Microsoft Updates Azure AD B2B, Releases 'Tenant Restrictions'
- By Kurt Mackie
- February 02, 2017
This week marked the rollout of several new Azure Active Directory (AD) capabilities designed to increase security and collaboration.
Microsoft has turned on additional capabilities for its Azure AD B2B preview, which is designed to make it easier for organizations to collaborate with external users. In addition, organizations using Azure AD can now ramp down access to Software as a Service (SaaS) applications in shared-tenant scenarios. This new "Tenant Restrictions" capability, released commercially ("general availability") this week for Azure AD users, is designed to meet the compliance requirements of large organizations.
Updates to Azure AD B2B Preview
Microsoft's Azure AD B2B preview is designed for business-to-business communications. Users can send invitations to people outside of an organization for collaboration purposes. This capability is still at the preview stage from its early introduction back in September 2015.
Microsoft announced this week that it has added to the Azure AD B2B preview's capabilities. Some of the highlights for IT pros include PowerShell support and "auditing and reporting capabilities." It's now possible to delegate the responsibility for issuing invitations for Azure AD B2B guest accounts to users who aren't administrators. Organizations using the service can now enforce multifactor authentication. Microsoft is also providing APIs for customization purposes, as well as the ability to add brands to invitation e-mails, among other improvements.
Microsoft is steering its Azure AD B2B capability toward commercial release, but the general timeline wasn't indicated. Microsoft sees Azure B2B as being valuable to organizations of all sizes, including ones with "complex compliance and governance requirements," according to its announcement.
The Tenant Restrictions capability is for large organizations that may fear information leakage because end users are accessing hosted applications from shared infrastructure. End users in an organization typically access those applications using a common domain name, such as outlook.office.com.
Since SaaS applications typically get accessed via shared datacenter infrastructure, large organizations may want to ensure that their users only connect to their SaaS apps, instead of other organization's SaaS apps, within that shared infrastructure. Microsoft's new Tenant Restrictions compliance solution is designed to permit organizations to specify a list of tenants that their end users can only access. It's a sort of whitelisting process for organizations that use Azure AD for single sign-on access to SaaS apps.
Using the Tenant Restrictions capability requires configuring a proxy server within an organization's IT infrastructure. The proxy server will send a new header, called "Restrict-Access-To-Tenants," which also includes a list of the tenants used by an organization. If an end user tries to access a tenant that's not on this list, then they will get blocked with a "You can't get there from here" message.
The details and requirements for enabling Tenant Restrictions are described in this Microsoft document for Office 365 SaaS applications. However, the article added that the Tenant Restrictions feature "should work with any SaaS cloud app that uses modern authentication protocols with Azure AD for single sign-on," and not just with Office 365 apps.
The "modern authentication" phrase mentioned above is Microsoft's terminology referring to any application that can work with the Active Directory Authentication Library (ADAL). The ADAL provides a means for developers to "obtain access tokens for securing API calls," according to this MSDN article's definition. Most of the more current Office 365 applications reached general availability in terms of having modern authentication support back in May, although some are at the preview stage, Microsoft had announced previously. The exceptions that won't work seem to be older Office applications, such as Office 2007, Office 2010 and Office for Mac 2011, which lack ADAL authentication capabilities.
Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.