In a world where collaboration rocks we always question the security boundary. By now I do hope all agree answer relies on identity. Our application access and controls should follow identity to allow people to truly provide the required flexibility to work from anywhere whilst maintaining the required security.
In Microsoft Azure Active Directory now they are towards to that dream. Today goes the public preview of allowing to share resources (Applications and data) with people from any organization, whether or not they have Azure AD or an IT department. Earlier Microsoft work closely with Google social IDs for this task.
Under this preview mode end user can use any of their e-mail ID type to access resources on another organization for true B2B collaboration. This is happening via email one-time passcodes (OTP).By using this new capability, you allow guest users to use their work email account for authentication while making sure your corporate resources are protected by the same security standards that are mandated by your partner organization. Once end user get the code and verified that session is valid for 24 hours. OTP codes are valid for 30 minutes. These settings carefully applied with security in mind.
In addition, we can apply additional security through conditional access and Multi-Factor Authentication (MFA) which available under AAP (Azure Active Directory Premium)
Guest user will get one-time passcode if below scenarios are true,
- They do not have an Azure AD account
- They do not have a Microsoft account
- The inviting tenant did not set up Google federation for @gmail.com and @googlemail.com users
(Picture credits goes to Microsoft Techcommunity)
Ok let’s get into action to enable this feature now.
Log into Azure portal and go to Azure Active Directory –> Organizational relationships –> Users from other organizations –> Settings
select “Enable Email One-Time Passcode for Guests (Preview) after that save the changes.
Well that’s all you have to do. Head back to “Users from other organizations” and add the users. Once above task completed it might take little time to apply.
After that when you share the resources with the outside party.
When the first time user get the email he/she has to go through the redemption procedure and accept the company policies. Once completed when they try to access the company resources they will be request to sign in prompt and request for a code. Below is such example situation,
(Picture credits goes to Microsoft Techcommunity)
What is exciting is the new doors this is opening for companies to allow securely access to their resources to external parties knowing the control they have.
