Windows Azure Identity Integration

Organizations deploying Microsoft’s hosted-services, such as Office 365, are using Windows Azure Active Directory (WAAD), a multitenant directory and identity provider. With directories and identity providers both on-premises and in Microsoft’s data centers, organizations will want to make sure they use each directory appropriately, and they will likely want to integrate them for easier management and to support single sign-on (SSO). Because WAAD instances can be created in multiple ways and by multiple users, organizations need to ensure the number of WAAD instances does not needlessly proliferate, and understand that different integration options may require additional identity management services.

Windows Azure Active Directory

WAAD is a scalable, multitenant, Microsoft-hosted directory and identity provider service. WAAD stores information about users, such as the user’s name, organization, and privileges, as directory objects and associated attributes. It can issue security tokens on behalf of each authenticated user that contain user-specific claims, which are based on the user’s information stored in the directory. Applications and services can use the claims in the security tokens from WAAD instances it trusts to determine the level of access to give to the user. Originally, WAAD was the directory and identity provider service for claims-based authentication and access to Microsoft’s Business Productivity Online Suite. It has evolved into a directory and identity provider for Microsoft’s hosted services such as Office 365, Dynamics CRM, and Windows Intune, as well as for a third-party’s and an organization’s proprietary and customer-facing applications, which can also rely on the claims from WAAD secure tokens for authentication and access control.