Manage external identities by using Azure AD

Azure AD External Identities is a set of capabilities that enable organizations to secure and manage customer, partner, and vendor access to their corporate apps and services. It allows users without an Azure AD account to sign in using their own credentials or social identities such as Facebook, Google, or Microsoft.

Azure AD B2B (Business to Business)

Azure AD B2B collaboration provides secure sharing of your company resources to external partners. These users can be given access through a variety of methods, such as a direct invitation or through self-service sign-up.

Inviting External Users:

Admins can invite external users to their organization using the Azure portal, PowerShell, or APIs. Invited users receive an email with a redemption link to access shared resources.

Self-Service Sign-Up:

Azure AD allows external partners to sign up via user flows that admins can customize depending on the application’s requirements. With this capability, you can manage who can access what, enforce multi-factor authentication (MFA), and automate user provisioning.

Azure AD B2C (Business to Customer)

Azure AD B2C is a customer identity access management solution that enables you to customize and control how customers sign up, sign in, and manage their profiles when using your applications. It differs from B2B collaboration as it focuses on app-specific user bases, typically end customers.

Policy and User-Flow Configurations:

Identity experiences are configured through user flows or custom policies allowing full control over branding, languages, and user experiences.

Conditional Access Policies

With external identities, enforcing Conditional Access policies is crucial for maintaining security. These policies allow organizations to define conditions under which users are allowed access, including user risk, device compliance, IP location, and more.

For example, you might enforce a policy that requires all external partners to perform MFA when accessing certain resources or block access from specific countries.

Governance and Lifecycle Management

Azure AD provides tools for governing external user access. Access Reviews is a feature allowing you to assess if users still require access to your resources. You can also automate responses or involve resource owners in the decision-making process.

Entitlement Management is another tool that automates access package assignments (which consist of resources, applications, and SharePoint sites) for external users. This tool streamlines the process of managing user lifecycles and access.

Monitoring and Reporting

Monitoring external user activity is essential. Azure AD offers auditing and reporting features which give insights into sign-ins, changes made, and security incidents, among others.

Azure AD reporting tools can generate reports such as:

• Sign-in logs: Shows sign-in activity of your external users.
• Audit logs: Details configuration changes and other significant events.
• Risky sign-ins: Highlights sign-in attempts that could indicate a security risk.

Example Implementation

Consider a scenario wherein Company A collaborates with Partner Company B. Company A can invite specific individuals from Company B to collaborate on a project by using Azure AD B2B. An invite is sent, and upon redemption, Company B’s users can securely access resources shared by Company A, such as documents on SharePoint.

To ensure security, Company A sets Conditional Access policies that require MFA from external users accessing the project resources from outside Company A’s network. If any user’s risk profile suggests suspicious activity, access can be blocked, or they can be required to reauthenticate.

Moreover, with Access Reviews set up, Company A periodically reviews the access of Company B’s users to evaluate whether they still need access or if their permissions should be modified or revoked.

In conclusion, Azure AD offers a comprehensive set of tools to manage external identities securely and efficiently. By leveraging capabilities such as Azure AD B2B, B2C, Conditional Access, Governance, and Monitoring, organizations can extend their networks, collaborate seamlessly with external users, and maintain a strong security stance. Following these best practices can help candidates understand the key concepts of managing external identities in preparation for the AZ-500 exam.