Securing Azure AD Identities

0:00[AUDIO LOGO] In order for someone to use Azure services, they need a user account. And that's what we're going to be focusing on in this Nugget. We're going to be focusing on Azure AD user accounts. And believe it or not, there is more than one type. So what do you say we get started? Let's jump in and get to work on these user accounts. All right, we're starting off with users. And we're here in our Azure Active Directory portal.

0:30I'm in my NuggetLabz tenant. And I'm going to go down here to Users. You guessed it. There we go, users. All right, I want to talk about this for a minute because in order to create user accounts, well, you need to have the Global Administrator or User Administrator role. So let's dive into the users. We've actually got three different types of users. And there are several listed. We have 12 users found here. And there's three types. We have something called a member user.

1:01And that's where we have Member here. We also have guest users. There are no guest users here. And we have Azure AD hybrid users. And these are accounts which have been synced with an on-premise Active Directory server. Now, it's a little misleading because when you see User type here, you're going to see Member and Guest. You're not going to see Azure AD Hybrid users. But there's a way to tell. If this is a directory-synced user, like we see Directory synced up here at the top, that means it was synced from an on-premise Active Directory.

1:36We have lots of Yeses here. And these are all Azure AD hybrid user accounts. They were synced from an Active Directory server. However, if we come down here, we've got some Nos. Here's a No right here for Morpheus Nugget. And there's a No down here for Robert Salmans and one for Trinity Nugget. That means these are Azure member accounts. So they are here. They were created by going to New user and creating a new user account directly within Azure Active Directory.

2:07They were not synced from an on-premise Active Directory server. So those are the three different types. Once again, we have our member users. We have our guest users and our Active Directory hybrid users. So let's go ahead and let's say we create a user. We're going to create an Azure Active Directory user. So we're going to say New user here. And this is going to be a member user. So what we want to select is Create user. If we select Invite user, well, that's how we create guest accounts.

2:40We invite outside parties or outside individuals, usually with a business partner or vendor or something, that we're going to collaborate with. We invite them in with a guest account. We're not doing that. We're creating a member account. So for a username, we're going to go with Neo. And there we go. We're going to leave it at the onmicrosoft.com. Name, we're going to go Tom Anderson because this is the full name. Tom. Anderson. There we go. Then we have Auto-generate password or Let me create the password.

3:12Now, if you select Auto-generate password, it's going to autogenerate it. And you can show it and see what it is. But it's going to also send the creator of this account, which is me, this password so that I would have it documented. But you could also say Let me create the password. And you could type it in, and away you go. So we'll just say Auto-generate. Now I'm going to scroll down here. And we have Groups and roles. So I could go ahead and select a group to add this user to. I can also assign some roles if I'd like to. Then under Settings, we have Block sign in.

3:44Right now, it's set to No, and that's the default. However, maybe Neo isn't going to start for another two weeks. I'm just kind of getting ahead of things and getting the user account created so it's ready when he shows up. So I could say Yes and go ahead and block sign in. And that way, it's blocked until he shows up, and then I unblock it. All right, then we have Usage location. We're going to say United States. That's where we're at. Now, this is very important. If you do not assign a usage location, you cannot assign this account licenses later on.

4:18So if you go to try to assign an account a license, it doesn't have a location, you're going to get an error. And then you're going to have to go back to the account and assign a location. Then you can go ahead and assign licensing. Then we have some job info here. Job title-- let's see, what is Neo? Well, let's just say he's an engineer. That'll work for me. Department, Engineering. There we go. Company name, NuggetLabz. Manager, you can assign a manager. No, you don't have to assign this stuff. However, if you use dynamic groups, which we're going to talk about later, these can come in handy.

4:50As you can imagine, a dynamic group looks at attributes of user accounts, and it groups users into a group. Maybe we have a group of engineers. So our group is named Engineers, and it looks for the job title of engineer. And it throws everyone with a job title of engineer into the engineers group automatically so we don't have to do it manually. So that is a dynamic group. Just kind of a little sneak preview there. But that is what those attributes are so helpful for. And now we go ahead and click Create. It's going to create our new account.

5:20And here we go, Tom Anderson. And you see under Directory synced, No. That's because we created this in Azure Active Directory, and it is a member account. And the account is enabled right there. Excellent. So that is creating a user account within Azure Active Directory. However, that's not the only way that we can create user accounts. We can jump on over to MS 365 Admin Center. That's where we're at right now. So what we can do is if we expand Users here and go to Active users, we'll get to see all of our users.

5:55And you'll see Tom Anderson that we just created. Hey, there's Tom right there. What do you know, Mr. Anderson. [LAUGHS] All right, so there's Mr. Anderson. Now you can also go in and add a user here. So hey, why don't we just do that? So let's click on Add user and see what it looks like. So here you put in your first and last name, display name, username. Looks pretty similar, doesn't it? Yes, it does, similar to the way we did it Azure Active Directory. Automatically create a password. Require users to change password when they first sign in.

6:26And send password in email upon completion. You have these options. So let's just fill in a little info just so we can go through and see what it looks like. I say Next. Product licenses, a-ha. This is different. This is where we set the location. And you'll notice, I can't not set a location. It defaults to something. And again, we can't assign MS 365 license or even as Azure Active Directory licenses if we don't assign a location. That's why it requires it.

6:57And then I can go through here, and I can assign licenses if I would like to. But I don't have to. I can say create a user without product licenses, and that's what I'm going to do. I'm going to say Next. And then it comes down to the roles and profile information. So here we have Job title, Department, Office, all this good information again that can be used for dynamic groups. Under Roles, we can say add the Admin center access if we want to. We can assign roles in here. And then lastly, we come to a Review and finish. I'm not going to create this user. I just kind of wanted to walk through and show you what it looked like.

7:29So there we go. Let's go ahead and close out of this. See if we can go back and-- there's your Cancel right over there. OK, yes, I want to cancel that out. All right, so we can create users through Azure Active Directory through Microsoft 365 Admin Center. That is awesome. You can also create your users on premise if you're doing AD Sync. And those were the accounts that synced up to-- let me go back here over here to Azure Active Directory-- those that did sync, like our directory sync, to our Azure AD. Those came from a local domain controller.

8:01So that is the third way, through our domain controllers. And then lastly, there's a fourth way, and that's through PowerShell. And that's what we're going to look at in the next Nugget. So I will see you there. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] We're continuing with Azure AD user accounts. And in the last Nugget, we saw how to use the Azure AD portal and Microsoft 365 portals to create user accounts. Well, that's not the only way to do it. We can also use PowerShell to do so. And that's what we're going to do right now. All right, here I am in the Azure Active Directory portal. So now I'm going to open up this Cloud Shell right here.

0:32At the top, you see where the cursor is. It's got this terminal-looking icon, and it says Cloud Shell. We're going to click that and open it up, and it's not going to open us up a PowerShell in Azure. It's going to go through and show you that it's connecting and such. And there we go. Now, if you're doing this from your local computer, you're going to need to first install the Azure AD module. So you would simply do Install-Module, space, AzureAD. There you go. And you'd run that and install that module, then you could carry on.

1:03But I'm already here in Azure, so I don't need to do that. So what I'm going to do is go ahead and copy in our first command. Now, what we're going to do is create a password profile. Because when we create this identity, we're not going to pass a password directly into the command. We're going to pass in a password profile variable that will then provide in the background what the password is. So let me go ahead and copy and paste a couple of things here. There we go, space, and hit Enter.

1:36There we go. That created a profile. I'm going to pass in the actual password to the profile. So this is the next one, Enter, and there we go. OK, let's talk about this. So what we did is create a variable called PasswordProfile. We're creating a new object of Microsoft.Open.A zure.Model.PasswordProfile. So we're creating a Microsoft password profile named PasswordProfile. Pretty straightforward in creating this variable object. And then what we're doing is we're passing in the password for it, which is this zNugget1!.

2:08This way, I can represent this password here using this variable. All right, excellent. So that's what I did. The next thing I need to do is go ahead and connect to Azure AD. So I'm going to type Connect-AzureAD. Enter. It's going to go through it, and now it's going to go out and connect to make sure I'm authenticated there and we're good to go. So now we can actually go ahead and use the new AzureAD user commandlet to create the member's identity. So let's do that.

2:38So let me copy this over here, and then we'll talk about it. And I'll paste that in, put a space, let me grab the rest of it here. Excellent. And we'll paste that in as well. There we go. Let's talk about this. So we're using the commandlet New-AzureADUser. That's pretty straightforward. We're creating a new Azure Active Directory user. And what we're passing after that is DisplayName-- the name is Annie Oracle-- the PasswordProfile that we created above here, then the UserPrincipalName, which is Oracle@NuggetLabz.com.

3:15And AccountEnabled, that option, we're setting it to True so the account's enabled and Ms. Annie Oracle can log in. We give it a male nickname, Oracle. So we're just giving it a nickname, and there we go. So if I go ahead and hit Enter now, it's going to go through. Excellent. And it created it-- gave us an object ID and everything. So if I go back up here to my portal and I go to Users, we should now have an Annie Oracle. So give that a minute to refresh here. Let's go ahead and hit the Refresh button. And excellent, Annie Oracle is now showing up.

3:48So that's how we can create a user account using PowerShell. Or another name for user account is, of course, an identity. [CHUCKLES] That's part of our IAM, Identity and Access Management. So there we go. That was all four ways that we can create user accounts. Again, in the last Nugget, we looked at using the Azure AD portal right here in Users. We also looked at creating it in the Microsoft 365 Admin Center, and we talked about doing it through your local domain controller using AD Sync.

4:20And then, of course, lastly, using PowerShell, which is pretty darn powerful. And that wraps up creating our user accounts. That's our member user accounts. But in the next Nugget, we're going to look at creating users in bulk. Because, hey, who wants to create one user account at a time? Not me. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] So we've now seen how to create user accounts in a couple of different ways, but what if you had to create a whole bunch of user accounts? Well, you don't want to sit there and create them one at a time, do you? Absolutely not. You might have to create 50, or 100, or 500 user accounts. Well, that's no way to do it. So is there a solution? The answer is yes, bulk creation of users.

0:30Hey, and we can actually also bulk delete users because maybe you've got some seasonal workers that come in, and they're only there for a couple of months. And you need to create a 100 or so user accounts for those seasonal individuals, and then you want to remove them after they leave. So let's see how to do this. Here I am within my Azure Active Directory. I'm going to go down here to Users because that's we're going to create, manage our users, delete users. Now, right up here at the top, we have an option for Bulk operations. Pretty straightforward. Bulk create, Bulk invite, Bulk delete and then Download list users.

1:03Now, invite again, that's when we're creating user accounts that are guest accounts. We have Bulk create, we'd use that for our standard user account, so it's our member accounts. And then Bulk delete for bulk deleting accounts. Now, all of these work the same, so we're just going to look at Bulk create. And I'll go ahead and click on that. It's going to bring this slide in window here on the right. And what it does is it provides us with a CSV or a Comma Separated Value file. So we can go ahead and click Download there. It's going to download that for me.

1:34Excellent. I close that out. Now, what I want to do is edit that file. So what I'm going to do is open the file from my Downloads. All right, I'm going to pull this file in, so you can see what it looks like. And there we go. And you'll see it was opened up in Excel because it is a CSV file. Now I'm going to spread some of these out so that we can see the information in these here columns. Now, what we have is display name.

2:04This gives you an example Chris Green. That's nice and all. But what we want to do is go ahead and create a new user. So in here-- well, let's just stick with Chris Green. That's fine. Chris Green. Chris@-- well, we need to change this. This is going to be nuggetlabz.onmicrosoft.com. Excellent. Password, there's a password block sign in that's set to no. First name, we can do Chris. Green. Job title, we could say accountant.

2:37How about that? How about an accountant? Excellent. Department, finance. Usage location-- we can go through all this additional information. Mobile phone, zip code, location, all those wonderful thing. Now, again, usage location, this is going to be important if you're going to assign licenses to this identity or account. But then we got Chris Green, maybe we say, then we also have Janet Blue, and you see where I'm going with this. Basically, we just fill out this information.

3:08Now, I'm going to go ahead-- and let me get rid of Janet Blue though-- OK, I'm going to go ahead and do a quick save here. So we'll save that. Excellent. Then I can come over here, I can select the file to upload. So I'm going to go here to my Downloads. I'm going to select the template that I updated and say Open. And then I'm going to say Submit. And it's going to say In progress here. Now, this does take a little bit. It's not really fast. It takes it a few minutes to go through and actually read the data in the file and then create the user account.

3:43So I'm going to pause this for just a few minutes while it does this process. Then we'll come back and take a look at Mr. Green. All right, here we are back in the users, and we now have a Chris Green account here. It's a member account. It is not directory sync because we create that directly in here in Azure Active Directory through our Bulk operations. So that's our Bulk create, you can do the Bulk invite, Bulk delete. If I click Bulk delete, you see it's going to give you the template. And we just go through and do the same thing. So there we go.

4:14Now, what if you want to do a bulk delete? Well, what about Download users? If I come to Download users, and we'll say Azure AD users, and we'll say Start. So it's going to provide us an export of our user accounts. Well, this could come in pretty handy when it comes to doing bulk delete because if I can get an export in CSV format of all my users, then I can use that to help me create my bulk delete CSV file.

4:45So now I'm going to say File is ready! Click here to download. We'll go ahead and download that. There we go. And Azure AD users is going ahead and open that file. And let me pull that in here, so we can see it. And there we go. So there's our userPrincipalNames, displayNames, surnames, mail, givenID. So we could use some of this information to help us create a bulk delete CSV. And there we go. Let me go ahead and close that out. And that's how we go through using bulk operations to do bulk creates, bulk invite, and bulk deletes.

5:20I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Now that we know how to create users within Azure AD in various ways. And now that we've finished that up, it's time to move on to groups. And we're going to do that right now. We're going to take a look at the different types of groups that we can create and why you might want to use one group over another group and how to create them in the Azure ID portal as well as the Microsoft 365 Admin portal, because we can do it in there as well.

0:31So let's get started. All right, here we are in our Azure Active Directory. And if we go down here to Groups and click on Groups, we're going to see that there's a lot of default groups that are in here. I didn't create all these, let me tell you. I did create the test-group. But there are several other groups that are already created in here, and that's fine. And when we want to create a new group, we can just go to this New group button up here. However, we're not going to start here. We're going to jump over to the Microsoft 365 admin center.

1:04And we're going to start here, and you'll see why in just a short bit. So let's go ahead and go down to Teams and groups, and expand that, and select Active teams and groups. This is going to list out our active teams and groups. And if we want to create a new group, we're going to go to Add a group. Pretty straightforward. We're going to click that. There are four different types of groups that we can create. And here they are. These are the four. Our Microsoft 365, it is the recommended group. However, I want to put air quotes around here in recommended.

1:37That's when you're creating groups within the Microsoft 365 admin center, because this creates a group email to collaborate. So you can use this with Microsoft Teams for your conversations files and calendar. So this is specifically used for-- I'm going to highlight this here, hopefully. And it won't let me-- collaborate. So really, what I want you to associate with Microsoft 365 groups, you should associate that with collaboration. That's what it's for. We're not going to be able to assign permissions and roles to this group.

2:09It's just used for Microsoft 365 products and collaboration. All right. Then we have distribution groups. This creates an email address for a group of people. So this distribution is used for email distribution within Exchange Online. It doesn't allow for any type of collaboration or assigning roles and permissions. It is only email distribution. All right, then next up we have Mail-enabled security down here. Now, this is a little different. This is like a distribution group, but we can also control access to OneDrive and SharePoint with it.

2:47So it does have some permission-enabled features within it. So it's going to have your distribution email assigned to it but also allow you to set permissions for OneDrive and SharePoint. All right, and then lastly, you have Security. And this controls access to OneDrive and SharePoint. You can use it for MDM, which is your Mobile Device Management, within 365. You can set roles and permissions for these groups. So this also plays into our Azure Active Directory. When we're setting roles to groups, it's going to be a security group when we do that.

3:19So let's go ahead and create this group. We'll stick with the Microsoft 365 for now. So we'll just say Next. We've got to give it a name. So we're going to say MS365 and then lowercase group. That way, we know what it is. I'm going to go ahead and add a description. There we go. We'll say Next. I need to assign owners. Now, this is pretty important. When we have a group, we need to assign an owner. But why? Why do we need an owner? IT manages it.

3:50No, we need someone to own it. They're going to be the owner of the group. They're going to determine who can be members of this group. So let's assign an owner. Let's just give it to Annie, why not? Annie Oracle. There we go. Annie is the owner of this group. So she's responsible for determining who the members are going to be. That means when someone leaves the organization or changes roles and they no longer need to be in this group, she's in charge of making sure that those members are removed. Now, she probably won't do it herself.

4:21She'll open a ticket with IT and the help desk to have that person added or removed. But she's responsible for making sure it happens. So we'll say Next. Now we could add members. We could add members. Let's add me. I'll be a member of Annie's group. There we go. Let's see, there we go. So let's add that. And we could add others as well. But basically, it's pretty straightforward. And we have some settings, like your group email address. Well, let's say this was our M365group.

4:51There we go. That'll work. And Privacy-- so if we see here, we hover over this, our public groups can be joined by everyone without getting approval from a group owner. That means you don't have to go through Annie Oracle to become a member of this group. Anybody could access it within your organization. Do you want that to be an option for this or not? Do you want it to be a private? And this means that it's not open for everyone to join and that the group owner is the one who can add members.

5:24So there we go. So let's go with private. I like the sound of that one better. Now, you can also go in here and add Microsoft Teams to this group. But you do have to have a license assigned to you. So we don't have that right now. So we'll say Next. And we'll go ahead and create the group. It's pretty straightforward. Our new group has been created. So let's close that out. And now we should see our MS365group right there. Excellent. Now we're going to jump back over to our Azure Active Directory. And we're going to create a new group here.

5:54Here I'm in our groups. So I'm going to do New group. And we're not going to do an MS 365. We're going to a security group because we want to assign permissions. Group name-- who would this be? Let's say KY-Admins. There we go. In our group description, this would be administrators for the KY office. How about that? And then here, Azure AD roles can be assigned to the group-- do you want to be able to assign roles? Well, in this instance, I'm going to say Yes.

6:26The Membership type. Now, actually, let me switch this back to No real quick. I want to talk about membership types. This is pretty important. So we have Assigned, Dynamic User, and Dynamic Device. Now, the Assigned is you are going to manually assign members to this group. So it's a manual process. It's kind of what we're used to, generally. And then we have Dynamic User and Dynamic Device. Now, dynamic is referring to the fact that Azure Active Directory will look at attributes of either users or devices and will add them dynamically, or automatically, to this group based on their attributes.

7:04So if I do Assigned, and I need to assign an owner. So I'm going to take this one actually. Let me just put me in here for this one. That'll work. And we'll select that. So now I'm the owner. Now, the members-- I'd have to go through here and manually select which users I want to be a member of this group. So it'd be a manual process. And I want Bill and Chris, and on and on and on. I can go through and do this. However, it is, again, a manual process. So we're going to say Remove and Remove. We're going to close that out. That's a pretty standard way of creating a group.

7:36Now, let's take a look at the dynamic. So let's switch over to Dynamic Users. So I'm still the owner. I need to add a dynamic query. So let's click on that. So now here we are on our Dynamic membership rules page. So what we need to do is create some rules. Now, we already have one here, starting with. But we can add additional expressions if we want to. So let's start off here. Let's say, Choose a property. So let's go down to, let's say, jobTitle. And we'll pick an operator. We'll say Equals. And the value will be Engineer.

8:08There we go. So it's going to pull in the engineers. We could also add other expressions, like maybe a location would be good, like a country, your department, maybe jobTitle. Actually, we used the jobTitle, didn't we? Yeah, we used jobTitle. But there's other attributes that we can select down here. So those are pretty handy. So really, you can just kind of go wild with it with your dynamic groups. But once we have what we think is going to work, we can actually come to validate rules.

8:39And what are we going to do? We're going to add users. And this is going to test against the users. Now, I remember when we created Neo, he was an engineer. So let's go ahead and add Neo. And then let's-- who else did we create? We got John. John is in there, I know. And I'm pretty sure I've only set Neo to be an engineer. So we're going to say select those two. And there we go. Neo, yes, has a check mark, meaning is in the group. However, John is not in the group, because John has an X. So let's view the details here.

9:13If I do that, it says here the jobTitle is equal to Engineer. And yes, Neo's job title was engineer. So that's what we know. But if we come down here to John Aseed, we see that John doesn't have a job title of engineer. So that's why he failed. OK, so that means it's validated. It works because Tom was added and John was not. So there we go. We know that that works. So now I want to go ahead and save this. So now we have our dynamic query.

9:44And I can actually go ahead and create this group. And so we'll go ahead and create that. We'll give that just a minute. All right, now we'll go find our KY-Admins group. And there it is. So if I click on this, it shows that membership type is Dynamic. And all right, that's what we set it to. That is excellent. I have my owner assigned down here. But I don't have any group memberships just yet. And that's because it says right here-- dynamic group membership updates are expected to process for all groups within 24 hours.

10:17So when you create the group, expect it to take a little while for the memberships to be fulfilled for that dynamic query that we had to go ahead and run and populate this group. So it doesn't take effect immediately. Just keep that in mind. So that's our four different types of groups. Let's jump back over here to our Microsoft 365 admin center. We're going to create a group or add a group. And again, these are our four groups. A quick review-- Microsoft 365, that is only for collaboration.

10:52Remember that. Microsoft 365 groups are only for collaboration. Distribution groups, that's your email distribution. That's all they do. No roles or permissions assigned. Mail-enabled security, that's like your distribution group, plus some permissions for OneDrive and SharePoint. And then lastly, our security group, where we can add roles and permissions. Pretty darn important to understand those. And then we also have our dynamic and assigned groups. So if I jump back here to my groups-- let me go back to Groups here.

11:23And go to New group. We had our dynamic and assigned. Remember, assigned was meaning it's a manual process of assigning members. Then we can use dynamic for either users or devices, where we create our dynamic query rules so that these groups are autopopulated based on the attributes of either users or devices. And those are the four different types of groups. And there are two subtypes, or membership types, meaning assigned or dynamic. And that's how we create them in Azure Active Directory and over here in Microsoft 365 admin center.

11:56I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] It's time to talk about Azure AD Identity Protection. And this is some pretty cool technology. It uses artificial intelligence and machine learning to figure out what's not normal in the user activity, what looks risky. And then it uses that information to let us know about this risky activity so that we can manage it and help protect our is Azure AD identities.

0:31So what do you say we jump in and take a look at this? All right, here we go. We are right into our Azure Active Directory. We're going to be working with Azure AD's identity protection. Now, Azure identity protection uses ML, machine learning, to monitor user activities. Is there a risky user account? Is there a risky sign-in? That's what the intelligence is trying to figure out. So let's jump in and take a look at some of this. So we're going to go down here. I'm gong to scroll down here to Security. And here we go.

1:01What we have over here if I scroll down under report, I've got risky users, risky workload, risky sign-ins, risk detection, this is where that identity protection data comes into play. Now, there's two primary types, user risk, that's for risk for users, and sign-in risk, risky sign-ins. Now, risky users, this is risk related to a specific user credential, like leaked credentials or an attack pattern targeting a specific user account.

1:35So really we're focusing on the account itself. Then we have sign-in risk. Now, this helps identify malicious login attempts that aren't from the actual user, such as logins from an anonymous IP address or something called impossible travel. That's where if you login from Kentucky, right now I login, and then 10 minutes from now there's a login from Australia, well, obviously, that wasn't me, was it? No.

2:05So that's called impossible travel. It's impossible for me to travel from Kentucky to Australia in 10 minutes. So it's impossible travel. There's other things like IP addresses linked to malicious activities. So what we're looking at there is the sign-in activity. Is this legit? Is this really Bob trying to sign-in or is this somebody else? And that's that risky sign-ins. So let's go ahead and take a look at risky users. It says none selected. Let me go in here and click Apply. There we go.

2:36All right. So what we have here is me. And as of today at 8:46 AM was the last update. So let's go ahead and click on this and see what we're talking about here. And it says, risky user details. So recent risky sign-in. So it looks like it's related to sign-ins there. OK. Now, risk state is remediated, and that's because I had remediated it earlier. Details, user performed secure password change.

3:08That's how it was remediated. Now, I'm going to explain what happened. But before we do, we've got user's sign-in. So I can click up here to see User's sign-ins. So let's go ahead and do that. And I don't want the last month, I want the last 24 hours. Let's click Apply. OK, there we go. Last 24 hours. So this is the ins for me for the last 24 hours. So this is as if I'm investigating what happened. So what I did was come in here and look. OK, this is today.

3:38Yeah, me. I'm Richmond. Yeah, yeah, that's me logging in. But I scroll down here, well, what's this? I got some weird logins yesterday afternoon. See, I was obviously in Richmond here, Richmond, Kentucky, Richmond Kentucky, Richmond, Kentucky. And then I come up and that last login there was 4:22 PM. But then about 30 minutes later or so, I've got a couple of logins, or at least one here, from Australia, and then just a minute or two later from Germany, and a minute or two later from Tokyo.

4:12Well, obviously I didn't travel to all those places and logged in, so that's weird. That's what generated the risk level. So it says, you know what? There's something going on here. We should investigate this. That's where identity protection comes into play. It signals that, hey, what's going on here? I'm seeing these logins and this can't be right. So what I did was-- we're back here with our risky users here. And where I clicked on User's sign-ins. There's also user's risky sign-ins, I could just went straight to there.

4:46And let's see what pops up here. I don't want last one month, I want last 24 hours. And then I also have to state, I got to add remediated because I had remediated this. There we go. And here they come. There's our Australia login, our Germany, and our Tokyo, Japan login. Those were the risky logins. So, OK, all right. So I see they're risky. And then let's go back one more time here. I want you to see User's risk detection. So you can click on that to see if there were any events associated with it.

5:19Let's go last 24 hours, Apply. Let's see. I want down here to Remediated, so we can see what came in. OK. All right, so here's the risk detections and here it's with the risk level. Look at that. So here Australia is high, high, high. And there's another Australia that's a medium. But you'll see we're starting to assign risk levels to these events so we can do investigations on this. Then if I go back here, I've got some other options. Maybe I want to reset the user's password, I want to confirm a compromise, so that'll allow me to open a case, I want to dismiss user risk, or I want to block this user, or investigate with Azure Defender, these are my options here.

6:00So that's risky users. Let's go to risky sign-ins and we're going to go to Remediated so we can see those. I want the last 24 hours. And here we go. Let's see. There we go. So there's the Australia, Germany, and Tokyo logins as we see. And if I click on this, it's going to open up additional information over here. Look at my user's risk report. So let's do that. Let's look at the risk report. If I go down here, I can see that I am a limited admin.

6:30The risk state is now at remediated, so I don't have a risk level. But if I didn't remediate it, I might have a high risk level. Well, tell me, friends, what does that mean? Well, it means if I have conditional access policies that are associated with risky users with the high risk level, I'm going to fall into that category. That's what that means. All right, so I get go look at sign-ins and risk detections. I could reset passwords, I have the same options here as we looked at before. Let me go back one more time to security. Now, remember these were remediated.

7:02And when I looked at that-- let me show see if it'll show us in here why it was remediated. Sign-in type was interactive. I don't see it in here. But let me go back real quick over to the Risky users. We're going to go to-- I don't want Dismissed, I want Remediated. Apply, there we go. And here we go. The risk, the details down here, here's what I want to see. It says user performed secure password change. So here's what happened, because of those logins from those foreign countries, it's called impossible travel, I couldn't have traveled to all those places and successfully logged in from them, obviously, there's some type of compromise or something going on.

7:40So what it did was it prompted me, I'm going to drag this image in here, it prompted me to do this. This is what I got when I tried to login this morning. It says somebody else might have access to your account. You need to choose a new password. So basically, it's forcing me to reset my password. And we saw within the conditional access policies, this was one of the options that we could do, enforce MFA or enforce a password reset. And this is that identity protection, the machine learning, using those signals.

8:10This is how it makes those decisions. So that's pretty cool. We can protect our identities this way. All right, super. So now we know how to do the investigation, how this works. I'm going to go back over here real quick. We can now look at creating some identity protection policies. And that's what we're going to do in the next Nugget. So I'll see you there shortly. I hope this has been informative for you. And I'd like to thank you for viewing.

0:06Now that we know what is Azure AD Identity Protection is and how it uses intelligence to let us know about risky activities so that we can make decisions, well, it's time to take a look at the policies that we can use with Azure AD Identity Protection to make some things happen. So let's get started. All right, here we go. We're in our NuggetLabs Azure Active Directory. We're going to create some Azure Identity Protection policies. We're going to take that intelligence that we have from our machine learning, those signals, and we're going to put policies into play.

0:39So let's do that. Let's go on down here to Security, and we'll let that load up. Then we're going to go up here to Identity Protection. All right, there we go. Here's some nice data. Oh, what's going on here? We've got some graphs, we've got this here. What is this? User risk policy, user risk policy. If I scroll down here, new risky sign ins detected. Hey, look at there. So if I were to click on one of these, let's do this here. Click on that, it's going to go in here. And I'd have to go in here to remediate it, and I'll show you why.

1:13There we go. There's our logins. Those are risky logins of recent. And you'll see this is-- there's the Tokyo and Germany and Australia, those are all in there. So that's going with. Let's go back to Identity Protection, but we get some nice graphs anyways. So those reports, risky users, risky sign ins, the risk detections that we just looked at in the last Nugget, they're right in here as well. Now, what I want to talk about are these three up here. Pretty good stuff, let me tell you. Starting off with user risk policy.

1:44So let's click on that. It's going to open this up. Policy name, user risk remediation policy. OK. So the assignment, users. I have this set to all users. Now, you don't have to. You could say selected users, or all users and then exclude specific users if you wanted to. So maybe I don't want the admins to fall into this or maybe certain C-level execs, I don't want to fall into this. Whatever it might be. But right now I have all users. Then we come down to user risk. This is the user risk score.

2:15You get to select as part of this policy that who do you want this to apply to? All users with medium and above is what it's set to, or it could be just high or could be low and above. But if they're at that risk level, and, again, it depends on the activities that are going on. If they have a risk level that matches this, they're going to fall into this policy. So what's going to happen? This is the controls. What's going to happen if they fall into this policy? Well, right now, if I click on here, it's set to allow access, require password change.

2:46And that's what we could choose. Or you could just say block access. So if this user has a high risk level, we're just going to block them completely. Well, that can turn into a problem. Require password change is probably pretty good. So let's start with that and kind of see where it goes. Then we're going to say, Done. And this is a policy error they had in place. And it was enforced, and that's why, let me bring this in again, that's why I got this password change notification this morning after those logins from all over the place.

3:17And, by the way, I did those yesterday using a VPN. So I just connected to the different countries and logged in. It wasn't really malicious. So don't worry too much. But it's a good way to test to make sure that your policies are functioning properly. So that was our user risk policy. Now, quick reminder, user risk relates to a specific user's credentials like leak credentials or attack patterns targeting specific credentials. This would be really better renamed probably as like credential risk policy. But that's what it is.

3:48Then we have sign in risk policy. And it looks very much the same. And the sign in risk policy, again, this helps identify malicious login attempts that aren't from the actual user, like from an anonymous IP address or an IP address associated with malicious activities or the impossible travel we talked about. But the idea here is if it falls in that risk category, then we want to do something. So right now, it's set to all users. You can, of course, go ahead and exclude or do just a specific group, like an admin group or something.

4:20So we'll leave it at All Users, put they're sign-in risk. You want high, medium and above or low and above, you get to select that, of course. And then down here for controls, you could either block access or allow access and require multifactor authentication so that you sign in. So there we go. So the sign-in we require MFA because it's actually signing in the risk policy. We see a target going on against a specific user, so we want them to reset their password. So that's our options right there, and that's, of course, is turned on.

4:52There we go. And one more policy I want to talk about MFA registration policy. So within our MFA registration policy here, this is designed to help push out MFA to your selected users. Right now it's to all users here, but you can do selected individual users. So if you put your per user MFA only to a handful of users, you create a group, put them in there, and you could do that by group. So there's that. So we just went with all users. And then your controls down here requires Azure AD MFA registration. So what we're doing is we are requiring them to go ahead and set this up.

5:26So at our user's next login through a browser, they will be prompted to go ahead and sign up for MFA. However, they will have an option to bypass this for 14 days. But after 14 days, the next time they log in, it will be mandatory that they sign up. So you can set up this MFA registration policy. Now, I want to talk about something that I had to run into. And it's dealing with these policies here. And the idea that if a user here matches one of these, all right?

5:59Maybe they had a high risk or something. Think about what causes that risk. Because if they can't log in because of a high risk, what we need to do is reduce that risk. And how can we reduce the risk? Well, if you do certain things like reset your password, that reduces your risk. So for instance, if you were locked out for a certain reason because of a high risk, try resetting your password and then waiting 15 or 20 minutes, and that should reduce your risk and you should be able to sign in at that point. Just depending on what's going on, of course.

6:29But that is something that I found along the way that, you know sometimes, you just need to wait and reduce your risk of your account so you can get back in or something like that. OK? So that's just a little bit of wisdom from the trenches. I hope this has been informative for you, and I'd like to thank you for viewing.