User management and authentication for O365: Microsoft or 3rd party?

Office 365 (O365) adoption is continuing across organizations, now with more than 100 million active users. These organizations will reap the benefits of a cloud service – freed up internal resources, and easy access to updates with minimal maintenance – but, they can’t ignore the inevitable complications of hybrid identities. Whether using the cloud, synchronized, or federated identity model, many find themselves in the middle of a hybrid identity game.

Creating an O365 account automatically creates a tenant in Azure AD, and introduces new authentication and user management processes for IT departments. Before embarking on the journey, they’ll need to answer:

• Where is it best to manage users (cloud or on-premises)?
• How should users authenticate to O365?

If your organization is regulated, you may not have much choice. You will need to integrate your on-premises directory to extend password policies, and other controls. You will also need to decide whether you’ll use Microsoft Azure AD Connect, or a 3^rd party offering. Many organizations, regulated or not, connect their on-premises user directory (for the majority, this is Active Directory) with O365. This allows them to benefit from existing user management processes. Active Directory integration not only extends on premises security controls, but also eliminates redundancies in user management. However, it’s not without its own challenges.

Going hybrid using free Microsoft offerings, comes with complexity, added administration time, and the likelihood of end-user disruption. This post will discuss challenges associated with Azure AD Connect, to help you make an informed decision when choosing between Microsoft, and 3^rd party offerings.

How do you want to create, and manage users?

First things first! Whether going cloud or hybrid, you’ll need to decide how and where you want to manage users. There are benefits and drawbacks to both, but if you want to extend on-premises controls to O365, you’ll need to connect to Active Directory. Remember that how you decide to manage users will affect authentication options. This will be detailed in the authentication section of the post.

Depending on your environment, and deployment goals, you will have to decide what makes the most sense for your organization. Industry analyst firms, such as Gartner, recommend integrating existing on-premises directories for truly integrated user management. The current state of your Active Directory environment will drive this decision as connecting to O365 requires preliminary work to ensure smooth migration. Microsoft offers some guidance, and a free tool (IdFix) to help. Unfortunately, it’s not all encompassing, and will require scripting to pin point errors outside of the tool’s scope.

To further guide your decision, the following table summarizes some of your options, as well as any considerations.

How do you want users to authenticate to O365?

How users are provisioned and managed will drive your authentication options. Because O365 is a valuable target for hackers, securing authentication by strengthening passwords, in combination with multi-factor authentication (MFA), is best practice.

Microsoft provides MFA for O365, both free and paid, via an Azure AD premium subscription.  However, depending on your deployment mode there are a few key differences. Consider the following questions:

• Do you want to remove the use of passwords?
• Do you want to enable federated single sign-on (SSO)?
• Do you want to extend existing 3^rd party MFA to O365?
• Do you want to rely only on phone-based factors?

The following table outlines Microsoft and 3^rd party authentication options.

The reality…

The adoption of O365 creates user management and authentication challenges, regardless of the deployment model.  Many organizations prefer hybrid deployments that integrate O365 with Active Directory. However, as we’ve shown here, doing so with Microsoft provided tools has its drawbacks. If you want a hybrid O365 deployment, minus the extra administration time, and security compromise, consider evaluating a 3^rd party provider.