Secure and governed access to all applications and resources
In this guide, we describe how to configure Microsoft Entra Suite products for a scenario in which the fictional organization, Contoso, wants to hire new remote employees and provide them with secure and seamless access to necessary apps and resources. They want to invite and collaborate with external users (such as partners, vendors, or customers) and provide them with access to relevant apps and resources.
Contoso uses Microsoft Entra Verified ID to issue and verify digital proofs of identity and status for new remote employees (based on human resources data) and external users (based on email invitations). Digital wallets store identity proof and status to allow access to apps and resources. As an additional security measure, Contoso may verify identity with FaceCheck facial recognition based on the picture that the credential stores.
They use Microsoft Entra ID Governance to create and grant access packages for employees and external users based on verifiable credentials.
� For employees, they base access packages on job function and department. Access packages include cloud and on-premises apps and resources to which employees need access.
� For external collaborators, they base access packages on based on invitation to define external user roles and permissions. The access packages include only apps and resources to which external users need access.
Employees and external users can request access packages through a self-service portal and provide their digital proofs as identity verification. With single sign-on and multifactor authentication, employees and external users use Microsoft Entra accounts to access apps and resources that their access packages include. Contoso verifies credentials and grants access packages without requiring manual approvals or provisioning.
Contoso uses Microsoft Entra Identity Protection and Conditional Access (CA) to monitor and protect accounts from risky sign-ins and user behavior. They enforce appropriate access controls based on location, device, and risk level
To successfully deploy and test the solution, configure the prerequisites that we describe in this section. Configure Microsoft Entra Verified ID For this scenario, complete these prerequisite steps to configure Microsoft Entra Verified ID with Quick setup (Preview):
- Register a custom domain (required for Quick setup) by following the steps in the Add your custom domain article.
- Sign in to the Microsoft Entra admin center with at least a Global Administrator role.
- Select Verified ID.
- Select Setup.
- Select Get started
-
If you have multiple domains registered for your Microsoft Entra tenant, select the one that you would like to use for Verified ID.
-
After the setup process is complete, you see a default workplace credential available to edit and offer to employees of your tenant on their My Account page.
-
Sign in to the test user�s My Account with their Microsoft Entra credentials. Select Get my Verified ID to issue a verified workplace credential
Follow these prerequisite steps to add a trusted external organization (B2B) for the scenario.
- Sign in to the Microsoft Entra admin center with at least a Security Administrator role.
- Go to Identity > External Identities > Cross-tenant access settings. Select Organizational settings
- Select Add organization.
- Enter the organization�s full domain name (or tenant ID).
- Select the organization in the search results. Select Add.
- Confirm the new organization (that inherits its access settings from default settings) in Organizational settings. ![image 3] (../images/VID-03.png)
Follow these prerequisite steps to create an Entitlement management catalog for the scenario.
-
Sign in to the Microsoft Entra admin center with at least an Identity Governance Administrator role.
-
Go to Identity governance > Entitlement management > Catalogs.
-
Select +New catalog.
-
Enter a unique name for the catalog and provide a description. Requestors see this information in an access package's details.
-
To create access packages in this catalog for internal users, select Enabled for external users > No.
-
On Catalog, open the catalog to which you want to add resources. Select Resources > +Add resources.
-
Select Type, then Groups and Teams, Applications, or SharePoint sites.
-
Select one or more resources of the type that you want to add to the catalog. Select Add.
To successfully deploy and test the solution, configure the access packages that we describe in this section.
Follow these steps to create an access package in entitlement management with Verified ID for remote (internal) users.
-
Sign in to the Microsoft Entra admin center with at least an Identity Governance Administrator role.
-
Go to Identity governance > Entitlement management > Access package.
-
Select New access package.
-
For Basics, give the access package a name (such as Finance Apps for Remote Users). Specify the catalog that you previously created.
-
For Resource roles, select a resource type (for example: Groups and Teams, Applications, SharePoint sites). Select one or more resources.
-
In Role, select the role to which you want users assigned for each resource.
-
For Requests, select For users in your directory.
-
In Select users and groups, select For Users in your directory. Select + Add users and groups. Select an existing group entitled to request the access package.
-
Scroll to Required Verified Ids.
-
Select + Add issuer. Select an issuer from the Microsoft Entra Verified ID network. Ensure that you select an issuer from an existing verified identity in the guest wallet.
-
Optional: In Approval, specify whether approval is required when users request the access package.
-
Optional: In Requestor information, select Questions. Enter a question that you want to ask the requestor. This question is known as the display string. To add localization options, select Add localization.
-
For Lifecycle, specify when a user's assignment to the access package expires. Specify whether users can extend their assignments. For Expiration, set Access package assignments expiration to On date, Number of days, Number of hours, or Never.
-
In Access Reviews, select Yes.
-
In Starting on, select the current date. Set Review Frequency to Quarterly. Set Duration (in Days) to 25.
Follow these steps to create an access package in entitlement management with Verified ID for guests (B2B).
-
Sign in to the Microsoft Entra admin center with at least an Identity Governance Administrator role.
-
Go to Identity governance > Entitlement management > Access package.
-
Select New access package.
-
For Basics, give the access package a name (such as Finance Apps for Remote Users). Specify the catalog that you previously created.
-
For Resource roles, select a resource type (for example: Groups and Teams, Applications, SharePoint sites). Select one or more resources.
-
In Role, select the role to which you want users assigned for each resource.
-
For Requests, select For users not in your directory.
-
Select Specific connected organizations. To select from a list of connected organizations that you previously added, select Add directory.
-
Enter the name or domain name to search for a previously connected organization.
-
Scroll to Required Verified Ids.
-
Select + Add issuer. Select an issuer from the Microsoft Entra Verified ID network. Ensure that you select an issuer from an existing verified identity in the guest wallet.
-
Optional: In Approval, specify whether approval is required when users request the access package.
-
Optional: In Requestor information, select Questions. Enter a question that you want to ask the requestor. This question is known as the display string. To add localization options, select Add localization.
-
For Lifecycle, specify when a user's assignment to the access package expires. Specify whether users can extend their assignments. For Expiration, set Access package assignments expiration to On date, Number of days, Number of hours, or Never.
-
In Access Reviews, select Yes.
-
In Starting on, select the current date. Set Review Frequency to Quarterly. Set Duration (in Days) to 25.
-
Select Specific reviewers. Select Self Review.
-
Sign in to the Microsoft Entra admin center with at least a Conditional Access (CA) Administrator role.
-
Go to Protection > Conditional Access.
-
Select New policy.
-
Enter a policy name such as Protect applications for remote high-risk sign-in users.
-
For Assignments, select Users.
-
For Include, select a remote user group or select all users.
-
For Exclude, select Users and groups. Select your organization's emergency access or break-glass accounts.
-
Select Done.
-
For Cloud apps or actions> Include, select the application(s) to target this policy.
-
For Conditions > Sign-in risk, set Configure to Yes. For Select the sign-in risk level this policy will apply to, select High and Medium.
-
Select Done.
-
For Access controls > Grant.
-
Select Grant access > Require multifactor authentication.
-
For Session, select Sign-in frequency. Select Every time.
-
Confirm settings. Select Enable policy
After you configure an access package with a Verified ID requirement, end-users who are within the scope of the policy can request access in their My Access portal. While reviewing requests for approval, approvers can see the claims of the verified credentials that requestors present.
-
As a remote user or guest, sign in to *myaccess.microsoft.com.
-
Search for the access package that you previously created (such as Finance Apps for Remote Users). You can browse the listed packages or use the search bar. Select Request.
-
The system displays an information banner with a message such as, To request access to this access package you need to present your Verifiable Credentials. Select Request Access. Scan the QR Code with your phone to launch Microsoft Authenticator. Share your credentials.
-
After you share your credentials, continue with the approval workflow.
-
Optional: Simulate user risk by following these instructions: Simulating risk detections in Microsoft Entra ID Protection. You may need to try multiple times to raise the user risk to medium or high.
-
Try accessing the application that you previously created for the scenario to confirm blocked access. You may need to wait up to one hour for block enforcement.
-
Validate that access is blocked by the Conditional Access (CA) policy that you created earlier using sign-in logs. Open non-interactive sign in logs from the ZTNA Network Access Client � Private application. View logs from the Private Access application name that you previously created as the Resource name.
