- [Instructor] Azure Active Directory has come a long way
since the first Azure exams.
Therefore, expect a fair amount
of Azure Active Directory content on this exam.
In this lesson, we're going to look at how to configure
Azure Active Directory Identity Protection.
If you're unfamiliar with
Azure Active Directory Identity Protection,
here is a high level overview.
It is only available in the Premium or P2 edition
of Azure Active Directory.
It will detect potential vulnerabilities,
it will handle suspicious actions automatically,
and it will also investigate incidents
and resolve them as well.
Let's go ahead and take a look at how we enable
and configure Azure Active Directory Identity Protection.
Before we can configure
Azure Active Directory Identity Protection,
we must first enable it.
And this is done by searching the Marketplace for
Azure Active Directory Identity Protection.
We have a blurb about
Azure Active Directory Identity Protection.
We'll go ahead and click create.
In my example, I have an information statement here
indicating that I already have
Azure Active Directory Identity Protection
assigned to my directory.
If you have never enabled it,
you will go ahead, select your directory,
and then click create.
And that's all there is to enabling
Azure Active Directory Protection.
Now let's go ahead and configure it.
I'm going to go ahead and launch
Azure Active Directory Identity Protection.
From the Overview page we can quickly see
we have two users that are flagged for risk.
We can see we have one risk event at the medium level.
And that we have seven users
without the multifactor authentication registration
policy assigned to them.
Let's now go ahead and configure these policies
and you'll find that under configure
and we'll start off with MFA registration.
We all know that Microsoft highly recommends
multifactor authentication for all of your Azure users.
And we can apply a multifactor authentication
registration policy to those users.
This doesn't mean that they have to do multifactor
at this point.
This means that they have to register
for multifactor authentication.
And the first thing we need to do
is select the users who are gonna be forced
to register for this policy.
In this case I have all users,
but you could select individual users and groups
and you can exclude certain users as well.
Next, we have controls.
And the only control that is available to us
is require Azure multifactor authentication registration.
The other options are not available
because they have to register first.
Next, we can review who will be impacted
by implementing this policy.
We can see here we'll have seven users
who will be affected by this policy.
Seven users isn't bad, but if you have thousands
you'll want to go ahead and prepare some training
and prepare your help desk for the calls
that will come in after the fact.
At this point, you can go ahead and enforce the policy.
I am not going to do so.
I'm gonna leave it as-is.
I would highly recommend that you don't enforce any policies
until you have tested it thoroughly.
Next we can configure the user risk policy.
As before, we can go ahead and assign this
to specific users, or all users.
And then we can go ahead and select the user risk.
And the user risk is the likelihood
that the user account is compromised.
And we had three levels to choose from.
We can select low and above,
medium above, and high.
I'm gonna leave it at medium and above.
You'll want to be careful here
and again, do the testing
because you do not want to frustrate your users
by selecting, say, a low setting.
If the user meets that threshold of medium and above,
next, we will allow access
but they will be required to change their password.
You could also go ahead and block access
to that user as well, if they meet that threshold
of medium and above.
As before, we can review the number of users
that could be impacted
and then you can go ahead and enforce that policy.
And finally, we have the sign-in risk policy.
Again, we can assign it to all users
or subsets of users.
And next is the condition for the sign-in risk.
And the sign-in risk is the likelihood
that the sign-in is coming from someone else
other than the user.
As before, we have our three selections to choose from.
I like to start off at medium and above
and do my testing from there,
as I do not want to frustrate my users.
And then, what kind of access
are we going to allow if they meet that threshold?
In our example here, we're going to allow access
but we are going to force them
to provide multifactor authentication.
We could also go ahead and block their access.
And as before, you can go ahead and enforce policy
and that is it.
There's one thing I want to mention here.
Sometimes users are unable to use MFA
or it may become a hindrance,
or it may not be practical.
For example, developers.
Always be sure to evaluate and test
to see which level best meets your needs
but does not frustrate your users.
That is all there is to creating and enabling policies
to help protect your identities
and in turn, your environment.