Identity in office 365 sps michigan 2013

Blog: http://www.MyCentralAdmin.com
Twitter: @ferringer

3 | SharePoint Saturday Michigan 2013
Outline
 Office365 Overview
 Changingthe IdentityPerspective
 Authenticationvs. Authorization
 Who Are You?
 What Do You Do Here?
 Who’s in Charge Here?

 Email and Calendaring
 Websitesand Collaboration
 IM and OnlineMeetings
 OfficeClientand Web Apps
 Hostedby Microsoft– in the cloud!

 Who Are You?

Did Someone say Cloud?

What’s Your Perspective?

Identity’s impact on Office 365
 End UserExperience
 Complexity
 Scale
 Manageability
 Investment

 Who Are You?

Authentication vs. Authorization
 Who getsin?
 What can they do?

Who gets in?
 Where do your Office 365
useraccounts live?
 What is neededto use them?
 What can they do?
 What are the limitations
of the approach?

 Who Are You?

Identity Options
1. MicrosoftOnline(MSO)IDs
2. MSOIDs +DirectorySynchronization
3. SingleSignOn +DirectorySynchronization
Your Environment
AD
MS Online
Directory Sync
Identity Services
Provisioning
platform
Lync
Online
SharePoint
Online
Exchange
Online
Active Directory
Federation
Services 2.0
Trust
IdP
Directory
Store
Admin Portal/
PowerShell
Authentication
platform
Office 365
Desktop Setup
Microsoft Online Services
IdP

What can they do?
Appropriate for
• Smaller orgs without
AD on-premise
Pros
• No servers required on-
premise
Cons
• No SSO
• No 2FA
• 2 sets of credentials to
manage with differing
password policies
• IDs mastered in the
cloud
Appropriate for
• Medium/Large orgs with
AD on-premise
Pros
• Users and groups
mastered on-premise
• Enables co-existence
scenarios
Cons
• No SSO
• No 2FA
• 2 sets of credentials to
manage with differing
password policies
• Single server
deployment
Appropriate for
• Larger enterprise orgs
with AD on-premise
Pros
• SSO with corporate cred
• IDs mastered on-premise
• Password policy
controlled on-premise
• 2FA solutions possible
• Enables co-existence
scenarios
Cons
• High availability server
deployments required

Sign On Experience *
SSO vs. Online IDs Summary
Win7/Vista/XP
SSO IDs
(domain
joined)
MS Online IDs
Outlook Web
Application
SharePoint Web
Application
ActiveSync,
POP, IMAP,
Entourage
Outlook 2007 or
2010
Online IDOnline IDOnline ID
Win 7/Vista/XP
Office 2010, or
Office 2007 SP2
Online ID
Win7/Vista/XP
Lync Online
Online ID
AD credentials AD credentials AD credentials AD credentials AD credentials
SSO IDs
(non-domain
joined) AD credentials AD credentials AD credentials AD credentials AD credentials
*Requires ADFS 2.0

How does AD FS work?
 Claimsauthentication
 Think of it likea passport
 PassportApplication
 Visa Application
 Submit for authorization
 Allowedaccess

AD FS’s Authentication flow
`
Client
(joined to CorpNet)
Authentication platformAD FS 2.0 Server
Exchange Online or
SharePoint Online
Active Directory
Your Environment Microsoft Online Services
Logon (SAML 1.1) Token
UPN:user@contoso.com
Source User ID: ABC123
Auth Token
UPN:user@contoso.com
Unique ID:254729

AD FS 2.0 deployment options
1. Single serverconfiguration
2. AD FS 2.0 server farm and load-balancer
3. AD FS 2.0 proxy serveror UAG/TMG
(ExternalUsers,ActiveSync,Outlook)
Enterprise
DMZ
AD FS 2.0
Server
Proxy
External
userInternal
user
Active
Directory
AD FS 2.0
Server
AD FS 2.0
Server
AD FS 2.0
Server
Proxy

ADFS Considerations
 Can you afford an outage?
 How do you secureit?
 It’s complex
 RequiresspecificAD config
 UPN formatting
 RequiresDirSync
 Otheroptions available
 Shibboleth
 Ping
 Okta
Hattip:@usher

Directory Synchronization
 One-way or two-way
copy of accounts to Office365
 Requiredfor SSO/ADFS
 But can be usedwithout AD FS
 Requiredfor Hybrid scenarios
 Think of it as an appliance,
always running

Your Environment
AD
MS Online
Directory Sync
Identity Services
Lync
Online
SharePoint
Online
Exchange
Online
Active Directory
Federation
Services 2.0
Trust
IdP
Directory
Store
Authentication
platform
Office 365
Desktop Setup
Microsoft Online Services
IdP
How DirSync Fits in

Getting to know DirSync
 It’s actually Forefront IdentityManager
 CopiesAD accounts into Office365
 But not back down
 Doesn’tsync passwords
 Filteringnow available
 Can have sizingissues
 Upload sizing
 Databasesizing
 FIM:no touchy! (maybe)

 Who Are You?

Office 365 admin roles
 Global administrator
 Billing administrator
 Password administrator
 Servicesadministrator
 Usermanagement
administrator
 Delegatedadministrator
 See the Office365 SupportServicesDescriptiondocument formore info:
http://tinyurl.com/o365SvcDescrs

 Who Are You?

Managing Identity in Office 365
 Admin activitiesdo not go away
 AD FS is complex
 And important!
 PowerShellis your friend
 How’s your internetconnection?
 Office365 is constantlychanging

Troubleshooting Identity
 MicrosoftOnlineDiagnosticsand Logging tool
(MOSDAL)
 MicrosoftRemoteConnectivityAnalyzer:
HTTP://testexchangeconnectivity.com
 Fiddler
 WireShark/Netmon
 Office365 ExpertDiscussionSeries:
http://tinyurl.com/o365ExptDisc

Tie IT All Together

Identity in office 365 sps michigan 2013

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Identity in office 365 sps michigan 2013

Ähnlich wie Identity in office 365 sps michigan 2013 (20)

Mehr von John Ferringer

Mehr von John Ferringer (14)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Identity in office 365 sps michigan 2013