Trust is accepting the dependency of other(s) to achieve an otherwise unavailable outcome. This dependency is the cost of trust, and the (expected) outcome is the reason to trust. At the time trust is given, the future actions of trustee(s) are unknown, making trust decisions irrational. The resulting consequences of trust are often unknown, making proper risk assessment impossible.

Azure Active Directory (Azure AD) is Microsoft's cloud-based Identity and Access Management (IAM) service used by Microsoft 365, Azure, and thousands of third-party services. To make consuming and managing cloud services easier, organizations have integrated their on-premises services to Azure AD. Microsoft has also recently announced new Azure AD features making cross-tenant collaboration easier. These integrations and cross-tenant collaboration features are based on trust between Azure AD and other parties. Trusting these parties expands the trust boundary beyond the control of the trustor, making it prone to attacks originating from the trustee(s).

This talk aims to understand the risks of various forms of trust related to Azure AD. The technical details and best practices of identity federation, directory synchronization, cross-tenant access settings, delegated administrative privileges, and similar Azure AD features are covered. These details help understand the consequences of trust of each feature and how to use them safely. Finally, the implications and best practices of chains-of-trust resulting from any cross-tenant trust are covered.

You will learn:

• The concept of trust in the security context
• Understand trust-related risks regarding Azure AD
• Best practices for configuring Azure AD security options