Securing Azure AD Identities

0:06Now that we know what is Azure AD Identity Protection is and how it uses intelligence to let us know about risky activities so that we can make decisions, well, it's time to take a look at the policies that we can use with Azure AD Identity Protection to make some things happen. So let's get started. All right, here we go. We're in our NuggetLabs Azure Active Directory. We're going to create some Azure Identity Protection policies. We're going to take that intelligence that we have from our machine learning, those signals, and we're going to put policies into play.

0:39So let's do that. Let's go on down here to Security, and we'll let that load up. Then we're going to go up here to Identity Protection. All right, there we go. Here's some nice data. Oh, what's going on here? We've got some graphs, we've got this here. What is this? User risk policy, user risk policy. If I scroll down here, new risky sign ins detected. Hey, look at there. So if I were to click on one of these, let's do this here. Click on that, it's going to go in here. And I'd have to go in here to remediate it, and I'll show you why.

1:13There we go. There's our logins. Those are risky logins of recent. And you'll see this is-- there's the Tokyo and Germany and Australia, those are all in there. So that's going with. Let's go back to Identity Protection, but we get some nice graphs anyways. So those reports, risky users, risky sign ins, the risk detections that we just looked at in the last Nugget, they're right in here as well. Now, what I want to talk about are these three up here. Pretty good stuff, let me tell you. Starting off with user risk policy.

1:44So let's click on that. It's going to open this up. Policy name, user risk remediation policy. OK. So the assignment, users. I have this set to all users. Now, you don't have to. You could say selected users, or all users and then exclude specific users if you wanted to. So maybe I don't want the admins to fall into this or maybe certain C-level execs, I don't want to fall into this. Whatever it might be. But right now I have all users. Then we come down to user risk. This is the user risk score.

2:15You get to select as part of this policy that who do you want this to apply to? All users with medium and above is what it's set to, or it could be just high or could be low and above. But if they're at that risk level, and, again, it depends on the activities that are going on. If they have a risk level that matches this, they're going to fall into this policy. So what's going to happen? This is the controls. What's going to happen if they fall into this policy? Well, right now, if I click on here, it's set to allow access, require password change.

2:46And that's what we could choose. Or you could just say block access. So if this user has a high risk level, we're just going to block them completely. Well, that can turn into a problem. Require password change is probably pretty good. So let's start with that and kind of see where it goes. Then we're going to say, Done. And this is a policy error they had in place. And it was enforced, and that's why, let me bring this in again, that's why I got this password change notification this morning after those logins from all over the place.

3:17And, by the way, I did those yesterday using a VPN. So I just connected to the different countries and logged in. It wasn't really malicious. So don't worry too much. But it's a good way to test to make sure that your policies are functioning properly. So that was our user risk policy. Now, quick reminder, user risk relates to a specific user's credentials like leak credentials or attack patterns targeting specific credentials. This would be really better renamed probably as like credential risk policy. But that's what it is.

3:48Then we have sign in risk policy. And it looks very much the same. And the sign in risk policy, again, this helps identify malicious login attempts that aren't from the actual user, like from an anonymous IP address or an IP address associated with malicious activities or the impossible travel we talked about. But the idea here is if it falls in that risk category, then we want to do something. So right now, it's set to all users. You can, of course, go ahead and exclude or do just a specific group, like an admin group or something.

4:20So we'll leave it at All Users, put they're sign-in risk. You want high, medium and above or low and above, you get to select that, of course. And then down here for controls, you could either block access or allow access and require multifactor authentication so that you sign in. So there we go. So the sign-in we require MFA because it's actually signing in the risk policy. We see a target going on against a specific user, so we want them to reset their password. So that's our options right there, and that's, of course, is turned on.

4:52There we go. And one more policy I want to talk about MFA registration policy. So within our MFA registration policy here, this is designed to help push out MFA to your selected users. Right now it's to all users here, but you can do selected individual users. So if you put your per user MFA only to a handful of users, you create a group, put them in there, and you could do that by group. So there's that. So we just went with all users. And then your controls down here requires Azure AD MFA registration. So what we're doing is we are requiring them to go ahead and set this up.

5:26So at our user's next login through a browser, they will be prompted to go ahead and sign up for MFA. However, they will have an option to bypass this for 14 days. But after 14 days, the next time they log in, it will be mandatory that they sign up. So you can set up this MFA registration policy. Now, I want to talk about something that I had to run into. And it's dealing with these policies here. And the idea that if a user here matches one of these, all right?

5:59Maybe they had a high risk or something. Think about what causes that risk. Because if they can't log in because of a high risk, what we need to do is reduce that risk. And how can we reduce the risk? Well, if you do certain things like reset your password, that reduces your risk. So for instance, if you were locked out for a certain reason because of a high risk, try resetting your password and then waiting 15 or 20 minutes, and that should reduce your risk and you should be able to sign in at that point. Just depending on what's going on, of course.

6:29But that is something that I found along the way that, you know sometimes, you just need to wait and reduce your risk of your account so you can get back in or something like that. OK? So that's just a little bit of wisdom from the trenches. I hope this has been informative for you, and I'd like to thank you for viewing.