Slide 1

Slide 2

Slide 3

Owner = ellen@outlook.com Owner = aaron@hotmail.com Owner = xyz@yahoo.com Owner = xyz@gmail.com Managed Identity Active Directory ellen@company.com aaron@company.com partner@yahoo.com prospectivecustomer@live.com

Slide 4

joe@partner.com prospectivecustomer @live.com Roles and Role Assignments Owner = ellen@outlookcompany.com Owner = aaron@hotmailcompany.com Azure Active Directory Users & Groups Sync 2500+ Pre-Integrated SAAS Apps Microsoft Online Services Microsoft Azure IAAS/PAAS Company In-House Developed Cloud Apps Managed Identity Active Directory ellen@company.com aaron@company.com Roles-Based Access Control Self-Service Groups Management B2B Access Management Conditional Access (MFA, Device Health, Network) Attribute Based Access Control Managed Access to Daemon Services Secure Sharing with Consumer Accounts Self-Service Password Management

Slide 5

Slide 6

Slide 7

RG S R R R R R R Role Assignment Role = Reader Subject = AAD Group Scope = Subscription Role Assignment Role = Owner Subject = AAD User Scope = Resource Role Assignment Role = Contributor Subject = AAD User Scope = Resource Group Access Inheritance

Slide 8

Slide 9

Slide 10

Slide 11

Azure On-Premises Sector 1 Sector 2.. Region NA Region SA Division Mktg.. Division Sales.. Project 1 Project 2.. Subscription per Sector Resource Group per Project Tags Region, Division, Project Standard VNet per Division in separate resource group Billing Tracked per Division Subnet On standard Vnet assigned to each Project Users, Groups and Password Sync Active Directory Express Route(s) IT Director Office Azure Active Directory Infrastructure Admins and Support Project Team Roles Network Admins Owners of Subscriptions VNet Contributors of standard VNet RGs Virtual Machine Contributors of Project RGs and standard VNet RGs Appropriate Role on Project RGs

Slide 12

Slide 13

Slide 14

Slide 15

Slide 16

Slide 17

Slide 18

Slide 19

Slide 20

Slide 21

http://www.dushyantgill.com/blog/2015/04/26/say-goodbye-to-key-management-manage- access-to-azure-storage-data-using-azure-ad/ http://www.dushyantgill.com/blog/2015/04/26/say-goodbye-to-key-management-manage- access-to-azure-storage-data-using-azure-ad/

Slide 22

2) Read Secret (Storage Account Key) Scheduled Job Running in Azure Automation Key Vault Storage Account 3) Access Storage Account with Key Write Secret (New Storage Account Key) Regenerate Storage Account Key User/Service Azure AD 1) Authenticate

Slide 23

Slide 24

Slide 25

Slide 26