Chapter 3: Identity and Authentication

Definitions:
- Authentication: The process of verifying a user's credentials to confirm their identity when logging into an Active Directory (AD) domain, whether on-premises or in the Azure cloud.
- Authorization: The process that follows authentication, where AD checks if the authenticated user has permission to access a particular resource, such as a shared file.

Identity Management: Handles user identities across both on-premises and cloud environments.
Microsoft Identity Management protects access to applications and resources across all environments.
Key Features:
- Additional validation such as:
- Multifactor Authentication (MFA)
- Conditional Access Policies
- Management of a single identity for each user, ensuring synchronization for users, groups, and devices across hybrid enterprises.
- Facilitates single sign-on (SSO) access to thousands of Software as a Service (SaaS) applications, enabling seamless user experiences.
- Provides secure remote access to on-premises web applications via Azure AD Application Proxy.

Definition: A system incorporating both on-premises Active Directory services and Azure cloud services for user authentication and authorization globally.
Microsoft Solutions: Develops a unified user identity for access across Microsoft 365, Azure, and integrated SaaS applications.
Azure AD Connect: A tool that resides on an on-premises server, allowing synchronization with Azure AD.
- Pass-Through Authentication: Enables single sign-on from local AD to cloud resources.
User Monitoring: Administrators can track logins and permissions through the Azure portal.

Role-Based Access Control: Used for administering privileged operations within Azure or Microsoft 365.
Risks of Permanent Privileged Access:
- Permanent access can lead to security risks if user accounts are compromised; a single breach may jeopardize the entire cloud security of an organization.
Azure AD Privileged Identity Management: A service that helps mitigate risks associated with privileged access management.

Importance: Familiarity with AD will enhance troubleshooting and management skills for SysAdmins.
Demonstration Introduction: Overview of the installation process for Active Directory.

Navigate to Add Roles and Features within Server Manager.
Install Active Directory Domain Services (AD DS).
Promote the server to a domain controller.
- Creating a New Forest: The initial Active Directory Domain begins with creating a forest. Both forest and domain names will be the same for the first domain.
Functional Levels: The forest and domain functional levels must be compatible with all existing domain controllers. Set them according to the lowest version, which could be 2016 if using an older version.
DNS Installation: Required for name resolution and must have at least one global catalog in the domain.
Recovery Mode: Configure a password for Active Directory Directory Services Restore Mode (DSRM).
Install: The installation and promotion process will conclude with an automatic server restart.

AD DS Installation: Must be checked again in Server Manager.
Promote the new server as an additional domain controller, connecting it to the existing domain.
Credentials Configuration: Log in using the new User Principal Name (UPN) format which is administrator@domain starting from Windows Server 2025.
Repeating the installation steps will ensure redundancy and reliability in service.

Multi-Master Domain Model: All domain controllers are equal; no primary or secondary, unlike older systems that had a primary domain controller.
AD manages resources like client devices, enhancing security and control for joined devices.

Azure Entra ID: Stores users credentials and groups for application access to Azure and Microsoft 365.
Entra ID Domain Services: Acts as a replacement for on-premises AD, mimicking behaviors and functions.
Azure Hybrid Identity: A one-way sync application from on-premises AD to Entra ID using Microsoft Entra Connect.

Native: Involves building users and groups directly within Azure Entra ID without on-premises dependency.
Dynamic Groups: Create groups based on user attributes, e.g. city or job title.

Definition: A security process where users provide two or more verification factors to gain access to a resource.
MFA Options in Azure AD: Include phone verification, mobile apps, or SMS codes.

Definition: A user ability to log in once and access various applications without needing to re-authenticate.
Federated SSO: Links multiple identity providers allowing secure access across applications.
Configuration: Set up SSO for applications via the Azure AD admin center.

Types of Groups:
- Security Groups: For resource permissions.
- Distribution Groups: Primarily for email notifications.
Group Scope: Managed based on domain needs (domain local, global, or universal).

Purpose: Control user and computer environments, applies settings collectively.
Policy Links: Can be created and assigned to users or OUs, affecting log in experiences.

Sharing vs Security Tab: Understanding effective permissions derived from both sharing settings and file security settings.
Creating Shares: Applicable methods include through Server Manager and file properties.

Layered Approach: Implementing multiple defenses against unauthorized access, including MFA, strong firewalls, and constant updates.
Privilege Separation: Only grant necessary rights for user roles to mitigate risks.
Data Loss Prevention (DLP): Targeted strategy to identify and secure sensitive information from breaches.
Device Security: Monitor and secure devices in a mobile-first environment.

Consult security experts when necessary, creating a tranquil IT environment.
Focus on maintaining secure and efficient systems operationally over time.
Prepare for natural transitions into newer tech like Azure Entra and adaptations needed for cloud security.