Updated on March 14, 2024

Azure AD Plugin for User Risk Exchange

Azure AD Plugin for User Risk Exchange

This document explains how to configure Azure AD with User Risk Exchange in the Netskope Cloud Exchange platform. This integration enables seeing multiple connected systems’ risk values for individual users and groups. The Microsoft Azure AD Risk Exchange plugin fetches users and their respective score and perform actions on them. Supported record types include Users.

Prerequisites

To complete this configuration, you need:

  • A Netskope tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
  • A Netskope Cloud Exchange tenant with the User Risk Exchange module already configured.
  • An Azure AD account.
  • An Azure AD Premium P2 subscription.
  • Connectivity to the following hosts:
    • https://graph.microsoft.com/
    • https://login.microsoftonline.com/
    • https://portal.azure.com/
Permissions

Refer to Get your Azure AD Credentials for details about obtaining and providing necessary permissions.

  • Group.Create
  • Group.ReadWrite.All
  • GroupMember.Read.All
  • IdentityRiskyUser.ReadWrite.All
  • User.Read.All
Performance

Instance details:

  • RAM: 15 GB
  • CPU: 8 Core
DataTime taken to Fetch Risky UsersTime taken to Fetch Risky Users Score
200K~15 Sec~20 Min

Workflow

  1. Obtain your Azure AD credentials: Client (Application) ID, Client Secret ID, Tenant ID, Microsoft Azure AD URL, and Microsoft Graph Token URL.
  2. Configure the Azure AD plugin.
  3. Configure User Risk Exchange Business Rules and Actions for the Azure AD plugin.
  4. Validate the Azure AD plugin.

Click play to watch a video.

 

Get your Azure AD Credentials

  1. Go to https://portal.azure.com/ and log in.
  2. Click Azure Active Directory, and go to Overview > Basic Information.
    image3.png
  3. Here you will find your Tenant ID. Copy this to use when you configure the plugin.
    URE-Azure-TenantID.png
  4. On the left hand side of Azure Active Directory, click App registrations.
    image4.png
  5. Click on your application name or New Registration. For a new registration, enter a name and click Register.
  6. On the application page, you will find Application (client) ID. Copy this to use when you configure your plugin. This is for the Client (Application) ID setting for the plugin.
    image5.png
  7. Click Certificates and Secrets.
    image6.png
  8. Click on + New Client Secret to create your key, and enter a description for you secret ID, select the duration for the secret value (by default it will be 6 months), click Add. Make sure you copy the value (NOT secret id), which is used for the Client Secret ID in the plugin. You can only get this when a Client Secret is first created.
    image7.png
    image8.png
  9. Next, perform the following steps:
    1. Click + Add a permission and then select + Add a permission.Click Microsoft Graph.Click Application Permission.Search for the following:
      • Group.CreateGroup.ReadWrite.AllGroupMember.Read.AllIdentityRiskyUser.ReadWrite.AllUser.Read.All
      Grant admin consent on left side.
  10. Use https://graph.microsoft.com as the Microsoft Azure AD URL, and use https://login.microsoftonline.com as the Microsoft Graph Token URL.
  11. Collect the Tenant ID, Client (Application) ID, and Client Secret ID to configure the plugin.

Configure the Azure AD Plugin for User Risk Exchange

  1. In Cloud Exchange, go to Settings > Plugins.
    image10.png
  2. Search for and select the Microsoft Azure AD v1.2.0 (URE) plugin box.
    image11.png
  3. Enter a Configuration Name and the Sync Interval.
  4. Enter the Client (Application) ID, Client Secret ID, and Tenant ID, Microsoft Azure AD URL obtained earlier.
  5. Select a range of scores.
  6. Click Save.

Configure Business Rules for the Azure AD Plugin

  1. Go to User Risk Exchange and click Business Rules.
  2. Click Create New Rule
    image14.png
  3. Select the options in the filter that you want to use. From the dropdowns, select a field, an operator, and a value. For example: Aggregate Score Grouping – Any in – medium.
    image10.png

    .

You can see what your users’ scores are by going to Users in the User Risk Exchange left panel.

Configure Actions for the Azure AD Plugin

  1. Go to User Risk Exchange and click Actions.
  2. Click Add Action Configuration.
    image18.png
  3. Click the Business Rule dropdown and choose the appropriate Business rule.
  4. Select the Configuration dropdown and choose your Azure plugin.
  5. Select Actions from the dropdown and select Add to Group, Remove to Group, No Action, or Confirm Compromised.
    • Add to Group : When triggered, users are added to that group.
    • Remove to Group : When triggered, users are removed from that group.
    • No Action : This does not perform any actions on users.
    • Confirm Compromised: When triggered, the compromised action will confirm that the user that is added to risky used is actually a risky user, and change the Risk State of that user to Confirm Compromised.
    image16.png
  6. Select a Group from the dropdown, or select Create new group from the Group dropdown, and enter the Group Name if you want to create a new group in Azure AD.
  7. Click Save.
  8. Click Sync to perform the action manually. Enter the days and click Fetch button to see the number of users that will be affected by this action.
  9. Click Sync for performing actions.

Validate the Azure AD Plugin for User Risk Exchange

Validate in Cloud Exchange

To verify the plugin is working correctly, go to User Risk Exchange > Action Logs to confirm whether any Azure AD risky users are being listed.

Validate in Microsoft Azure AD

Add to Group and Remove from Group Action
  1. In Azure, go to Home > Azure Active Directory.
    image21.png
  2. Click Groups on the menu on the left hand side.
    image22.png
  3. Search and select the name of your group. For example, Netskope in this case.
    image23.png
  4. Click Members from the menu on the left hand side.
    image24.png
  5. Verify the member is in or not in the group according to the action you performed. In this case, we added a member and we have a member (JA) in the group.
    1. If Add to group action is performed, then user will be added to the group.
    2. If Remove from group action is performed, then user will be deleted to the group.
    image25.png
Confirm a Compromised Action
  1. Log in to Microsoft Azure platform and search for Azure AD Risky Users.
    image26.png
  2. You’ll see Risk State. Initially when user is added to Risky Users then its risk state is At Risk and after the action performed then it’s risk state should changed to Confirm compromised as shown in below screenshot.

    Note

    This may take a few minutes (around 3 minutes) after the action Confirm Compromised is performed for the status of a user to change on the Azure platform.

    image27.png

Limitations

Netskope CE has some limitations related to Actions in the User Risk Exchange module. Here are the known limitation and steps to prevent them.

Update Plugin

After upgrading the Plugin from v1.1.2 to v1.2.0, you may get the Group ID displayed in the Action instead of the Group Display Name.

Edit the Action and select the Group according to the previously saved group.

image28.png

Delete/Edit Group

If the Group is Updated/Deleted from the Microsoft Azure AD then the Group name will be displayed as below.

{"id": "26739fd0-bba6-4eb7-b761-878e6f460a1c", "displayName": "Netskope CE Azure AD Demo", "display_name": "Netskope CE Azure AD Demo (Security)", "group_type": "Security"}

In the case of an Updated Group name, it won’t cause any failure, but if a Group is deleted it, will throw an error.

image29.png
Share this Doc

Azure AD Plugin for User Risk Exchange

Or copy link

In this topic ...