an understanding of your environment, investigate suspicious behavior you may have missed and to dismiss or confirm safe user who you have determined aren't at risk. We recommend allowing users to self-remediate through policies that will be discussed in [Step 3](#step-3-configure-your-policies).
49
53
50
54
### Existing risk detections
51
55
52
-
If your users have not been remediating risk then they could have accumulated risk or the user may have reset their password on-premises, which does not remediate risk. Make sure before you bulk dismiss users, you have determined they are not at risk. You can see samples for bulk dismiss via Microsoft Graph API in our Identity Protection Tools.
56
+
If your users haven't been remediating risk, then they may have accumulated risk. Users who reset their password on-premises don't remediate risk. Make sure before you dismiss risks, you've determined they aren't really at risk by [investigating risk detections](howto-identity-protection-investigate-risk.md). After investigating you can remediate user risk by following the steps in the article, [Remediate risks and unblock users](howto-identity-protection-remediate-unblock.md). Make bulk changes to user risk by following the samples in the article, [Azure Active Directory Identity Protection and the Microsoft Graph PowerShell](howto-identity-protection-graph-api.md).
53
57
54
58
## Step 2: Plan for Conditional Access risk policies
55
59
56
60
Conditional Access brings signals together to make decisions and enforce organizational policies. Conditional access sign-in risk and user policies work to automate threat detections and allow users to self-remediate risk.
Azure MFA and Secure password reset is a pre-requisite for using Conditional Access risk policies. For users to be able to remediate risk your must have your users registered in Azure Active Directory self-service password reset and Azure Active Directory multi-factor authentication.
68
+
For users to self-remediate risk they must register for Azure Active Directory self-service password reset and Azure AD Multifactor Authentication.
65
69
66
-
We have guidance and deployment plans for both Azure AD self-service password reset and Azure Active Directory multi-factor authentication.
70
+
We have guidance and deployment plans for both Azure AD self-service password reset and Azure AD Multifactor Authentication.
67
71
68
72
Combined registration MFA registration and SSPR - Enable combined security information registration - Azure Active Directory - Microsoft Entra | Microsoft Docs
69
73
@@ -73,66 +77,41 @@ Plan your Azure Active Directory Multi-Factor Authentication deployment with Con
73
77
74
78
### Known network locations
75
79
76
-
It is important to configure both trusted named locations in Conditional Access and to add your VPN ranges in Defender for Cloud Apps. Sign-ins from trusted named locationsimprove the accuracy of Azure AD Identity Protection's risk calculation, lowering a user's sign-in risk when they authenticate from a location marked as trusted. This will reduce the amount of false positives for some of the detections in your environment as these locations are used in our analysis of risk.
80
+
It's important to configure named locations in Conditional Access and add your VPN ranges to Defender for Cloud Apps. Sign-ins from named locations, marked as trusted or known, improve the accuracy of Azure AD Identity Protection's risk calculation. These sign-ins lower a user's risk when they authenticate from a location marked as trusted or known. This will reduce false positives for some detections in your environment.
77
81
78
82
### Report only mode
79
83
80
84
Report-only mode is a Conditional Access policy state that allows administrators to evaluate the impact of Conditional Access policies before enforcing them in their environment.
81
85
82
-
## Step 3: Build Conditional Access risk policies
86
+
## Step 3: Configure your policies
83
87
84
-
### Conditional Access templates
88
+
### Identity Protection MFA registration policy
85
89
86
-
FIX THE INCLUDE AND PUT IT HERE
90
+
Use the Identity Protection multifactor authentication registration policy to help get your users registered for Azure AD Multifactor Authentication before they need to use it. Follow the steps in the article [How To: Configure the Azure AD multifactor authentication registration policy](howto-identity-protection-configure-mfa-policy.md) to enable this policy.
87
91
88
92
### Conditional Access sign-in risk policy
89
93
90
-
Most users have a normal behaviour that can be tracked, when they fall outside of this norm it could be risky to allow them to just sign in. You may want to block that user or maybe just ask them to perform multi-factor authentication to prove that they are really who they say they are. You may want to start by scoping these policies to admins only.
91
-
92
-
1. Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.
93
-
2. Browse to Azure Active Directory > Security > Conditional Access.
94
-
3. Select New policy.
95
-
4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
96
-
5. Under Assignments, select Users and groups.
97
-
1. Under Include, select All users.
98
-
2. Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.
99
-
3. Select Done.
100
-
6. Under Cloud apps or actions > Include, select All cloud apps.
101
-
7. Under Conditions > Sign-in risk, set Configure to Yes. Under Select the sign-in risk level this policy will apply to.
102
-
1. Select High and Medium.
103
-
2. Select Done.
104
-
8. Under Access controls > Grant.
105
-
1. Select Grant access, Require multi-factor authentication.
106
-
2. Select Select.
107
-
9. Confirm your settings and set Enable policy to Report-only.
108
-
10. Select Create to create to enable your policy.
94
+
Most users have a normal behavior that can be tracked, when they fall outside of this norm it could be risky to allow them to just sign in. You may want to block that user or maybe just ask them to perform multi-factor authentication to prove that they're really who they say they are. You may want to start by scoping these policies to admins only.
95
+
96
+
The guidance in the article [Common Conditional Access policy: Sign-in risk-based multifactor authentication](../conditional-access/howto-conditional-access-policy-risk.md) provides guidance to create a sign-in risk policy.
109
97
110
98
### Conditional Access user risk
111
99
112
-
Microsoft works with researchers, law enforcement, various security teams at Microsoft, and other trusted sources to find leaked username and password pairs. Organizations with Azure AD Premium P2 licenses can create Conditional Access policies incorporating Azure AD Identity Protection user risk detections.
113
-
114
-
1. Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.
115
-
2. Browse to Azure Active Directory > Security > Conditional Access.
116
-
3. Select New policy.
117
-
4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
118
-
5. Under Assignments, select Users and groups.
119
-
1. Under Include, select All users.
120
-
2. Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.
121
-
3. Select Done.
122
-
6. Under Cloud apps or actions > Include, select All cloud apps.
123
-
7. Under Conditions > User risk, set Configure to Yes.
124
-
1. Under Configure user risk levels needed for policy to be enforced, select High.
125
-
2. Select Done.
126
-
8. Under Access controls > Grant.
127
-
1. Select Grant access, Require password change.
128
-
2. Select Select.
129
-
9. Confirm your settings, and set Enable policy to Report-only.
130
-
10. Select Create to create to enable your policy.
131
-
132
-
### ?Enable MFA registration policy?
100
+
Microsoft works with researchers, law enforcement, various security teams at Microsoft, and other trusted sources to find leaked username and password pairs. When these vulnerable users are detected, we recommend requiring users perform multifactor authentication then reset their password.
101
+
102
+
The guidance in the article [Common Conditional Access policy: User risk-based password change](../conditional-access/howto-conditional-access-policy-risk-user.md) provides guidance to create a user risk policy that requires password change.
133
103
134
104
### Migrating from older Identity Protection policies
135
105
106
+
If you already deployed legacy Identity Protection risk policies we recommend migrating them to Conditional Access policies. Conditional Access policies provide the following benefits:
107
+
108
+
- Enhanced diagnostic data
109
+
- Report-only mode integration
110
+
- Graph API support
111
+
- Ability to use more Conditional Access attributes like sign-in frequency in the policy
112
+
113
+
For more information, see the section [Migrate risk policies from Identity Protection to Conditional Access](howto-identity-protection-configure-risk-policies.md#migrate-risk-policies-from-identity-protection-to-conditional-access).
114
+
136
115
## Step 4: Monitoring and continuous operational needs
137
116
138
117
### Enable notifications
@@ -142,15 +121,17 @@ Enable notifications so you can respond when a user is flagged as at risk so you
142
121
### Monitor and investigate
143
122
144
123
Investigate risk with Identity Protection Alerts (in DRAFT)
145
-
Identity Protection workbook to help monitor and look for patterns in your tenant. Monitor this for trends and also Conditional Access Report Only mode results to see if there are any tweaks that need to be made for example additions to named locations.
124
+
Identity Protection workbook to help monitor and look for patterns in your tenant. Monitor this workbook for trends and also Conditional Access Report Only mode results to see if there are any tweaks that need to be made, for example, additions to named locations.
146
125
147
126
How to investigate anomaly detection with Defender for Cloud App Security Alerts
148
-
You can also use the Identity Protection API’s to export the risk to your SIEM tool so your security team can monitor and alert on risk events.
127
+
You can also use the Identity Protection APIs to export the risk to your SIEM tool so your security team can monitor and alert on risk events.
149
128
150
-
During this testing time you might want to simulate some threats Identity Protection protects against and you can see some of these here.
129
+
During this testing time, you might want to simulate some threats Identity Protection protects against so you can see some of these risks.
151
130
152
131
## Step 5: Enable Conditional Access policies
153
132
154
-
After you have completed all your analysis and evaluated the report only mode for Conditional Access and you have your stakeholders on board it is time to turn on your Conditional Access risk policies.
133
+
After you've completed all your analysis, evaluated policies in report only mode, and you have your stakeholders on board it's time to turn on your Conditional Access risk policies.
0 commit comments