Cisco ISE Meets Azure EntraID: Real-World Use Cases - ROPC

I good morning, everyone. My name is Mail Martinez and I'll be your host today. Eh, we are already at time. We are gonna start with our topic for today expertise.00:01Which is gonna be in this case, we're gonna be talking about a real world use case called ROPC.00:20Okay. Now, we invite you to please review and help us to join the slide for participation. The live is gonna be open and you're gonna have, you have the number in the screen also you have the passcode. We are gonna have the Q and A over there, so please feel free to.00:29So with any questions that you may have in the session, we're gonna have some panelists helping there to answer those questions. And also if we're gonna have some dynamics in the session.00:49So please open the slider to participate in it. We're gonna give a few minutes if you want to scan scan the QR code. Well, a few seconds, let's give it 1 min here. Well, everyone joins too.01:00Well, without further delay, we are gonna keep starting. So can you go to the next slide team, please? Okay, just a little bit of awareness. This session, it's gonna be, as I.01:35I'm gonna be your host, but we have also here.01:54As a speaker name or the presenter, it's gonna be team Bbby. He's a customer success technical leader. He's gonna be helping here with this session and also as the specialist we're gonna have here also helping us with the demo for this specific ROPC session.01:57This is not gonna be the the only session. We are gonna have also another session next week on Thursday. We are gonna provide the data at the end of the session. So be, be aware of it, but let's start here. Go ahead.02:16Thank you Miguel. Like Miguel said, if you didn't grab the QR code or get the link from the chat window from I/O, you can take another quick second to scan that QR code down at the bottom left and join into the Slido. We will have a couple of live questions that go out.02:34But also the Q and A panel is NO longer in Webex, it's over there in Slido for anything that you have questions on that come up throughout the session.02:53That like another couple seconds and dive into our agenda for today. Quick we'll go through a quick introduction on what we're talking about today, why we're talking about it today. We'll go through a little bit of the ICE ontra ID support. Today we're talking about the ROP.03:03Protocol, as a foundation integrating ICE with Entrav, getting the basics down before next week moving into some deeper dives into things like eap TLS, eap deep support, and further integrations that are possible with ontra ID and Azure.03:23I followed up with that. We'll go through a rundown of the integration steps required on the entra side as well on the ice side, quick run through of the ICE policy configuration that's needed and then we'll hand it over to I/O to demo all that out for us. So getting started, we'll start with a quick poll over on.03:41Slido, just giving a general idea, this will be a word cloud trying to figure out which ID stores you are using today, whether that's traditional Active directory, ontra ID.04:01Other sources, but just generally to get an idea of where everybody's at before we move forward and we'll give that a few seconds for people to get stuff punched in.04:13Yeah, not gonna be super surprising to see a lot of that Active directory on prem, a little bit of hybrid there.04:33Some migrations over, which is pretty much expected as well.04:40Alright, seems like we've got the the trends going a little bit of federated, some SSO going on.05:08See a couple more responses coming in, so I'll give it another like 10 s before we jump on to the next. Okay perfect. But yeah, so this, this kind of meets up with the expectation which we'll see here in a couple slides. You know, diving in, wanted to call this out at the beginning.05:24We do have a large documentation repository at the link there at the top of the screen covers various topics, but we do have a large session on entry ID.05:44Integrations capabilities for the full life cycle of what you're trying to do today with Entra or migrating from Active Directory over to Entra. But again, that's just c.CS.co/ice-berg. Adding the additional tag onto the end will take you to a specific section, but there's a a.05:56Ton of knowledge out there, a ton of documentation that can.06:16Provide you pretty much everything we're gonna go over today in this session. So this kind of was where the question previously came from. Numbers as of mid to late last year, we're seeing a ton of rest ID store adoption, but the vast majority of enterprises are still running active Directory on prem.06:19There are a few additional ones out there if we're doing radius ID stores or external radius to other providers, but the vast majority of what we're seeing as of today are Active directory.06:39LDAP and then starting to move into rest ID as more and more applications move to the cloud and everything becomes more and more hybrid. So good starting point is, differentiation between traditional ID versus ID. The two are not equivalent. There are some overlaps.06:53And what they can do, but they they both do serve slightly different purposes. Our on premise AdS generated local server based identity system, mostly using kerber roofs for network join machines. Entra, on the other hand is cloud based service targeted more at modern applications and utilizes things like.07:13Rest APIs, OAuth SAML to do the user authentication and then provide access specifically to applications that those users need, rather than broad perimeter based security access.07:33Again key differentiators, infrastructure wise, Active directory, mostly gonna be on premise hardware or virtual machines. Ontra is gonna be cloud managed, NO hardware requirement there, but you may have to have a service contract with Microsoft or another cloud vendor. Protocol wise, Active Directory.07:48With Kerberos NTLM, Entra, SAML, OAuth, OpenID connect, management wise.08:06Active Directory relies on traditional group policies and organizational units. Ontra ID is gonna use Microsoft Intune for policy and administrative units as we're adding devices, whether personally owned or organization owned into the system.08:14And then finally for our access and security, Active Directory is more focused on perimeter security while Entry uses things like conditional access policies, multi factor authentication and identity pro protection for, for their security.08:31Okay, a few different types of entra ID joins it can do with Microsoft. Again, Entra itself is gonna be more focused on either organization or personal owned devices. At the organization level, we're still looking at things like Windows devices, managing their policy through Intune and joining those devices to.08:51To the cloud into a specific organization.09:11On the personal side, the BYOD functionality, those are mainly going to be registered through other cloud vendors such as Intune and MDM to do device management, pushing down certificates, and then managing their user credentials through a combination of Entra and Intune.09:15And then we go down to the hybrid approach, which we're looking at either organization or personal and migrating on prem devices into the cloud and then using a combination of management. For things like machines, we might still be keeping them.09:34On premises using traditional AD and managing them with group policy and pushing out policy, and then for more mobile devices managing those in the cloud with Intune, and then doing an identity sync from Active Directory to bring those attributes into the cloud for use in specific app.09:50Applications.10:10One major thing to call out, there are differences in the way computer and user accounts are managed for both on prem and ENTRAID devices. Active directory, we're still targeting traditional office networks and again that perimeter based security, we need domain controllers, we need group policy objects.10:16User logins are done whether by cache credentials on the actual machine, in the case of like a certificate or they're entering credentials into a VPN client to get access to a network locally or remotely.10:35Community computer accounts are gonna be mainly domain joined and have full trust with the domain controller for authentication. This is still gonna be best for on premise legacy applications and in spaces where those devices have direct server access. Entra on the other hand, it's.10:50All cloud based internet 1st. Microsoft 3605 and SAS application support is the primary target, at least for early adopters. Management is all done through Microsoft Intune MDM.11:10User login, at least for the 1st ones are direct via the internet. It enables things like single sign on and multi factor authentication support, before granting access to cloud based applications. Devices rather than being actual objects are.11:26Essentially just joined devices, allowing for that zero trust device compliance using things like GUIDs rather than the old style Sam account names or use it principal names. And then the best place to focus on that interest side is for remote and hybrid employees.11:46Mainly using cloud only workloads where they don't necessarily need the on prem access to servers or services.12:06At the enterprise level. And then of course the thing missing here is the hybrid. So if you have users that are accessing things on prem and in the cloud, that's where we're gonna tie the two together. A quick high level rundown of the ICE and Azure or ontra ID.12:13Features that have come out over time. ICE three auto provided the ability to deploy ICE in the cloud and some basic access.12:33Associated with that three one and three two, we had our native Azure marketplace deployments. We added SAML SSO for admin portals and also the graphice API support which supports some of the stuff we're doing now and talking about today with entre ID.12:433334, we had a little bit of enhancements moving along with Windows eleven and adding support for tip and eap chaining taking away the the need for something like any connect Nam or secure client NAM to.13:01Tie in context of user and machine into policy within ICE. And then in our latest release, we've added some additional support for entry joined device and user identification, advanced certificate authentication, and then more attribute integration on the things available via the graph API.13:17Which will lead us to our second question of the day. How are you authenticating your users and your devices today? Are we going with, you know, traditional username and password support? Have you got a migration into certificates with eap TLS? Are we doing the eap chaining?13:39Or some other way if we're talking about the SSO MFA use cases to get into cloud apps, seeing a lot of certificate adoption, which is good.13:55Each chaining also a good way to go. MS chat B two is of course deprecated and NO longer supported fully, at least in the the latest versions of windows. So hopefully we see more and more folks moving away from that as time allows.14:16And just a little bit of username and password, which is expected give this one another couple seconds. Okay perfect. So let's.14:34Jump in a little bit, just a quick graphic on what was available in Active Directory, what's available on available in entry ID, and how some of these things differ.14:54Active Directory itself had a lot more support, because of the information that ICE was able to send over to Active directory. Ontra being a cloud service is pretty limited in what we can actually send. Basically as you see on the right, we can do certificate authentication and we can do.15:04ROPC OVERTTLS using PAP, which we're talking about today. So you do lose a little bit of the functionality and the control over how things are authenticating, but as time goes on, we're really migrating to those.15:24The one right in the middle, the eap TLS using certificate authentication, a little bit with peep TLS if we're sending certificates, and then for our base level tunnel TLS using PAP or ROPC, highly recommend staying away from the top two, even when you're using Active directory.15:40I just because of.16:00Continued issues with the way Microsoft changes things moving over to credential guard, and then blocking some of those deprecated styles of authentication because they are technically considered insecure at this point in time. And then more of a visual of how our community.16:03Communications from our end devices all the way up to ICE and then Active Directory would go in the past. Users over on the left.16:23Start a connection with whatever our network access devices, whether that's wired wired wireless, and eap negotiation happens there. We decide the endpoint supplicant is configured to do peep MS chat V two in this scenario. That's tunneled.16:32Through radius up to ice where ice extracts the username and the password hash out of that packet and then forwards it on to Active directory. Active Directory would validate that username and NT hash, send back.16:49A result there if the password was good or bad. If good, it can also send back the attributes that ICE can then use an authorization, that authorization gets back sent back to the network access device and then the user has the desired access that we're giving as part of our authorization policy.17:04The thing that breaks when you try to do this against entra ID is the legacy NTLM and credential guarden features within Windows eleven plus, and even Windows eleven prior. We cannot send an MS chat V two hash from ICE to Entra because it has NO idea what it is and it has NO.17:23Way to actually.17:43Match the hash up with that username and password so that at least at the base level limits us down to what we're talking about today with our OPC. Okay, and again, this leads us into the main topic for today and the foundation of the ice ontra ID integrations.17:46Which will bridge our gap until certificate authentication can be configured and rolled out in your environments. And again, the certificate side we'll be talking about next week in our session.18:06So just at a high level to explain what ROPC is, it's a part of the OAuth two.O RFC. It basically just stands for resource owner password credentials, excuse me, and it's a grant that allows an application, in our case ICE.18:19To request information on behalf of the user. So it's basically I'm giving it my username and password, ICE takes that, sets up an HTTPS rest call.18:39To an authorization server, and then that authorization server returns back a token. That token gets used from there on out as part of the flow to request information about me. So if I want to access something, ICE has a policy saying if Tim is a member of this particular group, we need.18:50To find out if he's a member of that group, I give my credentials to ICE, ICE sends those credentials up to the cloud, gets back the token, and then uses the token to request my group membership.19:10As it says down at the bottom of this, ROPC was deprecated and OAuth two.one, so it's very important to only use this with trusted services like the ICE Entra integration because there is still security inbuilt with the TTLS between the client.19:22In the ice server as well as the HTTPS rest using client secrets and client IDs for the REST calls to get back that information. So it's not actually sent in clear text even though at the beginning we're looking at app, which is a clear text protocol.19:40And then I think I called this out multiple times. Down at the bottom of the screen password change is not supported with this protocol, just as part of PAP. So if a user does need to change their password it has to be done outside of this flow.19:59Again running into how that all works. 1st we do our credential collection, whether that's through a VPN client or a client supplicant usually manually, like in the case of windows, we go into our network settings, set up the eight oh two.1X and enter our username and password there. It then attempts the whole piece.20:15Heap flow or not sorry not beat flow, heap flow with the network access device can communicates with ice. And then we continue on with that token request, trying to grab the parameters of the grant.20:35Giving back the token and then using that token to get our group membership back. And then just a basic visual representation of this. Like I just said, we still do from our end device that eap negotiation with the network access device. We set up an eap TTLS tunnel to ICE with those PAP credentials.20:47Inside the tunnel.21:07ICE extracts those performs a post with the specific parameters required. Ontra sends back the group attributes. We then evaluate our authorization policy, send that back to the network access device, and the user has all of the intended access we configure there.21:09Moving through, just to call out some limitations with this protocol, again, 1st time login, this is similar to the NO password change limitations within the flow. When you set up a user for the 1st time in entra, it does require a password change similar to when you would create a user in regular active directory.21:36So 1st time through, they need to go in to a web application that supports MFA.21:56Do the password change and then subsequently we can run the flow with ICE. Again, like I said PAP does not support password change as part of the protocol, so if the user loses their password every needs to change it, they do have to go to another web portal to be able to go through the whole MFA flow again, change the.22:03Password and then come back and try again.22:22Another major one, at least with ROPC initially, there's NO compu computer machine authentication concept within Entra because Entra does not store a device password there. It's basically just an object ID, which is why we can use it for things like EAPTLS because there's NO password there, but if we.22:26We tried to do a machine authentication the same way we do with Active directory. It just won't work because it's not supported.22:45With that being covered, and so now to get up too much time with slides, we're gonna run through the high level requirements for getting everything set up on the entre side as well as the ICE side before handing off to I/O for the more fun demo stuff. Okay, so.22:56A general list of everything that's required here. We have to have ICE set up as an application in entra ID. We have to make sure we have our client secret and we need to save that value off somewhere else for use later. It's only use visible to the administrator when it's created.23:14We need to make sure our ROPC public client flow is allowed by the application. We need to configure the groups that we want Entrere to be able to provide to ICE at a read access level. We need to grant the admin consent to allow the token exchange. We need to.23:33Then add the desired groups to the application, set up our token group claims, and then make sure we grab our client and tenant IDs for use over on the ice side. There's some quick just high level photos and, and walk through that again starting at the top, we're gonna register a new device in entraim.23:53Down there under app registrations, new registration.24:12As part of the registration, we always want to make sure that it's got a unique name. We need to make sure it's a single tenant only, and then we click the register button. We'll then go over and set up our client secrets and again copying the value.24:17It's really important at this point because it will not be visible again to you later. And if you miss it, you have to go back and essentially start from the beginning. We then need to enable the ROPC flow. This screen may look different in different environments, in the authentication preview mode, it's the newer model.24:33Used by entra. There is another version of this that that looks slightly different, but essentially in both cases we're just allowing public client flows that just enables ROPC for the application.24:53We then need to make sure via the Microsoft graph that we're setting up our application permissions. This is a read only, so we're allowing group read all to be able to pull that information back when ICE makes the request after retrieving the token.25:08We need to make sure we grant admin consent for this. If this step is skipped, when ICE reaches out and then tries to grab the groups for a particular user or particular object ID. If we've got this not granted for Cisco under the status or not granted for your tenant there under the status.25:26The process will fail, you'll get an error message as part of the authentication, and then it's in the troubleshooting mode.25:47Once we've got that initial stuff set up, we're gonna add our groups into entre ID. These are the ones that will become visible on ICE when you do the integration, and then those are selectable when you do the integration to be used then as dictionary policies over on the ICE side.25:57And then finally, we're gonna add our group claim. This allows the security groups to be passed back. Again, as part of this, if this one's not allowed, if you don't have the token configuration done, when ICE reaches out with the token retrieved.26:17For the user credentials as part of the initial request. When we go back and ask again for what groups that user is a member of, it'll throw an error and again we go back to troubleshooting mode, so just a good spot for everybody to.26:33To take another second to make sure that this one is enabled then finally, we're going to collect our application client ID and directory tenant ID. Copy these off locally. We'll use these in a few minutes once we move over to the ice side.26:50And then from the ICE, similar, just a quick checklist on everything we have to do. At a global level, we have to enable the rest ID store. It's not there out of the box in most versions. I haven't looked at three five patch three yet to see if this one's enabled by default or not.27:09But once we've got the rest ID store enabled, we then move over into our external identity sources and then configure Entra ID as an available external identity source. Enter all that information that we kept from previously, our client ID, tenant ID, and client secret.27:26Punch all that information in, test the connection to make sure everything looks good. As part of that initial one, it downloads the information about the groups available as part of the application, and then we can select those for use as part of the, the integration.27:44We then need to make an identity source sequence that includes the entra ID as one of the members, move over to our policy sets and then set up the resulting access we would like. And then the final piece of course is always to test, make sure our authentication and authorization are working properly.28:02So again, just a quick run through of this. I know I was gonna show a lot of this live. Enabling our rest ID store, configuring that rest ID store once that's been enabled, so punching in those three pieces of information, we copied from the huntry ID side.28:22A quick call out here, the optional username suffix, is very important with how users actually authenticate in your environment. If you don't include the@tenant.on microsoft.com as part of this configuration.28:38Then when users authenticate, they must include that as part of their username. If they don't, we'll say employee is the username, it tries to log in, ICE just takes employee as it is, sends it directly to Entra. Entra says, I have NO idea who employee is. So if you come back and say.28:55The employee@tenant.on microsoft.com, send the authentication, it's then successful.29:15So that one, we write it as optional, but it's really important to just figure out how you're authenticating your users, how those usernames are presented to the cloud, and then configuring based on that. Once we've got all this in, we test the connection. Hopefully we get the test connection succeeded box. We'll see.29:21Save it.29:41And then move over into our group selection. So the groups added on the entry ID side will show up just like this entry ID, in my case network read only, network admin and domain users. I'm choosing to select those three only as part of this integration.29:43So if a user is a member of Cisco or all company, but not a member of the other three, when I go to use it in policy, those users would fail to authenticate. Next up we have to move over to our identity source sequence, add that newly created.30:01Addressed ID store to the available authentication search list. If this piece isn't done.30:21We don't know that we need to send these authentications to Antra so it'll fail right there. And then once that piece is created, we move over into our actual policy set at the top level, screenshot didn't show up well, but this is the authentication policy. So I'm saying if.30:27We're using eap TTLS, I want to send this authentication for the user up to our entra integration, and then I'm choosing a rejection if the process fails here, just to let the note, let the network device know that the authentication failed.30:47Or the process failed and maybe it needs to try again. It's also an option to add drop there but if it's dropped it's a silent drop. The network device has NO idea that there was an issue. It just times out and then based on the.1X configuration, we'll try again after a time.31:05Timeout period, whether that's the normal ten to 15 s, and if that process continues.31:25After usually three attempts by default, if we've had three silent drops, the network device may mark ICE as dead, so subsequent authentications on that switch may fail. Adding it as reject, we actually do send back an access reject, so that's kind of tossing the coin on, on how you would.31:32To get to work in your environment.31:52Moving down into the actual authorization, setting up our external groups or using the external group dictionary for our ice entra integration. The three groups that I added as part of the setup are available here for selection, and then I configure a policy set like I normally would. In this case I'm just.31:58Just looking to see if the user authenticating is a member of domain users and.32:17Giving a very open permit access at this point, but also tagging it as an employee in a security group. From there we just move into testing and that dives quickly into just it's a single slide on a few places you can look for troubleshooting.32:231st stop is always going to be your radius live logs. 1st question, was your authentication successful? If yes, things probably look good. You still make sure that we match the correct authorization policy, check for latency.32:42Sometimes sending it up to the cloud will see a little bit of extra time required for the authentication just with round trip time usually still under a second, but in certain cases, if that exceeds one to 2 s, you may start seeing high latency alarms in ICE.32:57And then just a general stop for debugs. We need to enable for troubleshooting the rest ID store at the debug level and the runtime triple AAA configuration at debug. And once those are done, additional testing is done, we can move into our rest ID store log or our PRR team.33:14Management log, for actual troubleshooting of of what happened during.33:34The authentication in general, the rest commands and the posts that was set up to Entra for validation and any errors or or other issues that popped up along the way. Right, so with that, I will hand over to I/O to dive into a great demo on all of this for you.33:38Alright, thank you so much team. That was great information and team has really walked us through a lot of the things we're gonna be looking at in this demo, but all the same, we'll go through those details so we can actually see what the flow looks like.33:59Let us start with intra ID and we'll come over to the ICE environments in a minute. So we come over to portal.azure.com and we need to log in. Yeah and what I will walk through in this demo is 1st of all, let's make it work. We'll make it simple, NO.34:15The bells and whis whistles, set up intra ID, put in all the details, go over to ICE, set it up simple, get the authentication working, and then we'll break out some other details, how can I add attributes or how do I troubleshoot, and then some other things we can look at via the debug. So we are in our portal for.34:34Azure and we can come here for entry ID.34:54And we can do all the changes, our groups and applications here, but I actually like if I come to the overview, let me see if they have here from the homepage. They have a new intra ID admin center which I prefer. Again, you'll be able to do the same things.34:58But it's cleaner, so I prefer to go to the, intra ID admin center. Again, I will log in as myself. Yeah, so again, I just like the layout here on how you walk across the administrative details.35:15An entry ID, so let us skip to this. All right, number one, let us set up the application that we will use when we are speaking to ICE. And there was a question in Slido asking about this integration if we need to add the PAN IP or the PSN IP addresses. So again, this is an app.35:30Application that is communicating between ICE and entry ID, so we're basically making API calls. So unlike PX grid integrations where you need to put the IP address of admin, of the admin in like catalyst center and then goes via PX grid. We're not doing that here. It's just an API call directly from ICE to enter IDs, so we won't be putting any IP address.35:50From ice here. So for the sake of this session, let's call this ICE experts inside series. So let's go with ICE EIS and this will be a single tenant application, so that looks good, NO changes here. We don't need to redirect URI.36:11So let's register the application. Tim mentioned the application ID, the directory ID. Again, yeah, this is a data you should keep confidential, but because this is a demo, this is a test lab after this session, this app will be deleted, so we're fine. But again.36:26Client ID, tenant ID, these are very important details we need when we are setting up the ICE end. All right, let's go through some of the other details we add in the presentation. Under authentication, 1st we come to settings and this is where we set up ROPC. So if this is not enabled, you won't be able.36:44Able to initiate an ROPC flow to this application. So we need to have this enabled, and if you actually click on this learn more, it will direct you to the Microsoft site.37:04And again, it emphasizes what Tim was saying, like this is NO longer recom recommended because Pat sends the username and password in plain text, but again we are doing this via a trusted client. We're gonna have it TTLS on the outside, so that makes it more secure. So let's save this.37:14Alright, we have our PC enabled. That is great. Let's go over to certificates and secrets. For our token, all we need is a secret certificates are definitely optional. So I'll click on this. It's gonna ask for the duration.37:32Let me move this demo window a little bit up. Alright, let's call this YEARS secrets. Yeah recommendation is six months. Again, this is just for a few hours and we're gonna have it deleted, so let's go for the minimum of three months. Let's add that.37:48Again, this is very important. You have to copy this when you create it and this token needs to be kept secret. The good thing is even though this is showing everything, there are some characters that are eating, so I won't share that to us, but I need to copy this while we're here.38:07And I need to put this on my clipboard and I will show you later by the time we come back here we won't be able to see this information. So if you didn't copy this at the beginning, let me make sure I can paste it. I didn't paste next to that again. Copied.38:23Alright, there we go, now it's based. All right, so we have our secrets so again be mindful. We are copying the value, not the secret ID. I've had customers open tag cases because they copied the secret ID rather than the value itself. So we are copying the value, not the secret ID.38:42Let's come over to token. We talked about the group plane, so let us add that. For the sake of this setup, we need to be able to interact with all the groups, so we want to check security groups, directory roles.38:59And all groups. Again, when team was showing us the details between traditional AD and intra ID we see some of all, some of these options available, but for this setup, again, all we need is group ID, so that's all we're gonna have enabled here and let us add this.39:14All right, we are almost there now for API permissions, as we mentioned earlier, this is an API interaction from ICE over to intra ID, and the good thing is you can lock this down saying, hey, when that API call comes from ICE, I want to restrict the permission, the access it has.39:32With respect to this application. So user read is always added by default. We can add some more. In this case we want to be able to read groups. So Microsoft graph, this is an application, so application permissions, and here let's just search for group.39:51And that read, we need to group read all. So under group permissions, we have the group read all again this allows you to read all groups. So when ICE is speaking to this application, we want ICE to be able to read the groups that we have within entry ID. So we need that permission. So let's add it.40:09And if you watch yep, it's on this list, but it says it's not granted and it's saying it's not granted for home yeah because that's what I live out this entire day instance is so let's grant that permission and it should be all green. Alright, we look good.40:27Now for a basic setup, this is all we need to do on the intra ID side. And if I go back here, yeah, so now you see the secret is NO longer available and you cannot copy it. So like Tim mentioned, if we had not copied this at the beginning.40:44When we get about to ICE and we need this value we can't get it. So we'll have to delete this and create a new application or a new secret key. So when you create the secret, make sure you have it saved. All right, so technically we have an application running, but one thing we should be mindful of is even though we have the application registered, so if we come to.40:59All applications, we see our application is here and it looks good to go and we can come here and make changes. But we do not have any groups here. So we are telling ICE when you come over here, you're speaking to this application, give me the group information and the user so they can authenticate. But we don't have that here.41:19To enable the groups when it comes to the enterprise application. But before I do that, let me show you some users that I have in my intra ID setup. So again, we have the administrator and I have a couple of interesting and familiar names here as our users.41:37And if we come over to our groups, we have about three groups created as well and a couple of those users are already added to this group. So what we need to do to make the group reflect under the application we just created is to come into enterprise applications. So this is where we add those details. So again.41:53You see our new application here, which is good. So let's go into that. Now, under that application within our enterprise applications, we can come to users and groups. And when we check, you see we don't have those users and groups here. So even though the application is active.42:12We don't have the groups or the users added, so we need to do that saying, hey, for the purpose of this application, anyone making a REST API calls to it, I want to allow access to this group. So let's click all the three groups, even though we not use all three within ICE, but let's go with all three. So I have my CSS group, IM group and the remote.42:29Oops so let's select that.42:49That looks good. Yep, so this is good information. Only directly users added up to the group will be functional. So let's assign that. Now yes, so now we have our users and groups under the application, so that is very important. Some more things I will add before I go.42:52Over to ICE and the intra ID gurus, we probably know their ways their way around this. But as Tim mentioned, multi factor authentication should not be enabled for your users. If they are enabled and they are trying to log in via ROPCC, then that would not work because our cc's username and password, there is NO provision for.43:11Using MFA like Microsoft authenticator. So let's make sure that is not enabled for our users. So under users, we see the users here, we see the per user MFA setting here. I can come here and check and it says, Yeah MFA is disabled. Let's pick one of this e.g.. So again, we see that option here.43:31The MFA setting none of that is enabled, which is good. Now, something interesting that I came across while working with this in the lab is even though I had all this disabled, our PC authentication kept on failing and I had to make one more change.43:50Again I don't know if this applies generally or if it is just the way, my lab is set up, but I had to come into the authentication methods and I had to come into Microsoft Authenticator to see how it was set up. Because what was happening is even though I had my users.44:06MFA disabled. This was overriding that. So the authentication method here for Microsoft MFA was overriding that because it says hey all users have to do the Microsoft authenticator. So I had to come here and say, hey, by the way.44:24I want to exclude any user that is in the group IAM and remote when they are trying to authenticate, ignore the Microsoft authenticator path. So when I did this was when I was able to finally get our to work successfully. So again, if you run into that while you're testing, this is something you should check, but.44:40Again the entry ID groups will probably understand all these permissions better. Okay, so we have the basics in place, we have our applications, we have our groups, we have our user, we have our data for our application, we have our secrets, so let me actually leave this window open here because we're gonna need that data when I come back.44:57Yeah, let's keep it on this page. All right. Entry ID looks good, so let us go over to ICE. So this is my ICE instance. Let us log in with NO more credentials, not some of this time.45:17Okay, so this is our eyes instance. Let us start with the basics. Administration excellentity sources. So this is where we would have our rest API. So again, we're talking about in the polls.45:40Which integrations are we using AD, intra ID, and some hybrid setup? I don't have the option here to even create a rest ID store. And that's because we need to have it enabled 1st. So let's come to external identity source settings and rest ID enabled. Now the good thing about this.45:57Because they are containers, you don't have to restart.46:17The entire ICE application. So just enabling this and saving it takes about 15 20 s and we'll see that pop up here shortly. Once that is done, we have the ability to create. Yeah, there we go, that's our notification. If we come back over here now, we'll see now we have rest because that is now enabled, so.46:22Let us create that store. And let's make this easy to remember, so let's call it intra ID and let's use something similar experts inside series. In production, please put in those description is very helpful.46:42So we see those requirements here, the client ID, the tenant ID, and the client secret. So when ICE is speaking to entry ID, these are the parameters that will be sent across to allow that authentication and then we can pull the data and information we need from entry ID. So let's swing over here.46:58Client ID, we can copy that. Let's go copied. Let's paste that. Looks good. Client secret, I have that saved somewhere else, so let's copy that from where I saved it.47:18Let's come back here. Let's paste that looking good and then finally our tenant ID. Okay, so this looks good.47:37So we should be able to test connection now and fingers crossed that should be successful. Good. So step one, we are communicating successfully between eyes and the application we created in and tried it, so we're getting there. Before I save this, let's actually pull in the groups. Again, we're keeping it simple. We'll come over to user attributes later on.47:55But now let's make sure we can read those groups, so we have our asterisks there. Let's retrieve groups. Very good. So these are the three groups we added to the application on the intra ID side and we can read all those three groups. So our permissions are working as expected.48:16For the sake of this demo, I will stick with just IAM and remote. Let's ignore the CSS group. Let's save this. Alright, so this is saved. I will come back to this later. I know Tim walked us through this suffix as well and I will.48:32Introduces some changes depending on how your users.48:52Enter their credentials, so we'll come back to this later on. All right, we have the basics in place. Now let's look at all the other components we need for our policy sets and if you've been doing, you know, all the other basics with ICE, you'll be familiar with this. We did save that so I'll say ok. Again, best practice always.48:55Enable just the protocols you need, so I have my TTLS with PAP on the inside enabled here. So let's confirm what we have.49:15Yeah, so everything else is disabled. If it's LS with PAP, again, I I allowed all the other inside methods, you know, but if we really really want to lock it down, we'll disable all this and just have PAP. But again that this should be sufficient, so let's move on to authorization, let's see what profiles we have.49:23Under authorization, I have my IAM users, I have my remote workers, and that should collaborate with the groups within for IAM users and remote. So again, looking good, we have the required access for them. And of course something else that we are encouraging users to work on is the use of trustsec.49:43Now, this does not even require any form of enforcement, this is just classification as we have here and just propagation. So, again, this is something we are definitely encouraging users to get used to. And I have my IAM engineers and my IAM managers.50:03Trust set groups created. So again, that is good. Now what else? I think we are good to create our policy set. So let's go back to policy policy sets. So I have just a plain blanket, nothing really on the inside pointing to my server and letting us know, ok, this is a wired.1X.50:18Test, but these I don't want to use the default network access, so let us proceed and do and select the ETTLS one we created, so that way we know only things matching that protocol will be allowed. All right, let's see what we have in there. It should be.50:38Just the default, so default authentication default authorization. All right. So let us keep it simple. Again, we can add all the bells and whistles, always say, hey, 1st of all, make it work, and then you can tighten it up. So let's call this.50:56Enter ID, authentication, and let's just stick with the tunnel. Let's say the if tunnel is if the TLS, then we are we are happy with that. So let's come to network access.51:14And we want this to be TLS, and that looks good. So of course we want this to authenticate against the application we created, which points our rest ID stores, so let's find that in here. Yeah enter ID EIS is our application.51:31Team showed us this detail as well, so I'm gonna leave this as reject reject drop to make sure we definitely verifying that user. And for authorization, again, let's keep it simple. Let's just say, hey, so long as you match the group, we are good to go.51:52So let's do this for intra ID and let's say I am you know let's do this for the managers, so I am managers, and we're gonna pull the information here for our group.52:08Now I will emphasize this a little bit more, but I encourage you to pull the, the store from this dropdown, and if when we come in here, if you're running a version of ICE that supports the device authorization, which is ice three.four patch four upwards or ICE three.five, you will see.52:24The option for intra IDIS and also intra IDEIS device. For the sake of this.52:44We're doing entry IDEAIS when we come to the session next week for and device authorization, this will become very helpful. So let's be sure we pick the right one. And we just want to look at the external groups for now. So.52:51We should say the two groups Yep let's look at IAM. So if you have the IAM group, then we want you to match this and my profile for authorization is IM users and my SGT group. Let's go with the managers.53:07IAM managers and save this. So again, this is the simple configuration, just the basics, and what I will also like to do just so we get a lot of the details is let's enable debugs for ROPC rest ID store, so we come to operations.53:25Debug wizard and there are some profile configuration but again even if we come in here, we'll see how that is simple or oh Scott has a question. Scott the we're using Slido said there's a link in the chats at the beginning of the chat.53:43With a Slido link and the passcode as well. So yeah, the questions have been asked in Slido if you can find that please Scott. Thanks. All right, so let's come for rests rest ID store. And I really like this feature. We've had lots of tag cases where customers enable debugs on eyes and.54:01It just keeps running, but I like that now you can pick the debug setting. If you turn it to the debug, it's gonna tell you, hey, how long do you want those debugs to run? Again, I know you're not gonna be here for that long, but I'm just gonna set this to 2 h saying hey after 2 h turn off the debugs.54:21And that should come up here. Let's wait for it. Very good. So custom and it tells you, yeah, I've enabled debugs for rest ID star.log and iSPC.log, and that's gonna run through this time, so again, very, very good and also letting you know your disk space, so.54:37You can predict availability for your debug logs, so very, very good help there. And I think we're good for ICE on the GUI at the moment. Let us switch over to our PC if it hasn't gone to sleep.54:57All right. So this is gonna be our test PC and I'm not gonna go deep into this, but just some basic, this is probably oh probably make this a little bigger. 1st of all, let me just make this foncier bigger so it's not, you're not squainting to see, let's make this 16.55:19Okay, apply and let's restart the session. Yeah restart session. Yeah, I feel you I see that chat. Plenty of customers enabled. I know. All right, let's in as our CSS.55:37And here I'm just gonna go through the basic AAA configuration we have, you know, not in detail, that's not our focus for today, but let's just show this. I know some of you like to try this up in your own lab and and stuff as well. So just to give you an idea, what we have on your own looks like my.55:55Password wasn't correctly answered, there we go. So let's just do a show run for section triple A and just look at some of the basic comments we have. So again, your general AAA new model, your triple A server. Again, this is way more than you need. I have some other things going on in this lab, so that's why you see way more here.56:13So again, just some basic things.56:33And I will be on part zero seven, so show run for that interface as well. All right, so again, very simple basic setup for.1X So that is my switch configuration. Now let us look at the interface itself. Let's minimize this.56:36Let's come into control panel and I do have my two interfaces. So this is one without that one X and this is where we'll be going. So let's enable this and it might proceed to authenticate, but we'll just let that run for now. Okay, so good news. Successful authentication, well we'll come to those details in a minute.56:55Let's do, properties just to show you how the internet interface needs to be configured for EAPTTLS as well. So you have the options here for your normal EAPTLS or PEAP, in this case we are doing TLS, so we want to make sure that is enabled.57:15We want to come into settings, again certificate setting and all that is not a key priority here, but my CA was generated by this CA. And of course we talked about this a lot, app sends the.57:32Credentials in un encrypted format, which is why we need ETTLS to make sure that it goes through a secure tunnel. So again, that's why it's not a preference because we know with security today, we want to make sure it's encrypted in and out. So for this, it's plain on the inside it's encrypted through the tunnel or the tunnel itself is encrypted, so.57:49That's one thing to be mindful of. Something here as well, we want to make sure this is set to user authentication, and you know what, let me disable this. So if you watch, when I enabled the, the adapter, he didn't request my credentials.58:08Because I typed them a lot of times but now I'm just gonna cancel this. Delete credentials for all users but now yeah just so I can type it in for you. Yeah, I can leave it this way I think we'll be fine. If not, yeah, there we go. There we go. All right, so let me put in the credentials.58:24And the full domain and you have to watch all the typos. If not, we'll have to come back here to do it again. Yes, what do you want to come.58:46Connect.59:06Oh, something failed alright we'll come to that in a minute. Let me also enable the debugs. Let's have the debugs running. All right, so show login application. And if you don't remember the detail, you can just do include.59:08Rest or include our PC that will give you the path you need.59:27And now you can enter that. So let's till that and see what's going on. So arrow PC/rest, ID store, yeah that looks good. Let's do that log and actually let's just run it till.59:31Alright, good stuff. User authentication. So again, the one that failed, we'll probably put in something wrong. Yeah, invalid grant. Okay, we'll come to that. Let's see what's going on. Let's go over to ice. So live logs is always where we want to go to see what's going on.59:49All right. So again, we see the initial one authenticated successfully, and we can see the details here, ETTLS app with intra ID, yep matched our authentication, matched everything. Good, so this is good. All right, so authentication field for the other one, probably I typed something incorrectly. We'll come to that in a minute.01:00:06So this is what we want to see and if we look at the 1st one that was successful, let's get all those details.01:00:27Yeah, we set our policies, all the details with respect to the protocols, the method, the profile we pulled, which is everything we configured, that is very good. Something important is the AD group name. So this communicated with the intra ID application. It found the.01:00:33User Ethan and he said yeah Ethan was in the AD group IAM and that matched the policy we had which said hey the user is an IAM, and that's why we want to match for this authorization and we see the successful answer here as well. So we see ETTLS challenge.01:00:53We see that we picked the right intra ID store successful connection to that external store, that's very good. Again, letting us know plain text password authentication, was used. All right, alright, ok, so this looks good.01:01:09So let's go back to our endpoints and try to authenticate again. Let's see what we did wrong. So again, I have to disable and re enable, so let's give it a few seconds. And then when we enabled it should give us a pop up. And then we'll answer those credentials again. Let's see why authentication was failing, we probably.01:01:26You didn't type something right? Yeah, that should not worry. At, alright and our password.01:01:46Yes, connect. Alright, so that is looking good. We're probably figured one of the characters or the password earlier on. So let's look at the debugs or the successful one. So again, I'm gonna come to this, so let's pay attention to the.01:02:11This flow. We have our username which I answered in full so Ethan aunt.01:02:30At my full domain, we entered that, we put in our password which is blocked in this debug very important, so that's definitely good on the part of ICE. We have our client's ID, which is what we use to speak to the entry ID and we have the options to read.01:02:36We have all those details as well. I think someone found out what I typed wrong the 1st time. Thank you. So again, we see the user group call, we see our token was validated. We're able to get the group information and the writing is done. Great. Now, like I said, we wanted to keep it simple. So now the simple is working. We're authenticating successfully.01:02:54Week so now we can begin to tweak things yes, successful, so great.01:03:14Yeah, so we are happy, we have our security group. All right, this is this is basic stuff working. Now let's begin to break things around a little bit. Team walked us through, we have what 20 min ish? Yeah, that's good. So team gave us some details here during the presentation. Let's take a look at that. You know, let's let's use my.01:03:18Last year.01:03:38Now, so of course when we do the experts inside series, we try to show how things work and also some things you should be mindful of as you work and test. Let me start with this, the suffix. Now definitely I would prefer my users to just type their name or whatever username we've given them without having to type the entire domain.01:03:40So in an effort to make that easy, if we come in here, e.g., and we add.01:04:01The domain which is local.on Microsoft.com. Oops, that will be.com. So let's test our connection with that. Let's make sure we're still good. So that looks good.01:04:08If I save this, so what we expect this to do is when a user tries to authenticate, if they put in their username, so if an aunt in this scenario, ICE will add this suffix, so it becomes either aunt atlocal.on microsoft.com that.01:04:22Gets sent over to entry ID. Entry ID should be able to read that user and find the group and send all that detail to us. So that's what's supposed to happen. So I will show you two scenarios of what we do not expect to see and what we expect to see. So again, I'm gonna do this a couple of times today. So again, let's break the current.01:04:42Session, give it like two, 3 s to fully cut out. All right, let's enable it again. Now, I do not expect this to work because it's gonna overlap.01:05:02Because what we're gonna do, oh, I think it's saving, I don't want you to save. Let's come in here. I want to retype that I don't member the credential. So if I type the entire name.01:05:12With the domain, it should overlap. So we're gonna have like Ethan aunts at least on Microsoft.com@Microsoft.com. Come on, it's still saving those. Let me go in here and make a change.01:05:28So we said don't save. Yeah, let me bounce this session. I don't want it to save credentials. I want to type it myself so I can show you what I am explaining. Don't remember credentials, ok.01:05:48Let's disable this and try again. Yeah, because what we will notice in the debugs, so for a successful authentication, we will have the username like this, but if you oh ok so this is actually good. Yeah, so you said the overlap here, so we have it's an one act.01:06:07On Microsoft.com at so again this definitely was given problems, so this is actually good. This is what I was trying to show you. So again, we don't want that overlap happening. What we want to do is if you add the suffix, then when your users are trying to authenticate.01:06:25You want them to just add just the discipline which is. If they do everything it's gonna overlap, so Tim was mentioning this in the presentation, so this is something you should be mindful of.01:06:44So while you're in your testing phase, you know, do the suffix without your domain and with your domain and see what works. So that's one thing I I wanted to mention in the demo. All right, the next thing we're gonna do now is let us play with the attributes. Yeah, I know.01:06:54Let's leave this. We gonna do this in a second, so let me re enable it. All right, good. No, I'm looking at time, you know what? Let's save time. We'll come back to this. So let me cancel this. I know it's gonna fail, that's ok. We've passed the points across so let me remove this so we don't have any.01:07:10Issues in there and then we save this. Alright, so the other thing I want to add is, yeah, in some scenarios it's ok to have your policy set and say, hey, so long as you are in that group within entry ID, you know, that's all I need. But of course we know with ice, we know ICE can do a whole lot.01:07:29Lot more with respect to the conditions, you have an authorization.01:07:49So let's create something else that says, hey, alright, I want you to check the group. But apart from being in that group, I have IM users and I have IM managers, and I want to put the IM managers with a similar profile but in a different security group and I want to have ordinary IM users, but I don't want them to match this group if they are not managers, so.01:07:53Let's come over to enter ID and look at Ethan's detail. So this is one of our users. Ethan owns if we come in here, we'll see more details of his profile, let's come into properties. Alright, so we see the user principal name. This is becoming, this is gonna become very helpful next week and we talk about.01:08:13CLS authentication.01:08:33This is gonna be a very important part of that, but come back next week Thursday for that. Today, let's look at the other details on this user. So he's an identity and access security manager, that's important. Company name, we're gonna assume all the users in this demo work in the same company, so let's.01:08:35With that, office location. Yeah, ok, definitely they could be in different locations. In this case, this location is Miami, ok. What else do we have?01:08:55His account is enabled, let's see. Okay, I think that's something interesting we can definitely work with. So we have some more details about this user. So let's go back to ICE and say, hey, ICE, we have the basics working, but we want some other user attributes.01:09:04Within that rest ID store, so let's come in here and say user attributes. Again, there is a notification here. It requires premium license on the intra ID side. So if you want to use these attributes ensure that you have the adequate entra ID licenses.01:09:21So let's come in here and add a couple of those. Let's do job title, yeah. Manager, we want that. We want to make sure the account is enabled. The account is disabled and entry ID, we don't want to give them access on the network. Let's do office location for Miami.01:09:38What else do we need? Yeah, company name, yeah, let's just ignore that for now. Let's just go with this. I think these three should give us enough to play with. So job title, if the account is enabled on the office location. All right, let's say that.01:09:56Now, after we made these changes, I'm gonna run one more successful authentication, and this, I like to do a bit of reverse engineering when I'm setting in my authorization policy conditions. So if we come over to our policy set, let's use our bookmark.01:10:14Again, we haven't changed this. We're still leaving this as a just check the group only. But if we authenticate now, we should pull all that information let me see, I probably will leave this to.01:10:31Reauthenticate from the high side, but let's do it from here. All right, so let's authenticate successfully again. So Ethan and probably should have done a copy and paste for this, but let's just go with our typing today.01:10:48Yeah, looks good. Let's put in our password. Okay, so successful authentic authentication, and if we come back here, let me show you something interesting that has changed a little bit.01:11:08My debug, let me see if that's frozen, go up a little bit, my graph, yeah this to the default. Yeah, I probably need to restart the session.01:11:26Let me see, it's active, ok, because what you will see from the graph is even the call we are making now, I will ask some of those user attributes. So again, we'll come back to the debugs. I like to show all those details, so when you're troubleshooting, you know what to look out for. But let's come to live logs.01:11:42Alright, Let's authentication, and this is what I want to show you those attributes that we have set. So now we didn't have this in our previous authorization reports, but now because we have added these three user attributes, now it's still letting you know, hey.01:11:58The office location for this user is Miami. The job title is identity and accessibility manager, and the account is enabled. That is true. Now this helps because now that I know I am definitely pulling this information from intra ID, now I can do a reverse engineer and say, oh, ok, now I know that's gonna work. So.01:12:15I can definitely go back to my policy sets and say, NO alright I'm just checking the group. There are three other parameters I want to add to my authorization. So let's say new, come in here again remember, use this option.01:12:34Enter ID EIS and we should have those options yep so account is enabled. We want that to be true, let's add something else job title.01:12:52So again, we don't want to put the whole thing, we just say as long as the job title contains manager, that's sufficient. So manager, oops, that was not gonna work. And we add one more thing. So location, yeah, there was one more thing, now we added three. So let's.01:13:08Come in here and say, hey, office location.01:13:28Has to be Miami. All right, so three new attributes, which we've added saying alright, now we verified the group. We want all these other conditions to be true for us to actually give you a manager access. So let's save this, and this should work seamlessly because again we already tested it without. So all.01:13:31Since been equal, we should have a successful authentication.01:13:51And again, this eliminates a lot of the guesswork when you're setting things up. I've seen customers setting up tip and they go for everything right at the beginning, you know, chaining, user only authenticated, matching fill, and you spend hours troubleshooting, trying to find, figure out what's working, what's not working. Is it a user? Is it a device?01:13:54So just keep it simple at the beginning and then you can add the layers as you go. I can type while talking. Okay, alright. Almost there oh.01:14:14All right, so another successful authentication. Again, this is very good. Yeah, this is definitely frozen. Ok, maybe not alright so this is what I wanted to show you. So again, as you add those attributes and this helps when you're troubleshooting even with TAC on yourself with yourself or on your own.01:14:36Now you see even the call, ICE is now saying, hey, the call I am making over to Microsoft for the graph application, I'm also looking out for these details. So again, because these details are enabled on the entry ID side and I want to make that call, we are saying, hey, by the way, you know, these are some selected attributes that.01:14:54But I want to know as well. So that way.01:15:14My authorization will add that detail when we get the response from intra ID, so very important when you're troubleshooting. And as we see successful authentication, but let's just verify that again from our live logs successful. So again, that's good. I think I have time to show just one more thing I want to make sure we can take some questions at the end I'll probably.01:15:16Issue a bit of this.01:15:36I want to wrap this up in another 5 min so we can wrap things up. But one other thing that Tim mentioned, is you are not able to change or update your password via our PC. So even though I have users set up and I have the group set up and I say, hey, so long as you're in this group.01:15:37You know, ICE will read your information and you can authenticate. If we come in here and create a new user and let's do this quick because we are run out of time, let's pick an interesting one, you know, why not?01:15:57Let's go with Bruce. I know the guy called Bruce Wayne. Yeah. Display name are the same. Let's use our password auto generated. And let me keep this simple.01:16:09Let's go. All right, good enough. All right, let's create this user ok you know what, let's do something here real quick. Job tied too, we're just gonna say I am user. So again, it's not a manager.01:16:26And then let's also do the location, you know, let's say this guy's in Dallas, he's not in Miami, but the account is enabled. Yeah, ok. So let's review and create. Yeah, accounts is enabled is yes. Title location, create.01:16:42Alright, give it a few so and try it takes its time when you create a user or a group, give it a few. Yes, finishing that up. Okay, good. Now let's put this user in our IM group to make life easy. So all groups, I AM users, let's add a new user, add a.01:17:01You Member.01:17:21And there you are. All right, let's elect, and give it a few seconds and we'll refresh. All right, good. So this user is my IM group successfully added. We look good. So what you would expect is if I come over here.01:17:23Let me make sure my debugs are still running because that's gonna be very helpful here to see what I want to explain. Let's disable and try to authenticate with the Bruce Wayne credentials. And what I'm trying to explain here is when you create a user.01:17:43If that user does not update their password through one other means, you can authenticate successfully with for the 1st time. So that user needs to do one other login via a portal and actually choose a new password. If not, it's gonna fail, so.01:17:58Bruce, Wayne at local.Microsoft.com and let's put in that new password we created ourselves.01:18:15And we try to authenticate and yeah, authentication failed. And if we come in here, it's in it's funny what we'll see on ICE because it will actually tell you that the credential is expired. Yeah, so this is good. That's why I wanted the debugs running. So again, ICE is saying the password is expired.01:18:35Because that's what the response is getting from entry ID, but this is the user we literally just created, and that's because even though the user has been created successfully and he has a new password and that password authentication will not work the 1st time, you have to have that user, you know, log into a portal.01:18:52The user will get a prompt saying, hey, this is your password choose a new password, do that, and then you'll be able to get access. So again, we won't go through the entire flow, but let me just show you what that would look like here if I did sign in with a different user and I said, new account and we put in the bruce. So again, we won't do the entire flow because we run out of time.01:19:08But let me just show you what that prompts will look like. So when you get those issues just to know it's not a problem from ICE, you just need to have that user.com next. Yeah, let's put in the new password we created.01:19:28Yeah, so this is what I'm saying. So again, that user needs to update their password here. Let's just do this and we are gonna end this demo with that. So this is the old password and new password, let's do one here.01:19:51And do that again. Sign in. So we're not gonna go through the entire Microsoft authenticate off flow because it's gonna give us that prompt. But what I observed is even when I stop here and then went to ICE and I tried to authenticate it was successful. Let's see if we have a second to try.01:20:07Add a nut, and after this I am definitely handing it over so we can wrap this up. Fingers crossed, it's already ready let's go.01:20:27I just need to take some type in. All right, fingers crossed, this goes through. Oh, it still filled, ok, so I still need to do some details here. Yeah, but generally when you finish this user finish up that entity buildup, you will be able to authenticate successful with.01:20:50Alright alright let's leave it here. We run out of time. So guys, I'm gonna hand it over to you to wrap this up.01:21:10Thank you. Was that user from Miami? I think so. Or was was Bruce Wayne from New York. That may have been our issue there. Yeah to Dallas.01:21:18Alright, so yeah thanks thanks for a great demo there and some live troubleshooting, that's always great. Wanted to bring up, we do have the QR code at the bottom left.01:21:40Would be able to get you to our follow up Cisco community forum on this. Grant access to some follow up Q and A's that should be available for another ten days or so. We do have a few upcoming events in July. We don't have the one for next week listed on here, but registration is still open for that as well.01:21:55U.01:22:15Like we said, that will follow on with some deeper dives into additional authentication methods with entry ID for cloud based authentication. But our next series is gonna be focused on network segmentation foundations there, starting with traditional segmentation moving into trust sec, and then our segmentation integrations within.01:22:15We also have over on the right side a couple qrs for English and Spanish cyber capsules, short five to 10 min videos covering various topics on ICE, as well as the site I mentioned at the beginning of the presentation or.01:22:37CS.co/ice-beerg, for numerous configuration documents. I will leave this one on the screen for you. I can't see the Slido screen so I don't know if there were any outstanding questions anybody can see that can potentially be answered live.01:22:53When I looked before switching back over, it looked like everything had been covered Yeah I don't think there's anything outstanding. I see everything has replies. Okay.01:23:12Perfect. Well, again, we appreciate everyone's time today. I hope this was beneficial for you in setting the foundation of the the ICE and entra ID integrations, and we look forward to seeing you next week for the deeper dive and in our future sessions.01:23:30