Introduction to the Microsoft identity platform for developers

Editor's Notes

• #5: First, if you have a password database, it’s time to not have that anymore, period. Move ASAP
• #6: With our identity platform, we’re able to help you address some the challenges you’re looking for when developing apps. With Microsoft identity services, you can build applications that authenticate and sign in any Microsoft identity – personal Microsoft accounts like outlook.com, Xbox live and enterprise identities powered by Azure AD. Azure Active Directory (Azure AD) is Microsoft’s cloud-based identity and access management service for the enterprise which helps employees sign in and access resources. Now why should developers care about our identity platform? Well, there are four key benefits on why you should be using the Microsoft identity platform: First, you can simplify sign-in for users. You can allow users to sign-in with their Microsoft accounts, their social accounts or their work or school accounts provisioned by Azure AD. Azure AD is used by millions of enterprise users which can make it easier for your end users to sign-in or sign-up for your app. Second, you’ll be able to extend security features to your application to enterprises and consumers who already use Microsoft identities. Azure AD customers get built in benefits like passwordless auth, conditional access, identity protection and more. And just by supporting Azure AD…you’ll get these benefits extended to your application. Integration with Azure AD comes with advanced security and access management benefits that do not require you to write additional code. Help your application comply with IT policies by integrating with Azure AD. IT will love you when you integrate with Azure AD. Third, you can build richer applications by accessing you or your customers data in Microsoft 365 through the Microsoft Graph. To access data the data in Microsoft Graph, you’ll first need to authenticate Microsoft identities. Once you’ve integrated Microsoft identity into your app, you can make it easy for admins and end users to adopt it. Your app could be eligible in getting surfaced in Microsoft marketplaces. Let’s talk a little bit more about the opportunity to integrate with Azure AD.
• #7: Microsoft is one of the largest identity providers. Azure Active Directory manages over a billion identities, and billions of authentications a day. Over 200K customers, including most Fortune 500 companies, use Azure Active Directory. This is the potential opportunity that your app can reach.
• #9: So let’s start with some of the asks and needs that developers have when it comes to identity and access management (IAM) solutions? Developers in your organization are likely looking for a couple things when it comes to sign-in and authentication: How quickly can I get started to build authentication into my apps. Authentication isn’t something many developers have expertise in. Developers are looking to get their app running with authentication and signing-in users quickly so they can focus on the core value of the app or services. Is the identity platform well integrated with the tools, languages and platforms I use. Does it support mobile platforms? Does it support the programming languages I use? And is it well integrated into my workflow and the dev tools services I use. Is the platform feature rich and will it support continuous identity innovation and security. Developers don’t want to get in the business of building IAM features into their app or storing username and passwords. That’s best left to experts. If my company is using an IAM solution for their employees, can I use that solution when building my applications to help save costs? Can I use the IAM solution that my company uses to sign-in users to Office 365 with my applications? Microsoft has the leading enterprise IAM solution with Azure AD, which is built-in with Office 365 that you can also leverage for the apps you build.
• #10: Leverage the Microsoft identity platform when building applications. Why? Same time and focus on core product differentiation. Lower cost of development – no more building infra to store username and passwords Better user experience – allow users to use their preferred identity to sign in to their applications. Ensure Platform security and get the latest in identity innovation without building it And on top of that when you integrate with Microsoft identity platform, you’re able to access users and data in the MS cloud. Which enables you to build rich applications.
• #11: So what does the Microsoft identity platform consist of? You have: One portal to register all your applications One set of Microsoft Authentication libraries for building web, mobile and desktop apps with your favorite programming langague One endpoint, that is standards compliant, that sign-in any Microsoft identity, which allows compatibility with third-party libraries. Secure access to APIs – from Microsoft Graph to Azure resources to your own protected APIs This gives you the ability to authenticate any Microsoft identity including work or school accounts or personal accounts. And your application can sign any external user such as customers and partners social identities and local accounts. And our platform supports open industry standards. So if you have an existing application based on industry standards it’s straightforward to connect your application.
• #12: Now, when it comes to integrating with the Microsoft identity platform, we see a few common integration scenarios beyond just accepting sign in and authentication from Microsoft identities. These integrations are particularly of interest to customers who wan to reach the enterprise and the customers that use Azure AD as their identity and access management solution. The first is around single sign on or SSO. For Azure Active Directory customers, we can enable easy SSO integration for your SaaS application. SSO means giving your customers the ability to access all of the applications and resources that your customers need to do business, by signing in only once using a single user account. Once signed in with Azure AD, those users can access all of the applications, including yours, without being required to authenticate for a second time. Azure AD already enables easy integration to many of today’s popular SaaS applications and enables users to single sign-on to applications directly, or discover and launch them from a portal such as Office 365. The second is around user provisioning. Provisioning is when Azure AD sends create, modify and disable requests for users and groups to your applications based on actions in the enterprise's directory. For example, when a new manager is added an application can be ready for them on their first sign in. With user provisioning applications access can be automatically provisioned or de-provisioned based on their organization group membership, and also their status as an employee. Organizations want applications to integrate with Azure AD, so when a person joins/changes/leaves an organization, they will automatically be given the right access to your application without IT needing to take extra steps. The act of creating, updating, and/or disabling user account records in an application’s local user profile store can be arduous given the number of applications organizations have and use. To setup provisioning for your application you need to implement a webservice that supports SCIM 2.0. SCIM is an industry wide standard that enables Identity providers to provision apps. Next as mentioned, we see partners building great applications with Microsoft Graph: We’re seeing developers take advantage of the Microsoft Graph and enhancing their application with the data and APIs available to them. They are building smarter apps that provide richer context about who someone is, who they know, what they are working on. Finally, to grow app adoption, we see partners getting publisher verified to distinguish their app to drive better adoption With publisher verification developers can signal to admins and end users that they have verified their identity using a Microsoft Partner Network account associated with the app registration.  So lets dive deep into each integration opportunity.
• #13: And we already have a robust ISV ecosystem – some of which are your peers – that are building with us across a variety of categories. Many app partners are supporting SSO and user provisioning.
• #14: And we you’re building on our platform you can use industry standards. We’re working with industry alliances to standardize on modern identity solutions so we can work better together. We believe that modern auth solutions are important to create a more secure environment. Microsoft is committed to supporting industry standards. Our identity platform supports the SAML 2.0, OpenID Connect, OAuth 2.0, and WS-Federation authentication protocols. If your application already supports the SAML 2.0 or OpenID Connect 1.0 protocols for federated sign in, adding support for our identity platform can be straightforward. We want our identity platform to work with solutions you use, which is why we invest in standards like OpenIDConnect and OAuth2. This allows You to integrate with us using a 3P open source library or you can use our Microsoft authentication libraries that do the heavy lifting of allowing you access to many users and their data in a secure and compliant way.
• #15: Every company wants to digitally transform and we see organizations reaping real, tangible benefits - the positive outcomes are truly amazing. One group of people that is a catalyst for digital transformation are developers. Developers are the builders of our era, creating the ideas and writing the code that enables digital transformation for organizations around the world. They are at the heart of innovation. It’s why the Microsoft identity platform is woven into the tools, service and platform developer use today. From IDEs like Visual Studio, to popular Azure services like App Service, Functions or Kubernetes to low code solution like power apps, the Microsoft identity platform is integrated into the workflows of these services. We want to enable any developer to easily get started with the Microsoft identity platform using the tools and services they know and love.
• #16: Here are some ways you can integrate and support SSO. You can use your protocol of choice. For OpenID Connect and OAuth: use OIDC and Oauth when developing new apps. This simplifies app configuration, has easy-to-use SDKs, and enables your application to use Microsoft Graph. For existing apps that are SAML based we support SAML integration. For your mobile apps – be sure to support system Browser for authentication in order to support single sign-on with Azure AD ----- Integrate single sign-on with OpenID Connect/OAuth or SAML https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on Add sign-in with Microsoft button to your application https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-branding-in-azure-ad-apps Customize sign-in and sign-up experiences with Azure AD B2C https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-branding-in-azure-ad-apps
• #17: With our Microsoft Authentication libraries – often referred to as MSAL – we’ve made adding authentication into your apps easy. With our MSAL libraries you can sign-in users and acquire security tokens to call protected APIs. The Microsoft Authentication Libraries represent our best developer experience for easily integrating authentication into a diverse set of applications. For building modern applications that authenticate Microsoft identities, your app should be using our most advanced and up-to-date libraries and protocols. Our MSAL libraries support a variety of platforms and languages - .NET, Javascript, Java, Python, Angular, iOS, Android and we also recently released Microsoft.identity.web which is the glue between ASP.NET Core and MSAL.NET. When you use our MSAL libraries you applications are secure by default. MSAL makes it easy to implement the right authentication protocols and allows developers to get the latest identity innovations such as passwordless, Conditional Access and additional security features into applications with just a few lines of code. On top of that you can securely access to users and data in the Microsoft Cloud such as data in Microsoft Graph or Azure. You can also call your own protected API. So let’s take a look how easy it is to get started. Use Microsoft Graph to build experiences around the user's unique context to help them be more productive. Imagine an app that...
• #22: As you may have noticed throughout the discussion and the others today, we are very focused on identity and it’s at the center of focus. And identity allows you to build new experiences by connecting to Microsoft Graph comes. Microsoft Graph is the Microsoft 365 data that describes patterns of productivity, identity, and security in an organization, accessed through a unified API endpoint. It connects apps and devices with powerful cloud services – and puts them all to work for you. With the Graph API, you can build custom solutions which both leverage a customers organization’s data, directly from the source, as well as create a personalized experience directly in the flow of your users’ work.
• #23: Once you signed-in a user and authenticated you can start to access data in Microsoft Graph. It's best to think of Microsoft Graph as an API gateway that unifies the many REST API offerings we have as a company. Today, Microsoft Graph brings together more than 25 incredibly important APIs including Azure Active Directory, productivity APIs like Exchange and OneDrive, security and management APIs like Intune and Security Graph, Windows APIs like Rome and Cloud Print, and much, much more.  By leveraging the Microsoft Graph you can build better apps with: Rich context. Get rich context for your applications, such as who someone's manager is, whether they are out of office, or what documents they've been working on. Deep insights. Access deep insights generated from usage patterns, such as trending documents, best team meeting times, or who people typically work with. Real-time updates. Respond to changes in Microsoft Graph data in real time. Reschedule a meeting based on responses, notify others when a file is modified, or continue a process after it's been approved.
• #24: Depending on ISV…. talk about B2C if they it’s a qualified opportunity in that they are looking to embed auth system into an app they are building. Eliminating friction in the end-user experience is a top priority for organizations and developers engaging consumers, customers, or citizens. With Azure AD B2C, organizations and developers have the flexibility to tailor the identity experience of their customer-facing apps and services so it’s aligned with their brand and business requirements—without sacrificing security. Seamless and secure sign-in experiences: With Azure AD B2C, you can provide simple, reliable, and secure SSO access to customer-facing apps with customers using their preferred, already-established social, enterprise, or local account identities, while also protecting your customers and data. Customize the user journey: Azure AD B2C sign-up and sign-in policies allow you to control behavior by configuring settings, such as account types that consumers use, attributes that are collected from the consumer during sign-up, multi-factor authentication (MFA) usage, and the look and feel of all registration and authentication pages. Design the user experience: Designed to offer you flexibility and control, these customization capabilities include white-label features that allow you to design the entire user experience to blend seamlessly with your web and mobile applications.
• #25: Organizations may leverage Azure AD B2C to connect external users to external web and mobile apps using a wide range of social identity providers, OpenID Connect, and OAuth 2.0.