Hello, Cloud Gurus, and welcome back.
In this lesson, We're going to take a look
at an enabling single sign-on for Azure Active Directory.
Let's take a look at what we're going to cover.
First up, we'll take a closer look
at how password hash synchronization works,
including some of the advantages and disadvantages
of password hash sync.
Then we'll dive deeper into pass-through authentication,
we'll take a look at federation,
and then finally, we'll wrap up with a bit
of an introduction to Azure AD Connect Health.
Let's get started.
Now, let's take a look at those hybrid
identity authentication methods,
starting with password hash sync.
Password hash sync works by synchronizing
the hashes of password hashes to Azure AD
using either the Azure AD Connect sync server
or the cloud provisioning agent,
and users can authenticate directly with Azure AD
when they're not on the secure corporate network.
One of the advantages of password hash sync
is that it requires no additional effort to implement.
You can use the Azure AD Connect server or cloud sync
to synchronize the password hashes,
and because passwords can be verified directly by Azure AD,
the user experience is excellent.
Users will never need to complete
a second hop to authenticate,
and password hash sync provides some business continuity.
In the event of a network
or active directory domain services failure.
Users can still authenticate with Azure AD,
and because the hash of the password is synced to Azure AD,
Azure AD can check the password
on known leaked and bad password lists.
There are some disadvantages, though.
Because certain account information,
including some account restrictions
are not synced to Azure AD,
Azure AD doesn't check with AD DS
to authenticate the user,
and these account restrictions don't apply,
and these include things like account expired,
disabled account, password expired, account lockout,
and sign-in hours are not checked
each time the user signs in.
Another disadvantage of password hash sync
is that you can only have one Azure AD Connect sync server
deployed at any time.
So if that server is unavailable,
updated passwords might be delayed
or not available in Azure AD.
Another option is pass-through authentication.
Pass-through authentication works
by deploying both Azure AD Connect
and authentication agents on one or more of your servers.
Identity information is synchronized with Azure AD
via Azure AD Connect,
and then while authenticating, authentication is retrieved
by the authentication agent from Azure AD
and sent to a domain controller
to instantly authenticate the users
directly against domain controllers.
And then the authentication result is sent back to Azure AD
by the authentication agent.
And pass-through authentication
is still fairly easy to deploy.
It requires only Azure AD Connect
and some additional authentication agents,
and it provides an excellent user experience,
perhaps even more so than password hash sync,
as password changes are immediately available to Azure AD,
so they never end up out of sync,
which may happen on rare occasions with password hash sync.
And because pass-through authentication
uses authentication agents
to authenticate directly against domain controllers,
account-level restrictions are supported
and pass-through authentication supports smart lockout
to prevent brute force attacks
against Azure AD user passwords.
But the biggest disadvantage of pass-through authentication
is that it requires a permanent reliable connection
to Active Directory Domain Services.
Should your pass-through authentication agents fail,
or the network, or the domain controllers fail,
your cloud users will not be able to authenticate.
To get around this potential issue,
you can use both pass-through authentication
and password hash sync as a backup
when pass-through authentication is not available.
And Azure AD Connects configuration wizard can be used
to deploy and configure pass-through authentication.
And the final option to consider is federation,
and this typically uses
Active Directory Federation Services.
Federation works by synchronizing identities
to Azure AD using Azure AD Connect.
And then for cloud users,
authentication is first performed against Azure AD,
and then is redirected to Federation Services.
And this authentication is then handled
by 2 farms of servers,
including one or more federation proxies,
usually in some sort of application
load balancing configuration,
and then one or more federation servers,
and these are configured in a farm,
and this is a fairly complex setup.
So why would you want to go through this process?
Well, let's take a look
at some of the advantages of federation.
The biggest advantage of federation is that it supports
on-premises multi-factor authentication.
Another advantage is that password hashes
are not sent to Azure,
which is important in some compliance scenarios.
The biggest disadvantage is that it requires
significant effort to deploy and maintain,
especially if you want high availability.
It will require at least 4 additional
on-premises services, 2 for the federation proxy,
and 2 for federation services.
And the user experience
with Active Directory Federation Services
really depends on the implementation.
Federation Services can be configured
to automatically authenticate users
on Active Directory Domain Services-joined computers,
which provides an excellent user experience,
but that configuration is completely
up to the policy requirements
that your company must adhere to.
And high availability is also a challenge
with Active Directory Federation Services.
You will require multiple servers, load balancers,
reliable networks, and monitoring to ensure the availability
of your Active Directory Federation Services infrastructure.
But it is good to know
that Azure AD Connects configuration wizard
can be used to configure and deploy
Active Directory Federation Services.
All right, let's take a look at Azure AD Connect Health.
It provides monitoring
for your on-premises identity infrastructure,
including alerts, performance monitoring,
usage analytics, and more,
and it supports monitoring of password hash sync
and Active Directory Federation Services.
And it's really critical
if you're monitoring a complex Federation deployment,
as it can monitor your federation servers
and your proxy servers,
and the monitoring is provided through a single portal,
where you can explore lockout trends,
failed sign-ins, server configuration, and performance.
You can also be alerted via email for critical events,
for example, if your Azure AD Connect server
hasn't synced in a reasonable amount of time
and throughout my career, I've found those alerts
from Azure AD Connect extremely important to find out about.
So definitely take a look at Azure AD Connect,
and use it to monitor your hybrid identity infrastructure.
All right, let's take a look
at what we've covered in this lesson.
Choose password hash sync if you want business continuity
in the event of a network or domain controller failure,
or if you want leaked credential reports
or smart password lockout,
and choose pass-through authentication
if you want to enforce
Active Directory domain services account restrictions.
And choose the Federation authentication option
if you want to support
on-premises multifactor authentication.
And it's nice to know that Microsoft provides
a decision tree that you can use to help decide
which authentication option to choose
for your hybrid authentication solution,
and I'll include a link to this
in the resources section for this lesson.
All right, that concludes this lesson.
Thanks for being with me and I hope you found this useful,
and I look forward to seeing you in the next lesson.