Getting Started with Azure Active Directory Premium for Microsoft Cloud Solution Providers

Transcription

1 Getting Started with Azure Active Directory Premium for Microsoft Cloud Solution Providers This document is intended for CSP partners who have been on-boarded and are familiar with the CSP Partner Center

2 Table of contents 1 Introduction Scope Terminology Before you start Configuring Self-Service Password Reset Gathering end customer Self-Service Password Reset requirements Configuring end customer Self-Service Password Reset requirements Configuring group management Delegated group management Dynamic group membership Configuring Software-as-a-Service applications Adding Active Directory SaaS applications Reference links... 27

3 2 1 Introduction The Microsoft Cloud Solution Provider (CSP) program was released in July 2014 to provide a scalable, flexible partner program. Designed to deepen customer relationships and expand business opportunities, the CSP program allows partners to: Own and control billing Sell combined offers and services Deliver direct provisioning, management, and support To achieve those capabilities, CSP partners need to integrate their backend systems and business processes with various Microsoft cloud services and processes. Once integration has taken place, CSP partners then have the ability to directly provision, manage and support clients within the Microsoft Office 365, Microsoft Azure, Dynamics CRM, and Enterprise Mobility Suite (EMS) product offerings. The goal of this document is to help CSP organizations to quickly implement Azure Active Directory Premium, part of the Enterprise Mobility Suite, as a solution for their clients. This document provides guidance on how to gather necessary information from clients to facilitate the initial setup of Azure Active Directory Premium. It also provides step by step instructions on how to configure its various features. 1.1 Scope The scope of this document is to provide implementation and configuration guidance for the following Azure Active Directory Premium features: Self-Service Password Reset Delegated Group Management Dynamic Group Access Azure Active Directory SaaS applications

4 3 1.2 Terminology Term CSP EMS AAD Partner Center Azure Management Portal End Customer Azure Co-Administrator Description Cloud Solution Provider Enterprise Mobility Suite Azure Active Directory Portal for CSP Partners to administer their CSP offerings Portal for managing Azure subscriptions Organization that is managed by the CSP Partner Represents an administrator who can login to the Azure Portal and deploy or create new resources against a subscription

5 4 2 Before you start This document assumes that the following conditions have been met: The steps in the document Getting Started with the Office 365 and EMS for Microsoft Cloud Solution Providers have been completed Password write-back has been enabled in Azure Active Directory Connect The administrator completing these steps has co-administrator access to the Azure subscription All users have authentication contact attributes associated with their user account, i.e. authentication phone, alternate authentication phone, or authentication

6 5 3 Configuring Self-Service Password Reset Azure Active Directory Premium s self-service password reset function grants end customer user the ability to reset their own passwords without the need to engage the services of an IT administrator. Before implementation, there are number of elements to Self-Service Password Reset that need to be agreed upon with the end customer. 3.1 Gathering end customer Self-Service Password Reset requirements The following table outlines the features and functions that need to be agreed upon with the end customer to allow the CSP Partner to proceed with the configuration of Self-Service Password Reset. CSP Partners can leverage this table to discuss and determine end customer settings for each of the Self-Service Password Reset configuration options. For more information, refer to the document Customizing Password Management to fit your organization's needs. Self-Service Password Reset Option Description End Customer Setting Users enabled for password reset Restrict access to password reset Designates whether users in this directory who have an office phone, mobile phone, or alternate address specified in their profile can reset their own password. Select yes to restrict user password reset to only a limited group of users. Yes Yes/No Group enabled for password reset Defines the group of users who are allowed to reset their own passwords. Enter AD Group Name: Authentication methods available to users Select the alternate method types that the user may use to Authentication Methods: Office Phone Mobile Phone

7 6 verify their identity when resetting their password. Alternate Address Security Questions Number of authentication methods required Require users to register when signing in? Number of days before users are asked to re-confirm their authentication information Defines the number of alternate methods of identification a user in this directory must have to reset their password. Designates whether unregistered users are prompted to register their own authentication information when they sign in for the first time. This is not yet supported for Office 365 signins. User register via the following portal Designates the period of time before registered users are prompted to re-confirm their existing authentication information is still valid, up to a maximum of 730 days. Number: Yes/No Default: 180 Number of days: Customize "Contact your administrator" link? If set to 0 days, registered users will never be prompted to reconfirm their existing authentication information. Designates whether or not the "Contact your administrator" link that normally allows users to contact a service administrator directly is overridden to point to a custom location. Yes/No Custom Address or URL Designates the URL or address to which your custom "Contact your administrator" link will point. If you provide a URL, we will open it in a new window. If you provide an address, we will turn it into a mailto: link that will be sent to the address you specify. URL or address: Write-back passwords to onpremises Active Directory If you deployed password writeback when installing Azure AD Connect, you can control Yes/No

8 7 whether or not this feature is enabled here. If set to "no", federated or password-synchronized users will not be able to reset or change their passwords, even if password write back has been configured. Allow users to unlock accounts without resetting their password You can change this setting at any time. Designates whether or not users who visit the password reset portal should be given the option to unlock their onpremises Active Directory accounts without resetting their password. By default, Azure AD will always unlock accounts when performing a password reset, this setting allows you to separate those two operations. Yes/No If set to yes, then users will be given the option to reset their password and unlock the account, or to unlock without resetting the password. language preference Notify admins when other admins reset their own passwords If set to no, then users will only be able to perform a combined password reset and account unlock operation. Language for notification will be sent to users in your organization. Determines whether or not all global administrators receive an to their primary address when other administrators reset their own passwords via the self-service password reset portal. Locale based on subscription Yes/No

9 8 Notify users and admins when their own password has been reset Determines whether or not users receive an to their primary and alternate addresses notifying them when their own password has been reset via the self-service password reset portal. Yes/No 3.2 Configuring end customer Self-Service Password Reset requirements 1. When the requirements have been gathered from section 3.1, sign in to the Azure Management Portal as a co-administrator for the end customer tenant. NOTE: If you experience an issue while logging into the Azure Portal as a partner with the customers Azure Active Directory (AAD) subscription, and see your own tenant and not the end customer s tenant, allow the browser session to completely load and then sign out and log in again to access the correct tenant. 2. Select the AAD tenant for the end customer:

10 9 3. Select the CONFIG tab. 4. Under the heading, user password reset policy, select YES for USERS ENABLED FOR PASSWORD RESET to enable self-service password reset. 5. The User Password Reset Policy will populate will the configurable options:

11 10 6. Complete the configuration according to the information gathered from the end customer. 7. Once complete, select SAVE.

12 11 4 Configuring group management 4.1 Delegated group management Azure Active Directory Premium s group management function grants the ability to delegate group management to the end customer users. With this feature, end customer users are able to create and manage memberships in groups they own. There are number of elements to group management in AAD that need to be agreed upon with the end customer. The following table outlines the features and functions that need to be agreed upon with the end customer to allow the CSP Partner to proceed with the configuration of group management. Group Management Option Description End Customer Setting Delegated group management enabled Users can create security groups Users who can create security groups Group that can use selfservice for security groups Enable delegated group management for users through the access panel Enable users to create new security groups through the access panel Select some to restrict security group management to only a limited group of users Defines the group of users who are allowed to create security groups Yes Yes/No All/Some Enter AD Group Name: Users can create Office 365 groups Users who can use self-service for Office 365 groups Preview Feature Enable users to create new Office 365 groups through the access panel Restrict management. Select some to restrict Office 365 group management to only a limited group of users. Yes/No All/Some Group that can use selfservice for Office 365 groups Defines the group of users who are allowed to create security groups Enter AD Group Name:

13 12 Enable dedicated groups Enable "All Users" group Select yes to enable dedicated groups in the directory Select yes to enable the All Users group in the directory. Yes/No Yes/No Display name for "All Users" group Default: All Users Enter Group Name: 1. When the above information has been gathered, sign in to the Azure Management Portal as a co-administrator for the end customer tenant. 2. Select the AAD tenant for the end customer:

14 13 3. Select the CONFIG tab. 4. Scroll down to group management. 5. The user password reset policy will populate will the configurable options:

15 14 6. Complete the configuration according to the information gathered from the end customer. 7. Once complete, select SAVE. 4.2 Dynamic group membership The following section provides an example scenario where group membership within AAD can be established dynamically, based on user attributes synchronized from on-premises user properties. This example will dynamically add marketing users to the Twitter AAD group. This group will then be used in section 5 to assign Software-as-a-Service applications to users.

16 15 1. From within the Azure Management Portal, select the AAD tenant for the end customer: 2. Select the GROUPS tab:

17 16 3. Select ADD A GROUP. 4. Enter the following information: Field Description Value Name Friendly name of the group Twitter Group type Description Select the group type for this group Use this field to describe the group s purpose, members, or access type that would be granted when a user becomes a member Security Twitter for Marketing

18 17 5. Click the tick button to create the group. 6. Once the group has been created, select the group to view the properties. 7. Select the CONFIGURE tab: 8. Under the dynamic membership tab, select YES to ENABLE DYNAMIC MEMBERSHIPS. 9. Select YES to the warning popup: 10. Build the ADD USERS WHERE membership query with the following information: Radio Button Drop-down Menu Add Users Where Department Equals (-eq) Marketing

19 Select SAVE. All users with the Active Directory attribute Department with Marketing as a value will be dynamically added to the group. 12. Review any dynamically assigned members of the group by selecting the MEMBERS tab in the Twitter Group menu:

20 19 5 Configuring Software-as-a-Service applications AAD integrates with thousands of Software-as-a-Service (SaaS) applications. CSP Partners will want to provide end customers with access to SaaS applications managed by AAD. Review the list of available applications at the Azure Active Directory Marketplace with the end customer, including any designated as a CSP Partner who are included as part of the offering to the customer. Once the appropriate applications for the end customer have been agreed upon, these can be added to AAD to provide managed and secure access to SaaS applications.

21 Adding Active Directory SaaS applications In this example, the following instructions will add Twitter to AAD as a managed application for the end customer. This Twitter SaaS application will integrate with the dynamic group created in the previous section of this document to define which end customer users can gain access. Additionally, as the application is managed, each of the end customer users, defined in the dynamic group, will be logging in with a single Twitter for Marketing account, and therefore will not require individual usernames and passwords for access. 1. Sign in to the Azure Management Portal as a co-administrator for the end customer tenant. 2. Select the AAD tenant for the end customer:

22 21 3. Select the APPLICATIONS tab. 4. There will be applications provisioned automatically as part of the EMS and any Office 365 subscriptions: 5. Select ADD. 6. Select Add an application from the gallery:

23 22 7. Enter Twitter into the search field and select the search icon. 8. Enter the display name of the application as Twitter for Marketing: 9. Click the tick icon to continue. This will add Twitter for Marketing to the list of managed AAD applications. 10. The properties of Twitter for Marketing will now be displayed:

24 Select Assign accounts. 12. Enter within the search field the word, Twitter, and tick the box to continue. 13. A list of all AAD groups with the word Twitter will be displayed. 14. Select the Twitter group and select ASSIGN:

25 A window to configure the authentication for the SaaS application will appear. 16. To configure a shared account for the SaaS offering that is managed by the administrator, enter the following values: Setting Description Value I want to enter credentials to be shared among all group members User name Password I want to enable auto password rollover Administrative populated credentials without the need to provide individual users with the authentication details Refer to Azure Active Directory enables automatic password change for shared accounts for further details Selected Application user name Application password for user name provided above 1-13 Weeks During each password update, the password is updated using a randomly generated 16-

26 25 character complex string. To disable this feature and regain normal access, you will need to go through the password reset procedure provided by the application. 17. Select the arrow to continue. 18. Select the Rollover Frequency: 19. Click the tick box to continue.

27 26 This process can be repeated for any other SaaS applications that are to be integrated with AAD for the end customer. For tutorials related to other AAD integrated SaaS applications, refer to the Azure documentation List of Tutorials on How to Integrate SaaS Apps with Azure Active Directory.

28 27 Reference links CSP Partner Center Portal Azure Management Portal Azure Administration Portal Customizing Password Management to fit your organization's needs us/documentation/articles/active-directory- passwords-customize Password Writeback Active Directory Marketplace List of Tutorials on How to Integrate SaaS Apps with Azure Active Directory us/documentation/articles/active-directory- passwords-getting-started/ Azure Active Directory enables automatic password change for shared accounts us/documentation/articles/active-directory-saas- tutorial-list active-directory-enables-automatic-password-change- for-shared-accounts

29 28 Connect to Office 365 PowerShell Use Windows PowerShell to perform Office 365 admin center tasks from the command line