1. M7: New Features for Office 365 Identity Management

2. Meet Paul Andrew | @pndrw
Office 365 Technical Product Manager
Office 365 datacenter, networking, identity management
Passion for informing and inspiring IT Professionals to create simpler solutions to complex problems
Meet Jono Luk
Office Senior PM Manager
Office Client & Cloud Identity infrastructure
Long time Identity Management SME
Passion for ensuring top-quality customer story and solutions

3. Recent features change the landscape
12/4/2018
Recent features change the landscape
May 2013 Office 365 SSO with SAML 2.0 Identity Providers
May 2013 Office 365 Adapter
Jun 2013 Password hash sync added to DirSync
Nov 2013 DirSync tool run on Domain Controllers
Feb 2014 Multi Factor Authentication for Office 365
Feb 2014 Multi-Forest AD
Feb 2014 Non-AD Synchronization
Apr 2014 Alternate Sign-In ID to UPN
May 2014 Password Sync Backup for Federated Sign-In
May 2014 Azure Active Directory Sync Services
Dec 2014 Office client passive authentication
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Windows Azure Active Directory
Microsoft Lync
Office 365 SSO with SAML 2.0 Identity Providers
Shipped May 2013*
12/4/2018
* for early adopters
Windows Azure Active Directory
SAML-P
Authentication
Office 365 already supports:
Microsoft Active Directory
WS-Federation (qualified)
Shibboleth Identity Providers
Customers who need SSO with a SAML 2.0 identity provider can sign up for the early adopter program
SAML2
Identity Provider
User
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Office 365 Adapter Customer On-Premises Deployment
Shipped May 2013
Federation
& DirSync
Deployment
Prescriptive guidance for Partners or MCS to deploy the On-Premises components required in Azure
Bundle these components with Services and/or support to appear as an ‘adapter’
What remains on-premises
Existing AD infrastructure (required for other IT needs)
VPN router
Exchange coexistence servers, if required
Where to find more Information
Microsoft Download Center’s Office 365 Adapter: Deploying Office 365 Single Sign-On using Windows Azure
Azure
ADFS AD
DirSync
VPN Tunnel
AD Replication
VPN Router AD
Customer On-Premises

6. More Details on TechNet: http://aka.ms/sync
Windows Azure Active Directory Sync Tool
Shipped June 2013
More Details on TechNet:
Synchronizes user password hashes from on-prem AD to Azure AD (Office 365)
Respects on-premises password policies.
Can’t sync passwords for Federated Users, but can co- exist.

7. DirSync runs on a Domain Controller
Microsoft Lync
DirSync runs on a Domain Controller
12/4/2018
Shipped Nov 2013
Windows Azure Active Directory
Only for up to 10,000 user objects.
DirSync and AD Domain Controller
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Multi-Factor Authentication for Office 365
Microsoft Lync
12/4/2018
Shipped Feb 2014
Multi-Factor Authentication for Office 365
UPDATED
Multi-Factor Authentication
Phone call
SMS message
Mobile app
Licensing
Included in all Office 365 SKUs
Prior to Jan 2014 this was available for Admin accounts only.
Futures
Seamless multi-factor authentication is planned in the next 12 months for Office client applications
*For representative purposes only.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Windows Azure Active Directory
Microsoft Office
Multi-forest AD
12/4/2018
Shipped
Feb 2014
Windows Azure Active Directory
Multi-forest AD support is available using Forefront Identity Manager 2010 R2.
You also need the Windows Azure Active Directory Connector for FIM 2010 R2.
Guidance is also available for merging AD Forests on TechNet.
Federation using ADFS
Forefront Identity Manager
On-premises identity AD AD AD
User
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Windows Azure Active Directory
Microsoft Office
Non-AD Synchronization
12/4/2018
Shipped Feb 2014
Windows Azure Active Directory
Preferred option for Directory Synchronization with Non-AD Sources
Non-AD support with Forefront Identity Manager 2010 R2 is available now
FIM 2010 R2 Office 365 connector supports complex multi-forest topologies
Federation using non-ADFS STS
Office 365 Connector on FIM
On-premises identity
Non-AD (LDAP)
User
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Alternate Login ID removing dependency on User Principal Name (UPN)
Shipped April 2014
Alternate Login ID removing dependency on User Principal Name (UPN)
The reliance on UPN has been removed and you can now select an alternate login ID for use with Office 365 and Azure AD in general. Use of UPN will still be the default. Through configuration you can select the Mail attribute or any other attribute in your on- premises Active Directory.
This works with either synchronized identity or federated identity.

12. Password Sync Backup for Federated Sign-In
Shipped May 2014
Backup Password Hash Sync
Federated identity
User accounts
DirSync
Tool
AD FS
This new backup option for Office 365 customers using federated sign-in provides the option to manually switch your domain in a short amount of time during outages such as on-premises power loss, internet connection interruption and any other on-premises outage.
On-premises
directory

13. Azure Active Directory Sync Services
Targeted Q3 CY 2014
A new identity sync tool that provides customers with the ability to sync identity information from complex AD environments (i.e. multi-forest) and other identity directories such as Generic LDAP v3 (PowerShell, CSV etc.), Generic SQL through ODBC driver (MySQL, IBM, Oracle) and Generic Web Service (SOAP, JAVA, REST/JSON/XML)
In beta as of June 2014

14. Office Client OAUTH Support
Targeted End of 2014
Office Client OAUTH Support
This feature enables Office rich client applications to work with third party Identity Providers and to work with the Windows Azure Multi-factor Authentication implementation.

15. M7 Summary: New Features for Office 365 Identity Management
Great new features
May 2013 Office 365 SSO with SAML 2.0 Identity Providers
May 2013 Office 365 Adapter
Jun 2013 Password hash sync added to DirSync
Nov 2013 DirSync tool run on Domain Controllers
Feb 2014 Multi Factor Authentication for Office 365
Feb 2014 Multi-Forest AD
Feb 2014 Non-AD Synchronization
Apr 2014 Alternate Sign-In ID to UPN
May 2014 Password Sync Backup for Federated Sign-In
May 2014 Azure Active Directory Sync Services
Dec 2014 Office client passive authentication