This blog post is about the top ten concerns when implementing a new AD infrastructure for identity management. It is also not about that, but about using this as an opportunity to partner with the business to proactively communicate the impact of design decisions around the core of controlling who’s who in your world.
Anyone can go to ChatGPT and ask “What are the top 10 configurations to check while creating a brand-new Azure AD implementation?” Any rational actor would want to be safe when configuring their company’s core identity services. In fact, anyone can go to ChatGPT, post that question, and then follow up with “expand on each of those, please, with examples” to make sure the environment being configured is really as tight as it can be.
We say, “anyone can…” because we did. So this is a post about the proper configuration of your most central of security platforms – identity management – but also about the convenience of ChatGPT and other generative AI tools and how to manage the inherent risk in using them as a consultative guide for these sorts of implementations.
We won’t be posting the full outcome here – as previously stated, “anyone can” – but we will be providing a link to the saved chat at the bottom of this document. However, the bullet points from ChatGPT are:
- User and Group Provisioning
- Identity Protection
- Conditional Access Policies
- Security Defaults or Baselines
- Application Registration and Consent
- Authentication Methods
- Guest User Access
- Audit Logging and Reporting
- Role-Based Access Control (RBAC)
- Network Security
Straightforward list, right? And most would have occurred to a reasonably experienced resource. However, digging into these and the requested examples, ChatGPT delivers very little guidance. Not none, but certainly not enough, even when it looks specific. Building these policies to meet the need of the business requires partnership with the organization to understand the application ecosystem, the tolerance for risk vs. convenience, and the expectations as the organization enters varying degrees of partnerships with outside parties.
As an example, under Guest User Access, ChatGPT suggests the following:
- Define policies for guest user access and implement B2B collaboration.
- Example: Allow or restrict guest user access to specific applications or resources.
To which resources will this group of guests require access? Permanently, or until some specific date? Full ownership, basic read/write, or read-only? What’s the process by which this is reviewed, granted, and documented? If the access is temporary, where is it recorded that the account(s) should be disabled or removed?
For Network Security, ChatGPT offers:
- Configure conditional access policies based on network location.
- Example: Create a conditional access policy that allows access to a resource only if the user is coming from a trusted IP range.
This one also requires some non-AD process work. If an employee should travel to a country where the company doesn’t have operations, are they simply blocked? Is there a process for requesting, and then granting, temporary access? Should there be? Are there accounts that are never beholden to such controls, like frequently travelling executives? And are there accounts that are never exempted, such as service accounts?
Active Directory is security, not ‘just’ access or email addresses. The architecture and controls within Active Directory must be reflected in, and supported by, additional policies and processes, and all of them must come together to support the business and be part of the broader security, governance, and IT Operations posture.
Generative AI, while an excellent starting place, requires more information in order to be sufficiently prescriptive to your needs. Take the link below, work from this starting point, and explore to see if you can focus in on recommendations specific to your enterprise. Get specifics. Get code samples.
And for partnership for building a better partnership within your company for the purposes of security needs and ensuring that your identity management is, and stays, in line with your business, Altiam Digital is here to help with this and all of your GRC needs.
ChatGPT 3.5 transcript regarding Azure AD configurations:
https://chat.openai.com/share/c601337a-b22a-44bc-9847-0e16cfd0553f