• Active Directory
    • Active Directory Analysis
    • AD User Management
    • AD Delegation
    • AD Dynamic Groups
  • Software
    • FirstWare DynamicGroup
    • FirstWare IDM-Portal
    • FirstWare AD-Inspector
  • Company
    • About us
    • News
    • Career
    • References
    • Contact
  • English
    • German
FirstAttributeFirstAttribute
FirstAttributeFirstAttribute
IAM Specialists
Software & Cloud Services
  • Active Directory
    • Active Directory Analysis
    • AD User Management
    • AD Delegation
    • AD Dynamic Groups
  • Software
    • FirstWare DynamicGroup
    • FirstWare IDM-Portal
    • FirstWare AD-Inspector
  • Company
    • About us
    • News
    • Career
    • References
    • Contact
  • English
    • German

Integrating Cloud Services in the enterprise network

Dec 8, 2020 (Letztes Update) | Consulting, News |

 

 

The use of cloud services is being discussedintensively in many companies. The discussions does usually lead tothe following questions:

  • Is our data safe in the cloud?
  • Can I get fast access? At any time and from any place on theworld ?
  • Do Cloud Services meet the compliance guidelines of thecompany?

It gets really interesting when the decision is “pro cloud” andthe implementation project is about to start. If you need help, youcan rely on the experience of our specialists. Feel free to call orto send us a message.

Cloud services in general

Cloud services are a complex issue. There are many providerswhose offers differ just in details. Due to the already gatheredproject experience the experts of FirstAttribute focus onthe Microsoft cloud solutions.

Microsoft cloud solutions can be

  • IaaS (Infrastructure as a Service)
  • PaaS (Platform as a Service) and
  • SaaS (Software as a Service).

It is a mix of public cloud and private cloud services.Microsoft calls its public cloud service MS Online (MicrosoftOnline) or in short MS-O, the private cloud is called theOn-Premises or short OnPrem.

On the way from OnPremises to a SaaS solution, responsibilitiesalso move from from the local IT to the cloud service provider. Thepicture below shows you how the responsibilities for each cloudsolution are balanced between the local IT and the cloud serviceprovider .

Comparison of cloud variations OnPremise , IaaS , PaaS andSaaS

Cloud Computing with Microsoft – Examples :

OnPremises Server and applications are in your own computer center
IaaS Microsoft Azure Server in the Cloud computing center, OS are inself-responsibility
PaaS Microsoft Azure SQL Server in the Cloud computing center
SaaS Office365, Exchange, Sharepoint, Lync are in the cloud

Microsoft Office 365

Microsoft Office 365 is a SaaS (Software as a Service) solutionfrom Microsoft .
Office365 comes in 3 versions:

  • Office 365 Small Business Premium
  • Office 365 Midsize Business
  • Office 365 Enterprise

The characteristics and of each verison can be found on theMicrosoft website: https://office.microsoft.com/en-us/business/

Basically, the follwing components are offered:

  • Exchange Online ( EXO )
  • SharePoint Online (SPO)
  • Lync Online (LYO)
  • Office Online (Word, Excel, PowerPoint, Outlook, Access)

Technically seen, Microsoft provides a Microsoft Azure ActiveDirectory domain in a so-called cloud tenant (client). This domainis the basis for an Exchange organization and the provision ofother services such as SharePoint. The Office programs (Word, Exceletc.) are streamed via App-V directly to the terminals.

Workplace integration

The main questions here are:

  • How do cloud services fit into the existingenvironment?
  • How does the daily business look like for theuser?
  • How does the end user access to the cloudservices ?
  • Is it all transparent and understandable tothe user ?

Three-step concept for the integration

1 Directory synchronization

Establish a directory synchronization between the OnPremises ADdomain in your own data center and the Microsoft Azure ActiveDirectory domain based on the MIIS (Microsoft Identity IntegrationServer). So you can access the cloud tenant with the regular username. You can now access a different domain (Azure AD) and with adifferent password.

2 MIIS Password Synchronization

Establish a MIIS Password Synchronization. The directorysynchronization with the Microsoft Identity Integration Serverenables the transmission of passwords in the Microsoft Azure ActiveDirectory domain. Thus, users can sign in with the same usernameand password both OnPremises as well as in the cloud – but on twodifferent domains.

3 Single Sign-on SSO

Establishment of the single sign-on SSO. A STS (security tokenservice) is required which is set up with a ADFS Trust (ActiveDirectory Federation Services) between the Microsoft Azure ActiveDirectory domain and the AD domain OnPremises. This allows you todirectly access to cloud services without further notification. TheSSO solution is the best solution for the user, but also the mostcomplex.

For this reason we want to go a bit more into detail in thenext chapter.

Single Sign-On SSO

The implementation of SSO requires a Windows domain in mode2003R2, 2008, 2008R2 or 2012. You can install the ADFS serviceeither as ADFS 2.0 on a Windows Server 2008R2 or as ADFS role on aWindows Server 2012. If users want to log on to the cloud using SSOoutside the intranet, an AD FS 2.0 proxy server in the DMZ isnecessary. The Cloud login page passes the authentification on theADFS proxy to the ADFS server and the OnPremises domain.
The routing works if the user logs on using his UPN(UserPrincipalName), eg username@company.com. In addition, the DNSsuffix of the UPN must be a public registered DNS domain. Only thatway the forwarding target can be resolved externally to the ADFSproxy in the DMZ.
It is might be the best to use the e-mail address as UPN here, asthis is known to the user. Even for users who log on to theirworkstation to a domain PC, the UPN of the user object must becorrectly maintained to provide a proper SSO.

Conclusion

If you look at SSO it is easy to see that a cloudservice integration is a very complex issue. The UPN isjust one of many examples that must be considered before and duringthe implementation. In addition there are public certificates,external DNS entries, firewall rules, and trusted sites entries inInternet Explorer (to name just a few). All these should be takeninto consideration to get the connection to the cloud worksmoothly.

If you have questions or need support, you can rely on theexperience and expertise of FirstAttribute. We support andaccompany you on your journey to the cloud. Feel free to contact us.

graphics: adapted from Microsoft sources

Artikel erstellt am: 28.11.2018
Share

You also might be interested in

Release of FristWare-DynamicGroup 2015

Jun 12, 2015

FirstAttribute released the 2015 version ofFirstWare-DynamicGroup. The software creates dynamic[...]

Microsoft Windows Remote Desktop Services vs. Citrix XenApp

Jun 18, 2013

Microsoft Windows Remote Desktop Services (Terminal Services) isa component of[...]

Windows Server 2012 Active Directory

Apr 24, 2014

With the introduction of Microsoft Windows Server 2012 a lot[...]

LINKS

Home Office Service

FirstAttribute – Software

FirstAttribute – Tech Blog

Jobs bei FirstAttribute

Latest Posts

  • Helpdesk and automated groups in AD
  • DynamicGroup 2020 – IT Admins delegate AD group administration
  • FirstWare-DynamicGroup 2018
  • Integrating Cloud Services in the enterprise network
  • Identity Management for Small to Medium-Sized Enterprises (SME)

Categories

  • Consulting
  • DynamicGroup
  • IDM-Portal
  • News
  • Software

Contact Info

  • FirstAttribute AG
  • Am Büchele 18, 86928 Hofstetten, Germany
  • +49 89 215 442 40
  • https://www.firstattribute.com

Topics

  • Active Directory
  • Software
  • Migration
  • Privacy Policy
  • Legal Information

Latest News

  • Helpdesk and automated groups in AD
  • DynamicGroup 2020 – IT Admins delegate AD group administration
  • FirstWare-DynamicGroup 2018
  • Integrating Cloud Services in the enterprise network
  • Identity Management for Small to Medium-Sized Enterprises (SME)

© 2021 · FirstAttribute AG.

  • Active Directory
  • Software
  • Migration
  • Privacy Policy
  • Legal Information
Prev Next