Nordlicht Reisen GmbH, a fictional travel agency, has 220 employees with accounts in an on-premises Active Directory, around 400 external users at hotels and airlines, and customers who sign in to the portal. Who signs in how is the first decision of the cloud: It determines whether employees can still get in during an outage in Hamburg and whether an outside hotel needs a new password. This lesson recommends a sign-in solution and an identity management solution.
Prior knowledge. What Microsoft Entra ID and Domain Services are is covered in "AZ-900 compact, lesson 2.6". You set up users, groups, guests and SSPR in "AZ-104, lessons 1.1 and 1.2". Multitenant apps and workload identities are covered in "K4, lesson 4.7.3", managed identities in "K3, lesson 3.3.1". None of that is repeated here.
The requirement
Requirements sheet according to lesson 0.2, starting point G-01 to G-10. All numbers are assumptions of the task.
| No. | Requirement | Type | Measure | Weight | Source |
|---|---|---|---|---|---|
| 1.2-01 | Employees sign in to Azure and Microsoft 365 with the accounts of the on-premises AD. | F | 220 accounts, one forest; assumption | Must | Operations |
| 1.2-02 | Sign-in works even if the data center in Hamburg fails. | Q | failure of the site; assumption | Must | Management |
| 1.2-03 | An account disabled in the AD loses access to cloud applications promptly. | Q | within 30 minutes; assumption | Should | Security |
| 1.2-04 | Partners (G-05) sign in with the accounts of their own organization. | F | about 400 users; assumption | Must | Partner management |
| 1.2-05 | Customers register in the portal with email or a social account, separate from the employees. | F | no number | Must | Sales |
| 1.2-06 | Administrators and access to partner data from outside require a second factor. | Q | all administrators; assumption | Must | Security |
| 1.2-07 | The old booking application in Azure needs domain join, LDAP and Kerberos. | F | one application; assumption | Should | Development |
Cost frame. Cost comes before operating convenience, not before security. Cost drivers: license tier per user, for External ID the monthly active users (MAU), for Domain Services the running service.