New identity partnerships and integrations to accelerate your Zero Trust journey

by Contributed | May 20, 2021 | Technology

This article is contributed. See the original author and article here.

This month, our team is busy participating in several industry events – the RSA Conference, Gartner IAM and Microsoft Build – and sharing the new partnerships and integrations we’ve developed to help support your Zero Trust strategy.

Reflecting on last year, the RSA Conference in 2020 was my last in-person business trip before the pandemic. I loved connecting with our customers and partners to celebrate their hard work and discuss future opportunities to collaborate. I also enjoyed announcing the recipients of our Microsoft Security Partner Awards last week. While the RSA Conference is virtual this year, I was able to continue my tradition of celebrating our partners at our Microsoft Security Partner Awards. 

Congratulations to all the winners of Microsoft Security Partner Awards!  Something else worth celebrating? Exciting new integrations from our key alliance partners.

New compatible FIDO2 security keys to help you go passwordless

The general availability of Azure AD passwordless is generating buzz. Many customers are deploying passwordless authentication to improve their Zero Trust strategy. The Government of Nunavut, for example turned to phishing-resistant FIDO2-based YubiKeys after experiencing a ransomware attack.

This month, I want to highlight two new FIDO2 security keys with biometric sensors.

Nymi Workplace Wearables: This is our first wearable FIDO2 device that uses both fingerprint and heartbeat sensors to continuously authenticate you. You can use this device to access Azure AD-connected applications and physical buildings without regularly touching the device. Learn more about how the Nymi Workplace Wearable works by watching this video.

Kensington Verimak IT Fingerprint Key: This new FIDO2 device has a simple design and Match-in-Sensor Fingerprint Technology, which combines high biometric performance and 360-degree readability with anti-spoofing technology. It exceeds industry standards for false rejection rate (FRR 2%) and false acceptance rate (FAR 0.001%). Fingerprint data is also isolated and secured in the sensor, so only an encrypted match is transferred.

FIDO2 security keys are just one of the ways – along with Windows Hello for Business and the Microsoft Authenticator app – organizations can go passwordless. You can find the list of FIDO2 security key providers that are compatible with our passwordless experience in our documentation here.

Protect your mission-critical apps with F5 BIG-IP APM and Microsoft Azure AD Conditional Access

Last year, F5 and Microsoft launched a simplified user and administrator experience for application access to help customers enable their workforce to access all apps, including apps that use legacy authentication, seamlessly and securely when working from home. Since then, we’ve seen the use of the F5 BIG-IP Access Policy Manager (APM) integration increase nearly three times, with customers like Durham County and Johnson Controls using these capabilities to help deploy their Zero Trust strategy.

To make it easier for customers to protect their apps with F5 BIG-IP APM, F5 has developed an integration that allows customers to apply Conditional Access policies directly in the F5 BIG-IP APM interface. Customers will be able to streamline policy enforcement, such as requiring multi-factor authentication (MFA) for non-compliant devices, for access to their apps behind F5 BIG-IP APM.  With this integration, customers can easily extend the power of Conditional Access that they use for their cloud apps to apps that use legacy authentication as well. This integration will be available in the coming months and you can learn more by reading F5’s blog.

Protecting legacy apps with new secure hybrid access partners

Securing access to legacy apps with Azure AD continues to be a critical step to ensure customers can adopt a Zero Trust strategy. Our secure hybrid access partner solutions and Azure AD App Proxy are ways customers can protect their legacy apps with Azure AD. We’ve added three new secure hybrid access partner solutions to give you more choice on how you can secure your legacy apps. These new secure hybrid access partner solutions include Banyan Security, Datawiza Access Broker and CheckPoint Harmony.

As part of their integration, Datawiza also launched an automated way to integrate legacy apps to Azure AD with their One-Click solution last month. By utilizing the application API in Microsoft Graph, Datawiza’s One-Click solution automates several key application integration steps, eliminating manual steps like the need to toggle between Azure AD and Datawiza’s access management system. For each application, administrators can simply enter basic application information (i.e., location of application) into the Datawiza Cloud Management Console and click a single button to complete the integration with Azure AD.

Protect your Azure AD B2C tenant with Cloudflare Web Application firewall

Our customers need support for a strong network access strategy once they implement Azure AD B2C in their environment. Integrating Cloudflare Web Application Firewall with Azure AD B2C can provide customers the ability to write custom security rules (including rate limiting rules), DDoS mitigation, and deploy advanced bot management features. The Cloudflare WAF works by proxying and inspecting traffic towards your application and analyzing the payloads to ensure only non-malicious content reaches your origin servers. By incorporating the Cloudflare integration into Azure AD B2C, customers can ensure that their application is protected against sophisticated attack vectors including zero-day vulnerabilities, malicious automated botnets, and other generic attacks such as those listed in the OWASP Top 10.

New apps available in the Azure AD app gallery

Our team continues to add more applications to the Azure AD app gallery so our customers can easily deploy the apps their organizations need. Recently, we added some highly requested apps such as:

• Cisco Intersight, an intelligent visualization, optimization, and orchestration application that brings together your teams, tools, infrastructure, and apps.


• Broadcom DX, a SaaS based services that provides native and 3rd party data ingestion, monitoring, and analytics for cloud and hybrid environments.


• We’ve also partnered closely with Check Point to add five of their applications in the Azure AD app gallery.  These applications include Check Point Cloud Security Posture Management, Check Point Identity Awareness, Check Point Remote Secure Access VPN, Check Point Harmony Connect and Check Point Infinity Portal. 

Stay up to date with the latest identity integrations

In case you missed some of our recent partner integrations you can watch the latest edition of our new partner integration video below.

Helping customers adopt a Zero Trust approach requires us to work closely together with industry partners. I’m grateful for all the partners that have collaborated with us and welcome new partners to build solutions with our identity platform. We’ve added a new section to the Zero Trust Resource Center for ISVs who are creating Zero Trust solutions for partners. You can learn about general integration strategies, creating secure hybrid access solutions, and becoming a Microsoft-compatible FIDO2 hardware vendor. Reach out to me on Twitter @Sue_Bohn to share ideas or leave comments below.

Best regards,

Sue Bohn

Partner Director of Program Management

Microsoft Identity Division

Learn more about Microsoft identity:

• Return to the Azure Active Directory Identity blog home


• Join the conversation on Twitter and LinkedIn


• Share product suggestions on the Azure Feedback Forum

End-to-End IoT analytics and machine learning with Azure Data and AI services

by Contributed | May 20, 2021 | Technology

This article is contributed. See the original author and article here.

The Internet of Things (IoT) technology stack in Operational Technology (OT) is widely used across various industries, including oil & gas, manufacturing, utilities, and natural resources, for solving operational challenges and delivering mission-critical insights and analytics.

More and more organizations are leveraging Microsoft’s Azure cloud platform to perform large scale analytics and machine learning using data from IoT assets, something that had not been simple to do using traditional systems such as Scada and Historians.

In this article, we preview an end-to-end Azure Data and AI cloud architecture that enables IoT analytics. This article is based on our 3-part blog series on the Databricks Blog site. You can find more information and code samples starting with

• Part 1: How to Use Databricks to Scale Modern Industrial IoT Analytics – Part 1 – The Databricks Blog


• Full 3-part series index: Articles by Hubert Duan – The Databricks Blog

Here is the overall architecture discussed in this article and the Databricks blog series:

For making this article applicable on a common IoT use case, consider the scenario of balancing optimal short-term utilization of an asset, such as a wind turbine, against its long-term maintenance costs.

In order to develop insights on short-term optimization as well as longer term maintenance costs, various data sources need to be considered and ingested into the cloud for centralized storage and analysis. Here are a few Azure cloud services to consider, depending on whether the data sources can be stream or batch processed.

• For streaming data into Azure, IoT Hub or Event Hub should be used
  
  
  
  • Here is a reference on comparing these two services: Compare Azure IoT Hub to Azure Event Hubs | Microsoft Docs 
  
  
  • In general, for connecting IoT devices to Azure, Azure IoT Hub is recommended
  
  
  
  


• For batch data ingestion and data orchestration, Azure Data Factory should be considered

For the wind turbine scenario, streaming data can be the sensor data collected from the turbines, while structured data can be maintenance and failure data collected in a batch process.

Once the data sources are ingested into Azure, there are a few options, again depending on stream or batch processing, to process and store the data. In this architecture, the Delta format in Azure Databricks backed by Azure Data Lake Gen 2 is the preferred data format for large-scale IoT data sources: Delta Lake and Delta Engine guide – Azure Databricks – Workspace | Microsoft Docs

• For streaming data that is ingested into IoT Hub or Event Hub, Azure Databricks can leverage Spark Streaming: Structured Streaming – Azure Databricks – Workspace | Microsoft Docs to consume data from the ingestion service in order to process and perform analysis 
  
  
  
  • As a standard practice, Spark streaming can be used to stream from IoT Hub or Event Hub to a Databricks Delta table in the data lake: Table streaming reads and writes – Azure Databricks – Workspace | Microsoft Docs
  
  
  
  


• Alternatively, Data Factory can be used to move batch data to the data lake as well

Once the data is ingested, processed and stored into Delta format, Azure Databricks can be used for big data analytics including data engineering and data science using Spark. As a common pattern, multiple zones within the data lake and aggregations are highlighted below identified through

• Bronze for raw granular IoT data


• Silver for aggregated data, commonly used for machine learning and data science


• Gold for enriched data ready for analytics and reporting purposes

Data engineers can use Azure Databricks and create 3 Delta tables corresponding to these three zones. Users can use programming languages namely Python, Scala, R, and SQL in Azure Databricks for accelerated data engineering and data science development.

Azure Machine Learning can be used for machine learning, most commonly together with Azure Databricks, in this IoT architecture. For example, Azure Databricks can be used with Spark to engineer features and aggregate data. Then Azure Machine Learning can be used to build models through code, drag-and-drop, or even automated machine learning. In addition, Azure Machine Learning can be used to deploy and operationalize machine learning models.

For the wind turbine scenario, the bronze Delta table could be the granular IoT sensor data from the turbines while the silver Delta table is the aggregated (by the hour for example) data. Then Azure Databricks can be used to perform feature engineering and feature selection to build a machine learning and analytics ready dataset. This dataset would then be loaded in Azure Machine Learning to build a predictive maintenance model or a power generation prediction model.

Finally, once the predictions and gold enriched data is created in the gold Delta table with Azure Databricks, it can be loaded into Azure Synapse Analytics for BI analytics and reporting scenarios together with Power BI. Azure Data Explorer provides real-time operational analytics so IoT data can be streamed directly from IoT Hub or Event Hub to Data Explorer.

In summary, this article covered the end-to-end steps for enabling IoT data analytics and machine learning on the Azure cloud platform, including some best practices, recommended services, and application with wind turbine operations use case. This blog series has the full details and provides code samples as well: Articles by Hubert Duan – The Databricks Blog.

Join us for an AMA!

by Contributed | May 20, 2021 | Technology

This article is contributed. See the original author and article here.

The Microsoft Defender for Office 365 team wants to hear from you! We’re excited to invite you to join us for a Tech Community Ask Microsoft Anything (AMA). Our team will be on hand to answer any of your questions about Microsoft Defender for Office 365, Exchange Online Protection, and email and collaboration security in general, so come prepared!

The AMA will take place Thursday, May 27, 2021, from 9:00-10:00am Pacific Time. We hope to see you there!

Use the link below to add a reminder to your calendar and to join the discussion.

https://aka.ms/ama/DefenderO365