Author Archives: Jeff Graves

Enforcing MFA for partner AAD tenant in CSP

Posted on by

The Cloud Solution Provider program from Microsoft is a great way for partners to bundles their managed services with Microsoft first-party cloud services like Azure. CSP partners use Partner Center to manage their customers by logging in using identities in their Azure AD tenant. This happens using a concept of Admin-on-behalf-of in CSP which allows them to manage their customer’s cloud services. Given that these identities have access to multiple customers, they are prime targets for bad actors. As such, partners frequently want to enable multi-factor authentication to help secure these identities. Azure AD supports this natively, however, there is some additional configuration necessary to ensure it is enforced when managing customer’s Azure environments. Follow these steps to enable MFA on a partner AAD tenant and enforce it when managing a customer’s AAD subscription.

Configure an AAD user for MFA

  1. To configure MFA on the partner’s AAD tenant, go to https://aad.portal.azure.com. Click on Azure Active Directory from the menu and then select Users. From the Menu bar, select Multi-factor Authentication.
  2. This will open a new window to MFA settings for users. You can enable a specific user?by finding them from the list and selecting enable, or using the bulk update link at the top.
  3. Review the deployment guide, and select the enable multi-factor auth button when prompted.
  4. The next time the user logs in, they will be prompted to configure MFA.
  5. The user can choose to receive a phone call, SMS text message or use the Mobile Application for multi-factor auth.
  6. Now when the user logs in to Partner Center they will be prompted for multi-factor authentication and receive a notification per their preferred MFA settings.

Enforce MFA on a customer’s tenant

Even though we have configured MFA for the partner’s AAD user, we need to ensure it is enforced when managing the customer’s Azure subscription. This gets tricky with CSP and Admin-on-behalf-of – because the user will be managing a customer’s Azure environment, it’s the customer’s MFA settings that will decide whether MFA is necessary for logins. This means we need to create a conditional access policy in the customer’s Azure subscription in order for MFA to be applied to partner’s users. To set this up for the customer, they need at least 1 license of Azure AD Premium provisioned for their tenant.

  1. To configure the customer’s tenant, login to the Azure portal for the customer: https://portal.azure.com/tenant.onmicrosoft.com. Click on Azure Active Directory from the menu and then Conditional access.
  2. Next, we’ll create a policy that enforces MFA for all users when managing Azure. Select New Policy.
  3. Configure the policy to apply to All users, select the Microsoft Azure Management cloud application and Require multi-factor authentication under Grant access. Switch the policy On under Enable Policy, then click Create.

Now, MFA will be enforced any time a user attempts to manage Azure – including a partner’s AAD users. Note that the partner’s users can use the shortcut URL (https://portal.azure.com/tenant.onmicrosoft.com) only if they have already authenticated using MFA. If they have not authenticated using MFA and attempt to access the portal or PowerShell on behalf of the customer, the sign-in will fail.

Benefits of buying public cloud through a Managed Services Provider

Posted on by

At Microsoft, we see Hosting and Managed Services Providers as a key component of the Microsoft Cloud Platform. Not only do we want to ensure a consistent platform for customers across on-premises, hosted and Azure, but we understand that customers need help managing the cloud life-cycle as well. That is the premise behind the Cloud Solution Provider (CSP) program which enables Managed Services Providers (MSPs) to provide customers with a wholistic cloud solution, including assessment, enablement and operations. Let’s look at some of the benefits of purchasing Azure from an MSP.

Managed Services

Microsoft doesn’t provide managed services and most customers don’t have the IT staff or expertise to properly operate their cloud environment. Customers can choose to outsource this to an MSP who can protect, monitor, patch, and secure the workload allowing the business to focus on its core priorities.

Accelerated time to market with Cloud Expertise

The cloud encompasses many technologies which can be daunting for customers who try to go it alone. Leveraging the expertise of an MSP ensures that you are not only architecting your application efficiently for cloud but also that you are taking advantage of everything cloud has to offer.

Familiar Support Resources

Sometimes things go wrong and you need support. MSP’s can provide a more meaningful and customized support experience for customers who can’t afford a dedicated support contract from Microsoft.

Automation and custom solutions

The public cloud can be compared to a large box of legos. Building an environment for your application can take time and may have unique requirements. MSP’s have built automation and customized solutions for cloud that can help bring your application to life.

Custom Agreements

Cloud is a utility by nature which may not suit the needs of businesses who want certainty and consistency. An MSP can provide custom terms, SLA’s, and a single invoice for cloud computing and services costs.

Hybrid Solutions

Public cloud provides numerous technical advantages but is not best for all workloads. Some components will need to live in a datacenter and for customers who want to stop operating a datacenter, an MSP fills that need by hosting workloads in their datacenter while securely connecting them to cloud assets.