0

I'm looking for pointers on how to configure Azure "IAM" to trust an external IdP/Authentication server.... am trying to find my way around the docs for Azure which is... not easy. Help would be more than appreciated...

Some more context:

The challenge I have to solve should be "easy": I need to use an 3rd party authentication/MFA solution to manage access to the Azure "cloud" console, to control which users access the console etc.

So my first idea is to configure the Azure console/IAM to use an external IdP for user access/SSO... Now, looking at the docs, I can see lots of info on how to use Azure AD to act as an IdP for other systems, but not so much on how to act as an SP for an external IDP. Also, I find all the different "flavours" of Azure AD that seem to be available somewhat confusing...

The closer I've been able to find is this: https://docs.microsoft.com/en-us/azure/active-directory/b2b/direct-federation, but I'm not sure if that's the approach to follow...

There are other articles like https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp that seem to apply to using a SAML IDP for access to Office or other MS service -- but not to the Azure "tenant" itself?

ANY tip more than appreciated 😉!!

(Edit: Grammar and message cleaned up a bit for clarity)

Improve this question

2 Answers 2

Reset to default
2

Direct Federation is the way to go if you want users from another IDP to log on (while authenticating at the other IDP) and to receive privileges in Azure AD. This can be then be combined with Azure MFA and conditional access policies to provide more "factors".

However if as you state you "just" want a third party MFA solution - DUO, RSA and some others are already usable with Azure AD.

Improve this answer
2
  • Hi, @discondor thanks for the confirmation.... The ultimate goal is to have MFA when accessing the Azure console, and I haven't seen an "easier" way to hook it to a standard MFA solution. This MFA solution is going to be used to protect many other systems, so the idea behind federation is to enable SSO when relevant... Can you point me to docs on DUO or RSA being used for MFA for admin access on Azure Tenants? I'd appreciate having options!
    – JJarava
    Apr 26, 2020 at 21:07
  • But of course: RSA: community.rsa.com/api/core/v3/contents/160348/data?v=2 DUO: duo.com/docs/azure-ca Btw - you could also consider Azure MFA itself for other systems.
    – discondor
    Apr 28, 2020 at 11:25
0

After some more searching, it seems that the Direct Federation route is the "way" to go, at least in the default cases (basic Azure tenant, no ADFS "purchased", etc)... There might be more options when/if other Azure services are added...

As for other options, I saw a comment from @discondor that gave me also a couple of good pointers if the only need is to add MFA to Azure directly:

Which is a way to leverage those solutions if they're already in place..

Of course, other option would be to use the Azure's own MFA solution...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.