Практика Shadowing: Understand Microsoft Entra ID | AZ-104 | Episode 2 - Изучайте разговорный английский по видео

Выберите режим практики

Каждый режим открывает полноэкранную комнату практики.

537 предложений

Если предложения слишком короткие или длинные, нажмите Edit, чтобы их изменить.

Welcome.

My name is Bob Tickleman.

I'm a Microsoft Technical Trainer, and I'm excited to be your guide for this module on Microsoft Enter ID, part of the Identity Governance component.

We're going to take a specific look at what is Microsoft Enter ID

and how does it relate to your on -premises or your legacy Active Directory domain services.

Now, this is a fairly high -level conversation.

There's going to be much more that

if you want to get into deeper components that I'll show you some techniques that you can use and other learning paths.

But we're going to just take a look at the overall identity governance component that Microsoft Enter ID provides.

As I said, Microsoft Enter ID and its current name has evolved over time

and is part of the identity governance model at Microsoft.

It was originally called Azure Active Directory, leveraging its previous name on premises of Active Directory Domain Services,

or ADDS is the acronym I'll be using.

As identity in the cloud has evolved, and we'll explain all that as we get into this module,

the name has changed to reflect the significant modifications to identity in the cloud

and it's part of our ongoing evolving model in identity.

We're going to be currently at Microsoft Enter ID

and I'll make some reference to the next phase

which is going to incorporate a thing called verifiable identity as an industry standard.

We're going to specifically look at a number of features of what is Microsoft Enter ID.

I'm going to be making references to content from another module

where we're going to take a look at this thing called a tenant inside of Azure

which is part of the governance model inside of the cloud solution Microsoft Azure.

So if you want to get some information on the overall governance and what are subscriptions and tenants, make sure you see that recording as well.

But we're going to take a look at a very specific piece called EntraID and the identity governance that provides.

We're going to show that relationship to your legacy on -premises environment, as well as we're going to be showing you a feature to provide

that legacy infrastructure of the thing called Kerberos and NTLM, how you can replicate that into the cloud if you don't have one on -premises,

but you may need it for legacy purposes.

We'll be taking a look at features like license programs that you have, what comes along with those licenses, and the benefits of them, and how you can assign those licenses.

And we'll finish up with the self -service password reset, just one component of the overall identity management.

And as I said, I'll be doing whiteboarding as well as demonstrations that will show you not all of the features, but show you the broad capabilities that's available for it.

Let's get into this.

In its current state, Microsoft EntraID is where we manage identities.

Now, identities is an important thing to understand

and there's a lot of words at Microsoft that sound the same but are different.

There are things that sound different but are exactly the same.

I always go back to some of my history.

We used to have extended and expanded memory when we were managing computers for the operating system.

Those two terms sound very similar but they were completely different, but then you had base and conventional memory, which sound different, but were the same.

You'll see a lot of that as we get into identities, and I'll try and be very specific on how I use these names, and I'll encourage you to use them so

that you're going to be able to communicate with your colleagues and understand each other as opposed to going, are they talking about the thing that I'm thinking that it is?

But I'd always make sure that you're using the correct names, and then when other people are using them, that you understand what their intent is.

What you're seeing on the slide is the broad spectrum of this environment that we're working with.

Looking at the far right -hand side of the screen, you're looking at your legacy on -premises environment

that was built around your Windows server environment dating back to the 1999s or 2000s when Microsoft introduced Active Directory.

And that evolved over time because we called it Active Directory for that on -premises authentication and authorization.

There's two words, again, sound the same.

They're two parts of a whole.

Authentication is proving who you are, typically with a username and password.

Authorization then grants you access to certain resources based around being authenticated.

And we're gonna be taking a look at

that as we get into the whiteboarding and the demonstrations that I'll be doing with regards to identity.

So we had this product called Active Directory on -premises, and it was based around legacy technologies called Kerberos and NTLM.

And it has served us very well for over 25 years.

We learned a lot over that period of time, and not just we as Microsoft, but the industry as a whole.

And when we moved to the cloud, we came up with a new method to be able to provide this authentication and authorization.

And that's where we're gonna cover in this recording, as well as other recordings, what are some of those differences and the things

that you may need to bring to your skillset to manage things in the cloud.

The new identities are based around the technologies of OpenID.

OAuth, OData, and WSFed.

And while we have these new skills, they have to be able to potentially incorporate working with that on -premise legacy environment.

And so when we take a look at Microsoft EntraID, we'll be jumping in and taking a look at those new technologies and showing them in this.

Now, deeper dives into the authentication and authorization will be covered in other modules in this class.

We're just trying to understand the landscape around identities overall.

Now I mentioned

that you might want to be able to have this legacy technology still available to you

and you'll see as we get into not so much the material

but my demonstrations that you might have to provide some legacy communications back to that on -premises environment.

What happens if you don't have it or maybe you don't want to maintain

that infrastructure anymore but you still needed those underlying technologies of Kerberos

and NTLM And that's where you're seeing on the far left -hand side of this, a feature that inside of Azure,

Microsoft is going to be able to provide some of the legacy capabilities of Kerberos

and NTLM and some of the services of GPOs or group policy objects that are made available to you.

So just understanding that Microsoft has been able to communicate this new technology, make it work with your legacy -based environment,

and provide a broad spectrum of options available to you.

Taking a look at some of the similarities and differences between the two, I've identified some of these already.

You take a look at when Microsoft enter ID itself, we have that at the very top, we've got those identities.

Now I'm going to go to a whiteboard

and I want to show you and come back here to hopefully have you understand all of these terms of identities,

service principles, security principles, security principle names, again, all these things that might sound the same.

So let's go to a whiteboard session.

I want to start by showing you content

that was delivered in another module that talked about the architecture of Azure itself and a thing called a tenant.

So if you haven't seen that recording yet, I'd make sure you go see the governance model for Azure.

But what you're seeing is a diagram that I showed in that module that showed what this thing called a tenant is.

And inside of your tenant, you have two major components.

On the right -hand part of the screen, you're seeing identity management and identity governance, and that's what we're covering.

And on the left -hand side, you're taking a look at resource management that we're going to be covering in those other modules I talked about.

Now, specifically around EntraID itself, the identities that we want to take a look at are hierarchical,

and that's where I want to take a look now of what is an identity.

What you're seeing is this chart

that I've built to hopefully show you graphically what it is

that I'm going to show you in the interface and to understand from a concept.

At the very top level, we have our Microsoft Enter ID or your tenant directory.

I'm going to get on a soapbox here for just a minute.

Some people call this your tenant and it is not.

It is the tenant directory.

And what happens is over time, people have taken this tenant directory because there is a one -to -one relationship.

One tenant can have one tenant directory.

100

One tenant directory can only be associated with one tenant.

101

And because of that tight coupling, a lot of people have just kind of assumed that it was just one thing.

102

And over time, they've dropped the tenant directory name.

103

And so I've got my tenant.

104

I'm going, are you talking about your enter ID directory tenant?

105

Or are you talking about the actual tenant in Azure?

106

And they go, they're the same thing, but they're not.

107

So inside of your tenant directory where you manage your identities, we have this hierarchical structure.

108

Below that, we get terms called identities and application objects.

109

Now these are general terms that take up the identities that you create and break them up into several major categories.

110

Some of them go back to that legacy component of usernames and passwords, things like device identities that you have and group identities.

111

We have those, but we have a whole new set of identities

112

that came along with this OpenID OAuth OData model that I was talking about.

113

So diving in deeper, we are going to focus on the identities themselves

114

and we have what are called security principles and identity content.

115

So under the security principles, we get user principles.

116

These are all those names that I said get a little confusing.

117

And a user principle is basically what you might be used to, a username and password that is associated with an individual.

118

They typically use that to authenticate and then use that for authorization.

119

We're going to get into and take a look at groups specifically, and it is Microsoft's recommendation that you use groups to manage users.

120

Even if it's a single individual user, we recommend that you do not manage them as an individual user.

121

You should put them into a group, even as an individual, and manage that individual user through its group membership.

122

Because what happens in organizations, they don't typically change from a structural perspective, roles that are played by individuals,

123

HR managers versus HR users.

124

But the people performing those roles often do.

125

And so if I give a permission or manage a user

126

and that user either moves up in the organization or potentially moves out, I have to actually get rid of that user account and reprovision everything that that user had.

127

It is much simpler if you were to take that user and put them into say an HR manager group

128

Allocate all the permissions to all the files and resources and services that they can do

129

And then as that person either moves out of that role

130

or moves out of the organization You just remove them from the group removing all their capabilities

131

and put the new user coming in so absolutely Try and not use

132

Individuals for managing they're going to authenticate

133

but you're going to manage them through their group membership We then take a look at device identities

134

and we've had devices for years.

135

They used to be based around a Windows operating system, either Windows 10 or Windows 11.

136

Now these were what were referred to as domain joined devices.

137

What's happened over a period of time and one of the moves

138

that we changed when we went to the cloud in this OpenID, OAuth, OData and WSFed, these devices have expanded.

139

As opposed to Windows only devices that were domain joined, we broadened the type of devices.

140

We now had mobile devices of iOS and Android.

141

We had Mac and we had Linux devices that could be registered as opposed to join that.

142

We could then put a light set of controls over those.

143

You might have heard them referred to as BYOD or bring your own devices.

144

So we got a broad spectrum of devices, some from the legacy environment, as well as a whole new set that come from using with Azure Enter ID.

145

We then get this thing called service principles.

146

So we've talked about security principles, but then we have service principles.

147

There's that concept of names that sound the same, but they're different.

148

And these are all new.

149

This is one of the major things that have changed when we moved to Azure and this OpenID OAuth model.

150

What we have is application services, and we have managed identity that fall into two categories.

151

We're not going to get into it in this module.

152

It is covered in other courses.

153

Things like user -assigned managed identity

154

and system -assigned managed identity become this new model in a way for building applications

155

and having microservices and giving them their own identities to provide for the services

156

and applications to have their own identities at a microservice level that simplifies the management.

157

So something you may want to take a look at.

158

We're not going to really cover it in this module.

159

So how does this take place?

160

I've got on the screen a diagram of your legacy environment on premises in the Active Directory domain services, and you can see there a domain controller in

161

which you had a thing called your Active Directory domain services directory structure in a file called ntds .dit.

162

Now, this is where you had your individual users that could be authenticated with the usernames and passwords.

163

All the group membership, all that stuff I was talking about before, managed on premises, but you used the technology of Kerberos and NTLM as the foundation.

164

As I said, it worked for many years for us, and it was a great service.

165

And what happened is at the time that you got authenticated, a user would come to the domain controller, authenticate their username and password,

166

and it would then create this thing called a token.

167

And that token had a thing called a SID, or secure identifier on it.

168

It's going to be a token that you could then present, and it looks something like S -1 -5 -21, and then it had a really long number.

169

period, and then a shorter number, a thing called a domain SID and a RID.

170

We'll be doing this in other modules when we take a look at security

171

and how it differs in Azure versus on -premises.

172

But you had this token that at the time you logged in, you got this token and you would walk around and present it to resources and saying, hey, I've been proven that this is who I am.

173

Can I gain access to a resource?

174

And it would check that list against a thing called an ACL or access control list and it would grant you access.

175

But here's the potential problem with this.

176

If you log on, that token is going to be valid for you for that period of time.

177

And so it could be hours or even days that you have the same permissions.

178

What happens if I needed access to a resource and I called up help desk and asked them, hey, I can't access the resource and said, great, I'll put you in a group that's going to give you access to it.

179

Until you log out and log back in, that token won't automatically refresh.

180

So these are some of the limitations around the Kerberos and NTLM world.

181

When we move to EntraID, every single time that you're working with this as a cloud resource, if I now deprecate a permission or take something away from you,

182

I don't have to have you log out and log back in to have that take place.

183

As you now try and access a resource and it's been taken away from you, you are no longer going to have access to that information.

184

Now, we talked about being able to potentially tie these two together, and you'll see this coming up,

185

that we have the capability of tying the directory services of Active Directory domain services together with Azure and its EntraID.

186

So that this list of users that I have, the group memberships that they've got,

187

to make this simpler, what I have is a sync service that would allow me to communicate and synchronize these two directories.

188

Now, I'm not going to get into all the details in the class where you're going to be able to do this.

189

Again, it's done in other modules.

190

But we can now set up this sync service one of two ways.

191

We do talk about it in here, and we'll show that to you.

192

You can actually set up a sync server where you'll download some software from Azure.

193

You'll install that sync service on that server, and it will then provide the communication between EntraID and your on -premises domain controllers.

194

We now have a new sync service, which is a cloud -hosted service, so you don't have to have the infrastructure, patch it, maintain it, secure it, all that stuff.

195

So this ability to now synchronize information through this capability is available for you

196

so that if you create new users or deprecate users on -premises, they'll be then added or deprecated as needed.

197

inside of Azure and vice versa.

198

We also provide for password resetting, a whole bunch of other services, but we're going to cover all these as we get back into the course material,

199

and I'll be demonstrating those for you as we get into the demonstration itself.

200

So you understand the landscape. So now

201

that you've seen the overall architecture of how identity is going

202

to be managed both in the legacy environment of on -premises and this new world inside of Azure, we understand that there's some several components

203

and we're going to go back to the slides we'll take a look at it

204

and then I'm going to go to the actual portal and show you where some of these features are.

205

Okay

206

so we're back in the course material I'll be in the

207

portal in just a few minutes where we're actually going to show you all these concepts

208

but you're seeing things like you've got your tenant you've got

209

your tenant ID you've got your directories hopefully this all makes a bit more sense now.

210

Now when we get to a governance module or recording a different recording set than we're going to do today,

211

we're going to be able to see these things like management groups and subscriptions, which are ways to organize your tenant to be able to

212

have an organizational structure as well as a billing construct using subscriptions.

213

So all of these are the concepts that we were just talking about.

214

If you're following along in the course materials, you're seeing that the difference between the Active Directory Domain Services or ADDS and Microsoft Enter ID.

215

I covered all of this for you in the course material.

216

You can now catch up and read some more details in there.

217

I talked about a bunch of stuff that's not in the course material.

218

That's why you might want to watch some of these recordings.

219

I'm going to give you some stuff.

220

And there's a few things that are in the recordings that I haven't covered.

221

There may be some numbers that you'll talk about sizes or the times that it might take.

222

Now it becomes one of those eye -winking moments

223

that I talked about in the introduction

224

that you might want to take a look at the course material itself if you're ever going to write the exam.

225

I strongly recommend that you read the course material.

226

Look for numbers.

227

Look for things called default values.

228

Because when you take the exam, you might read a question going, well, gosh, there could be several answers that I have.

229

It could be this one or this one.

230

Well, given no other information, you have to assume the default values.

231

And when you look at that, wow, there's two ways to do this.

232

If you look at it from only a default position, only one of those answers is going to be feasible.

233

Yes, the other one might be possible, but it would take some labor for you to get in and do this.

234

Or maybe the question might say, with the minimum amount of administration, which one would you pick?

235

So these are pro tips that I'm going to be mentioning throughout the course.

236

Look for default values.

237

Look for comparative charts that might be the basis of question.

238

Again, I don't know what the question is, but look for that information, and I strongly recommend you read the course material.

239

They're talking about some of the stuff we just mentioned.

240

The REST APIs versus an HTTP and an HTTPS.

241

One is the way I access Azure through the HTTP and HTTPS, and a feature called LDAP,

242

which is how you communicate with the Active Directory Domain Services.

243

There's those terms I've talked about of OpenID,

244

WSFED, OAuth, OData, where those new technologies that we're working with versus the Kerberos and NTLM components that are available for us.

245

Now, there's a feature that came with the on -premises stuff called GPOs or Group Policy Objects.

246

These were ways to provide for administration of users and devices to control their configuration.

247

We don't have that capability inside of Azure, but we have other services that are going to provide a lot of

248

that administration and even more administration that you could have gotten through the GPOs themselves.

249

So again, just the difference between the on -premises world or your legacy environment.

250

and the modern world of Microsoft Entra.

251

Here's another eye -winking moment that you might want to pay attention to.

252

Any time I see information like this that is a chart that compares one feature versus another, you may want to remember that.

253

Now, don't memorize the entire chart.

254

What you're seeing is a lot of services are the same, whether they're the free service, whether they're on a P1 license, or a P2.

255

What I would pay attention to is what is missing.

256

That's the thing that I would say because, you know, I know that most of this stuff is going to be made available across all of them.

257

And now instead of having to try and memorize the entire chart, I only have to, in this case, remember a few things.

258

What is different between having a free versus having a P1 and a B2?

259

A number of questions that you might get is, what is the minimum license that you need to be able to get conditional access maybe?

260

And so you'd have to find something like conditional access.

261

What is the minimum license?

262

It's not available at free.

263

It's available in P1 and P2.

264

The minimum license would be a P1 in this case.

265

So just another example of kind of information you want to

266

take a look at to be able to prepare for the exam itself.

267

Now I'm going to do a demonstration in just a few minutes, and I want to call out a way to use AI.

268

We talk about AI infrastructure in a lot of different classes now and seeing how it's going to augment it.

269

And I'm going to show an example of, gosh, I'm looking at this information, and it's not in the course material,

270

but what's the difference between a Microsoft EntraSuite license that you get with the P2?

271

Now, does it mean that it's the same service between the P2 and the EntraSuite, or is there some additional features?

272

It doesn't talk about that here.

273

And what's this one down at the very bottom, the Advanced Identity Governance?

274

I'm going to show you a co -pilot, which is our AI service.

275

I'm going to ask it a question.

276

Say, hey, co -pilot, here's a picture.

277

What's the difference between an intro suite and the P2 licenses?

278

What are the features that it's not telling me that I get in one versus another?

279

So using AI is a great way to provide for expanding your learning.

280

You know about the licenses, but this is a way that's going to be able to

281

explore it to more of an operational use as you get into it.

282

Another service is a capability called the SSPR self -service password reset.

283

This has been around for a long period of time, and it really lightened the amount of administration that was needed for people to call up and actually have their password reset.

284

It's something you can do by yourself.

285

You'll notice that when we get to the portal, it's going to be identified as a deprecated service.

286

Now, it's not happening for a number of years, but it is potentially going away because while it's a good service, it provides some vulnerabilities from a security perspective.

287

What you have is the capability of signing licenses to individual users, and you can do that.

288

So I can assign some users that get a P1 license.

289

P2 is a bit more expensive.

290

Maybe not everybody needs all the features of a P2 license.

291

So I can selectively allocate where my licenses are being allocated to.

292

The self -service password reset can be assigned for none, all, or select groups of users.

293

So you can roll it out to specific users if you wanted to.

294

Now, you're probably used to this where there's some standard questions that you could ask people.

295

What was the name of your first pet?

296

What was your nickname in high school?

297

You've probably all seen those sample questions that if you could answer them, maybe one, two, or three, they might have multiples.

298

If you could answer them, it'll allow you to reset your password.

299

Well, social media and people's ability to put a lot of

300

that kind of stuff on the internet has made this kind of a weakness because now if you're actually answering those questions,

301

I could possibly go off and mine that information and potentially reset your password for you.

302

So it's one of the reasons to maybe think of a better way to provide for self -service password reset.

303

I'll give you a pro tip.

304

What I would do is answer the questions, as long as the service is available to me, and answer them incorrectly, though.

305

So don't actually pick what was the city that you were born in.

306

I put the city that my parents met in.

307

And from the city that my parents met in is the city I was born in.

308

So I've logically flipped things around.

309

So I'm not randomly just picking numbers because then I might not be able to remember it myself.

310

And so what was my nickname in high school?

311

It was my first pet's name and my first pet name was my name in high school.

312

So there's ways that you can still make this a secure service, but you need to educate yourself and your users to find a secure method

313

so that social engineering and social media can't be used to circumvent the capability of SSPR, but know that it is going away.

314

I'll show you that you also have the pre -built questions as well as some custom questions

315

that you could ask through this process.

316

But let's go over to the demonstration where I'm going to

317

show you these features in the portal as well as a couple others and then we'll close out the module.

318

So what I want to do is actually show you the Microsoft Learn content that we just covered.

319

I'm actually going to show you that pro tip

320

that I gave you for using Copilot to figure out what are the differences potentially between identities

321

or the licenses that we have for them.

322

And then I'm actually going to get into the Azure portal and show you the services that we talked about.

323

So starting off with the course content,

324

what you're seeing now is the learn content we gave you at that aka .ms forward slash course az -104.

325

We've drilled down into the Microsoft Identities and Governance Learning Path, and we're going to take a look at this one specifically, Understanding Microsoft Entry ID.

326

I'm not going to go through it in detail, but you can see a lot of that information about identities, what they are, what is Entry Tenants, what is the schema.

327

Again, we're going to cover some of this in another module specifically, but you can go through it.

328

It talks about the characteristics of ADDS, so you're going to follow along with that course content, and I strongly recommend that you do.

329

Now what I want to show you is that pro tip

330

that I talked about you're seeing I'm using the RAI Copilot

331

and I'm using the free version of this you have licensed versions

332

if you want to take a look at But I've taken the screen snippet of that

333

License that we talked about and the difference between the free the P1 the P2

334

and the Entra Suite You can see

335

that you know in this image What is the difference between the two P2 license versus the Entra Suite?

336

What do I get if there are check boxes in both?

337

And let's take a look at what it does.

338

So it's going to be able to take a look at

339

that image and it's going to come back and more than just the course material talking about what the differences are, it's actually going to give me some other recommendations.

340

So I really like this tool as a way to dive

341

deeper as opposed to just looking at maybe a limited amount of documentation.

342

And so it's talking about what we have, the difference between the ENTRE P2 license versus the ENTRE suite.

343

It talks about the P2 as the top tier.

344

Everything in the P2 is available in the ENTRE suite.

345

And then it's going to start talking about what you're going to get with the ENTRE suite as you're working with it.

346

And it talks about you get over top of identity protection, PIM, which is privileged identity management, lifecycle workflows.

347

I'm not going to get into all of these.

348

These are covered in other courses where we go into it much deeper.

349

But then it gives you some other features that you might want to come along with.

350

So great way to get in, advance your learning using some form of AI.

351

I'd recommend Copilot, but all of them should be able to assist you with this.

352

I'm now in the Azure portal

353

and we're going to be covering all of these services throughout the multiple modules that we're going to be recording.

354

But I'm going to come into the Microsoft Enter ID component

355

and you'll see down the left -hand side what we have is referred to as a blade.

356

So I'm in the Enter ID governance component, and I have a series of blades that I can work with that covers the individual users, the groups that we have.

357

We have external identities, a number of these we didn't cover, but I'm going to come down and take a look at a couple of these features along the way.

358

At the very bottom, we have the self -service password reset capability.

359

And what I have is the capabilities to have it on for none, all or selected groups of individuals.

360

Now there's some pieces that I've got masked out.

361

I've got a piece of software that masks secure information, so that's why you're not seeing it.

362

But if you were following along in your tenant, you would actually see your specific information.

363

And what I could now do is I can allocate to a specific set of user accounts and pick a group, or I can enable it for all.

364

I could then allocate this self -service password capability to a number of users.

365

I now can come in and take a look at the authentication methods.

366

And you're seeing there's that deprecation feature that March 2027, this is going to be a deprecated capability.

367

So until then, you're going to be able to do what it is we're taking a look at.

368

So I have the capability to ask from a base set of, in this case, up to five questions, how many questions do I want to ask the person?

369

Is it two, four, or five that you're working with?

370

So you can then select a set of questions that you have from a predefined pool.

371

We talked about that.

372

These are the ones that could be easily socially engineered, but I also have the capability of actually creating some custom questions

373

that might be less likely to be socially engineered and reverse engineered for breaching your security.

374

taking a look at a couple of other features along the

375

way you do have the capability to manage custom domains i'm going to cover this in a later module

376

so that maybe you have multiple domain names

377

that you've registered for your organization might you have several divisions

378

or different companies

379

that are amalgamated you don't need separate tenants technically you're going

380

to be able to put them together by having multiple domain names registered to this environment You have company branding

381

that can go along with this so that when you go to the website, it's going to be your logo in the background as opposed to some generic Microsoft image that you're working with.

382

Now I want to take a look at the user accounts themselves.

383

And we talked about different types of users.

384

Now in the past when I used to go around to customers, I would go up and they would usually meet me at the entrance

385

and I would go through some verification of who I was and show them my identity.

386

Usually have my Microsoft shirt on and they go, Great, Bob, here's an envelope and it would have my username and password that they created for me at that company.

387

Now I would typically, based around the role that I did, would only be in there for a couple of days.

388

I would go and fix the problem and I'd be gone.

389

I'd give them back that envelope, said, thanks very much.

390

Here you go.

391

Here's the username and password.

392

You may want to delete that.

393

They go, oh, no, keep it.

394

You may be coming back.

395

I'm going, I ain't coming back.

396

And the problem is, it's an attack surface.

397

You know and I've got a report that I have to fill out

398

that you know years ago I went to this customer

399

and they haven't deleted that account I can still log in with it

400

and I have to report that to Microsoft security

401

So these are attack surfaces you want to be you know very careful about of giving away Identities

402

and not managing them in the long term So some of the things

403

that we can do is we can create new users and you'll see this in the course material

404

You can create a user inside of your directory That is your responsibility to exist in your directory.

405

The authentication will come from there.

406

The other thing is you can invite in an external user.

407

Now, I'm going to be doing a demonstration where I have a personal, what we refer to as a Microsoft account.

408

That is something that ends in the at outlook .com, at live .com, at hotmail .com, or at msn .com.

409

So those four public domain names that Microsoft has emails that anybody can get an email for,

410

I could take a user from that environment or from another tenant inside of Azure.

411

I'm going to be doing an example of that as well.

412

My last name is Bob Tickleman.

413

So my last name is Tickleman.

414

I own the tickleman .com domain.

415

So I've got a set of user accounts inside of Azure

416

and an enter ID that is associated with my Bob at tickleman .com.

417

I could invite these users into my tenant here and now instead of having me manage them,

418

it's an external identity that now all I have to do is just break

419

that link and it's an identity managed by somebody else.

420

And going back to my Microsoft example, if I have an external Microsoft account for me that you're gonna invite into your tenant,

421

if I no longer work at Microsoft, they're gonna get rid of me from their tenant.

422

You don't have to worry about that identity now being breached in your environment because I can't authenticate against my Microsoft account, you are protected.

423

Now, the vice versa of this, if you had created an account for me inside of your tenant that you managed, I no longer work at Microsoft,

424

what stops me from showing up with my Microsoft shirt on and saying, I'm Bob from Microsoft, and use that account?

425

You don't know I don't work there anymore.

426

I'm now potentially being a threat actor inside of your environment.

427

So these are much more secure ways to manage it as opposed to having you create user accounts for all your users.

428

Not really part of the course.

429

Hopefully some additional information on what we recommend, what you do.

430

And so inside of this tenant that I have, I've got my tenant directory under Entra ID, and you can see that I've got a series of user accounts.

431

My Bob Tickleman, which is my R -O -B -T -I -C -H at Microsoft .com,

432

is a guest from an external Entra tenant that we already have.

433

So that's my Tickleman user account inside of Microsoft

434

that has been invited inside of this tenant and will actually be authenticated by that other tenant, Microsoft specifically.

435

I've got a number of other accounts in here.

436

I've got my TrainerBob, which is my rjbt at outlook .com, my personal account at the Microsoft public domain name for mail.

437

So I've invited these two users in as coming from this invited user coming into the tenant itself.

438

So it's being managed externally.

439

You can see those two different types.

440

Is it on -premises?

441

We can actually have those user accounts replicated, as we talked about, through the directory sync service.

442

You're hopefully seeing these different identities.

443

Now, speaking of the sync service, I'm going to come back to the Blade itself.

444

I'm going to take a look at Microsoft Connect.

445

And so you can see EntreConnect provides for that cloud sync service where you set it up in the cloud, and you're going to then connect using user accounts in your on -premises environment

446

that have the necessary permissions to read the data

447

that you need from your on -premises ADDS environment

448

and a user account that has the capability inside of Entra to be able to do this.

449

So you connect them through the sync service and it runs as a platform as a service inside of Azure.

450

I also have the capability of doing this connect sync

451

that allows me to now download the software where you're going to download that information, configure either a physical or virtual machine on premises.

452

that you would then do the very similar process of creating identities, both in the cloud and on -premises, that have the permissions in those both realms, and then be able to synchronize.

453

And you can select which accounts and how often they're going to replicate, what values are being replicated, so you can control all of that using that Connect service.

454

In addition to the users, I'm going to go back to this concept that I talked about, the group memberships.

455

Now, the groups, as I mentioned, is the recommended method to be able to manage the users themselves.

456

Try not to individually manage the users.

457

Put them in the group and give them the RBAC or the role -based access control of the group memberships.

458

And this can actually be a hierarchical structure.

459

I'm going to show an example of this.

460

So I'm going to use in my example, I'm going to have West users and East users.

461

I've got sales managers, I've got sales users in the West.

462

I've got sales managers and sales users in the East.

463

So I've got different groups now i've got an all west

464

and i've got an all east i've got an all sales group

465

which might be made up of its membership of all sales might be made up of all west sales users

466

and all e -sales users

467

that make up the all sales users i've maybe got an all managers group

468

because i've got a west sales managers i've got an east sales manager that's part of all sales managers

469

that might be part of an all managers group

470

that has also got managers from hr that you're working with

471

so So having this hierarchical structure provides for putting a user in a single group, and all of a sudden they're going to get membership across a wide variety.

472

And so you get this granular control that you're going to be able to work with.

473

Now we're going to take a look at the different types of group memberships of either dynamic or assigned.

474

So if you assign it, you specifically put something into a group or remove it from that group.

475

So you can put a user or a group into a group potentially and you can then remove them on an assignment.

476

If it is dynamically assigned, which only comes with certain licenses, based around a characteristic, and I'm going to use a job title and a location,

477

those two attributes are going to put a user into a group and then get this nesting capability you're working with.

478

So let's go take a look at that.

479

Under the group capability, you can create a new group, and we have the choice of having a security group or a Microsoft 365 group.

480

They are somewhat similar but are used differently.

481

If you're using Microsoft Exchange, our cloud -hosted mail service, what you have is probably a distribution list that you maybe had.

482

You had distribution lists based on a project, possibly.

483

So an M365 or Microsoft 365 group is a group for distribution through the mail system.

484

That's the only place it has.

485

It's not used for security.

486

A security group also can be used as a distribution list,

487

but it also has the added capability of being used for security to assign permissions and capabilities called roles.

488

So picking the type of group might limit where it could potentially be used.

489

Taking a look at the group name, we have a naming structure that you should follow.

490

Microsoft has a naming structure that we have listed on our website under our Azure documentation recommendations.

491

You'll see that in all the naming conventions that I'm going to use across these recordings.

492

Now you can get into the membership type.

493

It can be either assigned dynamic users or dynamic devices.

494

So you can even have devices that are part of this.

495

And it's going to show a feature called conditional access.

496

And you'll see that when we get to that recording on permissions that we covered, as I said, in another recording, because we're going to have personas,

497

because Bob, as a secure user in a secure location on a secure device,

498

is a completely different persona from a security perspective than Bob, as a secure user,

499

on an unsecured device in an unsecure location one might give

500

me access to something meeting all the conditions on a secure

501

device in a secure location versus Bob on an unsecured device in an unsecure location maybe not get access to

502

that information so you'll see that come through other recordings

503

so I can have devices users either dynamically

504

or specifically assigned now you'll see

505

that some of these will come with the different licenses some

506

of them on the free base free side you're not going

507

to be able to get some of the dynamic group assignments that we're working with.

508

I'm going to go back and take a look at a group that I already have.

509

And I'm going to show you that hierarchical structure that I was talking about.

510

So here's the example that I have from sales.

511

I've got an SGS security group for sales managers all.

512

I'm going to go take a look at this group, and I can take a look at its members.

513

And you can add, it has the sales managers East and the sales managers West.

514

They are groups that have been assigned to this sales manager or all sales managers group that you're working with.

515

Now, I'm going to go into the sales managers West and take a look at its members.

516

And you can see that it's actually got a user in here specifically.

517

and it's a member, but it was dynamically assigned

518

because I'm going to get into the group name and I take a look at its membership rules, so the dynamic membership rules for being a member of this group.

519

And you can see that I've built the rule that based on a job title, a sales manager, and an attribute of west for a location,

520

those two attributes together, looked at the directory structure, I built a user, it saw that user with those attributes, it now dynamically put them into that group.

521

I take that attribute away.

522

They're no longer made in that group.

523

They no longer have that nesting structure that you're working with.

524

So there's a brief introduction about the capabilities of managing identities inside of the Azure environment.

525

We looked at the major characteristics of what you're getting with a Microsoft Entra ID.

526

You get the capabilities of OpenID,

527

OAuth, OData, and WSFed as technologies as the foundation compared to those legacies technologies of Kerberos and NTLM.

528

We've provided synchronization capabilities to your on -premises, to the cloud, to provide for a homogeneous hybrid world for identities.

529

We saw that we had all these great capabilities of self -service password reset

530

that were very hard to manage in the past in the on -premises world.

531

And we have this growing capability as we take Microsoft Enter ID forward into the verified ID world, which is a whole new world If you want to do some deeper dive,

532

I may be doing a recording on that at another time.

533

So EnterID, the foundation for identity management.

534

It is a feature inside of your tenant as an identity governance plan for you to work with.

535

Thanks for joining us for this session.

536

To continue your learning, watch other videos in the course or explore more on Microsoft Learn at aka .ms forward slash learn.

537

Thank you.

Скачать приложение

Всё для свободной речи

ИИ-оценка произношенияОценка каждой фразы

Практика IPAОсвойте каждый звук

СловарьСоберите свой словарный запас

Игра со словамиУчитесь играя

Сканировать QR

Download on theApp Store Get it onGoogle Play

Тот же канал

FOR YOU

Лексика и советы по произношению к этому уроку

В этом видео 537 предложений и 7994 слов для шедоуинга. Речь длится 42:20. Говорящий говорит быстро, около 189 слов в минуту, поэтому звуки часто сливаются и сокращаются. 82% слов входят в 3000 самых частых слов английского языка; остальные стоит разобрать перед занятием.

Ключевая лексика этого видео

15 слов из видео, которые стоит выучить, с произношением и значением:

Слово	Произношение	Значение
tenant существительное	/ˈtɛ.nənt/	жиле́ц, квартиросъёмщик
capability существительное	/ˌkeɪ.pəˈbɪl.ɪ.ti/	спосо́бность
directory существительное	/dɪˈɹɛktəɹi/	указа́тель, пе́речень
premise существительное	/ˈpɹɛm.ɪs/	предпосы́лка, допуще́ние
domain существительное	/ˌdəʊˈmeɪ̯n/	владе́ние
password существительное	/ˈpæs.wɜɹd/	паро́ль
legacy существительное	/ˈlɛɡəsi/	насле́дство
module существительное	/ˈmɑd͡ʒul/	мо́дуль
cloud существительное	/ˈklaʊ̯d/	о́блако, ту́ча
governance существительное	/ˈɡʌvəɹnəns/	управле́ние
assign глагол	/əˈsaɪn/	назнача́ть, назна́чить
principle существительное	/ˈpɹɪn.sɪ.pəl/	при́нцип
component существительное	/kəmˈpoʊ.nənt/	компоне́нт, составна́я часть
versus	/ˈvɝsəs/	про́тив
reset глагол	/ɹiːˈsɛt/	перезагружа́ть, перезагрузи́ть

Фразовые глаголы, которые вы услышите

Слово	Произношение	Значение
come back глагол		возвраща́ться, возврати́ться
go away глагол		уходи́ть, уйти́
log out глагол		выходи́ть из систе́мы, вы́йти из систе́мы
set up глагол	/ˌsɛt ˈʌp/	устана́вливать, установи́ть
call out глагол		заявля́ть
come down глагол		спуска́ться, спусти́ться
come up глагол		поднима́ться, подня́ться
come up with глагол		придумывать, приходить в голову

Грамматика в этом видео

Конструкции, которые говорящий использует чаще всего, с точными словами из видео:

Конструкция	В видео
Условные предложения if + предложение, will/would + глагол — условие и его результат	If you could answer them, it'll allow
«Used to» used to + глагол — прошлая привычка или состояние, которых больше нет	used to have · used to be · used to go
Present Perfect have/has + причастие прошедшего времени — прошлое действие, важное сейчас	has evolved · has changed · has served
Пассивный залог be + причастие прошедшего времени — важно, что происходит, а не кто это делает	was built · being authenticated · was based

Произношение, на которое стоит обратить внимание

Говорящий использует 245 сокращённых и редуцированных форм, например I'm, you're, we're. Произносите их коротко, так, как слышите.

Звуки «th»: authorization /ˌɔːθəɹaɪˈzeɪʃən/, authenticate /ɔˈθɛn.tɪ.keɪt/, authentication /ɔːˌθɛntɪˈkeɪʃn̩/
Звуки «sh» и «zh»: potentially /pəˈtɛnʃ(ə)li/, demonstration /dɛmənˈstɹeɪʃən/, authorization /ˌɔːθəɹaɪˈzeɪʃən/, examination /ɪɡˌzæm.ɪˈneɪ.ʃən/, recommendation /ˌɹɛkəmɛnˈdeɪʃən/
Длинные слова — следите за ударением: capability /ˌkeɪ.pəˈbɪl.ɪ.ti/, directory /dɪˈɹɛktəɹi/, potentially /pəˈtɛnʃ(ə)li/, demonstration /dɛmənˈstɹeɪʃən/, authorization /ˌɔːθəɹaɪˈzeɪʃən/

Как заниматься с этим видео

Прослушайте всё видео один раз молча и выпишите незнакомые слова.
Начните со скорости 0,75×, повторяйте предложение за предложением и вернитесь к обычной скорости, когда станет легко.
Запишите себя и сравните с оригиналом, обращая внимание на такие слова, как tenant, capability, directory.

Что такое техника Shadowing?

Shadowing — это научно обоснованная техника изучения языка, изначально разработанная для подготовки профессиональных переводчиков и популяризированная полиглотом доктором Александром Аргуэльесом. Метод прост, но эффективен: вы слушаете аудио на английском от носителей языка и немедленно повторяете вслух — как тень, следующая за говорящим с задержкой в 1–2 секунды. В отличие от пассивного прослушивания или грамматических упражнений, Shadowing заставляет мозг и мышцы рта одновременно обрабатывать и воспроизводить реальные речевые паттерны. Исследования показывают, что это значительно улучшает точность произношения, интонацию, ритм, связную речь, понимание на слух и беглость речи — что делает его одним из самых эффективных методов для подготовки к IELTS Speaking и реального общения на английском.

Техника шедоуинга: читать полное пошаговое руководство →

Практика Shadowing: Understand Microsoft Entra ID | AZ-104 | Episode 2 - Изучайте разговорный английский по видео

Выберите режим практики

Скачать приложение

Тот же канал

Configure storage accounts | AZ-104 | Episode 16

Course Preview | SC-100 | Microsoft Cybersecurity Architect

Course Introduction | AZ-104 | Episode 1

Course Preview | AZ-104 | Azure Administrator Associate

Course Preview | AI-103 | Develop AI apps and agents on Azure

Рекомендуемое видео

Every Networking Concept Explained | Networking 101 (2026)

Advanced English Dialogues - British Restaurants & UK Dining Experiences - Real Everyday English

Armchair Architects: Resiliency in the Cloud – Core Patterns

Learn English From The News - Google, Elon Musk's SpaceX Discuss Launching Data Centers Into Orbit

THIS Is Where the Internet Lives

Mini Project - Implementing a Simple Web Identity Federation Application

BAS Bootcamp: Day 6 Setting up IO Internally

Free CCNA | VLANs (Part 2) | Day 17 | CCNA 200-301 Complete Course

What is an Organization? - the Nature of Organizations

Oracle Integration Cloud(OIC): A Quick Overview