Think security first when switching from traditional Active Directory to Azure AD

What enforces your safety boundary at present? What is going to implement it within the subsequent few years? For a few years, Microsoft Energetic Listing has been the spine and basis of community authentication, id, and connection. However for a lot of organizations transferring to cloud purposes or having a combination of working methods, the necessity for cloud-based community administration is on the rise.

Some companies are merely including synchronization between on-premise networks and cloud environments and calling it a day. However too usually consumer habits that had been acceptable in a conventional area are now not acceptable in a cloud-first surroundings the place you might not be fairly as conscious of assaults and the way attackers goal you. 

Over the previous few years, I’ve seen an increasing number of organizations query whether or not they need to be deploying conventional Energetic Listing anymore, on condition that Home windows 10 has seen its closing rollout (except for safety updates) and can now not be supported as of 2025. However everyone knows that one can’t have unmanaged computer systems, thus there may be the necessity for some form of administration mechanism.

Likelihood is that many are contemplating Azure Energetic Listing and cloud purposes to interchange conventional Energetic Listing capabilities — particularly newly fashioned or geographically dispersed organizations and presumably these using different working methods along with Home windows. The query is, is Azure Energetic Listing strong sufficient to be relied upon fully?

With Microsoft having introduced Home windows 10 22H2 as the ultimate launch of Home windows 10 and deployments now turning to Home windows 11, it might be time to assessment choices for adopting Azure Energetic Listing.

Take the time to get to know Azure AD fundamentals

When deciding to transition to Azure AD, take the time to know the fundamentals. You can begin with Microsoft’s documentation on the variations between on-premises Energetic Listing and Azure AD.

For instance, it’s useful to know that with Home windows 11, you’ll be able to instantly be part of a workstation to Azure Energetic Listing to benefit from its authentication course of. With an Azure P1 license, you need to use conditional entry to additional defend and handle deployment. Moderately than utilizing group coverage to handle gadgets, you’ll be able to pivot to Microsoft Intune to handle safety patches.

And Microsoft just lately launched a Home windows Native Administrator password resolution changing its Legacy LAPS toolkit. Home windows LAPS and Intune can be utilized to handle a neighborhood administrator password. Notice that the power to handle and retailer the password in Azure AD is in preview right now. Clearly, Microsoft sees that extra of us are wanting to maneuver to cloud-only deployment.

Consider the prices and advantages of switching to Azure AD

As well as, you’ll need to consider the prices and advantages of the licensing you’ll need to correctly defend your group. Whereas Microsoft offers a primary Azure AD, I might strongly advocate that you simply select both Premium P1 or P2 choice to deploy in your group. P1 consists of device-based conditional entry, whereas P2 offers risk-based conditional entry.

Reviewing the instruments you’ve been utilizing to manage conventional Energetic Listing and figuring out the cloud equivalents is vital. However don’t simply take what you do on-premise and do precisely the identical factor within the cloud — for one factor, the kinds of assaults on and the weaknesses of the 2 methods are of a distinct nature. The boundary of the cloud tends to be authentication and id and it’s much less reliant on firewalls as a protecting outer barrier. If an attacker can purchase credentials in a cloud surroundings, they’ll usually pivot into coming into cloud-based sources as properly.

Azure AD setup in Home windows 11 is simple

Becoming a member of a Home windows 11 workstation to Azure AD is now a part of the out-of-box setup expertise, although it is going to require a Home windows 11 Skilled, Enterprise, or Schooling model to carry out this perform. Once you activate Home windows 11 there’s a immediate that asks: “How would you wish to arrange this machine?” If you happen to select “arrange for work or college” this offers onboarding for Azure. Use the credentials you’ve arrange in Microsoft 365/Azure Energetic Listing.

The consumer will probably be prompted by the Microsoft account course of and when you have mandated multifactor authentication, you can be prompted accordingly. Then Azure AD will examine whether or not enrollment in cell machine administration is required, after which the general Azure AD enrollment is carried out. To confirm {that a} machine has been enrolled in Azure AD you’ll be able to go to Settings > Accounts, which is able to point out whether or not the machine is linked and supply info concerning what’s managed.

Within the Azure portal, you’ll be able to assessment these gadgets which are compliant in addition to non-compliant along with your insurance policies. You’ll additionally have the ability to handle Bitlocker keys, conditional entry, in addition to Intune. Do word that as with many cloud deployments, one needs to be affected person when onboarding computer systems. New gadgets is not going to present up within the portal for a number of hours, thus it’s sensible to plan accordingly.

Concentrate on how attackers goal Azure AD deployments

It’s additionally sensible to additionally concentrate on how attackers are focusing on Azure deployments. Many assaults begin with password-spraying strategies for Microsoft On-line accounts. Thus, it’s extremely beneficial that your deployment strategies ought to embrace multifactor authentication as a default verification possibility.

Conditional entry that permits you to set boundaries and alerts for uncommon actions is one other instrument that may permit you to higher defend your community from threats and assaults. Your password processes and insurance policies ought to be reviewed as you start the method to show to Azure AD.

Lastly, you’ll be able to benefit from Azure AD even If you happen to aren’t but absolutely migrated to Azure. It’s possible you’ll not have realized you’ve entry to a number of instruments with a hybrid deployment, comparable to Azure AD password safety, which is offered in Azure AD P1 or P2 licensing. Utilizing this function, you’ll be able to set a password coverage in your Azure AD that mimics what you have already got in your on-premises energetic listing.

Password safety conditions in Azure AD

You will want the next conditions:

1. Azure AD Password Safety Proxy put in on one (or extra, ideally) servers in your surroundings.
2. An Azure subscription with a Log Analytics Workspace
3. Area Controllers on DFS-R for Sysvol replication
4. All Area Controllers put in with Azure AD Password Safety agent
5. Area Controllers onboarded by way of Azure Arc (or forwarding particular occasion logs to Azure by way of one other methodology).
6. Azure AD Password Safety Proxy servers onboarded by way of Azure Arc (or forwarding particular occasion logs to Azure).

You possibly can then construct a workbook to synchronize your password insurance policies in order that your Azure AD could have the identical construction as your on-premise Energetic Listing insurance policies.

Even in case you are nonetheless absolutely entrenched in on-premise Energetic Listing, you need to at all times maintain a watch out for brand new choices and new strategies to guard and broaden your community. Azure Energetic Listing ought to be seen as one other instrument in your arsenal of id and safety.