Why do you need Azure AD B2B Collaboration?

 

Microsoft Azure AD B2B collaboration (sometimes known as ‘External Identities’) provides secure, managed collaboration for your organisation’s external relationships.

What this means is that when you work with organisations and users outside of your organisation to get things done, you don’t need to create new users and passwords in your directory and closely manage user access and lifecycles.  You can use the built-in federation capabilities of Azure Active Directory to add a user with credentials elsewhere, and choose from a number of options for inviting/approving the user and managing their ongoing access.

Why collaborate?

From sharing a SharePoint or Teams site with a supplier or customer, to giving access to a project management or HR application to contractors or joint venture partners – most organisations need to collaborate with external parties for one reason or another.  

But at the same time, external users often don’t have the same onboarding and offboarding mechanisms as regular staff, so it can be a challenge to keep your environment secure against exploits of more lax controls.

For example, if you create username and password credentials for an external user, and they leave their organisation, removing the reason they have for working with you, they may still be allowed to sign in to your organisation with the credentials you created.

Federation without the complexity

One way of mitigating against the kinds of threat mentioned above is to have your external users sign in with their own organisational credentials.

Previously, organisations relied on on-premises federation capabilities to collaborate with externals in this manner. 

With Azure Active Directory, this complexity is removed, and you can federate with any other Azure Active Directory tenant simply by sending a guest user invitation.  Additionally you can federate with other organisations (whose identity provider supports SAML or WS-Fed) by uploading their data into a simple Azure form – no complicated ADFS infrastructure in sight!

 

For partners of all shapes and sizes.

Many organisations work with external businesses of all shapes and sizes.  Some of these externals will rely on Azure Active Directory, while others may use competing identity systems such as Google Workspace, and still others may not have an industry standard system for managing identity.  B2B guest collaboration caters for all of these cases.

 

• Established identity providers outside of AAD (e.g. Google Workplace) can be ‘federated’ (in other words linked to your AAD tenant for the purpose of collaboration) via the ‘External Identities’ panel in Azure.  

• When you invite a single user via the Azure portal of the Microsoft Graph API, you can send the invitation to any email address and Azure takes care of the onboarding mechanism.

• Users without a AAD or a federated identity system are challenged with an email-based one time passcode (OTP) as a means of sign-in

• Access Packages work in the same way, except that the end user applies for the package using the Microsoft Access Portal, and then goes through an approval process before finally receiving access to the applications/resources they applied for.

• External Identity user flows give you the ability to onboard users automatically, with no manual approval, by checking their details against an API you create – so for example you can check supplier codes against addresses before allowing access.

Secure

With Azure AD you can rely on security in-depth.

• At the sign-in page Azure detects the threat level posed by the user and the session

• During sign in Azure uses industry-strength authentication protocols to communicate with front-end applications

• In the directory, the credentials are encrypted and hashed.  External user credentials live in their own tenant and are not copied across to the tenant hosting the resources.

Connected

Azure Active Directory connects with all of your front-end applications, web and native.  

• For off-the-shelf applications, many thousands of commercial applications already use SAML or OAuth protocols and can be connected to AAD by making simple configuration changes

• For developers, there is a great deal of help available for migrating your applications to AAD, including samples and libraries from the Microsoft website and github accounts.

• Applications which fall through the gaps can still be integrated with AAD single sign on via mechanisms such as Azure App Proxy.

Azure Active directory’s external identities feature connects with your back office too:

• During the sign-up and sign-in user flow, policies can make API calls to your web APIs to retrieve validity information or write information to your data store.

• Outside of policies, you can access AAD data via Microsoft’s Graph API.   This access can be triggered by a scheduled task or a specific event on your back office system.