coming up we take a look at updates to
conditional access part of microsoft's
enterprise mobility and security
solution that allows you to apply access
controls to company data we're going to
explore the new unified azure
administration portal the expansion of
conditional access controls that specify
the app and data access based on the
users and permitted locations and
compliant devices and then we're going
to have a look at risk-based conditional
access controls that incorporate machine
learning to continuously safeguard
access to your apps and data in real
time
[Music]
so today i'm joined by alex simons a
regular on the show from the enterprise
mobility and security team alex welcome
to the show hey simon nice to be back so
alex we've covered conditional access in
a couple of previous shows and i know
that it's a set of um policy rules that
define the circumstances under which
users get access to corporate data
but before we go into some of the
changes i know that we've made in the
product uh can you tell us like a little
bit more about conditional access just a
level set for folks yeah sure simon look
so in the old days everybody had you
know like a firewall and a directory and
some pcs and servers but it was all kind
of on premise and that gave you control
over things you knew what was going on
you didn't have to worry about security
very much you didn't have to worry about
were people doing the right things
right but as the internet comes along
right and all of a sudden there are
things like salesforce.com and concur
maybe the people want to use and as
employees are bringing lots of devices
like their iphones and their you know
android devices to work and want to get
those to get work done on all the sudden
it had a big challenge right and
initially you know you could just hook
up maybe one app or you could give
somebody a vpn on their device so they
could get back to your corporate network
and that kind of worked in 2009 right
but as you get to more and more of your
corporate it's state being in the cloud
in lots of different services and as
your employees want to use more and more
devices and as customers and partners
want to connect with you it all just
falls apart you can't use your firewall
and your on-premise directory to manage
that anymore right so really what you
need is you need a cloud control plane
that lets you coordinate between all
those different resources and people and
devices in a way that is compliant and
secure and that's what conditional
access is in the enterprise mobility
suite it lets you do things like dictate
corporate policy on hey where which
users can get to which things which
devices do they have to be on where can
they come from what kind of
authentication strength do they have and
then even what locations are they in
is the app a risky app or a not risky
app in terms of the business impact and
then finally even a risk score from our
machine learning system on does this
really look like it's the user who they
say they are or not and all of those can
work together in a conditional access
system to make you secure and compliant
that's great there's a really good level
set how have we actually been improving
conditional access though well the
biggest change in conditional access
recently has been bringing all of those
capabilities together in one
administrative portal right so now in
the new azure portal you can go in and
you can see all of your conditional
access policies across azure active
directory and intune in one place
the second big improvement has been
adding the ability to have multiple
policies per application and to share
application policies across applications
as well as for your whole tenant and
then finally we've also brought risk
scores in so now you can have
conditional access policies that include
the risk score as well as all of those
other factors so they sound like great
features can you show them in action
yeah so let's take a look at a demo like
i was an employee at the company okay
okay so here i am in the my apps portal
for azure active directory and you can
see all the apps have been assigned to
me each of these have different policies
depending on the app sensitivity that my
admins created for us okay so let's take
an easy one like box you know the
security level on that they're not too
worried about i can just click and get
immediately single signed into box no
problem right but a more sensitive app
like salesforce you know it has all our
customer records and stuff i probably
want to do a two-factor authentication
for that right so let me get out my
phone here
and then we'll go ahead and i'm going to
click on salesforce and you'll see how
it's going to force me to do a second
factor authentication before i'm logging
able to log in so uh on my phone i'm
going to get a call and this then adds a
whole new level of security uh to the
login so now we really know it's me
before i can get into salesforce.com and
you'll see look there my authentication
completed pretty cool excellent okay
right now if
let's go ahead and take a look at a
really sensitive app like this is one
which maybe has some like financial data
or something that i can't access if i'm
not on the corporate network right so
here we are in the studio obviously i'm
not on the corporate network let's go
ahead and click on this one and you'll
see that as we try to log into this app
it tells me oh i just can't get there
from here there's nothing i can do about
that that's pretty cool and i even have
details here that show me uh the ip
address that i came from so that if i
need to call help desk or something it's
easy for them to figure out what's going
on what about if you're coming from a
device that we know nothing about yeah
so you know some things are pretty
sensitive and you might not want people
to be able to download documents or
things like that so let's take a look at
this sharepoint site on this sharepoint
site when i try to log in this device
isn't registered yet and managed by my
mdm so the sharepoint type when i log in
comes up and tells me hey i can't get
there but it gives me instructions on
how to get my device managed and all i
have to do is click on that and here you
can see i'm in the experience to get my
device managed by my company so i can
get access that's pretty cool and that's
going to take you through the intune
enrollment process so yes exactly nice
so alex you also mentioned risky logons
uh what happens in those circumstances
well so simon our machine learning
system in identity protection is
watching every single log on for
suspicious activity uh and so if i try
to log in something that looks risky
it's gonna block me because it's you
know most likely i'm a hacker so let's
take a look here i'm going to try to log
into that same account using a tor
browser right and a tor browser is just
an example of the kind of thing maybe a
hacker might do
so if i try to log into my office
account using that tor browser let me
just get my password here
you'll see what's going to happen is in
real time my login is scored and it's
high risk because it's coming from an
isp address and so i've been blocked and
i can't get in here that's a pretty
awesome and robust set of controls that
you've been able to build directly into
the product yeah it really lets you
create corporate policy for both
compliance and security reasons right
that keeps your data secure but also
lets the board director sleep at night
so how do we get this all working from
an i.t point of view yeah so simon we've
talked about how this has all been
brought together in the new azure portal
so let's go ahead and take a look at
that here i am in my azure ad blade but
we're going to take a look at the
conditional access policies so the first
thing i want you see here is here's all
my conditional access policies and you
can see that i have multiple different
policies some of them based on for
instance like the high business impact
and medium business impact applications
but i can also have multiple policies
per application so you can see here this
is a sales force policy about requiring
multi-factor authentication this down
here is a salesforce policy that says i
can't get to it from an android device
okay so let's go ahead and take a look
at the require mfa policy for salesforce
and how that works so here you can see
is my policy i can pick which set of
users and groups it applies to for
instance i can pick all users or select
users and groups in this case the sales
group
i can also if i want exclude some people
from it so here the administrators have
been excluded so they can always get in
to get work done
i can choose which applications this
policy applies to so you can see here in
this case obviously it's a sales force
policy but i could use this for other
apps as well if i want to i can just add
a new one or i can make it apply to all
my applications that's been really
popular with customers and then i can
apply select the conditions under which
this applies so let me show you this
this is probably the coolest part right
so first i can like we were talking
about i can have my sign in risk right
so let's go ahead and turn on some sign
in risk here and so now when the
identity protection system sees that
this is a higher medium risk login i
want it to block those so i'm going to
make it apply to those higher medium
risk logins
i want to also make it so that people
have to be using a managed device like
it's you can't just use this on your
home pc right that's just too risky so
i'm going to configure this so that all
of my platforms android ios windows
phone and windows all have to be in a
managed and compliant state
i can pick the locations that people can
get to it from for instance i can set up
a whole range of ip addresses that
represent my corporate network so you
can only get to for that but given it's
a sales app i want people to be able to
use it wherever they are
and then finally i can pick which kinds
of applications even can access the
service so in this case you can see here
i've set it up so that only people using
a browser can get to it so they can't
download the data and take off with it
right so that's a pretty cool set of
conditional access policies
and now let's go ahead and take a look
at the way that i can control whether
they get access or not right so those
are all the things that essentially say
should this policy be applied now right
and then now here i can say okay look i
want to either block access so if the
risk score was super high block access
or i want to allow access but i want to
require some things right so in this
case we're requiring multi-factor
authentication but i'm going to update
this to also require that their devices
be compliant and then one of the really
cool things is down here you can decide
how restrictive is this am i going to
require them to do an mfa and have a
compliant device or if is either one
okay so we've got some really granular
controls and compliance policy yeah i
mean essentially you can now take all of
those different pieces of context we
were talking about the user and their
auth strength and their device and make
sure that you've got a policy that meets
your corporate security and compliance
requirements and what level of reporting
is there around this you can see all
kinds of stuff so for instance every
time
you want to look and see okay what were
users doing was there anything that
seemed risky you can come in and check
out all your users so here let's take a
look at jennifer davis you'll see that
jennifer has 10 high risk events that
have been flagged by the machine
learning system
and i
wonder what the heck is going on and you
can see all kinds of stuff happening
here she signed in from an anonymous ip
address she seems to have tried to sign
in from a place that was too possible
too far for her to go to she's coming
from an affected device
and from locations where no one in our
work ever goes most likely jennifer's
account has been hacked right maybe she
was phished or something like that and
there's someone trying to log in as her
so i'm going to go ahead and reset
require her to reset her password so the
next time she comes in she'll have to
pick a new password and complete an mfa
so that we can reclaim her account and
get it out of the hands of hackers so
alex it's fantastic to see that we've
got this granularity of controls
available across the whole of enterprise
mobility and security and in a single ui
what else do we invest in well so simon
you can really see how we're bringing
all of the capabilities of the
enterprise mobility and security suite
together in one control plane right and
so what you'll see is more and more of
this kind of work where we bring the
controls of intune the controls of azure
ad and all the rest of the enterprise
mobility suite into one administrative
experience and integrate all those
capabilities together what are the next
steps that people should take well simon
all this is working today and available
right so anyone who wants to can just go
to the azure portal and try it out or if
you want to learn more just click on the
link below alex thanks a lot for coming
on the show you can also keep watching
microsoft mechanics for the very latest
tech updates we'll see you soon
you