{"id":45847,"date":"2020-04-20T11:10:59","date_gmt":"2020-04-20T17:10:59","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=resource&p=45847"},"modified":"2022-10-20T18:21:23","modified_gmt":"2022-10-20T22:21:23","slug":"domainless-enterprise-roadmap","status":"publish","type":"resource","link":"https:\/\/jumpcloud.com\/resources\/domainless-enterprise-roadmap","title":{"rendered":"Roadmap to the Domainless Enterprise"},"content":{"rendered":"\n
Most IT organizations use Active Directory\u00ae<\/sup>, and they\u2019ve navigated seismic technological developments with it. As new technologies have emerged and cloud services have boomed, IT admins have augmented their AD instances with new add-ons and identity bridges to incorporate each new resource and centrally authenticate users to it.<\/p>\n\n\n\n What this means in practice is that the total cost of ownership of AD is much higher than its up front server and licensing costs, though. The TCO increases with each new add-on and identity bridge. As admins now must navigate a swift transition out of their offices, they need additional add-ons to accommodate and secure users working remotely.<\/p>\n\n\n\n Active Directory enables admins to establish an internal network \u2014 the domain \u2014 to secure on-premises resources and data. However, admins now need new and more efficient ways to expand the domain to users, devices, and resources located outside the traditional office.<\/p>\n\n\n\n An emerging cloud-based architecture integrates with AD to securely extend AD identities to virtually all resources beyond the traditional domain and centrally authenticate users and systems. This architecture can also serve as a stepping stone toward the domainless enterprise<\/em><\/a>. In the domainless enterprise model, admins\u2019 operations are as seamless off-premises as they are on, and users and devices are secured entirely from the cloud.<\/p>\n\n\n\n Armed with this innovative cloud directory architecture, organizations can realize faster time to market, reduce labor-intensive deployment, and achieve flexibility and fluidity in responding to external pressures and market forces.<\/p>\n\n\n\n Organizations primed for use of this architecture include those with: <\/p>\n\n\n\n You can take the following steps now to implement this architecture, ease your transition to remote work, and position your organization for a more significant IT transformation in the future \u2014 without disrupting your current directory environment.<\/p>\n\n\n\n First, we\u2019ll run through the steps an organization can take to move toward the domainless enterprise model, and then we\u2019ll cover considerations for selecting the right cloud directory service provider, training end users for secure mobile work, and preparing for the future. <\/p>\n\n\n\n With AD in place, you might use largely Windows\u00ae<\/sup> systems, Azure\u00ae<\/sup> or AWS\u00ae<\/sup> for cloud infrastructure, and Office 365TM<\/sup> as your productivity suite. You might combine these solutions with a vendor to enable web application single sign-on (SSO)<\/a>, other vendors to manage a smattering of Mac and Linux systems, and a VPN solution to connect users to the internal network when they work remotely.<\/p>\n\n\n\n Although this approach works, you might find there are more economical and cloud-forward ways to do so. These questions can help you assess your existing stack:<\/p>\n\n\n\n This kind of assessment can reveal that the total cost of extending AD<\/a> with an array of vendors is higher than expected, as well as identify opportunities to reduce those costs. Comprehensive identity bridge solutions exist that allow you to maintain AD as the source of truth but consolidate vendors and introduce deep system management capabilities for all operating systems, rather than just Windows machines. <\/p>\n\n\n\n The next step in moving toward the domainless enterprise model is to stand up a cloud-based directory, which can run in parallel with AD. This type of integration allows you to import AD users into the cloud directory service and sync changes between the two.<\/p>\n\n\n\n Through this integration, you can begin to eliminate vendors and add-on solutions by federating core AD identities via the cloud directory service to virtually all the resources AD struggles to manage. Ideally, you can get to the point where you only need AD combined with the cloud directory solution and don\u2019t need to rely on other vendors for additional management or federation functionality.<\/p>\n\n\n A worthwhile cloud directory solution will enable you to manage many AD tasks from a web-based console, rather than requiring you to be on-prem or use a VPN to connect directly to AD. By introducing a comprehensive, cloud-based access control and device management platform, you can take a more economical approach to extending AD. Vendor consolidation can also help reduce the risk of incompatibilities between software, increase flexibility in responding to new challenges like distributed workforces, and reduce the number of solutions required to securely authenticate users to the resources they need.<\/p>\n\n\n\n You can then take steps to track, secure, and troubleshoot computers, whether those systems are located in the office or elsewhere. These strategies can aid you now and in the future, particularly if remote work becomes a more regular part<\/a> of our daily work lives.<\/p>\n\n\n\n Systems serve as the conduit through which users access all their other allowed IT resources, so you\u2019ll want to ensure they\u2019re properly configured and monitored. This is particularly true when users work remotely, further away from IT\u2019s traditional office purview. An OS-agnostic cloud solution can extend AD identities to major operating systems, including Windows, Mac, and Linux, as well as take on remote system management tasks that AD cannot.<\/p>\n\n\n\n You can use this type of cloud directory solution to implement security configurations<\/a>, such as enforcing full disk encryption or requiring multi-factor authentication (MFA) at login, across a fleet of machines. The cloud solution can also return key telemetry about machine health and status. <\/p>\n\n\n\n These additional tools can also assist you in managing machines, wherever they are: <\/p>\n\n\n\n It\u2019s also critical to ensure that the networks by which users access resources are secure. With cloud RADIUS functionality, you can provision user access to the office WiFi and the VPN client with those users\u2019 core AD credentials. A cloud solution provides RADIUS functionality without additional on-premises infrastructure (i.e., a physical RADIUS server) and heads off challenges that exist in syncing a VPN directly with AD<\/a>.<\/p>\n\n\n\n Ideally, a cloud directory solution will also enable MFA so that users are prompted for another form of authentication, such as a TOTP MFA code<\/a>, when they log into the VPN. MFA is a critical line of defense for organizational access points, and studies have shown it to be incredibly effective against bulk phishing, bots, and even targeted attacks.<\/p>\n\n\n\n Particularly when much of an organization\u2019s workforce is remote, a secure VPN connection can enable users to connect to the internal AD network when needed, as well as protect their traffic if they work on unsecured home or public WiFi networks.<\/p>\n\n\n\n It\u2019s also critical to ensure you have secure authentication mechanisms for each of the applications in your portfolio. That will look different for legacy and LDAP apps than for SaaS apps, but a cloud directory solution can accommodate both.<\/p>\n\n\n\n A cloud directory integration capable of cloud LDAP, SAML, and other application authentication mechanisms allows you to provision app access using the same core AD identities. That way, users can access their LDAP apps and an SSO portfolio of SaaS apps with the same credentials they use to access their other resources. This approach can also replace a targeted web application SSO solution because the SSO capability is baked into the cloud directory solution itself, but users will still be able to access their web applications through a familiar and convenient portal.<\/p>\n\n\n\n MFA is critical to protect application access, too, so the cloud directory solution should enable you to require it at login.<\/p>\n\n\n\n Cloud LDAP functionality also helps you provide user access to network-attached storage (NAS) appliances, Samba file servers, and other resources that require a backing LDAP directory. That way, users can access organizational data, even if they\u2019re working outside the office, with the same core credentials.<\/p>\n\n\n\n If you want to take steps to move more of your stack to the cloud, you can implement cloud NAS solutions<\/a> so employees can share files quickly wherever they\u2019re based without the need to maintain on-prem infrastructure.<\/p>\n\n\n\n Once you\u2019ve implemented a cloud directory solution and secure authentication mechanisms for your IT resources, you can implement automated workflows to provision users<\/a> and zero-touch deployments<\/a> to ready machines for use.<\/p>\n\n\n\n You can even integrate the human capital management (HCM) system, so that when HR creates user identities in the HCM they are then translated into directory objects in the cloud directory service. Those identities can then flow onward to AD and the other IT resources where they\u2019re needed. The workflow looks like this:<\/p>\n\n\n\n HR System \u2192 Cloud Directory Service \u2192 AD & All Other IT Resources<\/p>\n<\/div>\n\n\n\n You can similarly automate deprovisioning so that, if a user leaves the organization, you can suspend them in the cloud directory service and rest assured that the user\u2019s access is suspended across your environment, including in AD.<\/p>\n\n\n\n Automated provisioning and deprovisioning<\/a> from the cloud allow you to reduce the amount of manual data entry you do, as well as easily manage user lifecycle stages from any location. <\/p>\n\n\n\n As you map your transition toward the domainless enterprise model, these additional considerations will help guide the process. <\/p>\n\n\n\n If you plan to trust core services to cloud service providers, you can first outline how you\u2019ll vet those service providers. Best practices include: <\/p>\n\n\n\n These practices help you ensure that, as you extend into the cloud, you maintain the same tight security that you have in on-prem environments. <\/p>\n\n\n\n Particularly if you have a more mobile and remote workforce \u2014 including users equipped with laptops \u2014 you can enumerate clear procedures for users about organizational security and threats like phishing.<\/p>\n\n\n\n You can use regular security training<\/a> to teach users how and when to use the VPN and secure their home WiFi networks, employ good password hygiene, and limit their work to managed devices (and keep personal browsing on personal devices). These types of practices help users continue to work securely, whether that\u2019s in the office or elsewhere.<\/p>\n\n\n\n In the short-term, the above steps will help you respond to urgent public health concerns in your community but maintain business continuity and security. In the long-term, these steps can prepare you to move beyond the domain all together. With a cloud directory integration running parallel to AD, you can begin to shift your workflows to the cloud and undertake a broader cloud transformation for your organization.<\/p>\n\n\n\n There are various circumstances that might prompt a move away from AD<\/a> \u2014 such as a failed domain controller<\/a> or a merger \u2014 and you can be more prepared if and when they arise. In a true domainless enterprise, admins can secure every user and device from the cloud, without any complex on-prem infrastructure or networking required.<\/p>\n\n\n\n At JumpCloud\u00ae<\/sup>, we\u2019re intent on helping organizations navigate the current transition to remote work and strategize about how to become more cloud-forward in the future. Our cloud directory platform is built just for those purposes, and we want to share that vision with you. Click here to learn more about moving off-prem in the domainless enterprise<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" This roadmap helps organizations implement cloud architecture, transition to remote work, and prepare for a future IT transformation.<\/p>\n","protected":false},"author":89,"featured_media":45848,"template":"","categories":[42],"collection":[],"wheel_hubs":[],"platform":[],"resource_type":[2311],"funnel_stage":[],"coauthors":[2545],"acf":[],"yoast_head":"\nDomainless Enterprise Model: Step By Step<\/h2>\n\n\n\n
1. Take Stock of Your Existing Environment <\/h3>\n\n\n\n
2. Implement a Cloud-Based Directory Integration <\/h3>\n\n\n\n
<\/figure><\/div>\n\n\n
3. Identify Strategies to Track, Secure, & Troubleshoot Remote Systems<\/h3>\n\n\n\n
4. Secure Network Access<\/h3>\n\n\n\n
5. Secure SSO Authentication to LDAP & SaaS Apps<\/h3>\n\n\n\n
6. Secure File Access<\/h3>\n\n\n\n
7. Automate & Streamline Provisioning Processes<\/h3>\n\n\n\n
Three Additional Considerations<\/h2>\n\n\n\n
1. Keep Security Front-of-Mind<\/h3>\n\n\n\n
2. Implement Security Procedures & End User Training<\/h3>\n\n\n\n
3. Plan for the Future<\/h3>\n\n\n\n