Microsoft Tech Community - Latest Blogs -

How to integrate Microsoft User Authentication using Microsoft Entra ID: A Step-by-Step Guide to Use

HuzaifaGhori — Thu, 27 Jun 2024 06:05:31 PDT

Greetings! It's Huzaifa Ghori and Microsoft Learn Student Ambassador from Karachi,Pakistan. I am in my senior of Computer Science Bachelors, from University of Karachi. Besides my studies I am a Python Developer and Data Engineer as well, I have a great skill set in development, including Front end Web, Backend, Chatbot Development, and also I give numerous services as a freelancer, I have started my technical writing here on techcommunity of Microsoft, I'll be sharing knowledge about Azure, cloud services, and many other micro services including integration with Python. So let's start today's blog

In this article we will be creating our tenant, resource and other services to use Microsoft Entra ID aka Azure AD, to create access management for only selected users at the end of this article you'll be able to create your own and also have the direction to take deep dive and more great implementation of this service.

In the fast-evolving landscape of digital identity management, Microsoft Entra stands out as a robust solution for secure authentication and streamlined access control. Whether you're a seasoned developer or a newcomer to the realm of identity services, this guide will walk you through the essential steps of setting up your application, creating user authentication, and empowering users with access privileges. Explore the power of Microsoft Entra and elevate your application's security and user management capabilities. Complete this step by step guide and use Microsoft Learn Module for further assistance and create your first User Access Management Using Microsoft Entra ID. In this guide we are going to learn:

How to create resource for Microsoft Entra ID
How to Register app in MS Entra ID Tenant
Following Quick Start integrating Microsoft User Authentication

Microsoft Entra ID, also known as Azure AD (Active Directory), offers numerous advantages. Whether you're prioritizing security or seeking a well-organized and automated User Management system, this tool is your go-to for building a secure authentication system, be it for a web app, mobile app, or any other application.

With Microsoft Entra ID, you gain not only security but also a host of other benefits. In this guide, we'll focus on creating a seamless sign-in experience. The registration process can sometimes be a bit tricky, but with Microsoft Entra ID, we'll simplify and handle it effortlessly from the portal.

So, if you're looking to make your application's authentication process secure, user-friendly, and seamlessly integrated, Microsoft Entra ID is the solution you've been searching for.

Lets Start !

How to create resource for Microsoft Entra ID

Starting by creating resource.

Click on create resource from Azure Portal

Search “Microsoft Entra ID”

Click on “Create”

Select “Microsoft Entra ID” then click “Next: Configuration” Button

Then Create Your Tenant fill out the the Details mentioned in the form.
Cilck on “Review + create”.

On the final screen wait for the validation passed Notification then click on “Create”

After completing this step the side pane will appear to complete the captcha after completing it you have to wait for some minutes for your tenant creation it will give the notification about the succesfull creation of tenant

Congratulations! You have successfully created your first tenant.

How to Register app in MS Entra ID Tenant

Lets begin with the “App Registeration” Process.

Click on the “+ Add” button appearing in the resource navigations

Click on “App registeration"

On the appeared screen fill out the form

Type the display name of your application (can be changed later)
Select Single Tenant.
Now in Redirect URI section select your application type in my case its website and Enter the URL where application will redirect user after authenticating you can enter URL later its optional so I am leaving it blank for now.
Click on Register Button.

Congrats! You have successfully Registered your first app in your first tenant.

Is this it? Nope Guys we are just around the corner be patient.

Lets follow quickstart to create our very first Authentication System using Microsoft services.

Go to quick start in left sidebar below Overview option click on “Quickstart”

Is this it? Nope Guys we are just around the corner be patient.

Lets follow quickstart to create our very first Authentication System using Microsoft services.

Go to quick start in left sidebar below Overview option click on “Quickstart”

In the Quick Start Page select your preferred technology of application in my case its Python Flask web application.

======>

Note: We are only 3 steps ahead from our first app with authentication system using MS Services.

Following Quick Start integrating Microsoft User Authentication

Lets quickly complete 3 steps and test our application

Step 1: Configure your application in Azure portal

For the code sample in this quickstart to work:

Add a reply URL as http://localhost:5000/getAToken.
Create a Client Secret.
Add Microsoft Graph API's User.ReadBasic.All delegated permission.

Either you can do it manually or can click on button “Make these changes for me” appears in quickstart tab to complete this automatically.

After clicking on button for automated process it will return you a client secret save it to enter in code later.

Step 2: Download your project or clone it from my GitHub

Download or clone the project and if download, extract the zip file to a local folder or clone, closer to the root folder - for example, C:\Azure-Samples

Step 3: Made the following changes in the code and run

You will need to install MSAL Python library, Flask framework, Flask-Sessions for server-side session management and requests using pip as follows:

pip install -r requirements.txt

Open folder in the vs code and made the following changes

Change the name of “.env.sample” to “.env”

=======>

Enter the environment variables include “Tenant ID”

Note: You can find your “TENANT ID” and “CLIENT ID” in the over view tab of your “App Registeration”

In app.py at the very last line you can find this command “app.run()” change it to “app.run(host="localhost", port=5000)”

============>

In app_config.py add metioned below lines in the beginning of file

import dotenv
dotenv.load_dotenv()

We are all set lets run
- python app.py

Conclusion:

As we conclude this guide on mastering Microsoft Entra, you now possess the knowledge to enhance your application's security and streamline user management. But our journey doesn't end here – it's just the beginning. Follow the Microsoft Learn Modules to Learn More about Microsoft Entra:
Understand Microsoft Entra ID
Register apps using Microsoft Entra ID
Implement app registration
Your Next Step: In the upcoming blog, we'll delve into the pivotal process of adding users to your app registration for seamless access provisioning. Learn how to empower users with tailored privileges, ensuring a dynamic and secure user experience. Click here to stay tuned for our next installment and continue your exploration of Microsoft Entra's capabilities.
Stay Connected: Feel free to connect with me on LinkedIn for further discussions or follow on Instagram to stay updated with the latest tech insights. I'm here to assist, so don't hesitate to reach out for any queries or clarifications. Your engagement is valued, and I look forward to connecting with you on this exciting journey. Thank you for being part of this transformative experience.

New on Azure Marketplace: June 14-20, 2024

Luxmi_Nagaraj — Thu, 27 Jun 2024 06:00:00 PDT

We continue to expand the Azure Marketplace ecosystem. For this volume, 105 new offers successfully met the onboarding criteria and went live. See details of the new offers below:

Get it now in our marketplace
	ActiveMQ v5.18.4 on Ubuntu v20: Anarion offers Apache ActiveMQ, an open-source message broker that enables reliable communication between different applications, systems, or services in distributed systems. It implements the Java Message Service (JMS) specification and supports various messaging protocols, making it a versatile tool for integrating heterogeneous systems.
	Bayer Historical Weather Data: Historical Weather Data AgPowered Services offers hourly and daily weather data from 1979 to present for specific global regions. The API allows users to retrieve attributes such as global radiation, cloud cover, temperature, wind speed and direction, precipitation, humidity, atmospheric pressure, and hail.
	Composabl Training Cluster: The Composabl Training Cluster streamlines training operations by deploying a scalable cluster that integrates with the Composabl platform. It offers automated training workflows, easy deployment and integration with Microsoft Azure resources, and secure and managed access.
	Cosmian Key Management System on Red Hat Enterprise Linux 9: Cosmian KMS offers advanced key management for crypto-agility, enhanced data protection, zero trust KMS strategy, and scalability and flexibility. It provides a unique combination of customer-managed keys and advanced encryption technology, integrated seamlessly with Microsoft Azure's secure and scalable cloud environment.
	Cosmian Key Management System on Ubuntu 22.04: Cosmian KMS offers advanced key management for crypto-agility, enhanced data protection, zero trust KMS strategy, and scalability and flexibility. It provides a unique combination of customer-managed keys and advanced encryption technology, integrated seamlessly with Microsoft Azure's secure and scalable cloud environment.
	Cosmian Verifiable VM on Red Hat Enterprise Linux 9: Cosmian Verifiable Confidential VM on Microsoft Azure is a secure and trustworthy, confidential computing solution that integrates with Azure's Confidential VMs. It provides end-to-end encryption, verifiability of hardware and code, high performance, and ease of use.
	Cosmian Verifiable VM on Ubuntu 22.04: Cosmian Verifiable Confidential VM on Microsoft Azure is a secure and trustworthy, confidential computing solution that integrates with Azure's Confidential VMs. It provides end-to-end encryption, verifiability of hardware and code, high performance, and ease of use.
	Debian 10 Minimal with Minecraft Java Game Server: Experience limitless imagination and exploration with the Minecraft Java Game Server on Debian 10 Minimal. Customize gameplay, create alliances, and build architectural wonders in a safe, high-performance environment tailored to your preferences. Start your adventure today.
	Debian 11 Minimal with Minecraft Java Game Server: The Minecraft Java Game Server offers limitless adventure and customization options in a secure multiplayer environment. With seamless scaling and great performance, players can explore endless worlds and collaborate with others. Subscribe today for a creative and community-driven experience.
	Decarbonization-as-a-Service (DaaS): Context Labs uses AI, machine learning, and blockchain to provide Asset Grade Data for accurate emissions monitoring. The Emissions Control Center dashboard allows real-time tracking of emissions, while the Environmental Attributes Registry supports value creation activities. DaaS integrates with Microsoft Azure for a net-zero economy.
	Document360: Document360 is an AI-powered knowledge base platform for creating and hosting documentation. It offers a self-service platform for building and managing knowledge bases, product documentation, manuals, SOPs, and wikis. It's useful for customer support teams, product owners, technical writers, and developers for various documentation needs.
	iGTB Contextual Banking eXperience: CBX is a Digital Engagement Banking platform that covers all domains of corporate banking. It provides over 400 user journeys as microservices and UI components, enabling banks to accelerate customer self-service and up-sell and cross-sell their services. CBX uses AI and machine learning to optimize transactions and deliver key insights to its bank customers.
	Learner Management System: The LMS is a flexible system for managing and monitoring learners and employees. It has core modules for student/employee management, company wellness, and workforce transformation.
	OmniData Fusion: OmniData Fusion is an analytics platform that integrates data from multiple sources, providing businesses with actionable insights through automated machine learning. It's designed for organizations looking to harness the power of their data through seamless integration, real-time processing, and intelligent analytics.
	Postfix v3.9.0 on Ubuntu v20: Anarion offers Postfix, a modular, open-source mail transfer agent known for its robustness, security, and performance. Its architecture allows for greater reliability and maintainability, and it employs multiple layers of defense to protect against unauthorized access and abuse. Configuring Postfix is straightforward, and its extensibility allows for integration with third-party tools and services. Its vibrant community and extensive documentation offer robust support for users.
	Preventive Service for Microsoft Entra ID: CSOC preventive services from glueckkanja offer standardized analysis workshops to assess the Microsoft Entra ID environment's ability to withstand attacks. The assessment includes content and manual evaluation, resulting in a report with prioritized recommendations for action on topics such as identity security and operational excellence.
	RabbitMQ: Cloud Infrastructure Services offers RabbitMQ, an open-source message broker that enables reliable and asynchronous data exchange between applications. It offers high availability, scalability, security, and compliance features, as well as efficient resource utilization, automated maintenance, and developer-friendly tools.
	RabbitMQ v3.13.3 on Ubuntu v20: Anarion offers RabbitMQ, an open-source message broker software that facilitates communication between different applications, systems, or services. It acts as an intermediary that handles the sending and receiving of messages between producers and consumers. Messages are stored in queues until a consumer retrieves and processes them, ensuring successful processing before removal.
	Red Hat Enterprise Linux 8.6 Minimal with Minecraft Java Game Server: Red Hat Enterprise Linux 8.6 Minimal offers a secure and stable operating environment for hosting Minecraft Java Game Server. With optimized performance, advanced security measures, and comprehensive management tools, it simplifies server setup and configuration, ensuring flawless gameplay and minimal disruptions.
	Snow Atlas: Snow Atlas is a cloud-native platform that provides complete visibility of your IT landscape, including on-premises and cloud infrastructures, SaaS applications, and more. It normalizes and augments data to present insights that help you make faster, more informed technology decisions. It's a popular ITAM and SAM tool.
	SonarQube v9.9.5 on Ubuntu v20: Anarion offers SonarQube, an open-source platform for continuous inspection of code quality, supporting over 25 programming languages. It offers automatic code review, multi-language support, quality gates, security vulnerability identification, and technical debt management.
	SUSE Linux Enterprise Server 12 Minimal with Minecraft Java Game Server: Simplify Minecraft server setup and optimize performance with SUSE Linux Enterprise Server 12 Minimal and Minecraft Java Game Server from Virtual Pulse. This solution offers robust security measures, scalability, and comprehensive management tools for smooth gameplay and minimal downtime.
	SUSE Linux Enterprise Server 15 Minimal with Minecraft Java Game Server: Simplify Minecraft server setup and optimize performance with SUSE Linux Enterprise Server 15 Minimal and Minecraft Java Game Server from Virtual Pulse. This solution offers robust security measures, scalability, and comprehensive management tools for smooth gameplay and minimal downtime.
	TechHouse's Aware Report for Copilot and AI in the Microsoft Cloud: The Aware Copilot and AI Readiness Report simplifies AI for small to medium businesses, providing guidance and recommendations for implementation. The report evaluates readiness for deploying Copilot in the Microsoft 365 cloud and offers personalized consulting sessions.
	Terraform on Windows Server 2022: Terraform from Belinda CZ s.r.o. is an open-source infrastructure as code tool that automates the creation, modification, and destruction of Microsoft Azure resources. It comes pre-installed with Azure PowerShell and Azure CLI, making it ideal for developers, DevOps engineers, and IT administrators who need a robust and efficient solution for managing Azure resources.
	The Growth Lab Life Events App: This solution provides guidance and resources for major life events such as career changes, family planning, and divorce. It can be integrated with Microsoft solutions and connected to Teams for communication between organizations. It is only available in Dutch and focused on the Dutch market.
	Ubuntu 18.04 Minimal with Minecraft Java Game Server: Experience endless possibilities with the Minecraft Java Game Server on Ubuntu 18.04 Minimal from Virtual Pulse. Customize gameplay, explore a vast landscape, and unleash your creativity with unparalleled flexibility. Start your adventure today and redefine the boundaries of exploration and creativity.
	Whizible: Whizible is a SaaS solution that connects all the dots in an organization's IT landscape and automates the entire value chain from efforts to cash. It streamlines businesses, saves costs, and makes existing managers more productive, accountable, data-driven, and free to generate more revenue. It covers PSA workflow, engagement management, projects, financials, and more in a single tool.
	YetiForce: ATH Infosystems offers Yetiforce, an open-source customer relationship management (CRM) system with features such as real-time data analytics, lead and opportunity tracking, workflow automation, helpdesk integration, and inventory tracking.
Go further with workshops, proofs of concept, and implementations
	Accigos Azure Network: 3-Month Assessment and Implementation: Accigos offers a 3-month Microsoft Azure network assessment and implementation package. The first month involves analyzing the network, the second month focuses on security and compliance, and the third month is for implementation and optimization. A comprehensive report is provided at the end.
	Analitycs by Act Digital: Act Digital uses Microsoft Azure solutions to provide end-to-end data solutions, including data capture, storage, centralization, analysis, and visualization. Benefits include scalability, informed decision-making, operational efficiency, and innovation. Use cases include demand forecasting, sentiment analysis, and predictive maintenance. This offer is available in Brazil and the United States.
	API Release Process into Azure API Management: Solidify's API Release Process simplifies and standardizes API releases, ensuring swift time-to-market while maintaining high quality standards. The solution offers well-documented resources, built-in observability, traceability, and compliance. It also provides tooling and training to assist team members with different roles in common tasks.
	Azure Migration Workshop: Acora offers a comprehensive Microsoft Azure migration workshop that equips participants with the knowledge and skills to confidently execute their migration journey. The workshop aligns business objectives with cloud adoption, considering motivations, financial aspects, and technical readiness.
	Build Your Web App 3 Times Faster with Raaghu Design system: Raaghu Design System from WAi Technologies is a React-based framework that offers pre-styled UI components and tools to accelerate web application development. It seamlessly integrates with ABP platform, providing a .NET Core API-based multi-tenant application with enterprise-ready pre-built features. Raaghu emphasizes a component-driven approach, enhancing code reusability and maintainability.
	ConXioN Cloud Center of Excellence - Infra/Network Monitoring and Azure X-Ray: ConXioN's Cloud Centre of Excellence offers a modular approach to help organizations effectively integrate and implement Microsoft Azure. The flexible trajectory is tailored to current needs and designed to evolve with future growth, resulting in scalability at every level. The end result is a detailed cloud strategy, migration plan, and regular reports for continuous optimization.
	Embark 5-Day AI InnovAIte Workshop: Saxon offers InnovAIte, a 5-day workshop for mid-market enterprises to learn about AI ideation, design, development, and implementation. Tailored for C-suite executives, department heads, and project managers, the workshop provides a structured approach to AI implementation, including accelerated ideation, tailored solutions, and scalable architectures.
	Fitzrovia IT - Azure Backup and Site Recovery: Microsoft Azure Backup and Azure Site Recovery offer a simple, secure, and cost-effective end-to-end backup and disaster recovery solution that can be integrated with on-premises data protection solutions. Fitzrovia IT provides business continuity and disaster recovery services using these cloud-native services for on-premise, hybrid, and cloud-only infrastructure models.
	Generative AI-based Copilot Development: WAi Technologies offers a contextual generative AI-based Copilot development service that leverages Microsoft Azure OpenAI, Azure AI Studio, and Copilot Studio to create custom copilots tailored to business needs. Key benefits include enhanced efficiency, personalized experience, scalability, cost savings, and data-driven insights.
	Get React MVP Completed in 15 Days: The "15-Day MVP Challenge" is a consulting service from WAi Technologies for companies using the ABP platform, offering rapid front-end development using React. The service delivers a Minimum Viable Product (MVP) within 15 days, ideal for businesses looking to modernize their front-end interfaces and improve customer experiences.
	Microsoft Fabric Proof of Value: 15- to 25-Day Implementation: Microsoft Fabric is an end-to-end analytics platform that helps organizations prepare for the AI era. It offers a unified solution for converting raw data into actionable insights, with data lakehouse technology, Power BI, real-time analytics, and data science capabilities. The Proof of Value service from OQuila provides a foundation for a data platform with innovative technologies, including Azure DevOps and landing zones.
	SVA Workshop KISARO (Keep It Simple Azure Red Hat OpenShift): Available in Germany, this workshop from SVA aims to simplify the process of installing OpenShift clusters by providing guidance on DevOps tools and best practices for development and operations, enabling companies to make strategic decisions and plan their implementation.
	TCS Cognitive Assurance for Risk and Compliance on Azure: 8-Week Implementation: TCS offers a suite of compliance solutions for banks and financial institutions hosted on Microsoft Azure to ensure security, flexibility, and scalability. These solutions drive intelligent interventions in risk information and control assurance, enabling industry players to ensure compliance, adopt human-guided cognitive automation, improve efficiency, increase regulatory confidence, reduce manual interventions, and optimize cost.
	Technology Industry Solutions by Cherry Bekaert Digital Advisory: Cherry Bekaert offers industry solutions that draw from its capabilities and expertise to deliver value quickly. These Consulting Services offer analytics, automation, and innovation solutions for the technology industry, including eSignature workflows and product innovation. Cherry Bekaert also provides services for enterprise technology, cybersecurity, and strategic tax.
Contact our partners
Abstract Security
Aethera AI
Aztute: CalAIM Solution
Azure Migration Assessment: Acora Migration Accelerator Package
Azure Migration Customer Briefing: Acora Azure Jumpstart Package
Bechtle Azure Health Check
Word Search in Attestations and Documents with AI
Cantier MES 4.0
CarbonScribe
Cargo Intelligence
Cloud Insights: 1-Hour Introduction
Corporate Social Responsibility App by Embee
CYBERN - COE Governance Solution for Power Platform
DATPROF Runtime: Test Data Simplified (BYOL)
Devart Connector for Zoho Books from Excel
Devart Connector for Zoho CRM from Excel
Devart Connector for Zoho Desk from Excel
Empower Group Care (EGC) Initial Offer
Elevate Your Azure IT Operation with Enkaytech Managed Services
Enterprise Internal AI Chat Services
EquityGPT
Fortified WISdom Enterprise: Database Workload Intelligence Solution
Gatsby
grabDoc
HRMS IT Automation PaaS Offering
iDos Games Engine
Industrial: Predictive Asset Intelligence
inFlow for Healthcare
Integrate Copilot into Your System: 2-Hour Briefing
IntelliOps Offer 2024
IntelliPredict Pro Suite
Lasso for Code Assistants
Lasso for GenAI Chatbots
Lasso Security for Model Protection
Leip SDK Latent AI
MailDepot
Managed Industrial Security [identify]
Matilda Optimize
Microsoft Fabric Quickscan: 2-Hour Assessment
NetReveal AML Transaction Monitoring
Online Illicit Trade Detection: Unauthorised Pesticides and Crop Protection Products Module
ownCloud Platform on Debian 11
ownCloud Platform on Debian 12
ownCloud Platform on Red Hat Enterprise Linux 7
ownCloud Platform on Red Hat Enterprise Linux 8
ownCloud Platform on Red Hat Enterprise Linux 9
ownCloud Platform on Ubuntu 20.04
ownCloud Platform on Ubuntu 22.04
peruser
Private AI Insights
Secure Public Cloud
Sensa Investigation Hub
Skyvia Data Integration
Social Insight
Swift Cloud ERP
TechHouse's Aware Report for Microsoft 365: Nonprofit
Veriphy AML Onboarding and Compliance Checks
Vinea for Winegrowers and Vineyards
Visionairy - Software
XFA
Zeta Alpha Neural Discovery Platform
Zscaler Cloud Connector

This content was generated by Microsoft Azure OpenAI and then revised by human editors.

Introducing SOC Optimization API

Jeremy Tan — Thu, 27 Jun 2024 03:04:38 PDT

SOC optimization is a new feature designed to combine the power of out of the box content with the flexibility of the SIEM to help you optimize your SOC processes and coverage to your organization’s specific needs, priorities, threats and environment. The first phase of this new feature helps you gain deep insights into your data usage patterns and coverage gaps against specific threats. It provides actionable recommendations to tighten your ingestion rates for data that doesn't provide security value, leverage correctly the data the does and improve your current coverage based on the threat landscape. You can learn more about the feature with the following resources.

Documentation: SOC optimization overview ; Recommendation’s logic

Short overview and demo: SOC optimization Ninja show

In dept webinar: Manage your data, costs and protections with SOC optimization

In this blog, we will focus on the API usage for SOC optimization. That’s right, if you didn’t know, there is an API available for you to interact with programmatically.

The API

Having an API for the SOC optimization feature is crucial for several reasons. We aim to unlock the power of precision-driven security and empower security teams through API with flexibility in automation, integration, customization, scalability and real-time access to SOC optimization data.

Refer to the Swagger specification and examples to learn more about the API.

Use cases

There are numerous scenarios where the SOC optimization API can be utilized. Here are some key use cases:

You can build custom reports and dashboards, for example, with Workbooks, Power BI, and other reporting tools. The Sentinel Optimization workbook has been updated with recommendation data via the API.
Integrate with third-party tools such as SOAR, ITSM, or any other applications that need to integrate with recommendations programmatically.
The API allows real-time access to SOC Optimization data. Security teams can retrieve up-to-date recommendations, trigger evaluations if needed, and respond promptly to the suggestions. Recommendations are calculated every 24 hours, and with the API you’re always up to date.
For customers or MSSPs managing multiple environments, the API provides a scalable way to handle recommendations across multiple workspaces.
You can export the data from the API and store it externally for audit, archiving, or tracking trends.

“We consider this feature as a valuable source of data for us and the customers we protect, it speeds up many tasks for us and provides meaningful insights we can act upon. The API and the reporting that it enables improves our efficiency and accuracy and reduces manual effort for custom reporting, thus reducing our costs and providing a better fidelity of service. “
Clive Watson – Solution Director, Quorum Cyber

Available actions

Below is a summary of the API actions and sample their sample responses.

1. Get recommendations

Use this action to list all the recommendations in your workspace.

GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/recommendations

2. Get recommendation

This allows you to get a specific recommendation by id. The id can be obtained from the previous action.

GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/recommendations/{recommendationId}

3. Patch recommendation

This allows you to update the status of a recommendation. For example, mark a recommendation as in progress, completed, dismissed or reactivate a recommendation.

Supported values when configuring the state property are ‘Active’, ‘InProgress’, ‘Dismissed’, ‘CompletedByUser’ and ‘CompletedBySystem’

PATCH /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/recommendations/{recommendationId}

4. Reevaluate recommendation

Use this action to manually trigger the evaluation for a recommendation.

POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/recommendations/{recommendationId} /triggerEvaluation

Sample workbook

If you need a sample for reference or to get started, you can refer to the Microsoft Sentinel Optimization Workbook as mentioned earlier. Install the workbook from the content hub, save the template, and launch the workbook. You will find the ‘SOC Optimization’ tab that visualizes the data based on the SOC optimization API.

Expand the items under ‘Details’ to drill down into each optimization type. Below are sample screenshots for ‘data value optimization’ and ‘threat-based optimization’ from the workbook.

Edit the workbook to check the parameters defined for SOC optimization (at the top of the workbook) and see how each visualization is built.

Customer story

Below is the case study shared by Quorum Cyber:

“When we first saw the preview of SOC Optimization the idea resonated with work we already do for customers as their MSSP. We knew that customers would be excited by this level of detail and insight provided and they would ask us questions about this. We were impressed with the API provided from day one, it worked immediately with Sentinel Workbooks, and we were able to almost immediately incorporate new reports on a customer-by-customer basis.

However, we were really interested in how we could scale this knowledge and be proactive. This is where the API really helped us; we were able to use it to detect all customers with data and bring those insights centrally to report on them. This gave us a few advantages; one was that we could see where a customer had an issue and where we might need to assist. For example, a customer has a warning about zero usage of a table (which you can’t detect otherwise), this helps our on-boarding team and improves our ongoing management, as it’s good to know that a table may have been asked for but isn’t used, or that over time the usage or importance of this may have changed and maybe we can adjust accordingly.

Detection coverage is a key part of us being an MSSP, we look to provide threat-led analytic rules to our customers, so having insights from the API on what might be missing and areas to investigate is crucial and looking at that data across customers at scale has given us many invaluable insights. For example, one customer being recommended coverage is important but having many customers with the same recommendation might mean this is a crucial task and we need to adopt the recommendation faster.

What we also appreciated was the link back to the Microsoft Sentinel GitHub for each analytic and the counts of active vs. available, so not only did we know that there were, for example, eight of 10 active detections deployed, but we had the GUID of that detection to look it up. With that data were able to correlate that GUID to our own GitHub repository to match to any customization we have done to that use case.”

Summary

Get started with the SOC optimization API today. We hope that this detailed walkthrough will help you unlock your use cases via the API.

Here is a list of useful resources mentioned in the blog:

API: Swagger specification and examples

Documentation: SOC optimization overview ; Recommendation’s logic

Short overview and demo: SOC optimization Ninja show

In dept webinar: Manage your data, costs and protections with SOC optimization

Workbook: Sentinel Optimization workbook

Using Keycloak with Azure AD to integrate AKS Cluster authentication process

sasina — Thu, 27 Jun 2024 00:00:00 PDT

Introduction

Integrating Azure Kubernetes Service (AKS) with Keycloak through Azure Active Directory (Azure AD) as an intermediary leverages Azure AD’s support for OpenID Connect (OIDC) to handle authentication and authorization. This integration enhances security, streamlines user management, and simplifies the authentication process for users accessing the AKS cluster.

Integrating Azure Kubernetes Service (AKS) with Keycloak through Azure Active Directory (Azure AD) Use case

The integration of AKS with Keycloak using Azure AD is highly applicable in all these industries and beyond that prioritize security, scalability, and efficient user management, making it a best practice for organizations leveraging cloud-based Kubernetes environments.

Financial Services: Securely manage and authenticate thousands of users accessing sensitive financial data and applications hosted on Kubernetes clusters.
Healthcare: Protect patient data and ensure compliance with healthcare regulations while providing medical staff secure access to applications.
E-commerce: Manage a large user base accessing e-commerce platforms and ensure secure transactions and user data protection.
Technology and Software Development: Provide developers with secure access to development environments and resources hosted on Kubernetes clusters.
Education: Manage access to educational resources and applications for students, faculty, and staff in a secure manner.

Figure 1: Similar use case architecture.

Concept

To make this integration possible and effective you should have a clear understanding of the following components, the concept of using Azure AD as an intermediary, and the pre-requisites.

Understanding the Key Components

What is AKS?

Azure Kubernetes Service (AKS) is a managed Kubernetes service that simplifies deploying, managing, and operating Kubernetes clusters in the cloud.

What is Keycloak

Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO), identity brokering, and user federation.

What is Azure AD?

Azure Active Directory (Azure AD/Microsoft Entra ID) is Microsoft’s cloud-based identity and access management service, which helps users access external resources like Microsoft 365, the Azure portal, and thousands of other SaaS applications.

Overview of OIDC

OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 protocol, allowing clients to verify the identity of end-users based on the authentication performed by an authorization server.

Why Use Azure AD as an Intermediary?

Using Azure AD as an intermediary offers several benefits:

Enhanced Security: Leverages Azure AD’s robust security features.
Simplified Management: Centralizes authentication and authorization.
Seamless Integration: Provides easy integration with Azure services and applications.

Pre-requisites for Integration

Before starting the integration process, ensure you have:

Azure AD: Set up and configured with necessary permissions.
Keycloak: Configured with a realm ready to be integrated.
AKS Cluster: Either existing or a plan to create a new one with Azure AD integration.

Figure 2: Mian concept

According to the image shown in Figure 2: Main concept, the authentication processes taken place in this concept is Azure Active Directory (Azure AD/Microsoft Entra ID) at the center, and from the right Azure Kubernetes Service requested an authentication and Azure AD will perform OIDC Token Exchange to Keycloak at the left, then Keycloak will perform validation and revert back to Azure AD while, Azure AD respond back to AKS.

Hands-on (Technical Steps)

More technical in these steps and processes, you will find step-by-step guide for seamless Integration.

Register Keycloak as an Application in Azure AD

Create an App Registration in Azure AD:

Navigate to Azure AD and create a new app registration.

Figure 3: Register Keycloak as an Application in Azure AD -1

Figure 4: Register Keycloak as an Application in Azure AD -2

Save the Client ID and Client Secret from Azure AD. This information will be needed later in Keycloak.

Obtain Client ID and Client Secret
After the registration is complete, go to the app's overview page and copy the "Application (client) ID".

Navigate to "Certificates & secrets" and create a new client secret. Copy the value of the client secret as it will not be shown again.

Figure 5: Register Keycloak as an Application in Azure AD -3

Configure API Permissions:

Go to "API permissions" and add the required Microsoft Graph API permissions. Typically, you need `User.Read` and `openid`, `profile`, and `email` permissions.

Figure 6: Register Keycloak as an Application in Azure AD -4

Figure 7: Register Keycloak as an Application in Azure AD -5

On click Add a permission, the above similar pane will be displayed as shown and you will click on Add permission. Then, after Add permission, you will have similar configuration to the below image.

Figure 8: Register Keycloak as an Application in Azure AD -6

Configure Keycloak to Use Azure AD

Set Up Keycloak:

https://www.keycloak.org/downloads
https://quay.io/repository/keycloak/keycloak
Log in to the Keycloak admin console.
Select the realm you want to configure or create a new realm.

Figure 9: Configure Keycloak to use Azure AD

Add Azure AD as an Identity Provider:

In the left menu, go to "Identity Providers".

Click "Add provider" and select "OpenID Connect v1.0".
Fill in the details:
Alias: A friendly name for the provider (e.g., AzureAD).
Display Name: A display name for the login button.
Authorization URL: `https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize`
Token URL: `https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token`
Client ID: The Application (client) ID obtained from Azure AD.
Client Secret: The client secret obtained from Azure AD.
Save the configuration.

Import OIDC Metadata:

Go to the Azure AD app registration overview and find the "OpenID Connect metadata document" URL.

Figure 10: Configure Keycloak: In Keycloak, use this URL to import the metadata automatically, which fills out most of the configuration fields.

Integrate AKS with Azure AD

Enable Azure AD Integration When Creating AKS Cluster:

Use the following Azure CLI command to create an AKS cluster with Azure AD integration

     az aks create \

       --resource-group myResourceGroup \

       --name myAKSCluster \

       --node-count 1 \

       --enable-aad \

       --aad-admin-group-object-ids <admin-group-object-id> \

       --enable-oidc-issuer \

       --oidc-issuer-url "https://<keycloak-server>/auth/realms/<realm>"

Replace the placeholders with actual values:

`myResourceGroup`: The resource group name.
`myAKSCluster`: The AKS cluster name.
`admin-group-object-id`: The object ID of the Azure AD group that will have admin rights.
`oidc-issuer-url`: The URL of the Keycloak OIDC issuer.

Update Existing AKS Cluster:

If you already have an existing AKS cluster, use the following command to enable Azure AD integration:

     az aks update \

       --resource-group myResourceGroup \

       --name myAKSCluster \

       --enable-aad \

       --aad-server-app-id <server-app-id> \

       --aad-server-app-secret <server-app-secret> \

       --aad-client-app-id <client-app-id> \

       --aad-tenant-id <tenant-id>

Outcome

The benefits of successful integration are not limited to the followings:

Streamlined User Management: Centralized user management through Azure AD.
Enhanced Security: Leverages Azure AD’s security features to protect your AKS cluster.
Simplify Security: Using Azure AD’s security features and Keycloak settings to simplifies the authentication process for users

Conclusion

We saw in this article how integrating AKS with Keycloak using Azure AD as an intermediary provides a robust and secure authentication solution. In addition, to the above steps, you can use `kubectl` to log into the AKS cluster test the integration, redirecting to the Azure AD login page, and after successful authentication, you should be redirected back to Keycloak if configured correctly. Verify that users have the appropriate roles and permissions in both Azure AD and Keycloak to access the AKS cluster. For troubleshooting, ensure the Client ID, Secret, and URLs are correct, and verify all required permissions and alignment of Keycloak and Azure AD settings and use HTTPS for all communications and regularly review and update access controls and permissions for security. Maintaining the system by keeping all components updated and implementing monitoring tools to track the health and performance of the integration and also, advanced configurations include adjusting claims in Keycloak to meet specific requirements and configuring group memberships according to organizational structure which will be in the next article. By following the steps outlined in this article, you can ensure a seamless and efficient integration process to simplify and enhance app security.

Microsoft Copilot in Azure Series - Copilot Access Management

Pierre Roman — Thu, 27 Jun 2024 00:00:00 PDT

Hello folks!

Today, we’re diving into Microsoft Copilot in Azure. It’s like having a super-smart assistant in the cloud!

It’s an AI-powered tool that’s all about making your life easier when you’re working with Azure, when you’re navigating the Azure portal, or using the Azure mobile app.

Now, keep in mind, at the time of recording this, Copilot in Azure is still in preview. That means it’s like a sneak peek, and there are some extra terms you have to check out before you jump in.

This Copilot in Azure can be a real lifesaver. It knows a ton about Azure’s services and resources, it also has access to all the information in Azure Resource Graph.

It’s like having a cheat sheet for the cloud. You can ask it questions about your environment, and it’ll give you answers tailored to your own Azure resources, and your level of access.

That means that Microsoft Copilot in Azure will only report on the resources that you have access to. It can only take the actions that you have permission to perform, and it requires confirmation before making changes to your environment.

It complies with all existing access management rules and protections such as:

1- Azure role-based access control (Azure RBAC),

2- Privileged Identity Management,

3- Azure Policy,

4- and resource locks.

You can chat with Copilot right in the Azure portal or on the go with the Azure mobile app. It’s like texting with a friend who can do some of your homework for you. It’ll answer questions, run queries, and even perform tasks for you, all while keeping your organization’s policies in check.

Oh, to use Microsoft Copilot in Azure you might need to have a chat with your network or security admins about a WebSocket connections to https://directline.botframework.com .

It's required for Copilot in Azure to work.

Now, Let’s dive into controlling the Access to Microsoft Copilot in Azure. By default, everyone in your tenant gets to play with Copilot in Azure. But, as the Global Administrator, you’ve got the power to manage access. Want to give specific users or groups a sneak peek? No problem! the video below shows you how to control access.

Remember, Copilot in Azure only helps you with the stuff you’re already allowed to touch. So, if you’ve already got access to certain data and resources, “Cool, let’s get to work!” But if it’s locked away from you, or you don’t have rights, Copilot respects that – no sneaking in or anything. It’s all about keeping things above board.

And that’s a wrap on this episode of ITOpsTalk "Using Microsoft Copilot in Azure"! Stay tuned to this channel for more episodes and updates

Catch you in the cloud!

Cheers!

Pierre