Module 7: Access & Information Protection with Windows Server 2012 R2

1. Module 7: Access & Information Protection with Windows Server 2012 R2 Rick Claus Microsoft Sr. Technical Evangelist Adam Hall Technical Product Manager

2. Jump Start Target Agenda Access & Information Protection with Windows Server 2012 R2

3. Talk with our Experts in Chat tool. #WS2012R2JS Hands-On Labs DOWNLOAD Windows Server 2012 R2 Preview aka.ms/ws2012r2 DOWNLOAD System Center 2012 R2 Preview aka.ms/sc2012r2 http://www.microsoftvirtualacademy.com System Center 2012 R2 Jumpstart July 15th - http://aka.ms/SCR2JS

4. Apps Today’s challenges Deploying and managing applicationsacross platforms is difficult. Devices Users Data Usersexpect to be able to work in any location and have access to all their work resources. The explosion of devicesis eroding the standards-based approach to corporate IT. Users need to be productive while maintaining compliance and reducing risk.

5. People-centric IT Empower users Allow users to work on the devices of their choice and provide consistent access to corporate resources. Unify your environment Deliver a unified application and device managementon-premises and in the cloud. Apps Data Devices Users Protect your data Help protect corporate information and manage risk. Management. Access. Protection.

6. Access & Information Protection √ Empower users Unify your environment Protect your data Common identity to access resources on-premises and in the cloud Centralize corporate information for compliance and data protection Policy based access control to applications and data Simplified registration and enrollment for BYO Devices Automatically connect to internal resources when needed Access to company resources consistent across devices

7. Empower users Challenges Solutions Users want to use the device of their choice and have access to both their personal and work related applications, data and resources Users want an easy way to be able to access their corporate applications from anywhere IT want to empower users to work this way but also need to control access to sensitive information and remain in compliance with regulatory policies Userscan register their devices which makes them known to IT who can then use device authentication as part of providing access to corporate resources Users can enroll their devices which provides them with the Company Portal for consistent access to applications, data and to manage their devices IT can publish access to corporate resources with conditional access based on the users identity, the device they are using and their location

8. Enabling IT to empower users Users can enroll devices for access to the Company Portal for easy access to corporate applications IT can publish Desktop Virtualization (VDI) for access to centralized resources Users can work from anywhere on their device with access to their corporate resources. VDI Session host IT can publish accessto resources with the Web Application Proxy based on device awareness and the users identity RD Gateway Remote Access Web Application Proxy IT can provide seamless corporate access with DirectAccess and automatic VPN connections. Web Apps LOB Apps Files Users can register devices for single sign-on and access to corporate data with Workplace Join Active Directory

9. Registering and Enrolling Devices Users can enroll devices which configure the device for management with Windows Intune. The user can then use the Company Portal for easy access to corporate applications Data from Windows Intuneis sync with Configuration Manager which provides unified management across both on-premises and in the cloud Active Authentication ADFS Users can register BYO devices for single sign-on and access to corporate data with Workplace Join. As part of this, a certificate is installed on the device Web Application Proxy As part of the registration process, a new device object is created in Active Directory, establishing a link between the user and their device IT can publish access to corporate resources with the Web Application Proxy based on device awareness and the users identity. Multi-factor authentication can be used through Windows Azure Active Authentication. Active Directory

10. Publish access to resources with the Web Application Proxy AD Integrated Developers can leverage Windows Azure Mobile Services to integrate and enhance their apps Published applications Use conditional access for granular control over how and where the application can be accessed Other cloud based apps and identity stores Active Directory Office Forms Based Access Claims & Kerberos web apps Mobile Services Restful OAuth apps ADFS Devices Web Application Proxy Users can access corporate applications and data wherever they are Active Directory provides the central repository of user identity as well as the device registration information Apps & Data Reverse proxy pass through e.g. NTLM & Basic based apps IT can use the Web Application Proxy to authenticate users and devices with multi-factor authentication Active Directory

11. Make corporate data available to users with Work Folders Active Directory discoverability provides users Work Folders location IT can configure a File Server to provide Work Folder sync shares for each user to store data that syncs to their devices, including integration with Rights Management IT can selectively wipe the corporate data from Windows 8.1 clients Reverse Proxy Active Directory Devices Access Policy File Services Users can sync their work datato their devices. Users can register their devices to be able to sync data when IT enforces conditional access Web Application Proxy IT can publish access directly through a reverse proxy, or conditional access can be enforced via device registration through the Web Application Proxy Domain joined devices Apps & Data

12. Effective working with Remote Access An automatic VPN connection provides automated starting of the VPN when a user launches an application that requires access to corporate resources. • Cannot originate admin connection from intranet Traditional VPNs are user- initiated and provide on-demand connectivity to corporate resources. VPN Session host VDI • Can originate admin connection from intranet Web Apps Firewall With DirectAccess, a users PC is automatically connected whenever an Internet connection is present. Files • Connection to • intranet is always active LOB Apps DirectAccess

13. Unify your environment Challenges Solutions Providing users with a common identity when they are accessing resources that are located both on-premises in corporate environment, and in cloud-based platforms. Managing multiple identities and keeping the information in sync across environments is a drain on IT resources. Users have a single sign-on experience when accessing all resources regardless of location. Users and IT can leverage their common identity for access to external resources through federation. IT can consistently manage identities across on-premises and cloud-based identity domains.

14. Expanded domain join capabilities Not Joined Workplace Joined Domain Joined User provided devices are “unknown” and IT has no control. Partial access may be provided to corporate information. Registered devices are “known” and device authentication allows IT to provide conditional access to corporate information Domain joined computers are under the full control of IT and can be provided with complete access to corporate information Browser session single sign-on Seamless 2-Factor Auth for web apps Enterprise apps single sign-on Desktop Single Sign-On

15. Active Directory for the cloud Leverage cloud platforms to run Windows Server Active Directory and Active Directory Federation Services to reduce infrastructure on-premises. Infrastructure Services Developers can integrate applications for single sign-on across on-premises and cloud-based applications. Manage Active Directory using Windows PowerShell, use the improved deployment experience and leverage the Active Directory Administrative Center for centralized management Files Web Apps LOB Apps Active Directory Activateclients running Office on at least Windows 8 or Windows Server 2012 automaticallyusing existing Active Directory infrastructure. Run Active Directory at scale with support for virtualization and rapid deployment through domain controller cloning.

16. Managing cloud identities Developers can build applications that leverage the common identity model 3rd party services Apps in Azure Users get access through accounts in Windows Azure Active Directory to Windows Azure, Office 365 and 3rd party applications Active Directory DirSync ADFS Web Apps LOB Apps Users are more productive by having a single sign-on to all their resources Files IT can use Active Directory Federation Services to connect with Windows Azure for a consistent cloud based identity. IT can provide users with a common identity across on-premises or cloud-based services leveraging Windows Server Active Directory and Windows Azure Active Directory Active Directory Dirsync keeps user attributes in sync across directories.

17. Increasing the value in Active Directory Federation Services Organizations can connect to SaaS applications running in Windows Azure, Office 365 and 3rd party providers Enhancements to ADFS include simplified deployment and management Published applications SaaS Apps Office Forms Based Access Claims & Kerberos web apps Active Directory Organizations can federate with partners and other organizations for seamless access to shared resources Restful OAuth apps ADFS ADFS Resources in other businesses or identity realms Web Application Proxy (includes ADFS Proxy) Conditional access with multi-factor authentication is provided on a per-application basis, leveraging user identity, device registration & network location Firewall Users can register their devices to gain access to corporate data and apps and single sign-on through device authentication

18. Corporate identity management Users can reset their passwords via Windows logon, significantly reducing help desk burden and costs. Manage the complete life cycle of certificates and smart cards through integration with Active Directory. Syncusersidentityacross directories, including Active Directory, Oracle, SQL Server, IBM DS, and LDAP. Active Directory Self-service group and distribution list management, including dynamic membership calculation in these groups and distribution lists, is based on the user’s attributes. Allow users to manage their identity with an easy to use portal, tightly integrated with Office.

19. User provisioning, de-provisioning, and role updates • Workflow Active Directory Automatethe process of on-boarding new users Real-time de-provisioning from all systems to prevent unauthorized access and information leakage • FIM LDAP Certificate Management Automatically synchronize all user information to different directories across the enterprise Built-in workflow for identity management

20. Protect your data √ Challenges Solutions Users can work on the device of their choice and be able to access all their resources regardless of location or device. IT can enforce a set of central access and audit polices, and be able to protect sensitive information based on the content of the documents. IT can centrally audit and report on information access. As users bring their own devicesin to use for work, they will also want to access sensitive information and have access to this information locally on the device. A significant amount of corporate datacan only be found locally on user devices. IT needs to be able to secure, classify and protect data based on the content it contains not just where it resides, including maintaining regulatory compliance.

21. Policy based access to corporate information IT can provide a secure and familiar solution for users to access sensitive corporate data from anywhere with VDI and RemoteApp technologies. Desktop Virtualization Centralized Data Devices RD Gateway VDI Users can access corporate data regardless of device or location with Work Folders for data sync and desktop virtualization for centralized applications. Session host Files Access Policy LOB Apps Distributed Data Web Apps IT can publish resources using the web application proxy and create business-driven access policies with multi-factor authentication based on the content being accessed. IT can audit user access to information based on central audit policies.

22. Protecting information with multi-factor authentication 1. Users attempts to login or perform an action that is subject to MFA 2. When the user authenticates, the application or service performs a MFA call Active Authentication 3. The user must respond to the challenge, which can be configured as a txt, a phone call or using a mobile app ADFS 4. The response is returned to the app which then allows the user to proceed 5. IT can configure the type and frequency of the MFA that the user must respond to Application authentication e.g. Active Directory, Radius, LDAP, SQL, Custom apps User 22

23. Protect data with Dynamic Access Control Active Directory File Services Central access and audit policies can be applied across multiple file servers, with near real-time classification and processing of new and modified documents. Automatically identify and classify data based on content. Classification applies as files are created or modified. Centrally manage access control and audit polices from Windows Server Active Directory. Integration with Active Directory Rights Management Services provides automated encryption of documents. File classification, access policies and automated Rights Management works against client distributed data through Work Folders.

24. Recapping: Access & Information Protection √ Empower users Unify your environment Protect your data Common identity to access resources on-premises and in the cloud Centralize corporate information for compliance and data protection Policy based access control to applications and data Simplified registration and enrollment for BYO Devices Automatically connect to internal resources when needed Access to company resources consistent across devices

25. Talk with our Experts in Chat tool. #WS2012R2JS Hands-On Labs DOWNLOAD Windows Server 2012 R2 Preview aka.ms/ws2012r2 DOWNLOAD System Center 2012 R2 Preview aka.ms/sc2012r2 http://www.microsoftvirtualacademy.com System Center 2012 R2 Jumpstart July 15th - http://aka.ms/SCR2JS