Microsoft Azure AD Options Explained

If your institution is using Office 365, you are already utilizing Azure Active Directory (“Azure AD”) and may not know it. It is the identity and access management system that manages how users authenticate to Office 365. In its base form, Azure AD includes the ability to synchronize with your on-premise network so that users can log into Office 365 with the same credentials they use locally.

The base version of Azure AD also includes multi-factor authentication to help ensure a user is who they say they are, support for self-service password changes, and some basic usage and security reports. In addition, the base version supports single sign-on to other popular cloud-based apps.

It does not take long after implementing Office 365 for administrators to discover that the base Azure AD lacks some features that they would like to have. For $6 extra per user, Microsoft offers Azure AD Premium 1. This level adds more capabilities, including:

• The ability to have a custom banned password list.
• More control and features for group management.
• Self-service password resets and unlocks that can also change on-premises passwords.
• Easier enrollment in Mobile Device Management (MDM).
• Self-service Bitlocker recovery.
• The ability to limit access based on group, location, or device status.
• The ability to block access to SharePoint from unmanaged devices.
• Better user and security reporting.

Since all good things come in threes, Microsoft also offers Azure AD Premium 2 for $9 per user. The Premium 2 version includes everything in Premium 1, but adds:

• Detection and automatic blocking of accounts with vulnerabilities (login from atypical locations, login from anonymous IP addresses, login from IP addresses linked to malware, login using credentials which have been leaked.
• The ability to investigate risk events.
• Better management and tracking of privileged users.
• The ability to perform access reviews of Office 365 access, including approval processes.

Because financial institutions usually are seeking a higher level of control, integration, and reporting, we recommend that they consider stepping up to at least the Premium 1 package. For only $3 above Premium 1, we believe the proactive threat seeking capabilities of Premium 2 make it worth looking at seriously.

Office 365 has a lot of complexities and is constantly rolling out new features. If you feel overwhelmed by trying to best configure and secure it, we can provide you with some valuable best practices. 

Shoot us an email at support@bedelsecurity.com to get the conversation started.