{"id":44461,"date":"2021-03-23T13:00:00","date_gmt":"2021-03-23T17:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=44461"},"modified":"2024-08-15T11:34:08","modified_gmt":"2024-08-15T15:34:08","slug":"user-provisioning-ad","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/user-provisioning-ad","title":{"rendered":"User Provisioning & Active Directory"},"content":{"rendered":"\n
Provisioning users to a variety of IT resources – think Mac\/Linux\/Windows machines, web applications, cloud infrastructure, VPNs, and more – is part of any admin\u2019s job, but establishing a single identity for each resource with Active Directory\u00ae<\/sup> (AD or MAD) presents a challenge. AD is not natively designed to federate identities to resources that have emerged – e.g. cloud infrastructure \/ web applications – since it was invented in 1999. Further, with the on-going global pandemic and the shift to remote work, provisioning user access to IT resources has become even more challenging.<\/p>\n\n\n\n Ideally, using one authoritative identity per user \u2014 which they use to access their permitted systems, apps, networks, and files \u2014 prevents identity sprawl<\/a> and enables admins to suspend access across their organization’s infrastructure immediately. Further, in the modern era of security, this approach can enable IT admins to leverage Zero Trust principles<\/a> to further lock down their infrastructure. Zero Trust and it\u2019s instantiation through Conditional Access policies are an important tool whether a user\u2019s credentials are compromised, the user leaves the organization or they are just accessing IT resources remotely.<\/p>\n\n\n\n However, despite the challenges of connecting users to modern IT resources, many admins see no alternative to AD because of its dominance in the market over the last twenty years. Its strengths in Windows-based user management and configuration are well known, but in an era where there are more non-Windows resources and work-from-home (WFH) is prevalent, is the on-prem domain model the correct one? In this post, we\u2019ll examine modern user provisioning requirements and how to best meet them while either maintaining AD and reducing identity sprawl or by considering the alternative: the Domainless Enterprise.<\/p>\n\n\n\n It\u2019s worth taking stock of the needs in your IT environment by asking yourself some important fact-finding questions:<\/p>\n\n\n\n Modern organizations regularly use SaaS and IaaS platforms to get work done, whether they are email platforms and the associated productivity suites, web applications to manage customer relationships and organize projects, or used to host infrastructure in the cloud. They are also increasingly providing Mac systems to their users. Each of these resources introduces heterogeneity and complexity in an IT environment.<\/p>\n\n\n\n For admins with a customized AD instance and deep knowledge of the domain, they might not envision migrating off AD to a cloud directory service \u2014 but they likely recognize the need to supplement it with add-ons to connect users with all of these resources. For some organizations, the chance to completely shift their user management infrastructure to the cloud is a welcome opportunity to modernize their management toolset.<\/p>\n\n\n\n The following resources challenge the AD model and require a different approach for user provisioning:<\/p>\n\n\n\n Of course, the remote work model that is taking over the world is also a major challenge for IT organizations. Admins who want to avoid juggling add-ons tailored for each of these resources should seek a universal AD bridge or, if possible, completely eliminate their on-prem AD instance altogether. Using a single and comprehensive federation service limits additional tooling admins need to manage, and it keeps the total cost of ownership of AD<\/a> as low as possible. If admins use one federation service for Mac machines and another for web app single sign-on (SSO), for example, their costs increase more than if they\u2019d employed a single solution for both. One such comprehensive solution is JumpCloud\u00ae<\/sup> Active Directory Integration<\/a> for those that seek to extend their AD instance, while JumpCloud\u2019s cloud directory platform can be leveraged to eliminate AD while providing user management and authentication capabilities to a wide range of IT resources.<\/p>\n\n\n\n Through JumpCloud\u2019s Active Directory Integration feature, admins can sync their AD identities with virtually all non-Windows and cloud resources and introduce key improvements in user and system management.<\/p>\n\n\n\n Using AD Integration, you can provision AD identities to Mac, Windows, and Linux machines and manage those machines\u2019 security configurations. You can apply cross-OS Policies<\/a> to lock down machines across your fleet \u2014 such as enforcing full disk encryption (FDE) and restricting user changes to system settings. You can also require multi-factor authentication (MFA) to systems, servers, apps, VPNs, and user portals. <\/p>\n\n\n\n You can provision AD identities to SaaS apps and enable single sign-on for users. JumpCloud features a catalog of hundreds of pre-configured SAML single sign-on (SSO) connectors<\/a>, as well as a generic SAML connector for use with proprietary or less common SAML apps. You can also automate app account creation with Just-in-Time (JIT) and SCIM provisioning for select apps.<\/p>\n\n\n\n With AD Integration, users can access domain-bound resources and their productivity suites (such as Google Workspace and Microsoft 365\u2122) with the same credentials as well. You don\u2019t need to manage Google Cloud\u2122 Directory Sync (GCDS)<\/a>, Azure\u00ae<\/sup> Active Directory (or AAD Connect), or other third-party solutions or middleware. You also avoid needing to manage an asynchronous directory in the productivity suite. <\/p>\n\n\n\n\nModern User Provisioning Requirements<\/h2>\n\n\n\n
\n
\n
Benefits of Active Directory Integration<\/h2>\n\n\n\n
1. System Provisioning & Management<\/h3>\n\n\n\n
2. Provision Users to Web Apps & Non-Windows Resources<\/h3>\n\n\n\n
3. Sync with Productivity Suites: Google Workspace & Microsoft 365<\/h3>\n\n\n\n