Securing Access with ISE and Entra ID

Oh. Thank you for joining us today. We will be talking about ICE integrations during this expert insight series. We will have.00:00Have two sessions as part of this expert insight series. The 1st one, today's one is focused on securing access with ICE and enter ID. The next week we will be talking about MDM integration.00:20If you can go to the next slide Mohammed, please. Thank you. Throughout the whole session you will have a possibility to ask us the questions. A Q and A panel has moved from Webex.00:34To Slido so if you follow the steps highlighted on this screen, you should be able to see the Slido Q and A panel.00:53Please put your questions there. We have the panelists ready to answer those questions, make this interactive as interactive as possible. And let me introduce the team for today. Our presenters will be Mohammed and Derek and on panelists side we will have.01:01Farid, Jeffrey, Surrender and Henry.01:21And a quick peek into the agenda. Mohammed will start with the comparison between intra ID and Active directory, why we are moving towards entra ID and then Tarek will talk us through all the use cases possible use cases with. After the.01:26We'll have a break of 10 min?01:46So, you will have some time to freshen up and at the end of the session we will as well talk about some enhancements when it comes to entry ID in the latest is version 3.5. And without further ado, Mohammed floor is yours.01:48Thank you, Renaka. Today we will talk about intra ID and 1st thing we need to see the difference between intra ID versus active directory. And to do this we need 1st to explain why.02:10We are doing this session and why we focus on entry idea.02:30Many organizations currently are navigating the shift from traditional Active directory to intra ID as part of their cloud journey. During this migration.02:39You could still use both of them as Active Directory and intra ID, which we call a hybrid environment as the so as you can see as per our telemetry information, more than 75 of our customers are using the active Directory with ICE as exten.02:55ID store.03:15As we can see also in the figure in the left, over the last three to four years, intra ID adoption is increasing revenue, and we can see this in this figure in the left.03:17This number of is not an actual numbers. It's just what we have available as part of our telemetry. And as you know, not all customers are sending the telemetry for us.03:37However, we can see the trend itself. It's increasing. That's why we decided to share how ID and ICE work together. So before dividing sorry before diving into integration details, let's address a basic concept.03:53Intra ID is not simply traditional active directory implemented in the cloud. They are fundamentally different tools designed for different eras. So let's discover what's the difference between intra ID and Active directory.04:15Traditional active directory was built for corporate Windows devices around the perimeters and can be deployed on prem or hosted in the cloud. Admins can centrally manage Windows devices using.04:34Either group policy or SSCCM or both of them.04:53They focusing this correctly on company owned assets through a single joint pipe which is computer joint pipe. While in the other hand, intra ID is purely cloud solution.04:57And use this in in Tune to manage these devices. Intra ID supports not only Windows but as well they support Apple and android. And we will check this later. Also while traditional active.05:14Directory don't have the concept of personal devices or bring your own devices theory but in the other side intra ID has a solution to provide access to.05:33Company or organization resources using your personal devices. So we recognize here two types of devices or endpoints corporate or personal. That's why we have multiple joint type.05:52In intra ID and we will explain this right now. So let us zoom in these different joint types to understand how we, how intra ID categorized devices based on.06:08Ownership of the device and.06:28The policy management itself. An intra ID, there is something we call join the devices, which is a device managed by the organization, which is corporate device. It can be windows, or the majority is Windows, but.06:30It can also be Mac OS version three, a Mac oS version or above.06:50And some other Linux editions. You can manage software for these devices eh configuration and post profiles and changes using Intune to manage these devices.06:57Okay, and this is the corporate devices and use a joint type called joined devices. 2nd type is for personal devices. E.g., phones, tablets, other, personal devices.07:15They logged in using bring your own device concept. From the admin perspective, we don't want to manage these devices, but we still want to allow users to use these devices.07:35To connect to our resources, e.g., to connect to share point to office 3605, some corporate applications and so on. These personal devices can't be joined to our, program.07:54Or to our organization, but they will peer as a registered devices. 3rd type will be available for in hybrid environment for organization with existing active directory.08:12With some functionality of intra ID, so we can implement intra hybrid joint device. These devices can be joined to your on prem active directory and registered with intra ID. So you can use both of them. You can use.08:31Use policy or SSCCM for Active Directory and Intune to manage inter ID with these devices.08:51This multi joint flexibility allows us to balance security and usability across every user profile. So now let's break down the most common scenario we had with active directory.09:03Which is beep with MS version two. Okay, it started with negotiation between the end device and radio server.09:20For our eyes to create a tunnel, and we build the tunnel using ICE certificate. We will send inside this tunnel the hash of the password.09:36Which called NT hash or NTLM hash. It's not actual user password, it's it's a hash only and this is how NS job version two works. This password hash is sent to Active directory and compared with users password.09:53Good harsh.10:13On Active directory. If they match, the user will be allowed to enter the network and if not, it will block the two from entering to the network. Okay, let's now try to replace this to replace Active Directory with.10:14ID and try to use beep with MS version two as inner protocol with.10:34It will not work. Why? Let's explain. The 1st of all, intra ID doesn't support NTLM protocol, which we mentioned in the.10:43Previous slide, Active directory is comparing NT hash of password to authenticate users while inter ID doesn't support this NTLM protocol. So, if intra ID doesn't store or understand NT hashes, we can't use hash based.10:59And 2nd of all client side already blocks through the usage of password hash as well. That's a feature to call a credential guard enabled by default on Windows machine.11:20It won't allow to generate empty hashes in new or modern windows versions. Windows natively enabled credential card in modern versions, hence we have NO way.11:37Of making a beep version two working with from both sides, from client or endpoint side and also from inter ID itself. So.11:53Let's discuss the the the side by side protocol support between active directory and intra ID. We can see that there is a limitation of protocol support with intra ID.12:11We can either use ETTLS with using ROBC or use certificate based authentication ETLS or using ETLS insight.12:30Our OPC is a very specific protocol designed specifically for trusted client like Cisco is to authenticate on behalf of users. Microsoft usually discourage it's used due to several measured security and operational.12:50The drawbacks.13:09I will not go deeply in this. Our expert direct will cover this more in a later parts, ok? So before jumping into the main part, there is actual use cases with interrupt.13:12ID let's check couple of differences in terms of computer and user account in active directory versus an infra ID. Beyond the protocol mechanics.13:32The underlying object models in active directory and intra ID are fundamentally different. In Active directory, endpoints are traditional computer accounts, so they can be managed by via a group policy or SSCCM.13:50And identified by attributes like some account name, distinguishment name and object SID. While in intra ID, we don't have computer accounts. We have intra devices.14:09Which can be used and managed via Microsoft Intune. And the endpoints are defined by globally unify unique identifi identifier like GUID and device ID.14:27Also the user proparts are a little bit different While in active directory it uses the same account name or user principal name, intra ID, it uses object ID or user principle name.14:46And now let's trace how Cisco ICE has evolved over the recent releases to support and 3.0 we started by our.15:06A cloud integration where we could 1st deploy ice over Azure VMware cloud, Azure or VMware cloud, use intra ID for.1X using ETTLS and ROBC.15:26And also use and intra ID for all portals except admin portals. Then in 3.1, we added support for MDM version three to help and solve operational challenges like Mac random and.15:46And other issues. I'm not gonna spend much time on this since we will have a whole session about MDM integration in a week, in 13th of October, so feel free to join this session.16:07Additionally in 3.0 patch five and 3.1 batch three, we transitioned from legacy Azure Active Directory APIs to use modern Microsoft graph API support.16:29In 3.2 and above, we introduced native Azure deployment support directly from the marketplace. We also introduced them to authentication for IS admin portals now. We support now admin portals.16:50And enhanced ETLS and keep using protocol as ETLS for two.1X authentication. With these certificate based protocols, authentication, which is certificate validation is performed on ICE.17:09While the user and the machine group membership is queried from intra ID for authorization on IS. While this slide covered up through IS version 3.2.17:29Our expert product will walk through all the new features and enhancement in version 3.5 in our 3rd topic today. Looking at the real use cases, this session will focus on four.17:44Is that.18:041st, as a 1st one, we will cover authentication for both of them guest and admin. Next, we will cover our step, we will look into EPTLS and using ETLS.18:06As as the inner protocols authorization against ID. And 4th one.18:25Will be looking into Intune integration. Now that concludes my part of presentation. I'm handing off to Tarek, our expert who will cover 2nd topic intra ID integration use cases.18:33You can share your screen right now.18:55Just let me know if you will see my screen, please, and we can start. Yes, we can see. Perfect, thank you very much. Hey guys, so 1st of all, thanks for joining this tough session, to be honest, it is tough because here we are talking about intra ID, right? Not active directory.18:58No on prem active directory. So if we need to talk about on prem active directory, which is more than 20 years old in the market, so it's really easy to be implemented on prem and then everybody will of us will have his own lab, then it will be easy to test anything here.19:17But with intra ID because it's cloud services and subscription services, so it's not really easy to be tested and maybe not all of us, they have chance to work with the intra ID, this why this.19:37This webinar today is a little bit difficult. I will try to make it easier as much as possible. I will show you a lot of demos how we can make this integration between Cisco eyes and intra ID and we need to talk.19:50Little bit more about use cases and business use case, what the benefit from using this integration and how we can make this integration.20:09To make it easier, I will define I will classify those use cases into two use cases. One use cases will be used like for for portal authentications, web portal authentication using and 2nd use cases, they will be a.20:19About using.1X with network access, so we need to differentiate between web portal access and network access. So we will see some details about what I'm talking about.20:38So let's start with you know it's the security assertion markup language. It's used to, to make web portal authentication. This way, if you remember example, then, then you need to remember that's used to, to authenticate.20:50The login to any portal with eyes. We are talking about guest portal, sponsor guest portal, bring your own device portal or my device portal and even the GUI admin portal. So those portal can be protected and integrated with Azure or with intra ID using.21:10As an authentication protocol. Before we go in details about and we talk about ZAML, let us.21:30Check what the difference Between be honest, there is a big difference between both of them. Zaml its need access at the beginning to the internet or to the network, let's say. But this access should be limited.21:37To be protected. So it's a little bit strange, right? Because we need to use to let the user get access to the border, right? But at the beginning we need this user to get access to the maybe to to limited access of course to the intra ID to maybe also to this application.21:56Before authenticating this user. So this is the tricky part from need limited access before get authenticated. But with the.1X.22:16It's once this user get authenticated, he will get access to the network. He has NO access to the network before get authenticated from the network access control. So with that, once this user started to reach out to our portal, then he need to redirect it to the intra ID to enter his experience.22:29Then he will get access to the portal itself. But with.1X he has NO access before he authenticated, then he will get authorized.22:49So let's see the the flow from using against intra ID. Here's the flow that I have my devices and once this device is connected to my wire or wireless network access device then need to be redirected.22:59From the the Cisco eyes to provide the URL redirection to provide limited access. This is what we call that require limited access to the network and this the limitation will be provided using these redirections. Then once this user.23:20Start to browsing the applications and here we are talking about web application because in this case the user, let assume that he need to access the admin give it from ice. Or maybe this user need to access the sponsor guest board or bring your own device portal, any web portal. If this portal brows.23:38Detected with intra ID for the authentication, then.23:58There there is another redirection that the user will, the user will be redirected to the IDB identity portals and here we are talking about intra ID. Then he will get authenticated. Most likely Microsoft started to enforce the multi factor authentications, then he needs.24:02Need to make 2nd factor authentications once get authenticated, then intra ID will return back to the cisco eyes, the assertion user and group attributes based on the those attributes, we will build our policy to make the authorizations. So.24:22Then the authentication happening here in intra ID and the authorization happens here in Cisco is based on the return back attribute from entry ID using. Let me show you here in a demo how this going to be work.24:42So I have recording to define this integration between my Cisco eyes and so before we get started with this demo, just I need to, to let you know that we have two locations that we can integrate.25:01Intra ID with Cisco eyes and you need to differentiate between both two locations. So the 1st location that from the external identity sources from this place we can define that I need to integrate with my active directory on prem active directory. Or if I have LDAP or ODBC, then I can also make integration with.25:18My Oracle database using ODBC from the same place I have two locations to integrate my intra ID. The 1st one to be used with that means I need to, to protect my web portal, sponsor portal, guest portal or maybe also the GUI of the.25:38So in this case I need to go to the ID provider. But later on I will show you some cases. We need to to make network access protections against sorry against intra ID. In this case I will go with the rest ID store from here.26:00So let's start with ID provider with this case. So here I will show you how we can protect our guest portal using with integration with intra ID. 1st of all, I need to provide a name for this integrations. I will call it intra ZAML.26:16For guest, then this is the name. Once I have this name, before going with the details about this configuration, then I go to my portal and here we are talking about guest portal, then I go to my guest portal from guest portal.26:34The 1st thing I need, check this is a login, it means there is NO it's used. I need to change the authentication method to be intra XAMML guest the same one I just created, and this case will change to the single sign on. You need to know that single sign on it's going to be used once we are using.26:50Then I need to go to the details and to complete this configuration from the identity provider. Before going deeply with that, also there's some terminologies that you need to be aware about and once we are talking about ZAML. The 1st terminology.27:12Is the identity provider. So we have identity provider, we have service provider. So identity providers where this is the place where we have the accounts, user and the group account. And in this case, we are talking about intra ID, of course, right? So in this case, anything need to be entered here, this need to be.27:31Come from the intra ID. So in this case I need to go the intra ID to bring the XML configuration and add it here.27:51So this place where we can define where's our entry ID, what the URL used for single sign on and here we will get also the certificate used to authenticate us against entry ID. With the service provider tab here, this is you know service provider tab, it means the application itself we are using to protect this application.27:58With entry ID. In this case here.28:19What we will have here, so service provider will be considered as a portal. That means our eyes will be the service provider. In this case, from here we can take the information, this way you can see here info. It means that from here we can take the information, the URL, the certificates needed to to make this integration, we take this configuration.28:22And information from here and go to the intra ID to to to provide this information to intra to intra ID. Let's see that in details.28:42So here is the information I need to take it, then I can click into export. I will get this, everything needed to make this integration. It will be exported from from I'm talking about from eyes itself, so if I show you this file, then we have three information.28:51Exists in this file, the the most important pre information. The 1st one entity ID, this URL is needed to make this integration and 2nd one is the reply URL will show you how we take it and we'll provide it here in the summit. Now, look now we have, here we are.29:11At the intra ID platforms, ok? And maybe here's the difficulties, right? Because maybe not all of us we are using intra ID daily basis and this why little bit this will be here difficult for the the some of the guys they don't have access to intra ID.29:31Directly or with the daily basis. So I will assume here that I already have the enterprise application created in my intra ID, but I have another demo to show you how can I create this enterprise application to be used with integrations, ok? So 1st, now I will assume that this application already exist.29:51And I have it and it's called ZAML IDB and then.30:11With this application, I have everything that's needed here. I have the users and the group already associated, I have three groups here, Cisco employees guests and each group has multiple user account inside it and we have a single sign on already enabled for this application and here you need to be careful that single sign on.30:16It's need to be enabled with the application used for them, but this single sign on doesn't, it's not needed once I need to create.30:36And applications to use with.1x. Okay, so don't mix between both. So we have two different type of application created in intra ID, so the 1st application I will use it for ZAML, but maybe later on I will show you that I can create another application to not be used with ZAML, so in this case I don't need single sign on.30:45To be enabled on it with that, then I will show you how can make this integration with that. But right now, as long as we are talking about ZAML, then we need single sign on to be enabled.31:05From single sign on, here I will enter those URL and those URL if you remember, those were taken from the eyes itself once we exported the XML file, then we have two URLs. The one is entity idea and 2nd one is reply URL. So.31:16Those two required URL once you have it then, then I need to make sure that.31:35Every attributes and the claims they are exist here. So those attributes I will need to use them to make the authorization at the end. And I will focus into this one groups and you need to see what the claim name's here because I need the exactly claim names here to be mapped in.31:40In my eyes once I need to, to, to create my groups and this is the value of this claim names. So this is what will be returned in the assertion inside this response to be returned back to ice. So in this case, android return back to eyes that the group of this user will.32:00Will be, this is the claim and this is the value. Then we'll provide all the group membership for the user. Then ICE will be able to use those groups in the authorization to make the authorization, the policies.32:20And then I can download the configuration from here. Those configurations, the the certificate and the URL it's needed from Cisco eyes to build this integration. And again, look, we have two tabs, very important tabs. The 1st one identity provider.com.32:35Where I need to bring the configuration from intra ID and I need to to import them here to Cisco's guys will will be aware about which URL used for for single sign on and also will be aware about the certificate needed to authenticate against intra ID. But the service provider information, this.32:56Because service providers consider like application and application in this case and in this scenario will consider.33:15Cisco eyes itself, the portal exists in Cisco eyes, then I will take the information from here and go with this information to complete this integration. I hope this is really clear because this terminology, if it's.33:22For somebody's new with these technologies with it will be really difficult to, to follow and understand those. Then I need to bring groups and I have, if you remember that we have three groups already with this. So I will need to look the employee group. I need to assign employee permission to to enter into this.33:39Portal. In this case I am interested with the object ID and this is something also you need to be aware that I'm not using group name from the from the intra ID I am using the object ID because this is what will be returning in the assertion in the ZAML itself. But.34:00With the name in eyes I can enter any name I needed to be helpful and to be, you know.34:19And to provide you meaning once you need to follow and to troubleshoot. The things you need to be also noticed here that I entered the group membership attribute, and this group membership attributes need to be entered the same name of the claims returned back from so you need to go back to the attribute.34:25From attribute and claim from the application from intra ID to see what the name of this group and it need to be also case sensitive. So here need to be in to the groups, the same case sensitive how it's located in SAML.34:46Then also I can use some maybe user attribute with my authorizations as well. Then you can check if there is attribute attributes for this user interesting you, then you can take this attribute and everything I am talking about from single sign on, right? From here we talk the, the, the configuration.35:03And we provide the integration configuration from eyes as well and here we have attribute and the claim, then I have the claim name also here. You see that it is the claim name itself department. Then I make a department. This is the name in assertion and it will match the department the same name in eyes.35:23But with the group it's not the same. So the group, we have object ID to be returned, then I need to map the object ID with the name and that's all from the integration, then I will have my policy. I need to create these policies to match this.35:41With with the SAML ID, then I have 1st policy here. Then the one below here, this will redirect anybody connected if I don't know to which group he's belong because here I am just checking if he's connecting to wire or wireless using Mac address bypass, then he will get re.36:00Directed to the.36:19Guest DAML in this case as long as we have a guest configured to be authenticated against the intra ID, then it will be redirected to ID. Then the one above, and it's this need to be above, I will create one authorization rule to be with the employee's ZAML.36:21And here I can check the.36:41The group membership, so then I can identify that the dictionary will be my zaml guest and then I need to check the group, external group and if this belong to employee, and remember that we already make mapping for employees, then I can use it and to provide the.36:44Suitable profile and the correct security group in this case guest, e.g., then we can test. So let's make a test for this. If you notice that we don't talk anything about the the authentication rule because the authentication will happen from the portal itself.37:05So the portal, we said that the authentication need to be against.37:24ZAML ID, then it will be to the, it will redirect you to Microsoft or intra ID to enter the the inter ID credential username and password once authenticated, then ZAML will return back the employee in the assertion for the XML.37:29Then based on that, this group, based on the my authorization policies, then it will get access to guest and then you have access to the internet.37:49And if you check the life logs, you will see that the user already, this is the username and this is the authorization was provided the authorization profile was guest access and this is the user account was provided.38:02I will show you another example, but in this case I will, I will make a protection for the eyes admin gateway itself with so and here also I will show you how to create this application in intra ID. So it will have little bit.38:20A different information about the the the 1st demo. So at the beginning we need to, to go to create the provider. And let me ask here one question. So we already, if I return back little bit, ok? Guys, we have already here created intra zaml guest, right? And now.38:40I need to use another.39:00IDB to to authenticate the user once they need to log into my eyes admin GUI. Do we need to create another identity provider or we can use this provider? This is really tricky questions because.39:03And let's go to the Active directory. I have already joined point here, right? For the Active directory. And I can use this active Directory join point to authenticate users once they need to log in e.g. to Cisco eyes against the Active Directory user and computer, right? Okay, against active Directory with the credentials.39:21And also I can use the same join point with Active directory to authenticate the users when they need to enter or to access our network. So I don't need to create.39:41Another join bone to the same active directory to authenticate both use cases, the 1st use case to enter to the eyes to manage eyes and 2nd case to to control the user accessing the network access. But without is something different. I do need really to create.39:54Yet another provider because if you remember that we have some URL here, right? And I take URL and this URL could be different, especially the reply URL. It could be not the same reply URL once I need to return back to, to this.40:14Identity provider. This number one, number two, the the the groups itself, what I have matched here, it could be not the same group I need to use them for to access my eyes admin. This why I will create another.40:34You go to the entry ID and in this case, I will use this to to authenticate against my GUI admin portal. For that, once I created this name, I go to the admin access from here, I need to provide this. This is the authentic.40:53This is the identities store.41:12Will be Zamil Zamil admin. Once this done, then I need the same what we did, with the guest access for the portal with the guest, then I need to do the same. I need to return back again to the external identity source and.41:14Again, I will remind you that we have two very important tabs here. The one is service provider information. From here I need to take the information and go to the to prove to make this integration and 2nd one, the identity provider where I bring information from to add it here to make this.41:31Relation works. So let's start from service provider.41:51I will make export for this XML file. Inside this file, I will see two very important URL. The 1st one is entity ID and 2nd one is the reply URL. I will show you them here.41:55So those they are two URL, I will make a copy for this URL, then I will return back to make copy for the reply URL once it's needed from. Then from here I will assume that I don't have, let me return back little bit here.42:17Guys now I don't have any enterprise application to be used with with admin portal authentications. So with that I need to create this enterprise application. So I will enter the name for this enterprise application.42:35And then I need to provide all the information I have seen in the 1st demo. So I need to provide what the users and the group will be associated for this application. I need to enable SAML. You remember that we need to enable single sign on with this application to be used at the application? This is the important.42:50And so with that here, this application just created, then I need to assign some groups to these applications. So I will have employee group to be at this in this to be associated here.43:12You need to be aware that this group is already exists, right? I just make association between this group and my application. And then I need to enable the single sign on because this application need to be used with ZAML, so I enable.43:27Single sign on here and then from single sign on, I need to enter this entity ID. I already made a copy for that. And then 2nd URL, this is the reply URL which is really important URL where, where intra ID need to to return back the, all the attributes.43:43And group membership in this URL here.44:03Once we have it, then we need also to look at what we have here from attributes and the claims. If you look at these attributes here, we don't have a group membership. This is why I need to, to add the security group to be attribute to return back to, to through the SAML and be careful.44:08All about the.44:28Name name here. This time it's not the same the 1st demo. The 1st demo was just the name groups, but here the URL, the complete name here, I need to make a copy because I need it once I create this in Cisco eyes. Then I will download this certificate and all the configuration needed.44:30From cisco eyes and then from eyes I will import this configuration here. Of course I will get the URL and the certificate needed to.44:49To make this integration, then we'll build the group mappings map between eyes and inside. And look at this. This is the claims name I have copied from, from intra ID.44:59In the 1st demo, it was different name. It was just groups, so you need to be here, really careful and identical. What the name we are using in intra ID, you need to be used the same name here once we need to create this group association between eyes and intra ID. Then.45:15I need the name in assertions and here's the idea that with groups, there is object ID. Then I go to.45:35So intra ID to look which group I need. I need employees to be authenticated and to provide them permission to go to Cisco eyes webgy. Then I go to this group and I take the object ID from this group. This is the object ID. Then I enter the object ID here, then I need to map.45:44But now if the user belongs to employee in group in intra ID, then I will provide him super admin permission. So I will add him into this admin group, which is super admin. It means any employee would make NO sense, of course. So any employee now in intra.46:04Already he will have full access to Cisco ICE.46:24So I will make save, now we need to make test.46:29Let us start the the browser in in a private window to to make sure that we don't have any cache or any problem with the cache. And I just wanted to show you that once you enable ZAML to be the identity provider for the admin, then you will have login with here, ok?46:49So this buttons will appear once you have the entered in as as the authentication source here.47:09So click into that, you will be redirected to Azure to make your to intra ID, sorry, to make your login and authentications, so you will enter your intra ID credential, username and password. If you are a member of employee inside intra ID, and this will.47:17Be returned back to eyes, then eyes will will consider you as a super admin, then you will have full administration into this GUI admin GUI, so you will see that you will have full access here.47:36And as long as we are talking about, you know, single sign on, that means if you logged out and I am using private window here then and and you logged in again, you will not be asked again to enter a credential because of the single sign on here.47:52So this is the idea from using with authenticating and we have seen that you can protecting, you can protect your web portals regardless which portal you are using from Cisco eyes, mostly all the portals. They can be protected using and also.48:09The admin access admin access using. Now we we need to go to different type of use cases.48:29Well, we talk about the web, but now we need to talk about the securex network access and with network access here, we are switching from to.1X, right? 802.1 X And in this case we need to little bit focus into EAP.48:37And we have two methods here. Either we can use the credential, username and password or we use a certificate, ok? So let's start with the 1st one, 1st use case, that if the the customer need to protect the network access.48:58With.1X but using username and password. If this is the scenario, then the only method we have is using password authentication protocol. Why? Because as explained earlier by Mohammed, he said that Microsoft chat version two is.49:16Not support from intra ID.49:36In this case, protected E is not going to work with intra ID, so the only method that I can use if the requirement is to authenticate the user once you need to connect to my network against the intra ID with username and password, the only one method remember that it.49:38Will be PAP password authentication protocol. This will allow us to authenticate the user based on the, the, the credential username and password against intra ID.49:57With that, we need this technologies here. You know from the name it's looked like really difficult and complicated technology, but let let us make it really easy. So this is EAP extensive authentication protocol and we will use tunnel TLS, you know TLS it's the same protocol used from HTTPS.50:09Transport layer security. Then I need to use tunnel.50:29To to 1st of all, I need to create a tunnel to cisco eyes and then inside this tunnel I need to use the authentication method inside this tunnel to be password authentication protocol. So in this case, ok? But in another scenario, maybe I don't need to use a bab. I can use.50:34EAPTLS. So in this case I need to send inside the certificate or anything else. But here we would will need to to focus into why why because Azure doesn't accept or Android doesn't accept Microsoft chat version two, and for for user credentials need to be with.50:54Password authentication protocol. This method in in an intra ID, it will be called ROBC resource owner password credential. So with that, if we need to implement this technology from Cisco eyes, you will never see something related to ROBC.51:14The ROBC need to be enabled from intra ID, but from Cisco eyes you need to work with this technology with EPTTLS, with that. So let's get started with with ROBC. You know ROBC it's defined with O of two with the this RFC reference.51:33Four comments.51:536749 and you will see here all the details about ROBC. The most important thing that you need to know about ROBC, it is password based. It means NO certificate, NO hash can be sent inside this authentication technologies. It's need to be used.51:55With the password based. And this is one limitation, right? Because this is considered like insecure technologies and the password, something is that this password cannot be changed. So password change is not supported.52:15And also some, another limitation that Microsoft from intra ID doesn't accept the MFC, doesn't support MFC with ROBC. So the multi factor classification multi factor sorry multi factor authentication is not going to be working with ROBC. There is NO two factor authentication with ROBC.52:32This is something also need to be considered. This is why Microsoft started to tell that using ROBC it's not something recommended. So please follow any new design, avoid to use ROBC.52:52But why we have it here in our webinars? Because now this is the only method that you will have it to authenticate the user against inter ID with user name and password. So this one and this also by the way, the 1st technology was added from Cisco eyes and as my.53:05Explain this was added once we started ice 3.0. So this is really all technology. Then we started to move from AUTOBC to be used with the certificate, then I will show you later how we can use the certificate with that.53:25Okay, let's see this in little bit the workflow for that. So let's see the flow for the ROBC how it works with my device endpoint will start the session, and here we are.53:42Talking about Eb by the way, so this is right? So once he started to to with the network X device, then the tunnel will be start to establish and this tunnel will be established using the EB.54:01Eyes certificate, so you know that ICE has Eve certificate here, then the client need to trust this Eve certificate and then it will be created. The the tunnel will be created using this EB certificate from ICE. Inside this tunnel, the client will start to send his credential. This will.54:16Why this technology considered somehow it's it's secure because even we are sending the which is clear text password, but still this password sent inside this encrypted tunnel, right?54:36Then I need to read this password because he need to send this user credential, username and password to intra ID, then intra ID to need to make this authentication and this is the only one method that intra ID will be able to make this authentication here because we.54:52We are sending the password in clear text inside the HTTPS bost request, then I intra ID will authenticate the user and check what which groups and attributes belong to this group user, then we'll return back those groups and through to Cisco eyes, then ICE will be able.55:12To make the authorization and return back.55:32Let's see this in action. 1st of all, let me start from intra ID and here I will assume I don't have anything with intra ID, so I need to create this application. And if you remember, if we need to differentiate between the application used for zamin.55:35And the application used for or or the application I need to use it now for network access with we started from enterprise application, we created an enterprise application and we enabled single sign on here. But here I don't need to go with the enterprise application to enable single sign on. I.55:54We will make application registration, ok? And once we make this registrations.56:14I provide a name and from this name, from this application once we create this application, you will have the, the.56:21The client ID and the tenant ID needed to make this integration between ICE and the inside. So we need to make a copy for those IDs. We will use it later on once we need to create the integration from Cisco eyes. And.56:39Now I need to enable the ROBC and this is very important point. So be careful that once you created the application inside the intra ID, the ROBC is not enabled by default. It need to be enabled because Microsoft supposed that you will not be able you are going to avoid using ROBC based on.56:56In the the limitation we talk about it that need password and clear text to be sent. So this why.57:16It's not enabled by default. Then I need to provide the certificate to to my application here, to intra ID application. Okay, the question now, which certificate I need to provide to to intra ID? This is the, the, the, just the public key. This is not.57:23Going to be with the private key anything. This is the public key that this certificate, the CA certificate which provide the EB eyes certificate. So this is certificate trusted from Cisco eyes and this certificate, the the CA certificate, the CA which generated.57:41The EB certificate which is used from Cisco is it need to be trusted from intra ID as well. So I will provide the root CA.58:00Here, if it's self signed, then this is the self signed from Cisco eyes and another thing and this is something different from the application used with and this application used with, with the.1X that this application need to provide API permission.58:08And be careful about which permission I need to provide. I need to provide group read all permission. So group group read all permission need to be provided for this because eyes need permission to read the group membership for all the users they are need to to authenticate.58:28From intra ID. And once this authenticated, then I have this application here and then we'll start to associate users and group. I don't have any users and group associated with that. I will associate.58:48E.g. employee group to be added into this application. Again, the group they are already exist, right? So I will add also contractors, so just I make association between those group and this application and maybe if needed, I can also add guests. If you look at these groups.59:05Most of those groups they have some user inside them. So e.g. employees, I can see that I have five users here and one of the user I need to test with that is already exists in employees in contractors, I have also have some user inside this group.59:25Well in this case we are good and we are done from the intra ID. So let's now go to the eyes and to see how we can make this integration with the intra ID and be aware that we have two locations that we can make integration with intra ID, right? The 1st one's and we have seen how we can.59:43Yet the integration between ICE and IDV. But now we we are talking about.1X authentication, right? So network access authentication. In this case, we are going to go to rest.01:00:03ID store. So from rest ID store I will create this integration and look at the what we have here. So with the rest ID store, by the way, this eyes eyes version 3.3 or maybe 3.4, it's not 3.5 because once we are going to talk about I3 .5 with the new feature.01:00:17With the new feature we we have been added with the is 3.5 you will see more tabs here, especially the tabs related to the device. We'll talk about that later, but here and this also it's good to mention here that we have a limitation here once we create the integration between.01:00:37Cisco eyes and intra ID that any groups you need to bring here and user attribute, those are users group and user attribute. Nothing related to the device.01:00:57Nothing related to the computer itself. Those related to only users inside the intra ID, which groups this user belong to then and also what the attribute used for these users, ok? But in 3.5, we have added the possibility that you can make authorized.01:01:08For device, we will talk about it later on. So let's continue to create this integration between Cisco eyes and intra ID. I need to specify that the identity provider will be Microsoft intra ID, and then I need to enter the client ID and tenant ID.01:01:28And now the secret here, this is something also tricky that the secret does not exist by default. You need to create this secret. So you need to go to the secret answer certificate and secret from here you need to create this secret. And once you need to create a secret, there is expired date for the secret for more security.01:01:47Then you will copy this secret and add it here. This secret like a password to associate this eyes with this application.01:02:07So now the integration works and, and test is working fine, then I need to make the to bring the groups to which groups I need to retrieve from intra ID. So those the complete group from.01:02:16Complete list from intra ID. But if you remember that I have only three groups associated with my application, this why also I need to be specific which groups they are associated with my applications. And here I can bring all user attributes in my, integration.01:02:34The integration now is done, so now Cisco eyes and Microsoft Interide is integrated. Let's see how we can build the policy and authenticate user based on the ROBC.01:02:55Again, don't forget that we are talking about ROBC, right? This is my policy and I need to be really little bit specific to which traffic it's matching here then to to to be with the the correct policy set.01:03:12And here I need to show you the authentication policy, right? And this is really important because you remember that I have created the rest ID store in in last step and rest ID store it was called with intra rest. This why I need to use this integration name, the intra.01:03:28ID store name which I created in the last step, to be the my identity store here.01:03:49So in this case, I need to authenticate the user. Once the user came with using TTLS protocol, that's why I said ok if then I need to send the credential, the, the using protocols to the intra ID using this integration.01:03:55And this is the only method that I can use it as intra ID here as identity stores. Don't forget because if we need to go further and to check the certificate, you will see that the certificate is not going to be sent to the interid to make the authentication there. The authentication will be done in.01:04:15Why this is this why I will, if I need to switch the certificate with EAPTLS instead EAPTTLS, in this case I am going to to provide something else here. I need to provide the certificate authentication profile instead of the intra ID store here.01:04:36This is something good to to mention and you need to remember this. This is the method that I can use it and it's ok if I'm using the ROBC, which is using EAPTLS with the case. So here you can check the the authorization.01:04:55That if I am using the e tunnel which is EBTTLS, then, and the external group, that means I am doing now here authorization based on the external group and I have employees here contractors, and if needed I can add a guest, then I provide the, the required permissions here.01:05:15Based on the authorization profile and that's all. We can test then once you enable your from And this is good point to mention that sorry I need to mention here that from Microsoft cloud.01:05:35You can natively enable EAPTLS so you don't need to install any.1X capable any any secure client or whatever. So here you can use EAPTLS directly from from native Microsoft.01:05:55And you can specify that I need to authenticate users here. Then once you wanted to make connect, you will be prompted to enter your credentials. This credential need to be checked against Active Directory from sorry from intra ID.01:06:10Not from eyes, then once this user exists and authenticated and belong to employees, then he will get access based on the policy with that. Okay guys, let's make like 10 min break, then we can continue to, to show you still I have a lot of.01:06:26Demos I need to show you a little bit more details about the integration use cases, so let's be focused and return back in 10 min guys just to grab some coffees and make a rest. See you later.01:06:43Okay team, I hope that everybody is back now, so we still have a lot to cover, so.01:07:13We need to get started yeah before our break, just to remind you that what we did, so before our break that we we make the we made the integration between eyes and intra ID using the, the rest ID.01:07:211st because we wanted to use.1X instead of the 1st use cases we we started with that.01:07:41And the use cases we did that we wanted to authenticate the user based on the intra ID, authentication. So that means we need to send the username and password, but now we need to to use a certificate because of the limitation and security concern with using ROBC.01:07:49Then we need to to start to look in another solution and this new solutions was added with ice 3.2. The 1st one ROBC integration was added with 3.0. This one was added with 3.2, so now we started to use.01:08:09Is the certificate.01:08:29With the eyes and intra ID integration, let's see that in flow. So let's see about EAP TLS, ok, against intra ID. So we have device will start the negotiation with device. Then eyes will start to send the server certificate which is used for EAP authentication.01:08:30Keep authentication certificate and then the client need to send his certificate and from the client certificate, will eyes will be able to make the authentications and be careful. Here the authentication is local in ICE, not in intra ID. This is the big difference between both, right?01:08:51With bad password authentication protocol, the authentication was sent to Android. Android was doing this.01:09:11This authentication, but here the authentication is going to be on eyes itself. So eyes will start to look at the certificate as trusted and then based on that, he will get the the subject from the subject alternative name.01:09:18Or from the subject itself, the common name, then he will send the common name to the intra ID just to bring the, not for the authentication, ok? This is just to, to check which group this common name belong to and which attribute this attribute will be returned back to the cisco eyes.01:09:36Nice will be able to make authorization based on those group return back. This is for Tip.01:09:56And the inner method will be EAPTLS. It's almost the same, but instead that we, the client is sending the certificate directly to the client to this cisco eyes, then we will have tunnel created between the client. So this is the endpoint will start to to make negotiation, then.01:10:06The the tunnel will be created using the the server certificate as always with the heap server certificate and the client will be able to send the certificate inside this tunnel. So this is the client certificate. Again, Cisco eyes will do the same. You will will be able to read the common name.01:10:25And go to intra ID to check which groups interviewed belong to this common name and then make the authorization. Again, this authentication happened into this eyes, so with that once why is this important because if you need to build your your policy from Cisco eyes, in this case the identity.01:10:44Store will be the certificate authentication profile, not the intra ID identities. So this need to be careful about that. Only that I can use the intra ID as identity stores if I'm just using ROBC from intra ID or the Bab from Cisco ICE.01:11:04Let me show you how we can enable or can work with TLS. So once we are talking about EAPTLS, right? We will have a certificate. So let's see the certificate used from this user. So I have, I have this certificate used for this user.01:11:24And let's check, of course it need to be provided from the trusted certificate authority and I need to make sure that root and subordinate certificate authority, the complete chain to be exist untrusted. Then I need to see what we have in subject and what we have in subject alternative name. So and I need to focus a little bit here in some.01:11:40Look at the subject alternative name. Here we have a global unique idea and this will be used later on once I have need, if I wanted to to add Intune be to to to to check the compliance status from this endpoint.01:12:01In this case I will use also global unique ID, but now it's fine, I will not use it and I will look at the principle name here and you can see Intune at domain name.on microsoft.com, which is really important and this name.01:12:16This username, it will be authenticated based local. Of course, the authentication here it will be going just based on the certificate. This why if you sorry if you look at the, the, the authentication policy, this is the authentication policy and here I need to check.01:12:35If the client is using the as authentication, the EAP authentication method, and I need to check the cab, the certificate authentication profile.01:12:55To check the subject alternative name in this case, I'm not using the the integration, the the intra ID identity is here as as identity store because I said the authentication will be happened locally in Cisco eyes. This is something important to mention once we need to to enablers with intra ID.01:13:05So the intra ID will be used here just for the authorization. How we make the authorization here as you can see that I have two policies. So the 1st policy I need to check the external groups from the intra ID from rest of the intra rest. This is the the the integration we created before this. And if this.01:13:24User belongs to contractor, then he will get contractor restricted access. But if he belongs to employees, then he will get employees access with that. Let's see.01:13:44Oh, you will make disable enable again for the user to to get authentication triggered, then the the the computer will start to send the certificate.01:13:55To authenticate against cisco eyes then authorize against intra ID. With that you will see that this getting authorized as employees. And here you can see the username was taken from subject alternative name. If you asking me, ok, why it's taken from subject not from the.01:14:15Subject itself because of the certificate authentication profile, it's designed that I need to go to the subject, not sorry to to to subject alternative name, not to subject. That's why I'm reading the username from subject alternative name. And here you can see all the properties of the certificate here. So you can see that this is this.01:14:34Common name from the subject, but the the this is the global unique ID which which we need to use it once we need to integrate with Intune and here's some other attribute used with the certificate. Okay, 2nd things that we can use it with the intra ID integration, the team with the chaining.01:14:53So again, look, we have three methods with the certificate we can use with integration with the intra ID. The 1st one TLS, without eap, ok? EAP TLS, that means the client need to send the certificate and ICE will make the authentication based on this certificate.01:15:13And 2nd one was but without chaining, ok? So without chaining it means that the client the same but the client need to send the certificate inside the tunnel, ok? So client send the certificate inside the tunnel to provide more security.01:15:30Now, we are going to talk about chaining. Why we do need chaining? Because with Microsoft, with Windows, the two things between computer and user authentication, they are not same. They are different. The computer's authentication will start when the computer boot up and started. But with the user.01:15:47Because when the user logged in or make any network associations, he will make the user authentication. So they are both not same. So we can authenticate user and we can authenticate the computer as well.01:16:07And with Cisco eyes, the good thing that we can check all the the scenarios if the machine get authenticated but user not or if the user get authenticated but machine not or both they are get authenticated. With each use case here you can define what you need to do as authorization result in.01:16:21This case, right?01:16:41And good to mention that team itself, it's already native with the Windows Ten and Windows eleven. So you don't need to install any extra 3rd party client to make the working with Microsoft. It's already, we have it here. You can enable with the native.01:16:42Dot one X applicant.01:17:03But we have another technologies from Cisco to make a chaining which called fast, right? So with fast, you do need to install Cisco security client with the network access module to be enabled or be running to to let you know, to let you use those two computer and.01:17:05User authentication with IP.01:17:25And let's see the the this with the chaining how we authenticate and authorize those in the flow. 1st of all once the computer started and booted, then he will start to make the authentication and this authentication will be based on the certificate.01:17:28Get against.01:17:48Localized, not against entry ID. We agreed about this point, then the result will be like user not authenticated because still the user didn't log in and but the machine authenticated and succeeded because the machine already sent their certificate and all is fine. Then once the user start to log in, once he entered the credential and.01:17:50Logged in, then the certificate of this user will be sent because here we are talking about TLS, right? Then the is will start to check the certificate and if the certificate is valid and authenticated, in this case the result will be user and machine both they are authenticated. Then we will try to check what they use.01:18:10User belong, which groups here, what the attribute has against intra ID.01:18:30And be careful that we didn't do this for the computer. Why? Because the computer is not able to authorize the computer against before I3 .5. There is NO computer authorization. Only we have user authorization. That's why the authorization happen after.01:18:35Start the user logged in and the user succeeded with authentication. Then we can make the authorization to bring the groups and the attribute belongs to the user, not to the computer, and we can make this authorization. Let me show you this in small demo.01:18:55So now we are talking about, about chaining, right? So computer and user. This why I'm using here Windows eleven and I have two certificates, one for computer and another one for the user, and you can see what I'm using here a subject name, not subject internative name, so you can select.01:19:11What you need to use from the certificate subject or subject alternative name. I have a common name inside the subject. I will use those.01:19:30Name common name inside the subject, then I need to make sure that team is enabled and I need to make sure that user or computer locations enabled here and then I have the the primary and secondary authentication method will be TLS, then we are good.01:19:39From client perspective. Let's go to see what we have here. With the allowed protocol, you need to enable keep but also you need to allow the EB chaining here. So enable ebit chaining this is required, but you need to check if it's not enabled, then this checkbox is enabled, otherwise.01:19:56EAP team will not be able to make the computer and user authentication. Then I have with the certificate profile here that I am checking the subject, not subject alternative name, and this is the policies.01:20:16I need to and check here the policies that I will consider like employees, PTLS employees, if user and machine both they have successful authentication. If both successfully authenticated, then they will consider like employees and I will provide them employees.01:20:29Permission based on that, then let's make disabled and enable. You know, once you make disabled for network interface card, this will trigger also the computer authentication. So remember that instead you make a log of restart, you can make disable and enable for network interface card. And here you can see that I matched the policies and the correct policy and you can.01:20:50Seen from the details that yes from here from details that I matched this both they are succeeded user and machine, and this is the common name was taken from both certificate because both they are.01:21:09Authenticated here you can see that EB chaining and also if you check for what have been checked with intra ID, you can see that the intra ID for the external group was evaluated as well. So this is how we integrate the using EAP with the chaining. Let's see now.01:21:27So if we need to integrate Intune, just to mention and as Mohammed said at the beginning that next week guys we will have 2 h.01:21:47Session, same decision, but it will talk about MDM mobile device management integration. And one of the MDM will be in tune. So, but the the team will cover more than not only in tune, but in Tune the most important part of this webinar, so.01:21:57Be careful to attend this one it will be next week. So with Intune integration, if I need to add the Intune integration, because most likely every customer they have intra ID, then the Intune it will be engaged and they need to make the compliance check be against the intune. So how this going to be.01:22:15You are, let's see this flow. So again, we return back to the you remember password authentication protocol that the client need to send this password and this password need to be sent to the intra ID to make the authentication. So in this case the authentication will happen here, right? Then I can make the MDM compliance check here, but you.01:22:35Need to be aware that MDM in tune, especially in Tune. It has two two options to to check the the endpoint if exist register and compliance or not.01:22:55One using Mac address. 2nd one is using global unique ID, ok? Microsoft always pushing to go away from Mac address because of the issue from Mac address randomization with most of the, the, the mobile and operating system nowadays. So this why.01:23:08It's now the the recommendation to go with global unique ID. Once we are talking about the global unique ID, then we do need the certificate because certificate will have in the global unique ID inside the subject alternative name and against this subject.01:23:28Global unique ID, we can check if this user or computer they are registered in in Tune and what the compliance status look like. So let's see. So we have in Tune in this case, as long as we are talking about then there is NO certificate here. For this client then the the the compliance status of.01:23:44Check will be against Mac address, be careful. So this will be working against Mac address. But once we change to to use the the from the endpoint, so as long as this endpoint sending the certificate and if this certificate contains the global unique ID, you remember I show.01:24:03Told you that we have a global unique ID. In this case, we will be able to check the intune compliance status here using the global unique ID instead of MAC address. So this is the important point. This why sometimes if you have a plan to make integration with android, you need to ask yourself, do we need to use Intune compliance status here?01:24:23In this case, it's the the recommendation to go with the EPLS or with the certificate because global unique ID is needed for the ok still the traditional with Mac address but maybe this will be duplicated very soon from Microsoft so be aware about that.01:24:43The same with the as long as we have a certificate inside this tunnel, then we will be able to get this global unique ID and check the status from Intune and authorize the user again. The same for the chaining, nothing is different, just because chaining as long as we have the certificate, then we'll.01:25:02You will be able to use.01:25:22The global unique ID to make check for the Intune. Let me show you that in in the small demo. So the Intune integrations. Once we are talking about Intune, then we need to go to MDM integration and we need to build this integration. And the important part here I need.01:25:24Need to, to, you know, I don't need to cover some topic from the the next webinar from next week, but I need to show you that there is a possibility once you make integration between Cisco eyes and Intune that you can select, do I need to use a Mac address or.01:25:44Global unique ID? Where's this global unique ID located? Is it this global unique ID located in common name in the the subject or it's located in subject alternative name? So you need to be really specific where is this global unique ID exist in my certificate? Depends on the certificate profile, was it created once you restart in.01:26:00Inside the Intune, then the Intune need to bush this certificate, then you need to check this certificate, where is the, the global unique ID located?01:26:20And I will make check both for both Remember that if you are using BAB with ROBC, then you do need Mac address to be checked as I have it here. Then let me show you my policies and this is the the authorization policy and this is the most important one that.01:26:30That I need to assign the MDM employees if the compliant status equal.01:26:49Compliant so if the device is compliant, the, the, the, the status return from MDM from Intune is compliant then will get access considered as employee and will assign his GTS employees. Let's see that.01:26:55This is my certificate and I need to check where is the, the global unique ID and you see that it is located here in subject alternative name and this is the global unique ID, UUID. This is the important part that Intune need this ID to make a check if this register compliant.01:27:18What the status is, then return back the complete MDM attributes back to, to Cisco eyes.01:27:39Then once reconnected, of course, you will not be prompt to enter credential because here we are talking about certificate, we are talking about ETLS and then you see that this is considered as employee. It means that the computer is compliant and I need to check.01:27:47This is the the policy, the authorization and authentications. Again, don't don't forget that the authentication happened not against in tune. This authentication happened local inside eyes and those the let's see the attributes Attributes not going to show up here in this.01:28:02Life logs. So in this case maybe we need to take this if you check the MDM, then there is NO MDM attribution up here, then we can take this address and go to the context visibility, check this in the context visibilities. From context visibility you will see NO.01:28:24More details and all the attributes will be shown up there. You can see what the MDM status for this, is it compliance and all the attributes registered and roll what the status you can see it here.01:28:44Perfect. Okay, then let's talk about hybrid intra ID. What we, we mean with the hybrid intra ID? So most of the customers they have both of them, to be honest, they have on prem active directory, and they have also intra ID. So in this case we call it like hybrid intra ID.01:29:02So let's assume that we have a device already joined into the intra ID, but user inside the Active directory. And so we need to authenticate the user against Active directory, but the device inside the intra ID with I'm using now the team with the with the certificate with the and using.01:29:22Training here.01:29:42So once the client com the computer started, then he will send the certificate, the same what we said. Then the user started as long as this user belonged to the active directory, then he will be able to get authenticated here. If the authenticate the certificate authentication profile, it's need to check the the identity if existing.01:29:43In the Active directory, then the authentication will happen inside the Active directory. Otherwise it will be said the same that the Cisco eyes will be responsible for the authentication for both of them.01:30:03But of course the authentication can be done with Active directory, but not with the entry ID, of course. And then the Active Directory retain the groups and attribute we can make this authorization. Now let's check if we can use microsoft chat version two. You remember interid did.01:30:14Doesn't support.01:30:34Microsoft chat version two, right? But with Active directory, we can do it. So you can mix between with Microsoft chat for the users. So in this case the computer one started will get authenticated as usual from ice, but the client, he get authenticated and he need to go to Active directory as the.01:30:35As Active Directory support Microsoft chat version two, then he will be entering credential user and password, get authenticated, then both they are successful, and then the attribute can be returned back from Active Directory and make the authentication.01:30:55If we need to compare what happens against Active directory on prem and and intra ID, everything can be happen just that to remember that, that the the the device authorization against intra ID is not possible.01:31:09Right? This is not possible with, with area version, but with the latest version with 3.5, we started to support intra ID device authorization. It means if you look at this table, after 3.5, you will see everything here market as green.01:31:26So let me show you then what we have enhancement inside the ICE 3.5 with interide. The 1st thing, the thing what we were talking about that the computer now or the, the, the device.01:31:45We will be able to make authorization for the device. So now we will be able to authorize users and device against intra ID, ok? And this feature is available with ICE 3.5 and also was added to to the batch number forward with ICE 3.4. Let me show you.01:32:01Do that in in.01:32:21Okay so this is my ice 3.5. I have REST ID stores so it's created to integrate with, with the intra ID and as you can see.01:32:31Okay, this is the rest ID and you can see here that we have more tab than the old version. If you remember that we have just general to to make the integration to enter the the client ID secret and so on to make in the integration, but here we have group and user attributes and this is the same with the old version, but the.01:32:44The things here we knew that we have a device attribute, we have a device query, we have a monitoring. Those things they were added as a new enhancement with ICE 3.5.01:33:04Let's see what those are. And I see some question about what licenses needed to make this integration between eyes and Active directory, you know, it depends what you need to use. If this is just about the authentication and authorization based on the users and the group here, so with the old version, you do need.01:33:14Just the essential license to make this integration. But if needed that I need to make also the comprehense status check against the intune. Once the Intune.01:33:34Enter in your workflow. In this case you will need the the eyes premiere licenses, but once we are talking here about device attribute, so some of the devices you need to be careful that this need two things the the maybe you need premier licenses from Azure itself and also.01:33:45Show you maybe for some of the devices attribute here to be used with the device authorization, it need the premier licenses from Cisco as well. So those are the user attribute and we have seen that, but this is not something new that I can bring some device attribute, ok? And we can.01:34:04Of all, some of those they require.01:34:24Not only essential maybe advantage and premier licenses, you can check in our documentation that you have table which which device attribute will will will require essential, which device attribute require advantage and which ones require premier licenses. But again, it's needed also extra licenses from Azure from.01:34:27Intrary ID itself.01:34:47And from device inquiry here and this also need to be be careful that you can check the device inside the intra I didn't want it to to say authenticate because here still we don't authenticate the device against intra ID. We are checking.01:34:49New Authorization on, only authorization, right? So I need to, to.01:35:09Select what I have here. Do I need to send for the authorization, right? To to make attribute lookup? Do I need to send device ID or device name? So you need to check what we have in the certificate. Do we have this device ID or device name and what I need to.01:35:14Into the Azure to the intra ID to make this lookup. And again, we need to check where is if I said, ok, I need device ID, where is this device ID located inside the certificate? It is common name or subject alternative name and how look like this device ID, right? So in this case I have.01:35:34Also, the possibility to change the regex exhibition to write, ok, how the device ID will look like to be checked and to be matched against the intra ID to be validated and to check.01:35:53This exists in the intra ID. Once I have this configured then of course you still again don't confuse, this is about what we talk about the device ID, this is for the authorization, but still I need to make the authentication, that's why I need the certificate authentication profile, but this will be done.01:36:10Inside eyes, not against intra ID. So this why I do still need the certificate authentication profile and don't confuse between this certificate profile and what we have seen in device ID.01:36:30Then we will build our policies and of course everything with authentication will be based on the authentication profile, but here are the things that you added here, that I can check some attributes here or the device, and here.01:36:44If the device is compliant, is it managed, managed this is duplicated if the device owner contains company, so you are using the company device or if the device category is managed assets, so I can add multiple attributes here.01:37:03And once this matches, then I provide the specific permission. I will show you the certificate used for this computer certificate. The the most important part that you need to check if you are using device name or or device ID and how look like the device ID should be.01:37:21I will go to s and be look here what we have that we started to use a public sorry cloud public key infrastructure BKI, so this is something new from Intune to start to use cloud BKI to provide this a.01:37:41And this is the certificate and you see that I have a principal name and this is the computer name, but also I have a principal name which contain the device ID here.01:38:02And I said the policy if I need to use either then I can select either using device name or device ID, but you need to provide the, the, the rejects formula how you need to to understand this to to be matched against and ride.01:38:11Then let's see the user certificate and the user certificate, you will see that also the certificate was generated from the public, sorry from the cloud public key infrastructure from.01:38:34Intune and this is something also new that now eyes can provide the client or you can use the Intune cloud keepi. So to make easier for you to to distribute the certificate for every device is connected and user connect to your environment, so in this case you don't need to install certificate authorities locally or you.01:38:51To use the the any connectors between Intune and your local certificate authority.01:39:11Okay, then let's see the connectivity I need to sign in. Of course, there is NO prompt here, just this prompt because the the certificate's not trusted here, the high certificate not trusted, it needs to be installed locally in his just for demo. Then you can see the authentication from here that this authentication.01:39:17Against intra ID and this this is intra devices, and if you check for some details.01:39:37You look to the details, you will see a little bit more details about with the authentication, authentication policies, what the authorization policy and all those information will be added here. And if I go to the contents visibilities.01:39:46Check for the same Mac, you will see more details about this device. This is the Mac address. You remember that the context visibility, you will see all the attributes here. I wanted just to highlight the attribute they came from the device itself. You Remember that we have the categories and some if this device is managed and all those.01:40:02Up here. So 2nd, this one something was added with the 3.5 2nd attribute I wanted to highlight is using the monitoring. You remember the 1st, the last step well once we create the integration?01:40:22With the rest ID stores, we have monitoring tab, right? And this tab allow you to monitor some, some attribute change. So in the box, let's assume that we have a user, his name Alex and Alex is existing finance groups.01:40:39And he get authenticated guys against the eyes and then get authorized from intra ID. And if he belonged to finance then he will get full access, let's assume, ok? But after a while, Alex was moved from finance to operations.01:40:56Group, in this case manual admin action need to be done here to provide the the correct permission. Otherwise, Alex will still shown up as a finance group and he will get access based on the financing group.01:41:13So now this is with the old version, with the 3.5, now we have the possibility to make monitoring for some of the attributes from intra ID and then once the attributes the attribute has any change inside this attribute, e.g. here, the group membership has been changed, then the change of.01:41:30Will be triggered to let this user to reauthenticate again and then he will get the new authentication. So this was important change and important feature was added. The last thing but not the the not least that the.01:41:50As mentioned that intra ID also started to use cloud BKI, so which make our lives really easier once we need to, to provide a certificate for all our endpoint to make authentication against Intune and intra ID, then we maybe don't use.01:42:05Use to to to use a local certificate authorities, so we'll be able to use cloud PKI, but still the possibility to use Skip or BKCS impossible with that so you have multiple options but using cloud PKI to make it.01:42:25More easier for us to provide the certificate on last lab I showed you that some of the clients they have certificate from the cloud BKI, but to be aware that cloud BKI it's based service from Microsoft ID and this need to be also mentioned.01:42:42With that, I will hand over to you, Veronica. Thank you so much. Thank you, Tarek, thank you Mohammed for sharing this very detailed and very I I hope for useful information with all of us. Before we wrap up, we would like to as well share some of the free education resources.01:42:59One of them is cyber capsules.01:43:19I've pasted a link to the cyber capsules as well as the links for some registrations for upcoming expedite series in the chat. But let me just mention what cyber capsules are. Usually those are a series of videos, they are really short, lasting around ten to 1512.01:43:2230 min and they are actually around a specific product. So feel free to.01:43:42To visit the website and and see what is available there. When it comes to upcoming sessions, here you can find the sessions in the upcoming few months. I would like to highlight one of them, which is a second line dual integration security for your Cisco portfolio.01:43:502nd day is around ICE integration with Cisco door. So if you are interested about this integration, feel free to use the link that is in the chat. And when it comes to ICE, customer success expert inside series, as Mohammed and Tarek mentioned, there is a.01:44:10ICE MDM integration next week, same time, so feel free to register and join us again. On 24 November 10aM. We will have a session about ICE upgrade best practices. And then next year sometime between February to April.01:44:30We will have a session about segmentation with trustsec.01:44:50And sometime around May and July we will talk about next generation ICE and ICE 4.0. So stay tuned about those invitations. And with that just 1 min ask and favor to ask, your feedback is really important to us and it helps us.01:44:53Just shape the sessions and we would like to hear from you what you liked, what you didn't like, what you would like us to improve or maybe add in the next session. So once this session closes, you will see a pop up open in your browser. Just take a few seconds, fill it in, let us know if you like the, like the session.01:45:13And give us five stars if you liked it and we really appreciate it. And with that I would like to thank you all for your time, for your participations. We are still going through a question, so if there are some unanswered questions, we will answer them. I would like to as well thank Mohammed and Tarek for sharing.01:45:33Think the knowledge with us and to all our panelists for answering questions. Thank you and have a nice day.01:45:53