Azure Solutions Architecture · AZ-305 · Architecture Case Studies · by Raushan Ranjan, MCT
The Problem: Expanding Workforce & Securing Application Access
Tailwind Traders is acquiring a new company, adding 75 on-premises employees, and hiring a marketing partner with 15 employees who already have Entra ID accounts. The IT department needs to securely integrate these new users while also improving existing security. In addition, a new application needs to securely access an Azure SQL database from both an Azure virtual machine and an on-premises server without storing passwords in the code.
Part 1: New User Accounts
Diagrams & Tooling
1. Acquired User Accounts (On-Premises): The process for migrating the acquired company's 75 on-premises user accounts to Tailwind Traders' Entra ID instance is called hybrid identity. The key tool for this is Microsoft Entra Connect.
Process: Microsoft Entra Connect will be installed on a server in the acquired company's on-premises network. It will synchronize the user and group accounts from their local Active Directory to Tailwind Traders' Entra ID tenant. This creates a mirrored identity in the cloud for each on-premises user. Users will still authenticate with their on-premises credentials, which are then securely verified by Entra ID. This is a seamless, low-impact way to integrate the new employees.
2. New Partner Accounts (Entra ID to Entra ID): The process for adding the new marketing partner's 15 employees is called Entra B2B collaboration.
Process: Tailwind Traders' IT administrator will send an invitation to the 15 partner employees using their existing email addresses. The partner employees will click the link in the email, which takes them to a redemption page. They will use their own company's Microsoft Entra ID credentials to sign in. Once they accept the invitation, a guest account is created in Tailwind Traders' Entra ID tenant that links to their home directory. This allows the partner employees to use their existing credentials for a single sign-on experience to access the corporate resources to which they have been granted access.
Benefits of the Suggested Solution
- Simplified Management: The acquired employees can use their existing on-premises credentials, and the partner employees can use their own company credentials. This removes the need for Tailwind Traders to manage new passwords for 90 people.
- Enhanced Security: By using Entra Connect and B2B collaboration, user identities are centrally managed and can be secured with Tailwind Traders' existing security policies. B2B collaboration, in particular, leverages the partner's security controls, such as MFA, to secure access to your resources.
- Improved User Experience: Both groups of new employees get a seamless single sign-on experience, allowing them to access the necessary applications without creating or remembering new credentials.
Recommendations for Improving User Identity Solutions
- 1. Implement Conditional Access Policies: This is the most important recommendation. Conditional Access allows the IT department to enforce robust security policies based on a user's context (location, device, role, etc.). For example, you can create a policy that requires Multi-Factor Authentication (MFA) for all employees when they access sensitive applications or when they are logging in from an untrusted network. This significantly reduces the risk of credential theft.
- 2. Enable Entra ID Protection: This is a crucial next step. Entra ID Protection uses machine learning to detect risks related to user identities, such as logins from anonymous IP addresses, impossible travel, or leaked credentials. It can automatically block risky sign-ins or force a password reset, preventing account takeover in real time.
- 3. Conduct Access Reviews: This recommendation is essential for long-term security. Since roles and access requirements are expected to change, an automated process to review who has access to which resources is critical. Access Reviews can be scheduled to periodically check if a user still needs access to a certain group or application, preventing "privilege creep" where users accumulate more permissions than they need.
Part 2: New Application Access
Access Solution for the Business Development Application
Problem: The Azure VM needs to securely access the Azure SQL database.
Solution: Use **Managed Identities**. A Managed Identity is an automatically managed identity for an application that needs to connect to services that support Entra ID authentication. We would create a **system-assigned managed identity** for the Azure VM.
Process:
- 1. Enable a system-assigned managed identity on the Azure VM.
- 2. Grant this managed identity an appropriate role-based access control (RBAC) role on the Azure SQL database (e.g., "SQL DB Contributor" or a custom role with more granular permissions).
- 3. The application on the VM can then use this managed identity to authenticate with the database without needing to store any credentials, passwords, or secrets in the code or configuration files.
Access Solution for the On-Premises Resources
Problem: An on-premises server needs to securely access the Azure SQL database.
Solution: Use a **Service Principal with a Client Secret**. Since the on-premises server is not a native Azure resource, it can't use a Managed Identity.
Process:
- 1. Create an App Registration in Entra ID for the on-premises application.
- 2. Create a **service principal** for this app registration. This is the application's non-human identity.
- 3. Generate a **client secret** for the service principal.
- 4. Grant this service principal the necessary RBAC permissions to the Azure SQL database.
- 5. The on-premises application will use its client ID and client secret to authenticate with Entra ID and get an access token. This token is then used to securely connect to the Azure SQL database.
- 6. The client secret must be stored securely, preferably in a vault or a secure configuration system on-premises, and never hard-coded.
Well-Architected Framework Pillars
- Security: This entire solution is built on the Security pillar. By leveraging **Microsoft Entra ID**, the identity provider, and **Role-Based Access Control (RBAC)**, the system ensures that only authenticated and authorized users and applications can access resources. The use of **Managed Identities** and **Service Principals** eliminates the critical security risk of storing credentials in code.
- Operational Excellence: The solution simplifies management. **Entra Connect** automates the synchronization of hybrid identities, and **Entra B2B** automates the invitation process for partners. Automated features like **Conditional Access** and **Entra ID Protection** reduce the manual work required to maintain a secure environment.
- Reliability: The use of a centralized, cloud-based identity provider like Entra ID ensures that user authentication is highly available and redundant. The identity and access solutions for applications are independent of the core application, ensuring the application can't be compromised by poorly managed credentials.
- Cost Optimization: All the recommended services are part of the Microsoft Entra ID suite, which is often included in existing Microsoft 365 licenses. The proposed solutions for application access (Managed Identities and Service Principals) are free to use. This provides a high level of security without incurring additional costs.