Securing Azure AD Identities

0:00[AUDIO LOGO]

0:06In order for someone to use Azure services,

0:09they need a user account.

0:11And that's what we're going to be focusing on in this Nugget.

0:14We're going to be focusing on Azure AD user accounts.

0:17And believe it or not, there is more than one type.

0:20So what do you say we get started?

0:22Let's jump in and get to work on these user accounts.

0:25All right, we're starting off with users.

0:27And we're here in our Azure Active Directory portal.

0:30I'm in my NuggetLabz tenant.

0:33And I'm going to go down here to Users.

0:36You guessed it.

0:37There we go, users.

0:38All right, I want to talk about this for a minute

0:40because in order to create user accounts, well,

0:44you need to have the Global Administrator or User

0:47Administrator role.

0:48So let's dive into the users.

0:50We've actually got three different types of users.

0:54And there are several listed.

0:55We have 12 users found here.

0:57And there's three types.

0:58We have something called a member user.

1:01And that's where we have Member here.

1:03We also have guest users.

1:05There are no guest users here.

1:07And we have Azure AD hybrid users.

1:11And these are accounts which have

1:12been synced with an on-premise Active Directory server.

1:16Now, it's a little misleading because when

1:18you see User type here, you're going to see Member and Guest.

1:22You're not going to see Azure AD Hybrid users.

1:26But there's a way to tell.

1:27If this is a directory-synced user,

1:30like we see Directory synced up here at the top,

1:33that means it was synced from an on-premise Active Directory.

1:36We have lots of Yeses here.

1:38And these are all Azure AD hybrid user accounts.

1:42They were synced from an Active Directory server.

1:46However, if we come down here, we've got some Nos.

1:49Here's a No right here for Morpheus Nugget.

1:51And there's a No down here for Robert Salmans

1:55and one for Trinity Nugget.

1:56That means these are Azure member accounts.

2:00So they are here.

2:01They were created by going to New user

2:03and creating a new user account directly

2:06within Azure Active Directory.

2:07They were not synced from an on-premise Active Directory

2:12server.

2:13So those are the three different types.

2:14Once again, we have our member users.

2:17We have our guest users and our Active Directory hybrid users.

2:22So let's go ahead and let's say we create a user.

2:25We're going to create an Azure Active Directory user.

2:28So we're going to say New user here.

2:30And this is going to be a member user.

2:33So what we want to select is Create user.

2:35If we select Invite user, well, that's

2:38how we create guest accounts.

2:40We invite outside parties or outside individuals,

2:44usually with a business partner or vendor or something,

2:46that we're going to collaborate with.

2:47We invite them in with a guest account.

2:50We're not doing that.

2:51We're creating a member account.

2:53So for a username, we're going to go with Neo.

2:57And there we go.

2:58We're going to leave it at the onmicrosoft.com.

3:01Name, we're going to go Tom Anderson

3:03because this is the full name.

3:05Tom.

3:06Anderson.

3:07There we go.

3:08Then we have Auto-generate password

3:10or Let me create the password.

3:12Now, if you select Auto-generate password,

3:14it's going to autogenerate it.

3:15And you can show it and see what it is.

3:16But it's going to also send the creator of this account, which

3:21is me, this password so that I would have it documented.

3:25But you could also say Let me create the password.

3:27And you could type it in, and away you go.

3:30So we'll just say Auto-generate.

3:32Now I'm going to scroll down here.

3:34And we have Groups and roles.

3:36So I could go ahead and select a group to add this user to.

3:39I can also assign some roles if I'd like to.

3:42Then under Settings, we have Block sign in.

3:44Right now, it's set to No, and that's the default.

3:47However, maybe Neo isn't going to start for another two weeks.

3:50I'm just kind of getting ahead of things

3:51and getting the user account created

3:53so it's ready when he shows up.

3:55So I could say Yes and go ahead and block sign in.

3:57And that way, it's blocked until he shows up,

3:59and then I unblock it.

4:01All right, then we have Usage location.

4:03We're going to say United States.

4:06That's where we're at.

4:07Now, this is very important.

4:10If you do not assign a usage location,

4:13you cannot assign this account licenses later on.

4:18So if you go to try to assign an account a license,

4:20it doesn't have a location, you're going to get an error.

4:22And then you're going to have to go back to the account

4:25and assign a location.

4:26Then you can go ahead and assign licensing.

4:28Then we have some job info here.

4:30Job title-- let's see, what is Neo?

4:34Well, let's just say he's an engineer.

4:36That'll work for me.

4:36Department, Engineering.

4:39There we go.

4:39Company name, NuggetLabz.

4:42Manager, you can assign a manager.

4:43No, you don't have to assign this stuff.

4:45However, if you use dynamic groups,

4:47which we're going to talk about later, these can come in handy.

4:50As you can imagine, a dynamic group

4:51looks at attributes of user accounts,

4:54and it groups users into a group.

4:56Maybe we have a group of engineers.

4:58So our group is named Engineers, and it looks

5:01for the job title of engineer.

5:03And it throws everyone with a job title of engineer

5:05into the engineers group automatically so we

5:07don't have to do it manually.

5:08So that is a dynamic group.

5:10Just kind of a little sneak preview there.

5:12But that is what those attributes are so helpful for.

5:16And now we go ahead and click Create.

5:18It's going to create our new account.

5:20And here we go, Tom Anderson.

5:22And you see under Directory synced, No.

5:24That's because we created this in Azure Active Directory,

5:28and it is a member account.

5:31And the account is enabled right there.

5:33Excellent.

5:33So that is creating a user account

5:36within Azure Active Directory.

5:37However, that's not the only way that we

5:40can create user accounts.

5:41We can jump on over to MS 365 Admin Center.

5:46That's where we're at right now.

5:48So what we can do is if we expand Users here and go

5:52to Active users, we'll get to see all of our users.

5:55And you'll see Tom Anderson that we just created.

5:57Hey, there's Tom right there.

5:59What do you know, Mr. Anderson.

6:01[LAUGHS]

6:03All right, so there's Mr. Anderson.

6:04Now you can also go in and add a user here.

6:07So hey, why don't we just do that?

6:10So let's click on Add user and see what it looks like.

6:14So here you put in your first and last name, display name,

6:16username.

6:17Looks pretty similar, doesn't it?

6:19Yes, it does, similar to the way we did it

6:21Azure Active Directory.

6:22Automatically create a password.

6:24Require users to change password when they first sign in.

6:26And send password in email upon completion.

6:29You have these options.

6:31So let's just fill in a little info

6:33just so we can go through and see what it looks like.

6:38I say Next.

6:39Product licenses, a-ha.

6:41This is different.

6:42This is where we set the location.

6:44And you'll notice, I can't not set a location.

6:47It defaults to something.

6:49And again, we can't assign MS 365 license

6:52or even as Azure Active Directory licenses

6:54if we don't assign a location.

6:56That's why it requires it.

6:57And then I can go through here, and I can assign licenses

7:00if I would like to.

7:01But I don't have to.

7:02I can say create a user without product licenses,

7:04and that's what I'm going to do.

7:06I'm going to say Next.

7:07And then it comes down to the roles and profile information.

7:10So here we have Job title, Department, Office,

7:12all this good information again that

7:14can be used for dynamic groups.

7:16Under Roles, we can say add the Admin center access

7:20if we want to.

7:20We can assign roles in here.

7:22And then lastly, we come to a Review and finish.

7:25I'm not going to create this user.

7:26I just kind of wanted to walk through and show you

7:28what it looked like.

7:29So there we go.

7:30Let's go ahead and close out of this.

7:33See if we can go back and--

7:35there's your Cancel right over there.

7:36OK, yes, I want to cancel that out.

7:38All right, so we can create users

7:40through Azure Active Directory through Microsoft 365 Admin

7:43Center.

7:44That is awesome.

7:45You can also create your users on premise

7:46if you're doing AD Sync.

7:48And those were the accounts that synced up

7:51to-- let me go back here over here to Azure Active

7:53Directory-- those that did sync, like our directory sync,

7:56to our Azure AD.

7:57Those came from a local domain controller.

8:01So that is the third way, through our domain controllers.

8:03And then lastly, there's a fourth way,

8:05and that's through PowerShell.

8:07And that's what we're going to look at in the next Nugget.

8:09So I will see you there.

8:10I hope this has been informative for you,

8:12and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06We're continuing with Azure AD user accounts.

0:09And in the last Nugget, we saw how

0:11to use the Azure AD portal and Microsoft 365 portals

0:15to create user accounts.

0:17Well, that's not the only way to do it.

0:19We can also use PowerShell to do so.

0:21And that's what we're going to do right now.

0:24All right, here I am in the Azure Active Directory portal.

0:28So now I'm going to open up this Cloud Shell right here.

0:32At the top, you see where the cursor is.

0:34It's got this terminal-looking icon, and it says Cloud Shell.

0:37We're going to click that and open it up,

0:39and it's not going to open us up a PowerShell in Azure.

0:43It's going to go through and show you

0:44that it's connecting and such.

0:46And there we go.

0:47Now, if you're doing this from your local computer,

0:49you're going to need to first install the Azure AD module.

0:53So you would simply do Install-Module, space, AzureAD.

0:59There you go.

1:00And you'd run that and install that module,

1:02then you could carry on.

1:03But I'm already here in Azure, so I don't need to do that.

1:06So what I'm going to do is go ahead

1:09and copy in our first command.

1:10Now, what we're going to do is create a password profile.

1:13Because when we create this identity,

1:15we're not going to pass a password directly

1:17into the command.

1:18We're going to pass in a password profile variable that

1:22will then provide in the background what

1:25the password is.

1:26So let me go ahead and copy and paste a couple of things here.

1:31There we go, space, and hit Enter.

1:36There we go.

1:37That created a profile.

1:38I'm going to pass in the actual password to the profile.

1:42So this is the next one, Enter, and there we go.

1:45OK, let's talk about this.

1:46So what we did is create a variable

1:48called PasswordProfile.

1:49We're creating a new object of Microsoft.Open.A

1:52zure.Model.PasswordProfile.

1:53So we're creating a Microsoft password

1:56profile named PasswordProfile.

2:00Pretty straightforward in creating this variable object.

2:03And then what we're doing is we're passing in the password

2:05for it, which is this zNugget1!.

2:08This way, I can represent this password here using

2:13this variable.

2:14All right, excellent.

2:15So that's what I did.

2:16The next thing I need to do is go ahead

2:18and connect to Azure AD.

2:19So I'm going to type Connect-AzureAD.

2:24Enter.

2:24It's going to go through it, and now it's

2:26going to go out and connect to make sure I'm authenticated

2:28there and we're good to go.

2:30So now we can actually go ahead and use the new AzureAD user

2:34commandlet to create the member's identity.

2:37So let's do that.

2:38So let me copy this over here, and then we'll talk about it.

2:44And I'll paste that in, put a space,

2:47let me grab the rest of it here.

2:49Excellent.

2:50And we'll paste that in as well.

2:52There we go.

2:53Let's talk about this.

2:54So we're using the commandlet New-AzureADUser.

2:58That's pretty straightforward.

2:59We're creating a new Azure Active Directory user.

3:01And what we're passing after that is DisplayName--

3:05the name is Annie Oracle--

3:06the PasswordProfile that we created above here, then

3:11the UserPrincipalName, which is Oracle@NuggetLabz.com.

3:15And AccountEnabled, that option, we're

3:17setting it to True so the account's enabled

3:19and Ms. Annie Oracle can log in.

3:22We give it a male nickname, Oracle.

3:24So we're just giving it a nickname, and there we go.

3:27So if I go ahead and hit Enter now, it's going to go through.

3:30Excellent.

3:31And it created it-- gave us an object ID and everything.

3:34So if I go back up here to my portal and I go to Users,

3:38we should now have an Annie Oracle.

3:40So give that a minute to refresh here.

3:42Let's go ahead and hit the Refresh button.

3:44And excellent, Annie Oracle is now showing up.

3:48So that's how we can create a user account using PowerShell.

3:52Or another name for user account is, of course, an identity.

3:56[CHUCKLES] That's part of our IAM, Identity

3:59and Access Management.

4:01So there we go.

4:01That was all four ways that we can create user accounts.

4:04Again, in the last Nugget, we looked at using the Azure AD

4:08portal right here in Users.

4:10We also looked at creating it in the Microsoft 365 Admin Center,

4:15and we talked about doing it through your local domain

4:18controller using AD Sync.

4:20And then, of course, lastly, using PowerShell,

4:23which is pretty darn powerful.

4:25And that wraps up creating our user accounts.

4:29That's our member user accounts.

4:30But in the next Nugget, we're going

4:33to look at creating users in bulk.

4:35Because, hey, who wants to create one user account

4:38at a time?

4:39Not me.

4:40I hope this has been informative for you,

4:42and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06So we've now seen how to create user accounts

0:09in a couple of different ways, but what

0:12if you had to create a whole bunch of user accounts?

0:15Well, you don't want to sit there and create

0:17them one at a time, do you?

0:18Absolutely not.

0:19You might have to create 50, or 100, or 500 user accounts.

0:22Well, that's no way to do it.

0:24So is there a solution?

0:26The answer is yes, bulk creation of users.

0:30Hey, and we can actually also bulk delete users

0:32because maybe you've got some seasonal workers that come in,

0:35and they're only there for a couple of months.

0:37And you need to create a 100 or so user

0:39accounts for those seasonal individuals,

0:41and then you want to remove them after they leave.

0:44So let's see how to do this.

0:46Here I am within my Azure Active Directory.

0:48I'm going to go down here to Users

0:50because that's we're going to create, manage our users,

0:52delete users.

0:53Now, right up here at the top, we

0:56have an option for Bulk operations.

0:58Pretty straightforward.

0:59Bulk create, Bulk invite, Bulk delete and then

1:02Download list users.

1:03Now, invite again, that's when we're

1:05creating user accounts that are guest accounts.

1:08We have Bulk create, we'd use that for our standard user

1:11account, so it's our member accounts.

1:14And then Bulk delete for bulk deleting accounts.

1:16Now, all of these work the same, so we're just

1:18going to look at Bulk create.

1:20And I'll go ahead and click on that.

1:21It's going to bring this slide in window here on the right.

1:23And what it does is it provides us with a CSV or a Comma

1:28Separated Value file.

1:30So we can go ahead and click Download there.

1:32It's going to download that for me.

1:34Excellent.

1:35I close that out.

1:36Now, what I want to do is edit that file.

1:38So what I'm going to do is open the file from my Downloads.

1:42All right, I'm going to pull this file in,

1:43so you can see what it looks like.

1:45And there we go.

1:47And you'll see it was opened up in Excel

1:50because it is a CSV file.

1:53Now I'm going to spread some of these out so

1:56that we can see the information in these here columns.

2:02Now, what we have is display name.

2:04This gives you an example Chris Green.

2:06That's nice and all.

2:08But what we want to do is go ahead and create a new user.

2:11So in here-- well, let's just stick with Chris Green.

2:14That's fine.

2:14Chris Green.

2:16Chris@-- well, we need to change this.

2:18This is going to be nuggetlabz.onmicrosoft.com.

2:25Excellent.

2:28Password, there's a password block sign in that's set to no.

2:30First name, we can do Chris.

2:33Green.

2:34Job title, we could say accountant.

2:37How about that?

2:38How about an accountant?

2:40Excellent.

2:41Department, finance.

2:43Usage location-- we can go through all

2:45this additional information.

2:47Mobile phone, zip code, location,

2:49all those wonderful thing.

2:51Now, again, usage location, this is

2:53going to be important if you're going to assign licenses

2:56to this identity or account.

2:58But then we got Chris Green, maybe we say, then

3:02we also have Janet Blue, and you see where I'm going with this.

3:06Basically, we just fill out this information.

3:08Now, I'm going to go ahead-- and let me get rid of Janet Blue

3:11though--

3:12OK, I'm going to go ahead and do a quick save here.

3:16So we'll save that.

3:17Excellent.

3:17Then I can come over here, I can select the file to upload.

3:22So I'm going to go here to my Downloads.

3:26I'm going to select the template that I updated and say Open.

3:29And then I'm going to say Submit.

3:32And it's going to say In progress here.

3:33Now, this does take a little bit.

3:35It's not really fast.

3:36It takes it a few minutes to go through and actually

3:39read the data in the file and then create the user account.

3:43So I'm going to pause this for just a few minutes

3:45while it does this process.

3:46Then we'll come back and take a look at Mr. Green.

3:50All right, here we are back in the users,

3:52and we now have a Chris Green account here.

3:55It's a member account.

3:57It is not directory sync because we create that directly in here

4:00in Azure Active Directory through our Bulk operations.

4:04So that's our Bulk create, you can do the Bulk invite,

4:06Bulk delete.

4:07If I click Bulk delete, you see it's

4:08going to give you the template.

4:10And we just go through and do the same thing.

4:12So there we go.

4:14Now, what if you want to do a bulk delete?

4:15Well, what about Download users?

4:17If I come to Download users, and we'll say Azure AD users,

4:24and we'll say Start.

4:25So it's going to provide us an export of our user accounts.

4:29Well, this could come in pretty handy

4:31when it comes to doing bulk delete because if I can get

4:34an export in CSV format of all my users, then

4:39I can use that to help me create my bulk delete CSV file.

4:45So now I'm going to say File is ready!

4:46Click here to download.

4:48We'll go ahead and download that.

4:49There we go.

4:50And Azure AD users is going ahead and open that file.

4:54And let me pull that in here, so we can see it.

4:56And there we go.

4:57So there's our userPrincipalNames,

4:59displayNames, surnames, mail, givenID.

5:03So we could use some of this information

5:05to help us create a bulk delete CSV.

5:09And there we go.

5:11Let me go ahead and close that out.

5:13And that's how we go through using

5:15bulk operations to do bulk creates, bulk invite,

5:19and bulk deletes.

5:20I hope this has been informative for you,

5:21and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06Now that we know how to create users

0:08within Azure AD in various ways.

0:11And now that we've finished that up,

0:12it's time to move on to groups.

0:14And we're going to do that right now.

0:16We're going to take a look at the different types of groups

0:18that we can create and why you might

0:20want to use one group over another group

0:22and how to create them in the Azure ID portal as well

0:26as the Microsoft 365 Admin portal,

0:29because we can do it in there as well.

0:31So let's get started.

0:33All right, here we are in our Azure Active Directory.

0:36And if we go down here to Groups and click on Groups,

0:39we're going to see that there's a lot of default groups

0:41that are in here.

0:42I didn't create all these, let me tell you.

0:44I did create the test-group.

0:46But there are several other groups that are already created

0:50in here, and that's fine.

0:52And when we want to create a new group,

0:53we can just go to this New group button up here.

0:55However, we're not going to start here.

0:59We're going to jump over to the Microsoft 365 admin center.

1:04And we're going to start here, and you'll

1:06see why in just a short bit.

1:08So let's go ahead and go down to Teams and groups,

1:10and expand that, and select Active teams and groups.

1:14This is going to list out our active teams and groups.

1:18And if we want to create a new group,

1:20we're going to go to Add a group.

1:22Pretty straightforward.

1:23We're going to click that.

1:24There are four different types of groups that we can create.

1:27And here they are.

1:28These are the four.

1:29Our Microsoft 365, it is the recommended group.

1:33However, I want to put air quotes

1:36around here in recommended.

1:37That's when you're creating groups within the Microsoft 365

1:40admin center, because this creates

1:43a group email to collaborate.

1:46So you can use this with Microsoft Teams

1:48for your conversations files and calendar.

1:50So this is specifically used for--

1:53I'm going to highlight this here, hopefully.

1:55And it won't let me-- collaborate.

1:58So really, what I want you to associate with Microsoft 365

2:01groups, you should associate that with collaboration.

2:05That's what it's for.

2:06We're not going to be able to assign permissions

2:08and roles to this group.

2:09It's just used for Microsoft 365 products and collaboration.

2:14All right.

2:15Then we have distribution groups.

2:17This creates an email address for a group of people.

2:19So this distribution is used for email distribution

2:23within Exchange Online.

2:25It doesn't allow for any type of collaboration

2:28or assigning roles and permissions.

2:30It is only email distribution.

2:33All right, then next up we have Mail-enabled security

2:36down here.

2:37Now, this is a little different.

2:38This is like a distribution group,

2:41but we can also control access to OneDrive and SharePoint

2:46with it.

2:47So it does have some permission-enabled features

2:51within it.

2:51So it's going to have your distribution email assigned

2:54to it but also allow you to set permissions

2:57for OneDrive and SharePoint.

2:58All right, and then lastly, you have Security.

3:00And this controls access to OneDrive and SharePoint.

3:03You can use it for MDM, which is your Mobile Device

3:06Management, within 365.

3:08You can set roles and permissions for these groups.

3:11So this also plays into our Azure Active Directory.

3:15When we're setting roles to groups,

3:16it's going to be a security group when we do that.

3:19So let's go ahead and create this group.

3:23We'll stick with the Microsoft 365 for now.

3:26So we'll just say Next.

3:28We've got to give it a name.

3:29So we're going to say MS365 and then lowercase group.

3:33That way, we know what it is.

3:35I'm going to go ahead and add a description.

3:39There we go.

3:40We'll say Next.

3:41I need to assign owners.

3:43Now, this is pretty important.

3:44When we have a group, we need to assign an owner.

3:47But why?

3:48Why do we need an owner?

3:49IT manages it.

3:50No, we need someone to own it.

3:52They're going to be the owner of the group.

3:54They're going to determine who can be members of this group.

3:59So let's assign an owner.

4:00Let's just give it to Annie, why not?

4:02Annie Oracle.

4:04There we go.

4:04Annie is the owner of this group.

4:06So she's responsible for determining who

4:08the members are going to be.

4:10That means when someone leaves the organization or changes

4:13roles and they no longer need to be in this group,

4:15she's in charge of making sure that those members are removed.

4:19Now, she probably won't do it herself.

4:21She'll open a ticket with IT and the help desk

4:23to have that person added or removed.

4:25But she's responsible for making sure it happens.

4:28So we'll say Next.

4:30Now we could add members.

4:31We could add members.

4:33Let's add me.

4:34I'll be a member of Annie's group.

4:36There we go.

4:37Let's see, there we go.

4:39So let's add that.

4:40And we could add others as well.

4:41But basically, it's pretty straightforward.

4:43And we have some settings, like your group email address.

4:46Well, let's say this was our M365group.

4:51There we go.

4:52That'll work.

4:53And Privacy-- so if we see here, we hover over this,

4:57our public groups can be joined by everyone

4:59without getting approval from a group owner.

5:02That means you don't have to go through Annie Oracle

5:05to become a member of this group.

5:08Anybody could access it within your organization.

5:11Do you want that to be an option for this or not?

5:15Do you want it to be a private?

5:16And this means that it's not open for everyone to join

5:18and that the group owner is the one who can add members.

5:24So there we go.

5:25So let's go with private.

5:27I like the sound of that one better.

5:29Now, you can also go in here and add

5:31Microsoft Teams to this group.

5:33But you do have to have a license assigned to you.

5:36So we don't have that right now.

5:37So we'll say Next.

5:38And we'll go ahead and create the group.

5:40It's pretty straightforward.

5:42Our new group has been created.

5:43So let's close that out.

5:44And now we should see our MS365group right there.

5:49Excellent.

5:50Now we're going to jump back over

5:51to our Azure Active Directory.

5:53And we're going to create a new group here.

5:54Here I'm in our groups.

5:56So I'm going to do New group.

5:58And we're not going to do an MS 365.

6:00We're going to a security group because we

6:02want to assign permissions.

6:04Group name-- who would this be?

6:06Let's say KY-Admins.

6:09There we go.

6:10In our group description, this would be administrators

6:15for the KY office.

6:18How about that?

6:19And then here, Azure AD roles can

6:21be assigned to the group-- do you want

6:22to be able to assign roles?

6:23Well, in this instance, I'm going to say Yes.

6:26The Membership type.

6:27Now, actually, let me switch this back to No real quick.

6:29I want to talk about membership types.

6:30This is pretty important.

6:31So we have Assigned, Dynamic User, and Dynamic Device.

6:36Now, the Assigned is you are going to manually assign

6:40members to this group.

6:42So it's a manual process.

6:44It's kind of what we're used to, generally.

6:46And then we have Dynamic User and Dynamic Device.

6:49Now, dynamic is referring to the fact

6:52that Azure Active Directory will look at attributes

6:55of either users or devices and will add them dynamically,

7:00or automatically, to this group based on their attributes.

7:04So if I do Assigned, and I need to assign an owner.

7:07So I'm going to take this one actually.

7:09Let me just put me in here for this one.

7:11That'll work.

7:12And we'll select that.

7:14So now I'm the owner.

7:15Now, the members-- I'd have to go through here

7:17and manually select which users I want

7:19to be a member of this group.

7:21So it'd be a manual process.

7:22And I want Bill and Chris, and on and on and on.

7:27I can go through and do this.

7:28However, it is, again, a manual process.

7:30So we're going to say Remove and Remove.

7:32We're going to close that out.

7:34That's a pretty standard way of creating a group.

7:36Now, let's take a look at the dynamic.

7:38So let's switch over to Dynamic Users.

7:40So I'm still the owner.

7:41I need to add a dynamic query.

7:44So let's click on that.

7:45So now here we are on our Dynamic membership rules page.

7:49So what we need to do is create some rules.

7:50Now, we already have one here, starting with.

7:53But we can add additional expressions if we want to.

7:56So let's start off here.

7:57Let's say, Choose a property.

7:59So let's go down to, let's say, jobTitle.

8:03And we'll pick an operator.

8:04We'll say Equals.

8:05And the value will be Engineer.

8:08There we go.

8:09So it's going to pull in the engineers.

8:11We could also add other expressions,

8:13like maybe a location would be good,

8:17like a country, your department, maybe jobTitle.

8:21Actually, we used the jobTitle, didn't we?

8:22Yeah, we used jobTitle.

8:24But there's other attributes that we can select down here.

8:28So those are pretty handy.

8:29So really, you can just kind of go wild with it

8:32with your dynamic groups.

8:33But once we have what we think is going to work,

8:37we can actually come to validate rules.

8:39And what are we going to do?

8:40We're going to add users.

8:42And this is going to test against the users.

8:44Now, I remember when we created Neo, he was an engineer.

8:46So let's go ahead and add Neo.

8:48And then let's-- who else did we create?

8:51We got John.

8:53John is in there, I know.

8:54And I'm pretty sure I've only set Neo to be an engineer.

8:59So we're going to say select those two.

9:01And there we go.

9:03Neo, yes, has a check mark, meaning is in the group.

9:07However, John is not in the group,

9:10because John has an X. So let's view the details here.

9:13If I do that, it says here the jobTitle is equal to Engineer.

9:18And yes, Neo's job title was engineer.

9:20So that's what we know.

9:21But if we come down here to John Aseed,

9:24we see that John doesn't have a job title of engineer.

9:30So that's why he failed.

9:31OK, so that means it's validated.

9:34It works because Tom was added and John was not.

9:37So there we go.

9:38We know that that works.

9:39So now I want to go ahead and save this.

9:41So now we have our dynamic query.

9:44And I can actually go ahead and create this group.

9:47And so we'll go ahead and create that.

9:48We'll give that just a minute.

9:50All right, now we'll go find our KY-Admins group.

9:53And there it is.

9:54So if I click on this, it shows that membership type

9:57is Dynamic.

9:59And all right, that's what we set it to.

10:00That is excellent.

10:02I have my owner assigned down here.

10:05But I don't have any group memberships just yet.

10:08And that's because it says right here-- dynamic group membership

10:13updates are expected to process for all groups within 24 hours.

10:17So when you create the group, expect

10:19it to take a little while for the memberships

10:22to be fulfilled for that dynamic query

10:25that we had to go ahead and run and populate this group.

10:30So it doesn't take effect immediately.

10:32Just keep that in mind.

10:33So that's our four different types of groups.

10:36Let's jump back over here to our Microsoft 365 admin center.

10:40We're going to create a group or add a group.

10:44And again, these are our four groups.

10:46A quick review--

10:47Microsoft 365, that is only for collaboration.

10:52Remember that.

10:53Microsoft 365 groups are only for collaboration.

10:56Distribution groups, that's your email distribution.

10:59That's all they do.

11:00No roles or permissions assigned.

11:02Mail-enabled security, that's like your distribution group,

11:05plus some permissions for OneDrive and SharePoint.

11:07And then lastly, our security group,

11:09where we can add roles and permissions.

11:12Pretty darn important to understand those.

11:14And then we also have our dynamic and assigned groups.

11:19So if I jump back here to my groups--

11:21let me go back to Groups here.

11:23And go to New group.

11:24We had our dynamic and assigned.

11:27Remember, assigned was meaning it's a manual process

11:30of assigning members.

11:31Then we can use dynamic for either users or devices, where

11:34we create our dynamic query rules so that these groups are

11:39autopopulated based on the attributes of either users

11:42or devices.

11:43And those are the four different types of groups.

11:45And there are two subtypes, or membership types,

11:48meaning assigned or dynamic.

11:50And that's how we create them in Azure Active Directory

11:53and over here in Microsoft 365 admin center.

11:56I hope this has been informative for you,

11:58and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:05It's time to talk about Azure AD Identity Protection.

0:09And this is some pretty cool technology.

0:11It uses artificial intelligence and machine

0:14learning to figure out what's not normal in the user

0:19activity, what looks risky.

0:21And then it uses that information

0:23to let us know about this risky activity

0:26so that we can manage it and help protect our

0:29is Azure AD identities.

0:31So what do you say we jump in and take a look at this?

0:34All right, here we go.

0:36We are right into our Azure Active Directory.

0:38We're going to be working with Azure AD's identity protection.

0:42Now, Azure identity protection uses ML, machine learning,

0:46to monitor user activities.

0:47Is there a risky user account?

0:49Is there a risky sign-in?

0:51That's what the intelligence is trying to figure out.

0:54So let's jump in and take a look at some of this.

0:56So we're going to go down here.

0:57I'm gong to scroll down here to Security.

1:00And here we go.

1:01What we have over here if I scroll down under report,

1:05I've got risky users, risky workload, risky sign-ins,

1:09risk detection, this is where that identity protection

1:14data comes into play.

1:15Now, there's two primary types, user risk,

1:18that's for risk for users, and sign-in risk, risky sign-ins.

1:22Now, risky users, this is risk related to a specific user

1:27credential, like leaked credentials or an attack

1:32pattern targeting a specific user account.

1:35So really we're focusing on the account itself.

1:39Then we have sign-in risk.

1:42Now, this helps identify malicious login attempts

1:45that aren't from the actual user, such as logins

1:49from an anonymous IP address or something

1:52called impossible travel.

1:54That's where if you login from Kentucky,

1:57right now I login, and then 10 minutes from now

2:00there's a login from Australia, well, obviously, that

2:03wasn't me, was it?

2:04No.

2:05So that's called impossible travel.

2:08It's impossible for me to travel from Kentucky

2:10to Australia in 10 minutes.

2:12So it's impossible travel.

2:13There's other things like IP addresses

2:15linked to malicious activities.

2:17So what we're looking at there is the sign-in activity.

2:20Is this legit?

2:21Is this really Bob trying to sign-in

2:23or is this somebody else?

2:24And that's that risky sign-ins.

2:27So let's go ahead and take a look at risky users.

2:30It says none selected.

2:32Let me go in here and click Apply.

2:35There we go.

2:36All right.

2:36So what we have here is me.

2:39And as of today at 8:46 AM was the last update.

2:45So let's go ahead and click on this

2:46and see what we're talking about here.

2:48And it says, risky user details.

2:52So recent risky sign-in.

2:55So it looks like it's related to sign-ins there.

2:58OK.

2:59Now, risk state is remediated, and that's

3:02because I had remediated it earlier.

3:04Details, user performed secure password change.

3:08That's how it was remediated.

3:09Now, I'm going to explain what happened.

3:11But before we do, we've got user's sign-in.

3:14So I can click up here to see User's sign-ins.

3:17So let's go ahead and do that.

3:19And I don't want the last month, I want the last 24 hours.

3:23Let's click Apply.

3:25OK, there we go.

3:26Last 24 hours.

3:27So this is the ins for me for the last 24 hours.

3:30So this is as if I'm investigating what happened.

3:34So what I did was come in here and look.

3:36OK, this is today.

3:38Yeah, me.

3:39I'm Richmond.

3:39Yeah, yeah, that's me logging in.

3:41But I scroll down here, well, what's this?

3:45I got some weird logins yesterday afternoon.

3:48See, I was obviously in Richmond here, Richmond, Kentucky,

3:51Richmond Kentucky, Richmond, Kentucky.

3:52And then I come up and that last login there was 4:22 PM.

3:57But then about 30 minutes later or so,

4:00I've got a couple of logins, or at least one

4:03here, from Australia, and then just a minute

4:07or two later from Germany, and a minute or two later from Tokyo.

4:12Well, obviously I didn't travel to all those places

4:14and logged in, so that's weird.

4:16That's what generated the risk level.

4:20So it says, you know what?

4:21There's something going on here.

4:22We should investigate this.

4:25That's where identity protection comes into play.

4:28It signals that, hey, what's going on here?

4:31I'm seeing these logins and this can't be right.

4:34So what I did was-- we're back here with our risky users here.

4:40And where I clicked on User's sign-ins.

4:41There's also user's risky sign-ins,

4:44I could just went straight to there.

4:46And let's see what pops up here.

4:48I don't want last one month, I want last 24 hours.

4:51And then I also have to state, I got to add remediated

4:55because I had remediated this.

4:57There we go.

4:58And here they come.

4:58There's our Australia login, our Germany,

5:01and our Tokyo, Japan login.

5:03Those were the risky logins.

5:05So, OK, all right.

5:07So I see they're risky.

5:08And then let's go back one more time here.

5:12I want you to see User's risk detection.

5:14So you can click on that to see if there were

5:17any events associated with it.

5:19Let's go last 24 hours, Apply.

5:22Let's see.

5:23I want down here to Remediated, so we can see what came in.

5:26OK.

5:26All right, so here's the risk detections

5:29and here it's with the risk level.

5:31Look at that.

5:32So here Australia is high, high, high.

5:34And there's another Australia that's a medium.

5:36But you'll see we're starting to assign

5:38risk levels to these events so we can do investigations

5:42on this.

5:42Then if I go back here, I've got some other options.

5:45Maybe I want to reset the user's password,

5:48I want to confirm a compromise, so that'll

5:51allow me to open a case, I want to dismiss user risk,

5:54or I want to block this user, or investigate

5:56with Azure Defender, these are my options here.

6:00So that's risky users.

6:02Let's go to risky sign-ins and we're

6:04going to go to Remediated so we can see those.

6:08I want the last 24 hours.

6:11And here we go.

6:12Let's see.

6:12There we go.

6:13So there's the Australia, Germany, and Tokyo

6:16logins as we see.

6:18And if I click on this, it's going

6:19to open up additional information over here.

6:21Look at my user's risk report.

6:23So let's do that.

6:24Let's look at the risk report.

6:27If I go down here, I can see that I am a limited admin.

6:30The risk state is now at remediated,

6:33so I don't have a risk level.

6:34But if I didn't remediate it, I might have a high risk level.

6:38Well, tell me, friends, what does that mean?

6:40Well, it means if I have conditional access policies

6:42that are associated with risky users with the high risk level,

6:45I'm going to fall into that category.

6:47That's what that means.

6:49All right, so I get go look at sign-ins and risk detections.

6:52I could reset passwords, I have the same options here

6:54as we looked at before.

6:56Let me go back one more time to security.

6:58Now, remember these were remediated.

7:02And when I looked at that-- let me show

7:03see if it'll show us in here why it was remediated.

7:07Sign-in type was interactive.

7:09I don't see it in here.

7:11But let me go back real quick over to the Risky users.

7:14We're going to go to--

7:15I don't want Dismissed, I want Remediated.

7:17Apply, there we go.

7:19And here we go.

7:21The risk, the details down here, here's what I want to see.

7:24It says user performed secure password change.

7:28So here's what happened, because of those logins

7:31from those foreign countries, it's called impossible travel,

7:34I couldn't have traveled to all those places

7:36and successfully logged in from them,

7:37obviously, there's some type of compromise or something

7:40going on.

7:40So what it did was it prompted me,

7:43I'm going to drag this image in here,

7:45it prompted me to do this.

7:47This is what I got when I tried to login this morning.

7:50It says somebody else might have access to your account.

7:52You need to choose a new password.

7:53So basically, it's forcing me to reset my password.

7:58And we saw within the conditional access policies,

8:00this was one of the options that we could do, enforce MFA

8:04or enforce a password reset.

8:06And this is that identity protection, the machine

8:09learning, using those signals.

8:10This is how it makes those decisions.

8:13So that's pretty cool.

8:14We can protect our identities this way.

8:17All right, super.

8:19So now we know how to do the investigation, how this works.

8:22I'm going to go back over here real quick.

8:24We can now look at creating some identity protection policies.

8:28And that's what we're going to do in the next Nugget.

8:30So I'll see you there shortly.

8:31I hope this has been informative for you.

8:33And I'd like to thank you for viewing.

0:06Now that we know what is Azure AD Identity Protection is

0:09and how it uses intelligence to let

0:11us know about risky activities so that we can make decisions,

0:14well, it's time to take a look at the policies

0:17that we can use with Azure AD Identity Protection

0:20to make some things happen.

0:22So let's get started.

0:24All right, here we go.

0:24We're in our NuggetLabs Azure Active Directory.

0:28We're going to create some Azure Identity Protection policies.

0:31We're going to take that intelligence that we have

0:33from our machine learning, those signals,

0:36and we're going to put policies into play.

0:39So let's do that.

0:39Let's go on down here to Security,

0:43and we'll let that load up.

0:45Then we're going to go up here to Identity Protection.

0:48All right, there we go.

0:49Here's some nice data.

0:51Oh, what's going on here?

0:52We've got some graphs, we've got this here.

0:53What is this?

0:54User risk policy, user risk policy.

0:56If I scroll down here, new risky sign ins detected.

1:00Hey, look at there.

1:01So if I were to click on one of these, let's do this here.

1:05Click on that, it's going to go in here.

1:07And I'd have to go in here to remediate it,

1:10and I'll show you why.

1:13There we go.

1:14There's our logins.

1:16Those are risky logins of recent.

1:18And you'll see this is-- there's the Tokyo and Germany

1:22and Australia, those are all in there.

1:25So that's going with.

1:26Let's go back to Identity Protection,

1:27but we get some nice graphs anyways.

1:29So those reports, risky users, risky sign ins,

1:32the risk detections that we just looked at in the last Nugget,

1:34they're right in here as well.

1:36Now, what I want to talk about are these three up here.

1:40Pretty good stuff, let me tell you.

1:42Starting off with user risk policy.

1:44So let's click on that.

1:45It's going to open this up.

1:47Policy name, user risk remediation policy.

1:51OK.

1:52So the assignment, users.

1:53I have this set to all users.

1:55Now, you don't have to.

1:56You could say selected users, or all users and then

1:59exclude specific users if you wanted to.

2:01So maybe I don't want the admins to fall

2:04into this or maybe certain C-level execs,

2:06I don't want to fall into this.

2:07Whatever it might be.

2:09But right now I have all users.

2:11Then we come down to user risk.

2:13This is the user risk score.

2:15You get to select as part of this policy

2:17that who do you want this to apply to?

2:19All users with medium and above is what it's set to,

2:22or it could be just high or could be low and above.

2:25But if they're at that risk level,

2:27and, again, it depends on the activities that are going on.

2:30If they have a risk level that matches this,

2:32they're going to fall into this policy.

2:35So what's going to happen?

2:36This is the controls.

2:37What's going to happen if they fall into this policy?

2:40Well, right now, if I click on here,

2:42it's set to allow access, require password change.

2:46And that's what we could choose.

2:48Or you could just say block access.

2:50So if this user has a high risk level,

2:53we're just going to block them completely.

2:55Well, that can turn into a problem.

2:58Require password change is probably pretty good.

3:01So let's start with that and kind of see where it goes.

3:03Then we're going to say, Done.

3:05And this is a policy error they had in place.

3:07And it was enforced, and that's why,

3:09let me bring this in again, that's

3:12why I got this password change notification this morning

3:15after those logins from all over the place.

3:17And, by the way, I did those yesterday using a VPN.

3:22So I just connected to the different countries

3:23and logged in.

3:24It wasn't really malicious.

3:25So don't worry too much.

3:27But it's a good way to test to make sure

3:29that your policies are functioning properly.

3:31So that was our user risk policy.

3:33Now, quick reminder, user risk relates to a specific user's

3:37credentials like leak credentials or attack patterns

3:40targeting specific credentials.

3:42This would be really better renamed probably

3:44as like credential risk policy.

3:47But that's what it is.

3:48Then we have sign in risk policy.

3:51And it looks very much the same.

3:52And the sign in risk policy, again, this

3:55helps identify malicious login attempts

3:57that aren't from the actual user,

3:59like from an anonymous IP address or an IP

4:02address associated with malicious activities

4:05or the impossible travel we talked about.

4:07But the idea here is if it falls in that risk category,

4:11then we want to do something.

4:12So right now, it's set to all users.

4:14You can, of course, go ahead and exclude or do

4:17just a specific group, like an admin group or something.

4:20So we'll leave it at All Users, put they're sign-in risk.

4:23You want high, medium and above or low

4:25and above, you get to select that, of course.

4:27And then down here for controls, you

4:31could either block access or allow access

4:33and require multifactor authentication

4:36so that you sign in.

4:37So there we go.

4:38So the sign-in we require MFA because it's actually

4:41signing in the risk policy.

4:43We see a target going on against a specific user,

4:46so we want them to reset their password.

4:48So that's our options right there,

4:50and that's, of course, is turned on.

4:52There we go.

4:52And one more policy I want to talk about MFA registration

4:56policy.

4:57So within our MFA registration policy here,

5:00this is designed to help push out MFA to your selected users.

5:04Right now it's to all users here,

5:06but you can do selected individual users.

5:08So if you put your per user MFA only to a handful of users,

5:11you create a group, put them in there,

5:12and you could do that by group.

5:14So there's that.

5:16So we just went with all users.

5:18And then your controls down here requires Azure AD MFA

5:21registration.

5:21So what we're doing is we are requiring them

5:25to go ahead and set this up.

5:26So at our user's next login through a browser,

5:30they will be prompted to go ahead and sign up for MFA.

5:34However, they will have an option

5:35to bypass this for 14 days.

5:39But after 14 days, the next time they log in,

5:41it will be mandatory that they sign up.

5:43So you can set up this MFA registration policy.

5:46Now, I want to talk about something

5:48that I had to run into.

5:50And it's dealing with these policies here.

5:53And the idea that if a user here matches

5:57one of these, all right?

5:59Maybe they had a high risk or something.

6:00Think about what causes that risk.

6:03Because if they can't log in because of a high risk, what we

6:07need to do is reduce that risk.

6:09And how can we reduce the risk?

6:10Well, if you do certain things like reset your password,

6:13that reduces your risk.

6:15So for instance, if you were locked out

6:17for a certain reason because of a high risk,

6:19try resetting your password and then waiting 15 or 20 minutes,

6:23and that should reduce your risk and you should be

6:26able to sign in at that point.

6:27Just depending on what's going on, of course.

6:29But that is something that I found along the way

6:32that, you know sometimes, you just need to wait and reduce

6:35your risk of your account so you can get back in

6:37or something like that.

6:39OK?

6:39So that's just a little bit of wisdom from the trenches.

6:42I hope this has been informative for you,

6:44and I'd like to thank you for viewing.