Category: Exams of Microsoft AZ-304 (Page 1 of 2)

To set up CA, you first need to disable Security Defaults. To perform this, follow these steps:

1. Navigate to the Azure portal at https://portal.azure.com.
2. In the top bar, search for and select Active Directory.
3. On the left-hand menu, click Properties.
4. At the bottom of the page, click Manage Security Defaults.
5. A side window will appear, with an option to disable Security Defaults.

The next step is to purchase AD licenses, as follows:

1. Navigate to the Azure portal at https://portal.azure.com.
2. In the top bar, search for and select Active Directory.
3. On the left-hand menu, click Licenses.
4. On the main page, click Manage your purchased licenses.
5. Click Try / Buy.
6. A side window will appear; click Purchase services.
7. This will open a new browser window: the Purchase Services page of the Microsoft 365 admin center (admin.microsoft.com).
8. Scroll to the bottom of the page and select Security and Identity under Other categories.
9. Select Azure Active Directory Premium P2.
10. Click Buy.
11. Choose whether to pay monthly or pay for a full year and select how many licenses you need. Click Check out now.
12. Complete the checkout process.

Once you have completed the checkout process, you need to assign your licenses to your users, as follows:

1. Navigate back to the Azure portal at https://portal.azure.com.
2. In the top bar, search for and select Active Directory.
3. On the left-hand menu, click Licenses.
4. On the main page, click Manage your purchased licenses.
5. Click All products.
6. Click Azure Directory Premium P2 (your licenses count has increased by the number of licenses you have purchased).
7. Click Assign.
8. Click Users.
9. In the side window that appears, select the user(s) you wish to assign licenses to. Click Select.
10. Click Assignment options.
11. In the side window that appears, set your license options and click OK.
12. Click Assign.

With Security Defaults disabled and your premium licenses assigned, you can now configure CA policies, as follows:

1. Navigate to the Azure portal at https://portal.azure.com.
2. In the top bar, search for and select Azure AD Conditional Access.
3. On the left-hand menu, click Named locations.
4. Click + New location.
5. On this page, you can define specific countries or IP ranges that users can sign in from. Click the back button in your browser to return to the CA page, or click the CA breadcrumb.
6. On the left-hand menu, click Policies.
7. Click New Policy.
8. Enter Managers under name.
9. Click Users and groups.
10. Click the Users and groups checkbox, and then select a user. Click OK.
11. Click Conditions. You can choose different risk profiles depending on your needs—for example, click Sign-In risk, and then click the Medium checkbox, as in the following example. Click Select:

Figure 3.14 – Assigning risk policies

12. Choose the action to perform when the policy is triggered. Click Grant under Access controls, and then click the Require multi-factor authentication checkbox. Click Select.
13. Set the Enable policy to Report-only.
14. Click Create.

In this example, we have created a simple access policy that only applies to a single user. The policy will trigger if the user’s activity is deemed medium risk, and will then enforce MFA. However, we set the policy to Report-only, meaning that the actual MFA enforcement won’t take place. This is advised when first creating policies in order to ensure that you do not inadvertently lock users out. In other words, it gives you the ability to test policies before applying them.

In this section, we examined how to provide greater control over the user authentication process for internal users. Sometimes, however, we will want to provide access to external users.

When working with virtual machines (VMs), you are responsible for managing the operating system that runs on them, and attackers can seek to exploit known vulnerabilities in that code.

Regular and timely patching and security updates with anti-virus and anti-malware agents are the best line of defense against this. Therefore, your solution design needs to include processes and tools for checking, testing, and applying updates.

Of course, it is not just third-party code operating systems that are susceptible; your application code is vulnerable too.

Application code

Most cloud services run custom code, in the form of web apps or backend application programming interface (API) services. Hackers often look for programming errors that can open holes in the application. As with other forms of protection, multiple options can be included in your architecture, and some are listed here:

• Coding techniques: Breaking code into smaller, individually deployed components and employing good development practices such as Test-Driven Design (TDD), paired programming, or code reviews can help ensure code is cleaner and error-free.
• Code scanners: Code can be scanned before deployment to check for known security problems, either accidental or malicious, as part of a deployment pipeline.
• Web application firewalls (WAFs): Unlike layer 3 or 4 firewalls that block access based on Internet Protocol (IP) or protocol, WAFs inspect network packet contents, looking for arbitrary code or common exploits such as SQL injection attacks.

Application-level security controls help protect you against code-level exploits; however, new vulnerabilities are uncovered daily, so you still need to prepare for the eventuality of a hacker gaining data access.

Data encryption

If the data you hold is sensitive or valuable, you should plan for the eventuality that your security controls are bypassed by making that data impossible to read. Encryption will achieve this; however, there are multiple levels you can apply. Each level makes your information more secure, but at the cost of performance.

Encryption strategies should be planned carefully—standard encryption at rest is lightweight but provides a basic protection level and should be used for all data as standard.

For more sensitive data such as credit card numbers, personal details, passwords, and so on, additional levels can be applied. Examples of how and where we can apply controls are given here:

• Databases: Many databases now support Transparent Data Encryption (TDE), whereby the data is encrypted. Applied by the database engine itself, consuming applications are unaware and therefore do not need to be modified.
• Database fields: Some databases provide field-level encryption that can be applied by the database engine itself or via client software. Again, this can be transparent from a code point of view but may involve additional client software.
• Applications: Applications themselves can be built to encrypt and decrypt data before it is even sent to the database. Thus, the database is unaware of the encryption, but the client must be built specifically to perform this.
• Transport: Data can be encrypted when transferring between application components. HyperText Transfer Protocol Secure (HTTPS) using Secure Sockets Layer (SSL) certificates is the most commonly known for end-user websites, but communications between elements such as APIs should also be protected. Other transport layer encryption is also available—for example, SQL database connections or file shares.

Data can be encrypted using either string keys or, preferably, certificates. When using certificates, many cloud vendors, including Azure, offer either managed or customer-supplied keys. With managed keys, the cloud vendors generate, store, and rotate the certificates for you, whereas with customer-supplied keys, you are responsible for obtaining and managing them.

Keys, secrets, and certificates should always be stored in a suitably secure container such as a key vault, with access explicitly granted to the users or services that need them, and access being logged.

As with other security concerns, the variability and ranges of choices mean that you must carefully plan your encryption techniques.

On their own, each control can provide some protection; however, to give your solution the best defense, you need to implement multiple tactics.