Implement and manage identity and access Flashcards
Risk events are separated into what 3 types? How do you access these reports?
Risky Users, Risky Sign Ins, Risky Detections. To Access go to Azure Portal -> Azure Active Directory -> Security -> Identity Protection -> Reports
How do you configure Identity Protection Alerts?
Azure Portal -> Azure Active Directory -> Security -> Identity Proection -> Users at Risk Detected/Alerts
How do you access and implement the sign-in risk policy?
Azure Portal -> Azure Active Directory -> Security -> Identity Protection -> Sign-In Risk Policy
How do you implement the sign-in risk policy?
Setup Assignments (Users, Conditions)
Setup Controls - Access, Allow, Block, Require pw reset
Microsoft recommends set the threshold to “Medium”
How do you access the User Risk Policy?
Azure Portal -> Azure Active Directory -> Security -> Identity Protection -> User Risk Policy
How do you implement the User Risk Policy?
Setup Assignments (Users, Conditions)
Setup Controls
Microsoft recommends set the threshold to “High”
What behaviors are identified by sign-in risk policy?
This policy helps identify and respond to risky or unusual account sign-in behavior that might indicate the account has been compromised.
What types of behaviors will the sign-in risk policy detect?
Anonymous IP Address Atypical travel Malware-linked IP address Unfamiliar sign-in properties Admin-confirmed user compromised Malicious IP address Suspicious Inbox Manipulation Impossible travel
What behaviors are identified by User Risk Policy?
This policy helps identify and respond to user account behavior or activities that seem suspicious and indicate the account might have been compromised.
What types of behaviors are detected by the User risk policy?
Leaked Credentials
Azure AD Threat Intelligence
What are the 2 types of available Identity Protection policies?
User Risk Policy
Sign-in Risk Policy
What is Azure AD Identity Protection? What license is required?
Azure AD Identity Protection is an Azure AD Premium P2 feature that includes user risk and sign-in risk policies and alerts that help you stay on top of mitigating the potential of data loss.
How do you configure PIM roles?
Go to Azure Portal -> search for Azure AD Privileged Identity Management -> then Azure AD Roles settings
What is PIM?
Privileged Identity Management (PIM) enables your organization to protect important resources across Azure, Azure AD, Intune, and Office 365 apps & services by managing and auditing access to them.
How are Role assignments created?
portal. azure.com
- > click Subscriptions
- > then Access Control (IAM)
What is RBAC?
Azure Role-Based Access Control (RBAC) allows fine-grained access management of Azure resources. Allows you the ability to divide responsibility by role for and access to management of various machines, networks, resource groups, and so on.
What 3 components does RBAC consist of?
Security Principal - object requesting access (user, group, service, etc)
Role Definition - a set of permissions that defines the actions that can be performed
Scope - the resources to which access will be granted
In RBAC what is the scope resource hierarchy?
Management Group
- > Subscription
- > -> Resource Group
- > ->-> Resource
What is the default option when you create a Conditional Access Policy?
the default option is Report Only.
This is good for testing the effect the policy will have on users
Where do you create Conditional Access Policies?
Microsoft EndPoint Manager Admin Center
endpoint. microsoft.com
- > select Endpoint Security
- > Conditional Access
- >New Policy
Aside from Compliance Policies, you can configure general compliance settings, where?
Microsoft EndPoint Manager Admin Center
- > choose Device
- > Compliance Policies
- > Compliance Policy Settings
Where do you go to configure and manage device compliance for endpoint security?
Microsoft EndPoint Manager
endpoint. microsoft.com
- > select devices
- > Compliance Policies
- > Create Policy
How are Conditional Access Policies related to Compliance Policies?
Compliance policies are configured separately but they can be used within Conditional Access Policies.
What license is required for SSPR with Password write back?
Azure AD Premium P1 licenses
