Secure All Environments and Applications Within Your Business

Administrators are generally the most privileged users in the environment, and they often have privileges assigned that are not used. This creates a liability for the environments that needs to be addressed. Spyglass often leverages technologies like the ones listed below to help generate a solution that does not impact the ability for admins to perform their work but helps to secure and limit the permissions that they will have at any given time.

• Privileged Identity Management (PIM) is a solution that helps provide just in time access to resources connected to Azure AD. This focuses on helping to implement and maintain the Principle of Least Privileged.
• Conditional Access – Conditional Access policies are a key component in allowing access to resources within M365 in a secure, controlled, and audited manner. It helps to dictate the how, when, who, and what people can access before they even connect to the resources themselves.
• Permissions Management – Permissions Management is focused on looking across multi-cloud environments at what rights users are assigned versus what they actually use so that roles can be adjusted to only provide the permissions on items that are actually needed across Azure, AWS, Google, and other cloud solutions.
• Multi-Factor Authentication (MFA) is a simple mechanism that allows for a second authentication mechanism to be leveraged to help verify an identity and dramatically increase security. Azure MFA is part of the Azure Active Directory (AAD) solution and available to most licensed users.

Managing and Governing External Users – This is one of the biggest challenges that any organization will face, and Spyglass has helped to address this issue by using some of the solutions listed below and creating the necessary governance based on the specific use cases and requirements that our customers have.

• Multi-Factor Authentication (MFA) is a simple mechanism that allows for a second authentication mechanism to be leveraged to help verify a identity and dramatically increase security. Azure MFA is part of the Azure Active Directory (AAD) solution and available to most licensed users.
• Access Packages and Reviews – Access Packages and Reviews allows for resources and permissions to be grouped together to help create more automated processes for the onboarding and offboarding of accounts through potentially automated means.
• Consolidation – Consolidation is the effort to reduce the amount of unique identity providers to allow for better user experience, increased management capabilities, and less overhead to manage and secure identities including external identities.
• External User governance – The governance of external users in any environment can be challenging. Spyglass helps to simplify aspects of this through the use of Azure AD configuration and solutions and leveraging outside products like Power Automate and/or Azure B2C.
• Conditional Access – Conditional Access policies are a key component in allowing access to resources within M365 in a secure, controlled, and audited manner. It helps to dictate the how, when, who, and what people can access before they even connect to the resources themselves.
• Cross Tenant Access (CTA) – Part of the Azure AD suite of products, CTA allows for the configuration federation between Azure AD tenants to allow for better management of external users from trusted domains.

This is a space that is becoming more and more critical as applications and other workloads are leveraging their own identities to gain access to resources throughout the environment and perform actions that may need elevated rights. This has to be managed closely as to protect these accounts and easily coordinate the actual permissions that the accounts needs. Spyglass has worked with numerous customers to design, plan, and implement solutions to handle these identities that often leverage:

• Verified ID – As identities become more decentralized, Verified IDs can help to maintain a high level of security and assurance. The verified ID provides the necessary claims and signatures to be securely leveraged for individuals and resources
• Workload Management – Extending identities beyond just people and into the idea that machines, applications, and other resources may need to have an identity assigned.
• Key Vault – An Azure location that is used to host keys and secrets that can be used in protecting resources and identities across the environment including multi-cloud.

There has always been a challenge around making sure that users only have the rights that they need while keeping management to a minimum. To help combat this challenge, Spyglass has looked to some of the solutions listed below and leveraged the use of working to automate the onboarding and offboarding processes that organizations use. Some of the automation is inside the solutions while others are scripted or leverage tools like Power Automate.

• Privileged Identity Management (PIM) is a solution that helps provide just in time access to resources connected to Azure AD. This focuses on helping to implement and maintain the Principle of Least Privileged.
• Permissions Management – Permissions Management is focused on looking across multi-cloud environments at what rights users are assigned versus what they actually use so that roles can be adjusted to only provide the permissions that are actually needed across Azure, AWS, Google, and other cloud solutions.
• Access Packages and Reviews – Access Packages and Reviews allows for resources and permissions to be grouped together to help create more automated processes for the onboarding and offboarding of accounts through potentially automated means.
• Conditional Access – Conditional Access policies are a key component in allowing access to resources within M365 in a secure, controlled, and audited manner. It helps to dictate the how, when, who, and what people can access before they even connect to the resources themselves.
• Single Sign On – to help create a better user experience, Spyglass works to integrate applications and identities into a single organized structure that allows for a single identity to connect to all applications, resources, and environments in a secure manner.