Hello,
With the recent Executive Order on Improving the Nation’s Cybersecurity mandating Zero Trust Architecture and multifactor authentication, you may be wondering what those requirements are and how you can use the tools you have in Azure AD to meet the standards.
I am excited to share with you new guidance within our public documentation. This guidance is tailored to help you meet government and industry identity requirements using Azure Active Directory. Microsoft documents how we as a company meet many of these standards. While you can leverage our compliance, there are often “shared responsibilities” beyond what Microsoft accreditation provides. This new prescriptive guidance is designed to help you meet these identity requirements using Azure Active Directory.
As an example, let us consider meeting FedRAMP High controls IA-2 (1-4). To understand these requirements, one would have to start with FedRAMP Security Controls Baseline, dive into NIST SP 800-53 Rev. 4 which builds on NIST SP 800-63 Rev. 3 which in turn builds on NIST FIPS 140-2. You get the idea…lots of “light” reading. Alternatively, one could leverage the standards & compliance section which provides prescriptive guidance for meeting this control by:
(a) configuring Conditional Access (CA) policies to require MFA,
(b) configuring device management policies and CA policies such that sign-in to these managed devices would require MFA,
(c) viable MFA options meeting NIST Authentication Assurance Level (AAL) 3 as required by FedRAMP High and
(d) use of PIM to eliminate privileged local access without PIM activation.
I am happy to announce the first two content sets under the new standards & compliance area: Configure Azure Active Directory to meet NIST Authenticator Assurance Levels
We have started with NIST 800-63 – Digital Identity Guidelines which is a well understood framework for digital identities that many other standards and regulations use as a building block.
This guidance details how you can use Azure Active Directory to meet NIST Authentication Assurance Levels (AAL) and maps these AAL’s to all available authentication methods.
Configure Azure Active Directory to meet FedRAMP High Impact level
Many US federal agencies as well as cloud solution providers (CSPs) delivering cloud services to these agencies must meet requirements of the FedRAMP program. We anchored our guidance around the FedRAMP High baseline to cover the most stringent set of identify related controls. This approach allows customers who need to adhere to lower FedRAMP baselines to use this guidance as well.
US Government agencies will soon be required to have fully adopted multifactor authentication. Check out our resources to Enable MFA in your organization to verify explicitly as part of your Zero Trust approach.
We would love to hear more from all of you on what standards, regulations, or other compliance frameworks with identity requirements you would like to meet with Azure Active Directory. We will continue to review standards, regulations, or other compliance frameworks and where appropriate, produce guidance to help our customers meet their identity requirements using Azure Active Directory.
Learn more about Microsoft identity:
- Return to the Azure Active Directory Identity blog home
- Join the conversation on Twitter and LinkedIn
- Share product suggestions on the Azure Feedback Forum
