[B! ADFS][Azure] s_naganoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

s_nagano id:s_nagano

ADFSã¨Azureã«é–¢ã™ã‚‹s_naganoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Microsoft365ã¨Azureã® Active Directoryãƒãƒƒã‚¯ãƒ‰ã‚¢ã®æ¤œå‡º
Mandiantã¯ã€Microsoft365(M365) ã¨Azure Active Directory (Azure AD) ã§ç™ºç”Ÿã™ã‚‹ä¾µå®³ã®å¢—åŠ ã‚’ç¢ºèªã—ã¦ãã¾ã—ãŸã€‚ã“ã‚Œã‚‰ã®ä¾µå®³ã®ã»ã¨ã‚“ã©ã¯ã€ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ãƒ»ãƒ¡ãƒ¼ãƒ«ã«ã‚ˆã£ã¦ã€M365ã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ãŸã‚ã«ä½¿ç”¨ã•ã‚Œã‚‹èªè¨¼æƒ…å ±ã‚’ã€ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ãƒ»ã‚µã‚¤ãƒˆã«å…¥åŠ›ã™ã‚‹ã‚ˆã†ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å¼·åˆ¶ã™ã‚‹ã“ã¨ã«ã‚ˆã£ã¦ç™ºç”Ÿã—ã¾ã™ã€‚ä»–ã®ä¾µå®³ã¨ã—ã¦ã¯ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ã‚¹ãƒ—ãƒ¬ãƒ¼ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ã‚¹ã‚¿ãƒƒãƒ•ã‚£ãƒ³ã‚°ã€M365ãƒ†ãƒŠãƒ³ãƒˆã«å¯¾ã™ã‚‹ç°¡å˜ãªãƒ–ãƒ«ãƒ¼ãƒˆãƒ»ãƒ•ã‚©ãƒ¼ã‚¹ã®è©¦ã¿ãªã©ãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã‚‰ã®ä¾µå®³ã®ã»ã¼ã™ã¹ã¦ã«ãŠã„ã¦ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¯å¤šè¦ç´ èªè¨¼ (MFA)ã«ã‚ˆã£ã¦ä¿è·ã•ã‚Œã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚ ã“ã‚Œã‚‰ã®æ—¥å’Œè¦‹çš„æ”»æ’ƒã¯ã€M365ãŠã‚ˆã³Azure ADã«ã¨ã£ã¦ã€æœ€ã‚‚ä¸€èˆ¬çš„ãªå½¢å¼ã®ä¾µå®³ã§ã‚ã‚Šã€é€šå¸¸ã€æŒç¶šæ€§ã‚’ç¢ºç«‹ã™ã‚‹ãŸã‚ã®æœ€åˆã®ãƒ™ã‚¯ãƒˆãƒ«ã§ã™ã€‚ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆãƒ¬ã‚¹ãƒãƒ³ã‚¹(IR)ã‚¨ãƒ³ã‚²ãƒ¼ã‚¸ãƒ¡ãƒ³ãƒˆã¨ãƒ—ãƒã‚¢ã‚¯
s_nagano 2021/01/26
ã‚ã¨ã§èªã‚€

AD

ADFS

Azure

microsoft

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
Azure AD ã¨ AD FS ã®ãƒ™ã‚¹ãƒˆ ãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹: ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ ã‚¹ãƒ—ãƒ¬ãƒ¼æ”»æ’ƒã®é˜²å¾¡
ã“ã®æ”»æ’ƒãƒ‘ã‚¿ãƒ¼ãƒ³ã¯ã€å€‹ã€…ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¾ãŸã¯ä¼æ¥ã‹ã‚‰è¦‹ã‚‹ã¨ã€ãã‚Œãžã‚ŒãŒåˆ¥ã€…ã®ãƒã‚°ã‚¤ãƒ³å¤±æ•—ã®ã‚ˆã†ã«è¦‹ãˆã‚‹ãŸã‚ã€ã»ã¨ã‚“ã©ã®æ¤œå‡ºæ‰‹æ³• (ä¾‹ãˆã°ãƒãƒƒã‚¯ã‚¢ã‚¦ãƒˆãªã©ã®è¨å®š) ã‚’ã™ã‚ŠæŠœã‘ã¦ã—ã¾ã„ã¾ã™ã€‚ æ”»æ’ƒè€…ã«ã¨ã£ã¦ã¯æ•°å—ã‚’å½“ã¦ã‚‹ãƒŠãƒ³ãƒãƒ¼ã‚ºã®å®ãã˜ã®ã‚ˆã†ãªã‚‚ã®ã§ã€æ”»æ’ƒè€…ã¯ã‚ˆãå½“ãŸã‚Šãã†ãªæœ€ã‚‚ä¸€èˆ¬çš„ãªãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ã„ãã¤ã‚‚çŸ¥ã£ã¦ã„ã¾ã™ã€‚ã“ã‚Œã‚‰ã®æœ€ã‚‚ä¸€èˆ¬çš„ãªãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¯å…¨ä½“ã® 0.5 ã€œ 1.0ï¼… ç¨‹åº¦ã§ã™ãŒã€1000 å€‹ã»ã©ã‚¢ã‚«ã‚¦ãƒ³ãƒˆãŒã‚ã‚Œã°ã€æ•°å€‹ã¯æ”»æ’ƒãŒæˆåŠŸã™ã‚‹ãŸã‚ååˆ†åŠ¹æžœçš„ã§ã™ã€‚ æ”»æ’ƒè€…ã¯ã€ãƒã‚°ã‚¤ãƒ³ãŒæˆåŠŸã—ãŸã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’ä½¿ç”¨ã—ã¦é›»åãƒ¡ãƒ¼ãƒ«ã‹ã‚‰ãƒ‡ãƒ¼ã‚¿ã‚’å–å¾—ã—ã€é€£çµ¡å…ˆæƒ…å ±ã‚’åŽé›†ã—ãŸã‚Šã€ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã®ãƒªãƒ³ã‚¯ã‚’é€ä¿¡ã—ãŸã‚Šã€ã•ã‚‰ã«ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ ã‚¹ãƒ—ãƒ¬ãƒ¼ã®æ¨™çš„ã‚’åºƒã’ã‚ˆã†ã¨ã—ã¾ã™ã€‚ æ”»æ’ƒè€…ã¯ã€æœ€åˆã®æ¨™çš„ãŒèª°ã§ã‚ã‚‹ã‹ã«ã¤ã„ã¦ã¯æ°—ã«ã›ãšã€æœ€åˆã®æˆåŠŸã‚’ãã£ã‹ã‘ã«ãã®å¾Œã©ã‚Œã ã‘æ”»æ’ƒã‚’åºƒã’ã‚‰ã‚Œã‚‹ã‹è©¦ã—ã¦ã„ãã¾
s_nagano 2018/03/21
å¤§äº‹ãªã“ã¨ãŒæº€è¼‰

ActiveDirectory

security

AD

password

Azure

ADFS

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Office 365 ã® TLS 1.0/1.1 ç„¡åŠ¹åŒ–ã«ä¼´ã† AD FS / WAP (AD FS Proxy) ã®å¯¾å¿œ
This browser is no longer supported. Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. 2018/02/15: TLS 1.2 ã®å¿…é ˆåŒ–ã¯å½“åˆäºˆå®šã—ã¦ã„ãŸ 2018/3/1 ã‹ã‚‰ 2018/10/31 ã«å»¶æœŸã«ãªã‚Šã¾ã—ãŸã€‚ ã“ã‚“ã«ã¡ã¯ã€ Azure ID ã®ä¸‰æµ¦ã§ã™ã€‚ ä»Šå›žã¯ Office 365 ã§ã® TLS 1.0 ã¨ 1.1 ã®ã‚µãƒãƒ¼ãƒˆç„¡åŠ¹åŒ–ã«ä¼´ã† AD FS / WAP (AD FS Proxy) ã§ã®å¯¾å¿œã«ã¤ã„ã¦ã¾ã¨ã‚ã¾ã—ãŸã€‚ æ¬¡ã®æƒ…å ±ã«ã‚ã‚Šã¾ã™ã‚ˆã†ã« 2018/10/31 ã« Office 365 ã§ã¯ TLS 1.0 ã¨ 1.1 ã®ã‚µãƒãƒ¼ãƒˆã‚’ç„¡åŠ¹åŒ–ã™ã‚‹ã“ã¨ã‚’äºˆå®šã—ã¦ã„ã¾ã™ã€‚
s_nagano 2018/01/29
AD

Azure

adfs

Office 365

Office
ãƒªãƒ³ã‚¯
ADFSãªã—ã§Office365ã¸ã®ã‚·ãƒ³ã‚°ãƒ«ã‚µã‚¤ãƒ³ã‚ªãƒ³ã‚’å®Ÿç¾ã™ã‚‹(2)
Always on the clock ã“ã‚Œã¾ã§ã«ã€ã‚»ãƒŸãƒŠãƒ¼ã‚„ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã€æ›¸ç±ã‚’é€šã˜ã¦ãŠä¼šã„ã—ãŸæ–¹ã€…ã€ãã—ã¦ã“ã‚Œã‹ã‚‰å‡ºä¼šã†ã§ã‚ã‚ã†æ–¹ã€…ã®ãŸã‚ã« Microsoft ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ã‚’ä¸å¿ƒã¨ã—ãŸæƒ…å ±ã‚’æ ªå¼ä¼šç¤¾ã‚¨ã‚¹ãƒˆãƒ‡ã‚£ã‚¢ãƒ³ã®å›½äº• å‚‘ (ãã«ã„ ã™ãã‚‹) ãŒæä¾›ã™ã‚‹ãƒ–ãƒã‚°ã§ã™ã€‚ çš†ã•ã‚“ã“ã‚“ã«ã¡ã¯ã€‚å›½äº•ã§ã™ã€‚ å‰å›žã®æŠ•ç¨¿ã§ã¯ã€Kerberosã‚’Azure ADã«ã¾ã§æ‹¡å¼µã™ã‚‹ã“ã¨ã§ã€ADFSã®è¦ã‚‰ãªã„ã‚·ãƒ³ã‚°ãƒ«ã‚µã‚¤ãƒ³ã‚ªãƒ³ã®æ–¹æ³•ã‚’ç´¹ä»‹ã—ã¾ã—ãŸãŒã€ã“ã®ä»•çµ„ã¿ã«ã¯ã‚‚ã†ã²ã¨ã¤ã®å®Ÿè£…æ–¹æ³•ãŒã‚ã‚Šã¾ã™ã€‚ãã‚Œã¯ã€Œãƒ‘ã‚¹ã‚¹ãƒ«ãƒ¼èªè¨¼ã€ã¨ã„ã†ã‚µã‚¤ãƒ³ã‚¤ãƒ³æ–¹æ³•ã§ã™ã€‚ (ã¡ãªã¿ã«ã€å‰å›žç´¹ä»‹ã—ãŸãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒãƒƒã‚·ãƒ¥åŒæœŸã¯PHSã€ãƒ‘ã‚¹ã‚¹ãƒ«ãƒ¼èªè¨¼ã¯PTAã¨ç•¥ã™ãã†ã§ã™ã€‚åˆã‚ã¦ã¿ãŸã¨ãã¯ã€ã€Œç§ã‚‚æ˜”ã¯ã‚¢ã‚¹ãƒ†ãƒ«ä½¿ã£ã¦ãŸã‚ˆã€ã¨ã‹ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„ã“ã¨ã‚’æ€ã„å‡ºã—ã¦ã—ã¾ã„ã¾ã—ãŸ) ãƒ‘ã‚¹ã‚¹ãƒ«ãƒ¼èªè¨¼ã¨ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼èªè¨¼ã‚’Active Directoryã«
s_nagano 2017/05/28
AD

SSO

ã‚·ãƒ³ã‚°ãƒ«ã‚µã‚¤ãƒ³ã‚ªãƒ³

Azure

ADFS

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Office365ç®¡ç†è€…ã¯è¦å¯¾å¿œã€‚å¤–éƒ¨å…±æœ‰ã«ã‚ˆã‚Šä¸è¦ãªã‚¢ã‚¯ã‚»ã‚¹æ¨©ãŒä»˜ä¸Žã•ã‚Œã‚‹
ã„ã‚ã‚“ãªã‚¢ã‚¤ãƒ‡ãƒ³ãƒ†ã‚£ãƒ†ã‚£ç®¡ç†ç³»è£½å“ã‚„ã‚µãƒ¼ãƒ“ã‚¹ã®å®Ÿé¨“ã®è¨˜éŒ²ã‚’ã—ã¦ã„ãã¾ã™ã€‚ å¾Œã¯ã€é–¢é€£ã™ã‚‹ãƒ‹ãƒ¥ãƒ¼ã‚¹ãªã©ã‚’å¾’ç„¶ã¨ã€‚ ã“ã‚“ã«ã¡ã¯ã€å¯Œå£«æ¦®ã§ã™ã€‚ OneDrive for Businessä¸Šã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚„SharePoint Onlineã®ãƒãƒ¼ãƒ ã‚µã‚¤ãƒˆã‚’ä»–çµ„ç¹”ã®ãƒ¦ãƒ¼ã‚¶ã¨å…±æœ‰ã‚’ã™ã‚‹B2Bã‚·ãƒŠãƒªã‚ªã§åˆ©ç”¨ã—ã¦ã„ã‚‹ä¼æ¥ãƒ»çµ„ç¹”ãŒå¢—ãˆã¦ã„ã‚‹ä¸ã€Office365ï¼ˆãŠã‚ˆã³ãã®IDåŸºç›¤ã§ã‚ã‚‹Azure ADï¼‰ã®æ§‹é€ ä¸Šã®å•é¡Œã«ã‚ˆã‚Šã€æ„å›³ã—ãªã„ã‚¢ã‚¯ã‚»ã‚¹æ¨©ã‚’å¤–éƒ¨ãƒ¦ãƒ¼ã‚¶ã¸ä»˜ä¸Žã—ã¦ã—ã¾ã†å ´åˆãŒã‚ã‚‹ã®ã§ã€æ³¨æ„å–šèµ·ã®æ„å‘³ã§æœ¬ã‚¨ãƒ³ãƒˆãƒªã‚’æ›¸ãã¾ã™ã€‚ [3/7 Update] ä¸€éƒ¨ä¿®æ£ãŒè¡Œã‚ã‚Œã€ãƒãƒ¼ã‚¿ãƒ«ã‹ã‚‰ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªæ§‹æˆæƒ…å ±ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ãƒ–ãƒãƒƒã‚¯ã•ã‚Œã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ è©³ã—ãã¯ã“ã¡ã‚‰ã‚’ã”è¦§ãã ã•ã„ã€‚ http://idmlab.eidentity.jp/2017/03/office365.html ç¾åœ¨ã€ã“ã®èª²é¡Œã«
s_nagano 2017/01/11
â€œæ„å›³ã—ãªã„ã‚¢ã‚¯ã‚»ã‚¹æ¨©ã‚’å¤–éƒ¨ãƒ¦ãƒ¼ã‚¶ã¸ä»˜ä¸Žã—ã¦ã—ã¾ã†å ´åˆãŒã‚ã‚‹â€

Azure

Office

ADFS

AD

office 365

SharePoint
ãƒªãƒ³ã‚¯
1