Getting Started - Azure Active Directory On-Demand Assessment

The On-Demand Assessment - Azure Active Directory (AD) is a cloud service that analyzes and provides identity and access management (IAM) guidance for Azure AD and related components. The analysis generates a list of recommendations to address with remediation guidance and best practices to improve the health and security of Azure resources. In addition, the assessment identifies features that can be enabled to expand Azure AD capabilities. Assessments are available through the Services Hub to help optimize the availability, security, and performance of Microsoft technology investments. These assessments use Microsoft Azure Log Analytics, which is designed to simplify IT and security management across the environment.

This assessment is designed to provide specific actionable guidance grouped in focus areas to mitigate risks to Azure Active Directory and the organization.

Key pillars of the Azure AD Assessment

• Identity and Access Management
• Governance
• Operations
• Authentication
• Security

Running the Azure AD Assessment

Prerequisites

To take full advantage of the On-Demand Assessments available through Services Hub, it's required to:

1. Have linked an active Azure Subscription to Services Hub and added the Azure AD assessment. For more information, see Getting Started with On-Demand Assessments or watch the how to link video.

2. An assessment scheduled task account (domain or local user) with the following rights:

• Administrative access to the data collection machine
• Log on as a batch job privileges on the data collection machine

3. An Azure AD account for the setup of the Azure AD registered application with the following properties:

• Global Administrator
• Non-federated

4. Review the Azure AD Assessment Prerequisites . This document explains the detailed technical documentation of the Azure AD Assessment and the server preparation needed to run the assessment. It also documents the different types of data collected by the assessment.

Note

On average, it takes two hours to initially configure your environment to run an On-Demand Assessment. After you run an assessment you can review the data in Azure Log Analytics. This will provide you with a prioritized list of recommendations, categorized across six focus areas. This allows you and your team to quickly understand risk levels, the health of your environments, act to decrease risk, and improve your overall IT health.

Setup the Microsoft Azure AD Assessment on the data collection machine

Note

You will only be able to successfully setup the assessment once you have linked your Azure Subscription to Services Hub and added the Azure AD Assessment from IT Health -> On-Demand Assessments in Services Hub.

Register the Microsoft Assessments application in the in-scope Azure AD tenant

1. On the data collection machine create the following folder: C:\OMS\AzureAD (or any other folder as you may please)
2. Open regular Powershell (not ISE) in Administrator mode and run the cmdlet below to create the registered app in the Azure AD tenant being assessed:

 New-MicrosoftAssessmentsApplication

Note

If the command New-MicrosoftAssessmentsApplication is not available, the module is not yet found. It can take some time after installing the agent before it to show up.

3. Provide the required Azure AD account credentials that satisfy the requirements mentioned in this article earlier. Click accept on the admin consent prompt for the read permissions this application requires for the assessment.

Note

Please refer to Permissions for Microsoft Azure AD Assessment Application for consent details.

Create the assessment scheduled task

1. Open regular Powershell (not ISE) in Administrator mode and run the cmdlet below using the parameters below, replacing <Directory> and <AccountName> with assessment working directory, and assessment scheduled task account name:

[!IMPORTANT] Do not use the "C:\ODA" as a working directory path, as this is reserved by the system!

 Add-AzureAssessmentTask -WorkingDirectory <Directory> -ScheduledTaskUsername <accountname>

WorkingDirectory is a path to an existing directory used to store the files created while collecting and analyzing the data from the environment

Workspace Id – provide id for the Log Analytics workspace that will be used to store the uploaded data

Note

If the command Add-AzureAssessmentTask is not available, the module is not yet found. It can take some time after installing the agent before it to show up.

2. The script will continue with the necessary configuration and create a scheduled task that will trigger the data collection.

3. Data collection is triggered by the scheduled task named AzureAssessment within an hour of running the previous script and then every 7 days. The task can be modified to run on a different date/time or even forced to run immediately from the task scheduler library -> Microsoft -> Operations Management Suite -> AOI*** -> Assessments -> AzureAssessment

Assessment execution

4. During collection and analysis, data is temporarily stored under the Working Directory folder that was configured during setup.

5. After a few hours, your assessment results will be available on your Log Analytics and Services Hub. You can navigate to see the results by going into Services Hub -> Health -> Assessments and then clicking on "View all recommendations" in the active assessment.

6. If you wish to get a Microsoft Accredited Engineer to go over the issues about your Azure AD Assessment with you, you can contact your Microsoft Representative and ask them about the Remote or Onsite CSA led delivery.

Agreement	Remote Engineer	Onsite Engineer
Premier	Azure AD Remote Datasheet	Azure AD Onsite Datasheet
Unified	Azure AD Remote Datasheet	Azure AD Onsite Datasheet