Tutorial: Configure Silverfort with Azure Active Directory for secure hybrid access
In this tutorial, learn how to integrate Silverfort with Azure Active Directory (Azure AD). Silverfort uses innovative agent-less and proxy-less technology to connect all your assets on-premises and in the cloud to Azure AD. This solution enables organizations to apply identity protection, visibility, and user experience across all environments in Azure AD. It enables universal risk-based monitoring and assessment of authentication activity for on-premises and cloud environments, and proactively prevents threats.
Silverfort can seamlessly connect any type of asset into Azure AD, as if it was a modern web application. For example:
Legacy and homegrown applications
Remote desktop and Secure Shell (SSH)
Command-line tools and other admin access
File shares and databases
Infrastructure and industrial systems
These bridged assets appear as regular applications in Azure AD and can be protected with Conditional Access, single-sign-on (SSO), multifactor authentication, auditing and more.
This solution combines all corporate assets and third party Identity and Access Management (IAM) platforms. For example, Active Directory, Active Directory Federation Services (ADFS), and Remote Authentication Dial-In User Service (RADIUS) on Azure AD, including hybrid and multi-cloud environments.
In this guide, you'll configure and test the Silverfort Azure AD bridge in your Azure AD tenant.
Once configured, you can create Silverfort authentication policies that bridge authentication requests from various identity sources to Azure AD for SSO. Once an application is bridged, it can be managed in Azure AD.
The following diagram shows the components included in the solution and sequence of authentication orchestrated by Silverfort.
|1.||User sends authentication request to the original Identity provider (IdP) through protocols such as Kerberos, SAML, NTLM, OIDC, and LDAP(s).|
|2.||The response is routed as-is to Silverfort for validation to check authentication state.|
|3.||Silverfort provides visibility, discovery, and bridging to Azure AD.|
|4.||If the application is configured as bridged, the authentication decision is passed on to Azure AD. Azure AD evaluates Conditional Access policies and validates authentication.|
|5.||The authentication state response is then released and sent as-is to the IdP by Silverfort.|
|6.||IdP grants or denies access to the resource.|
|7.||User is notified if access request is granted or denied.|
To set up SSO for an application that you added to your Azure AD tenant, you'll need:
An Azure account with an active subscription. You can create a free account.
One of the following roles in your Azure account - Global administrator, Cloud application administrator, Application administrator, or Owner of the service principal.
An application that supports SSO and that was already pre-configured and added to the Azure AD gallery. The Silverfort application in the Azure AD gallery is already pre-configured. You'll need to add it as an Enterprise application from the gallery.
Onboard with Silverfort
To deploy Silverfort in your tenant or infrastructure, contact Silverfort. Install Silverfort Desktop app on relevant workstations.
Configure Silverfort and create a policy
From a browser, log in to the Silverfort admin console.
In the main menu, navigate to Settings, and then scroll to Azure AD Bridge Connector in the General section. Confirm your tenant ID, and then select Authorize.
A registration confirmation is shown in a new tab. Close this tab.
In the Settings page, select Save changes
Log in to your Azure AD console. You'll see Silverfort Azure AD Adapter application registered as an Enterprise application.
In the Silverfot admin console, navigate to the Policies page, and select Create Policy.
The New Policy dialog will appear. Enter a Policy Name, that would indicate the application name that will be created in Azure. For example, if you're adding multiple servers or applications under this policy, name it to reflect the resources covered by the policy. In the example, we'll create a policy for the SL-APP1 server.
Select appropriate Authentication type, and Protocol.
In the Users and Groups field, select the edit icon to configure users that will be affected by the policy. These users's authentication will be bridged to Azure AD.
Search and select users, groups, or Organization units (OUs).
Selected users will be listed in the SELECTED box.
Select the Source for which the policy will apply. In this example, All Devices are selected.
Set the Destination to SL-App1. You can select the edit button to change or add more resources or groups of resources (optional).
Select the Action to AZURE AD BRIDGE.
Select SAVE to save the new policy. You'll be prompted to enable or activate it.
The policy will appear in the Policies page, in the Azure AD Bridge section:
Return to the Azure AD console, and navigate to Enterprise applications. The new Silverfort application should now appear. This application can now be included in CA policies.