Tutorial: Configure Secure Hybrid Access with Azure Active Directory and Silverfort
Silverfort uses agent-less and proxy-less technology to connect your assets on-premises and in the cloud to Azure Active Directory (Azure AD). This solution enables organizations to apply identity protection, visibility, and user experience across environments in Azure AD. It enables universal risk-based monitoring and assessment of authentication activity for on-premises and cloud environments, and helps to prevent threats.
In this tutorial, learn how to integrate your on-premises Silverfort implementation with Azure AD.
Learn more: Hybrid Azure AD joined devices.
Silverfort connects assets with Azure AD. These bridged assets appear as regular applications in Azure AD and can be protected with Conditional Access, single-sign-on (SSO), multi-factor authentication (MFA), auditing and more. Use Silverfort to connect assets including:
- Legacy and homegrown applications
- Remote desktop and Secure Shell (SSH)
- Command-line tools and other admin access
- File shares and databases
- Infrastructure and industrial systems
Silverfort integrates your corporate assets and third-party Identity and Access Management (IAM) platforms. This includes Active Directory, Active Directory Federation Services (ADFS), and Remote Authentication Dial-In User Service (RADIUS) on Azure AD, including hybrid and multicloud environments.
Use this tutorial to configure and test the Silverfort Azure AD bridge in your Azure AD tenant to communicate with your Silverfort implementation. After configuration, you can create Silverfort authentication policies that bridge authentication requests from identity sources to Azure AD for SSO. After an application is bridged, you can manage it in Azure AD.
Silverfort with Azure AD authentication architecture
The following diagram shows the authentication architecture orchestrated by Silverfort, in a hybrid environment.
- User sends authentication request to the original Identity Provider (IdP) through protocols such as Kerberos, SAML, NTLM, OIDC, and LDAP(s)
- The response is routed as-is to Silverfort for validation to check authentication state
- Silverfort provides visibility, discovery, and a bridge to Azure AD
- If the application is bridged, the authentication decision passes to Azure AD. Azure AD evaluates Conditional Access policies and validates authentication.
- The authentication state response goes as-is from Silverfort to the IdP
- IdP grants or denies access to the resource
- User is notified if access request is granted or denied
You need Silverfort deployed in your tenant or infrastructure to perform this tutorial. To deploy Silverfort in your tenant or infrastructure, go to silverfort.com Silverfort to install the Silverfort desktop app on your workstations.
Set up Silverfort Azure AD Adapter in your Azure AD tenant:
- An Azure account with an active subscription
- You can create an Azure free account
- One of the following roles in your Azure account:
- Global Administrator
- Cloud Application Administrator
- Application Administrator
- Service Principal Owner
- The Silverfort Azure AD Adapter application in the Azure AD gallery is pre-configured to support SSO. From the gallery, add the Silverfort Azure AD Adapter to your tenant as an Enterprise application.
Configure Silverfort and create a policy
From a browser, sign in to the Silverfort admin console.
In the main menu, navigate to Settings and then scroll to Azure AD Bridge Connector in the General section.
Confirm your tenant ID, and then select Authorize.
Select Save Changes.
On the Permissions requested dialog, select Accept.
A Registration Completed message appears in a new tab. Close this tab.
On the Settings page, select Save Changes.
Sign in to your Azure AD console. In the left pane, select Enterprise applications. The Silverfort Azure AD Adapter application appears as registered.
In the Silverfort admin console, navigate to the Policies page and select Create Policy. The New Policy dialog appears.
Enter a Policy Name, the application name to be created in Azure. For example, if adding multiple servers or applications for this policy, name it to reflect the resources covered by the policy. In the example, we create a policy for the SL-APP1 server.
Select the Auth Type, and Protocol.
In the Users and Groups field, select the edit icon to configure users affected by the policy. These users' authentication bridges to Azure AD.
- Search and select users, groups, or Organization Units (OUs).
- Selected users appear in the SELECTED box.
Select the Source for which the policy will apply. In this example, All Devices is selected.
Set the Destination to SL-App1. Optional: You can select the edit button to change or add more resources, or groups of resources.
For Action, select AZURE AD BRIDGE.
Select Save. You're prompted to turn on the policy.
In the Azure AD Bridge section, the policy appears on the Policies page.
Return to the Azure AD console, and navigate to Enterprise applications. The new Silverfort application appears. You can include this application in Conditional Access policies.