Enterprise Mobility + Security

October 16, 2018 By PC Portal

Microsoft named a 2018 Gartner Peer Insights Customers’ Choice for Access Management

Howdy folks,

Every day, everyone in the Microsoft Identity Division comes to work focused on helping you, our customers, make your employees, partners, and customers more productive and to make it easier for you to securely manage access to your enterprise resources.

So, I was pretty excited to learn that Microsoft was recently recognized as a 2018 Gartner Peer Insights Customers’ Choice for Access Management, Worldwide.

In the announcement, Gartner explained, “The Gartner Peer Insights Customers’ Choice is a recognition of vendors in this market by verified end-user professionals, taking into account both the number of reviews and the overall user ratings.” To ensure fair evaluation, Gartner maintains rigorous criteria for recognizing vendors with a high customer satisfaction rate.

Receiving this recognition is incredibly energizing. It’s a strong validation that we’re making a positive impact for our customers and that they value the innovations we added to Azure Active Directory (Azure AD) this year.

To receive this recognition, a vendor must have a minimum of 50 published reviews with an average overall rating of 4.2 stars or higher.

Here are few quotes from the reviews our customers wrote for us:

“Azure AD is fast becoming the single solution to most of our identity and access problems.”
—Enterprise Security Architect in the Transportation Industry. Read full review.

“Azure Active Directory is making great strides to become a highly available and ubiquitous directory service.”
—Chief Technology Officer in the Services Industry. Read full review.

“[Microsoft] has been a great partner in our implementing an identity solution [that] met the needs of our multiple agencies and provided us with a roadmap to continue to move forward with SSO and integration of our legacy and newly developed application. We were also able to set a standard for our SaaS application authentication and access.”
—Director of Technology in the Government Industry. Read full review.

Why and how you simplify IT with Microsoft 365

During this past week at Microsoft Ignite, it was an honor to spend time sitting with customers, listening to them explain what’s working and what’s not, and learning more about where they need our help.

In my session on Monday, I showed 75 minutes worth of examples of how we’ve applied a new philosophy to the way we build tools and services for IT pros. We refer to this approach to architecture, development, and end-user experience in Microsoft 365 as being “Integrated for Simplicity.” Our goal with this integrated simplicity is to make it as easy as possible for our customers to shift to a modern desktop and make their modern workplace a reality.

As part of my session on Monday, we made a series of announcements that align with this approach:

The shift to a modern desktop is an extension of what many organizations are already doing or are planning to do in the near future. There are many ways to start this process; for example, many tools and processes you’re using right now—like ConfigMgr and Active Directory—can easily be cloud-connected. Doing this not only reduces complexity—it also harnesses the power of Microsoft’s cloud-driven intelligence.

Modern desktop puts the power of the cloud in the hands of both end users and IT

The makeup of a modern desktop is simple: Windows 10 with Office 365 ProPlus—which are built in and driven by the cloud so that their scale, compute, automation, intelligence, and flexibility can simplify your IT. Supporting your end users with the Office ProPlus apps is a fundamental component of a modern desktop. These are the only apps with an artificial intelligence (AI) that can do the hard work of security while simultaneously improving and beautifying documents and presentations.

If you didn’t watch my session live, you can check it out in this recorded media stream. At the end of the session, I share three ways you can start using that cloud intelligence right now—and you can do these three things in minutes, not days.

1. Cloud-connect what you have today

A powerful way to begin cloud-connecting your existing infrastructure is to link your on-premises Active Directory with Azure Active Directory (Azure AD). This process is simple and it adds significant flexibility, security, and mobility to your organization’s identity.

I also strongly encourage you to cloud-connect ConfigMgr with Intune. The process takes #Just4Clicks and, once enabled, reaps immediate rewards including superior visibility into device health, as well as access to actions such as remote wipe and security features like conditional access.

For more information, you can watch the #Just4Clicks video on our Microsoft Cloud channel.

You can also get your files up into the cloud with OneDrive Known Folder Move. This simple process immediately gives you protection from ransomware, and it improves real-time collaboration.

Find more information in our Tech Community blog, Migrate Your Files to OneDrive Easily with Known Folder Move.

2. Gain superior visibility and control

One of the many announcements we made at Ignite was the work we’ve done to merge 20+ separate web consoles into a single point of entry called the Microsoft 365 admin center. This consolidation is a part of our focus on integrated simplicity, and it features seven specialist workspaces for security, compliance, device management, and more.

I encourage you to check out the preview at admin.microsoft.com

Another simple action with big benefits is enabling conditional access so that you can better understand how corporate data is being accessed by personal devices. Configuring conditional access is easy and it dramatically increases your security posture while also reducing the risk of both intentional and accidental data leakage.

Learn more about how to enable conditional access.

In addition to support for Win32 app deployment in Intune, we also announced Intune security baselines. These baselines are pre-configured (but still customizable!) and published every month. I strongly encourage everyone using Intune to enable these as soon as possible.

More information is available in Using security baselines in your organization.

3. Shift to a modern desktop

For years, engineers at Microsoft have dreamed of building a service that learns from the millions of devices, billions of authentications, and trillions of signals in the Microsoft Cloud—and then applies that information to the estates of our customers in real-time. Desktop Analytics is the realization of that dream.

Desktop Analytics is one of the most powerful tools we have ever created—and it is custom built to give IT teams the insight and information they need to deploy, manage, and service apps and devices.

Desktop Analytics offers a tightly integrated, end-to-end solution that automates the mountain of work required to validate the compliance of your hardware, drivers, applications (both 3rd party and your own internally developed), as well as the Office add-ins. This doesn’t just eliminate hundreds of hours of work for IT teams, it wipes out thousands of hours otherwise spent on manual compliance checks which have chronically stolen your bandwidth at a time when you could be pursuing strategic projects that make a lasting impact on the way your company operates.

Desktop Analytics is currently in private preview (public preview will be announced soon), but you don’t need to wait to use it: The Windows Analytics service (which is part of Desktop Analytics) is available to use right now. I think you’ll be really surprised by how much Windows Analytics will simplify and improve your ability to manage devices and apps, as well as simplify the task of upgrading to Windows 10.

More information is available in Windows Analytics Overview: Device Health, Update Compliance, Upgrade Readiness.

I also want to highlight how simple and valuable it is to shift from Office perpetual to Office 365 ProPlus with the Office Customization Tool in ConfigMgr. This is proof of how easy it now is for your on-premises infrastructure and the cloud to work together to reduce the complexity of what would otherwise be arduous manual tasks—e.g., migrating from MSI deployments of Office perpetual editions in favor of Office 365 ProPlus Click-to-Run.

Only the Office ProPlus apps offer the AI required for these scenarios.

More information is available in Overview of the Office Customization Tool for Click-To-Run.

As you plan for the future of your organization, prioritize finishing Windows 10 upgrades before January 2020. Both Windows 7 and Office 2010 will reach the end of extended support in 2020, and based on our data, we can see that there are now more devices in the enterprise running Windows 10 than any other previous version of Windows.

If your Windows 10 deployment hasn’t also reached the halfway mark yet, now is a great time to reach out to our FastTrack team for help with upgrades, migrations, and (as of Ignite) application compatibility as part of the newly announced Desktop App Assure program.

More information is available in Helping customers shift to a modern desktop.

Make the shift today

I started Monday’s session talking about the past instead of the future.

This look backwards focused on the little-known story of John Napier. In the early 1600s, Napier was an eccentric inventor and treasure hunter who never left his home without a wooden box of spiders in his pocket or a black rooster he considered magical. From this very unlikely source came a project 20 years and 10 million calculations in the making.

In 1614, he published a 147-page book that ushered in the technical underpinnings of the modern world. With no advanced notice or fanfare, he introduced the concept of logarithms and how to use them.

Once logarithmic tables were available, the sciences and engineering professions surged. Almost overnight, a world full of equations that could not be solved by hand within the time limits of a normal lifespan could be unraveled in minutes. This made the world a dramatically simpler place, and the sciences surged with this new, user-friendly computational technology.

Logarithmic calculations offered the means for accurate measures of planetary orbits, which led to interstellar cartography, which led to satellites and moon landings. Trade routes could now be measured and planned across oceans instead of counties. Engineers could now build things bigger, safer, and stronger—which led to industrialization, internal combustion, and skyscrapers. In very short order mobility leapt from carts, to steam engines, to intercontinental flight, and human productivity took flight by moving from hand tools, to electricity, to the cloud.

I believe we’re at another pivotal moment in history. All hyperbole aside, I see the volume and quality of the new tools demonstrated at Ignite as a huge opportunity for IT. Not only do these tools work with and expand upon the elements you already have within your infrastructure, but they put the power of the cloud in the hands of every one of your end users. The integrated simplicity and functionality of what has been built for IT pros allows you to cloud-connect the work you are doing and use cloud-based intelligence to transform your organization.

Please evaluate and investigate all of our announcements—and don’t hesitate to share your feedback. I appreciate your partnership and I am grateful for the incredible work you do every day.

The post Why and how you simplify IT with Microsoft 365 appeared first on Microsoft 365 Blog.

August 29, 2018 By PC Portal

The role of standards in accelerating innovation

Howdy folks,

Today I’m going to blog about something a bit different: the important role identity open standards play in accelerating innovation. If you’re an identity geek or an open standards geek, or just interested in understanding where we believe the future of identity is headed, I think you’ll find it interesting.

At Microsoft, we firmly believe that open identity standards accelerate innovation. Some of you might think this is an oxymoron. Let me explain why it isn’t.

By building upon widely implemented industry standards, innovators are free to focus on the innovative aspects of their work, letting existing standards do the heavy lifting for the needs of their projects that standards already address. The potential for use of cryptographic and digital identity standards in decentralized systems illustrates this point.

Microsoft is deeply engaged with a ton of innovative members of the identity community, and we’re all working together to design and prototype an open standards–based approach to decentralized public key–based identity systems. Needless to say, we are VERY excited by the potential here.

We love what’s happening and the way innovators are coming together to enable new digital identity possibilities. All of us want these possibilities to achieve their promise as quickly as possible. Integrating and maintaining interoperability with existing identity management systems—all based on standards—will be key to accelerating this process.

Standards play a huge role in enabling innovation in decentralized public key–based identity systems. By using widely adopted industry cryptographic and data representation standards as an agreed framework, innovators in this space can achieve laser focus on the unique value that they’re adding. Furthermore, use of standards, where applicable, will facilitate faster adoption as decentralized public key–based systems move from prototypes to production systems.

To make things concrete, we believe that use of the following standards will accelerate innovation when building decentralized identity systems:

JWK [RFC 7517] is a widely deployed representation of cryptographic keys.
JWS [RFC 7515] is a simple, flexible representation of digital signatures.
JWE [RFC 7516] is a no-nonsense JSON-based representation encrypted content.
JWA [RFC 7518] defines an initial set of algorithms for use with all the above.
JWT [RFC 7519] is a simple, powerful, widely deployed representation of claims (including that JWT is often used for representing verified claims).
CBOR [RFC 7049] defines a compact binary data representation, which can be used as an alternative to JSON [RFC 8259] when size is at a premium.
COSE [RFC 8152] is the CBOR equivalent of JWK, JWS, JWE, and JWA.
CWT [RFC 8392] is the CBOR equivalent of JWT, providing a binary claims representation.
W3C Web Authentication and FIDO Client to Authenticator Protocol (CTAP) employ the building blocks above for public key–based authentication.

Great standards not only solve current use cases but enable solving new ones. The JOSE [RFC 7515-7518] and JWT [RFC 7519] standards and their binary equivalents explicitly enable innovation while still using the standards. How is this possible?

While JWA [RFC 7518] defined how to a set of commonly used cryptographic algorithms with JWS, JWE, and JWK, it also established the IANA JOSE Algorithms registry to enable additional algorithms to be used for new use cases, without having to revise the JOSE standards. For instance, RFC 8037 defined how to use new elliptic curves with JWS, JWE, and JWK. Microsoft is currently working with decentralized systems implementers on registering the secp256k1 algorithm for use with JWS and COSE. And when new cryptographic algorithms are invented, new identifiers can and will be registered for them in the IANA JOSE Algorithms registry.

Microsoft is building a proof of concept for decentralized identities based on these robust industry standards. We’d like to invite others to join us using this approach. Together we can dramatically accelerate innovation and rapid adoption using this approach.

We’re excited to see what we’ll achieve together!

Best regards,

Alex Simons (Twitter: @Alex_A_Simons)

Corporate Vice President of Program Management

Microsoft Identity Division

The post The role of standards in accelerating innovation appeared first on Microsoft 365 Blog.

August 27, 2018 By PC Portal

Microsoft Authenticator companion app for Apple Watch now in public preview

Howdy folks,

We heard our customers loud and clear—they want support for the Microsoft Authenticator app on Apple Watch. So, that’s why I’m thrilled to announce we are starting to roll out the public preview of the Microsoft Authenticator companion app for Apple Watch and plan to release to general availability within the next few weeks. This experience will allow you to approve sign-in notifications that require PIN or biometric on your Watch without having to use your phone.

The Microsoft Authenticator app on Apple Watch supports Microsoft personal, work, and school accounts that are set up with push notifications. All supported accounts automatically sync to the Watch.

Try it out

To test drive the app, upgrade to Microsoft Authenticator v. 6.0.0+ on your phone when it becomes available to you. If you want to try it out before it’s generally available, sign up to become a Microsoft Authenticator TestFlight user.

Once you have the upgrade installed, just follow these three steps:

Make sure your phone and Watch are paired.
Open the Microsoft Authenticator app on your Watch.

Under the account title, tap the Set up button. If there’s no Set up button next to your account, no action is required! You can now approve sign-in notifications on your Watch.

To see the full experience in action, sign in to your account using the Microsoft Authenticator. When a notification comes to your Watch, you can easily and quickly approve.

From a security standpoint, we still consider the experience on the Watch as two-step verification. The first factor is your possession of the Watch. The second factor is the PIN that only you know. When you put the Watch on your wrist in the morning, you will need to unlock it. As long as you don’t remove the Watch from your wrist and it stays within range of your phone, it will stay unlocked—so you don’t need to provide your PIN again.

If you have additional questions, please see our Microsoft Authenticator app FAQ page. Also, feel free to comment below—we would love to hear your feedback and suggestions.

Best regards,

Alex Simons (Twitter: @Alex_A_Simons)

Director of Program Management

Microsoft Identity Division

The post Microsoft Authenticator companion app for Apple Watch now in public preview appeared first on Microsoft 365 Blog.

August 21, 2018 By PC Portal

It’s time for token binding

Howdy Folks,

The last few months have been some VERY exciting times in the world of identity and security standards. Due to the efforts of a broad set of experts across the industry, we’ve made incredible progress in finalizing a broad set of new and improved standards that will improve both the security and user experiences of a generation of cloud services and devices.

One of the most important of these improvements is the Token Binding family of specifications which is now well on its way towards final ratification at the Internet Engineering Task Force (IETF). (If you want to learn more about token binding, watch this great presentation by Brian Campbell.)

At Microsoft, we believe that the Token Binding can greatly improve the security of both enterprise and consumer scenarios by making high identity and authentication assurance broadly and simply accessible to developers around the world.

Given how positive we believe this impact can be, we have been and continue to be deeply committed to working with the community for creation and adoption of the token binding family of specifications.

Now that the specifications are close to ratification, I’d like to issue two calls to action:

Begin experimenting with token binding and planning your deployments.
Contact your browser and software vendors, asking them to ship token binding implementations soon if they aren’t already.

And I’m happy to report that Microsoft is just one of many industry voices saying that token binding is an important solution whose time has come.

For more on why token binding matters, I’ll turn things over to Pamela Dingle – a leading industry voice who many of you already know – who is now Microsoft’s Director of Identity Standards on the Azure AD team.

Best Regards,

Alex Simons (Twitter: @Alex_A_Simons)

Director of Program Management

Microsoft Identity Division

—————————————————————————————————————————–

Thanks Alex and hi everybody,

I share Alex’s excitement! Years of time and effort have been put into the specifications you will see celebrated as new RFC standards in a very short time. The time is right for architects to dig in to the specific identity and security advantages that Token Binding represents.

What is so great about token binding, you might ask? Token binding makes cookies, OAuth access tokens and refresh tokens, and OpenID Connect ID Tokens unusable outside of the client-specific TLS context in which they were issued. Normally such tokens are “bearer” tokens, meaning that whoever possesses the token can exchange the token for resources, but token binding improves on this pattern, by layering in a confirmation mechanism to test cryptographic material collected at time of token issuance against cryptographic material collected at the time of token use. Only the right client, using the right TLS channel, will pass the test. This process of forcing the entity presenting the token to prove itself, is called “proof of possession”.

It turns out that cookies and tokens can be used outside of the original TLS context in all sorts of malicious ways. It could be hijacked session cookies or leaked access tokens, or sophisticated MiTM. This is why the IETF OAuth 2 Security Best Current Practice draft recommends token binding, and why we just recently doubled the rewards on our identity bounty program. By requiring proof of possession, we turn the opportunistic or pre-meditated use of cookies or tokens in ways they were not intended into something difficult and expensive for an attacker to attempt.

Like any proof of possession mechanism, token binding grants us the ability to build defense in depth. We can work hard to never lose a token, but we can also verify just to be safe. Unlike other proof of possession mechanisms such as client certificates, token binding is self-contained and transparent to the user, with most of the heavy lifting done by the infrastructure. We hope that this eventually means anyone can choose to operate at a high level of identity assurance, but we expect to see strong demand from the government and financial verticals at the beginning, as they have immediate regulatory requirements to do proof of possession. As one example, anyone who requires NIST 800-63C AAL3 categorization requires this kind of technology.

Token binding represents a long road. We are three years in, and while the ratification of the specifications is an exciting milestone, as an ecosystem we still have a lot to build, and this specification needs to work across vendors and platforms to be successful. We are very excited over the coming months to start sharing in depth the security benefits and best practices that have come from our embrace of this functionality, and we hope you will join us in advocating for this technology wherever you need it.

Cheers,

— Pam

The post It’s time for token binding appeared first on Microsoft 365 Blog.