Entra Architektur, Bereitstellung & Betrieb Entra Architecture, Deployment & Operations

Tenant-Architektur: Single Tenant vs. Multi-Tenant Tenant architecture: single tenant vs multi-tenant

Ein Single-Tenant-Modell minimiert Richtlinien-Drift. Mehrere Tenants sind sinnvoll bei rechtlicher Trennung, souveräner Datenhaltung, M&A oder dediziertem Customer-Identity-Betrieb. A single-tenant model minimizes policy drift. Multiple tenants make sense for legal separation, sovereign data residency, M&A, or dedicated customer identity.

Interne Komponenten: Authentication Service, Directory Service und Graph Internal components: authentication service, directory service, and Graph

Globale Infrastruktur, primäre und Backup-Datacenter Global infrastructure, primary and backup datacenters

Kundenrelevante Ausfälle entstehen oft nicht im Cloud-Service selbst, sondern in lokalen Abhängigkeiten wie PTA-Agenten, ADFS-Farmen, Reverse Proxies, DNS oder Zertifikatsprüfungen. Customer-facing outages often originate not in the cloud service itself but in local dependencies such as PTA agents, AD FS farms, reverse proxies, DNS, or certificate validation.

Datenresidenz, Souveränität und SLA Data residency, sovereignty, and SLA

Phase 1 – Foundation Phase 1 – foundation

• Break-Glass außerhalb von Synchronisation und Federation halten. Keep break-glass outside synchronization and federation.
• Notfallzugang mit dokumentiertem Testprotokoll prüfen. Validate emergency access with a documented test record.
• Initiale Hardening-Checkliste für Einladungen, Consent und Rollen definieren. Define an initial hardening checklist for invitations, consent, and roles.

Phase 2 – Authentication Phase 2 – authentication

• MFA mit privilegierten Rollen und IT-Support beginnen. Start MFA with privileged roles and IT support.
• Passwordless nach Plattformreife und Persona einführen. Introduce passwordless by platform maturity and persona.
• SSPR erst aktivieren, wenn Helpdesk- und Writeback-Pfade geklärt sind. Enable SSPR only after help desk and writeback paths are defined.

Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","UserAuthenticationMethod.Read.All"
Get-MgDomain | Select-Object Id, IsDefault, AuthenticationType
Get-MgPolicyAuthenticationMethodPolicy | Format-List *
Get-MgPolicyAuthorizationPolicy | Select-Object AllowEmailVerifiedUsersToJoinOrganization, DefaultUserRolePermissions
                

Phase 3 – Application Integration Phase 3 – application integration

Phase 4 – Governance Phase 4 – governance

Phase 5 – Security Phase 5 – security

B2B-Kollaborationsarchitektur B2B collaboration architecture

B2B Collaboration ist das Standardmuster für Partner und Lieferanten. Gastobjekte leben im Ressourcentenant, die Primäridentität verbleibt im Heimatsystem. B2B collaboration is the standard pattern for partners and suppliers. Guest objects live in the resource tenant while the primary identity remains in the home system.

B2C/External ID für Kundenidentitäten B2C/External ID for customer identities

Kundenidentitäten sollten in einem dedizierten External-ID-Tenant betrieben werden, damit Workforce-Richtlinien und Kunden-Branding sauber getrennt bleiben. Customer identities should be hosted in a dedicated External ID tenant so workforce policies and customer branding remain cleanly separated.

Föderation mit externen IdPs Federation with external identity providers

• OIDC und SAML bevorzugen. Prefer OIDC and SAML.
• Zertifikatsrotation und Logout-Semantik prüfen. Review certificate rotation and logout semantics.
• Partner-MFA und Notfallverfahren bewerten. Assess partner MFA and emergency procedures.

Direct Connect Architektur Direct connect architecture

Monitoring-Strategie, Baselines und Schwellenwerte Monitoring strategy, baselines, and thresholds

Benutzerkonten überwachen Monitor user accounts

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| summarize Countries = make_set(LocationDetails.countryOrRegion, 20), Count = count() by UserPrincipalName
| where Count > 5 and array_length(Countries) > 3
                

AuditLogs
| where TimeGenerated > ago(3d)
| where OperationName in ("Update user","Reset user password","Update user authentication methods")
| extend Target = tostring(TargetResources[0].userPrincipalName)
| project TimeGenerated, OperationName, Target, InitiatedBy, Result
                

Privilegierte Konten und Consent Grants Privileged accounts and consent grants

AuditLogs
| where TimeGenerated > ago(14d)
| where Category =~ "RoleManagement"
| where OperationName has_any ("Add eligible member","Add member to role","Activate eligible role assignment")
                

AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("Consent to application","Add delegated permission grant","Add app role assignment grant")
                

Anwendungen, Credentials und Service Principals Applications, credentials, and service principals

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName has_any ("Add application","Update application","Add service principal credentials","Add application password")
                

Geräte und Registrierungsanomalien Devices and registration anomalies

SigninLogs
| where TimeGenerated > ago(7d)
| where DeviceDetail.isCompliant == false or isempty(DeviceDetail.deviceId)
| summarize Count = count() by UserPrincipalName
| where Count > 3
                

Hybrid-Infrastruktur und Connect Health Hybrid infrastructure and Connect Health

SecurityAlert
| where TimeGenerated > ago(7d)
| where ProductName has_any ("Microsoft Entra","Azure AD Connect Health","Microsoft Sentinel")
                

Log Analytics und Sentinel-Integration Log Analytics and Sentinel integration

• Zentralen Security-Workspace mit Retention und Exportstrategie definieren. Define a central security workspace with retention and export strategy.
• Analytics Rules für Rollen, ungewöhnliche Länder, Consent und App-Credentials bauen. Create analytics rules for roles, unusual countries, consent, and app credentials.
• Workbooks nach Persona bereitstellen: SOC, IAM, Helpdesk, App-Owner. Provide persona-based workbooks: SOC, IAM, help desk, app owners.
• Playbooks für Containment und Ticketing koppeln. Link playbooks for containment and ticketing.

Tenant Operations Tenant operations

• Admin-Portal-Konfiguration, Branding, Datenschutzlinks und Kontakte aktuell halten. Keep admin portal configuration, branding, privacy links, and contacts current.
• Self-Service-Einstellungen bewusst öffnen oder sperren. Intentionally open or restrict self-service settings.
• External Collaboration Settings und Terms of Use regelmäßig prüfen. Review external collaboration settings and terms of use regularly.

Identity Operations Identity operations

Authentication Operations Authentication operations

• MFA-Health, Registrierungsquoten und Authenticator-Fehler überwachen. Monitor MFA health, registration rates, and Authenticator failures.
• CA-Policy-Review mindestens monatlich durchführen. Run a CA policy review at least monthly.
• Zertifikate in Federation, SAML und App Proxy zentral nachhalten. Track certificates in federation, SAML, and App Proxy centrally.

Application Operations Application operations

• App-Registrierungen auf Owner, Scopes, Redirect URIs und Secrets prüfen. Review app registrations for owners, scopes, redirect URIs, and secrets.
• Enterprise Apps auf Nutzung, Zuweisung und Consent-Hygiene prüfen. Review enterprise apps for usage, assignment, and consent hygiene.
• Token-Konfiguration und Gruppenclaims bei jeder Migration verifizieren. Verify token configuration and group claims on every migration.

Governance Operations Governance operations

Angriffsvektoren Attack vectors

Tier-0- und Credential-Isolation Tier 0 and credential isolation

• Entra-Admins von Standardkonten trennen. Separate Entra admins from standard accounts.
• Privileged Access Workstations oder gleichwertigen Schutz einsetzen. Use privileged access workstations or equivalent protection.
• Gespeicherte Kennwörter durch Managed Identities und Federation ersetzen. Replace stored passwords with managed identities and federation.

Servicekonten, Connectoren und Agent-Sicherheit Service accounts, connectors, and agent security

Jeder Agent und jedes Servicekonto braucht Eigentümer, Patchfenster, Minimalrechte, Egress-Regeln und ein Ersetzungsverfahren. Every agent and service account needs owners, patch windows, minimum permissions, egress rules, and a replacement procedure.

AI-Agenten mit Entra absichern Secure AI agents with Entra

Identity-first und Data Access Governance Identity-first and data access governance

• Jeder Agent erhält eine explizite Identität und minimalste Rechte. Every agent gets an explicit identity and minimal rights.
• Datenlabels, App-Rollen und Compliance-Kontrollen kombinieren. Combine data labels, app roles, and compliance controls.
• Owner-Review und Rezertifizierung für AI-bezogene Apps erzwingen. Enforce owner review and recertification for AI-related apps.

Conditional Access für AI-Services Conditional Access for AI services

AI-Frontends und Administrationsflächen sollten in eigene CA-Scopes aufgenommen werden, damit phishing-resistente MFA, compliant devices und Session Controls gezielt durchgesetzt werden. AI front ends and admin surfaces should have dedicated CA scopes so phishing-resistant MFA, compliant devices, and session controls can be enforced precisely.

DR-Planung und Wiederanlauf DR planning and recovery

1. Break-Glass testen und dokumentieren. Test and document break-glass.
2. Policy-Fehler isolieren oder zurückrollen. Isolate or roll back policy failures.
3. Hybridpfade prüfen: PTA, Sync, App Proxy, Federation. Validate hybrid paths: PTA, sync, App Proxy, federation.
4. Helpdesk, SecOps und App-Owner informieren. Inform help desk, SecOps, and app owners.

Authentifizierungsresilienz und Backup-Methoden Authentication resilience and backup methods

Resilience Defaults und Multi-Region-Pattern Resilience defaults and multiregion patterns

• Cloud-Authentifizierung als Zielbild bevorzugen. Prefer cloud authentication as the target state.
• Mindestens zwei Emergency-Access-Konten betreiben. Operate at least two emergency access accounts.
• Kritische Apps auf degradierte Modi und Token-Caching prüfen. Assess critical apps for degraded modes and token caching.
• Hybridagenten N+1 auslegen und Health Checks alarmieren. Design hybrid agents N+1 and alert on health checks.

Directory Size Limits, Token-Größe und Group Nesting Directory size limits, token size, and group nesting

API-Throttling und Bulk-Strategien API throttling and bulk strategies

Graph- und Entra-APIs erzwingen dynamische Service-Protection-Limits. Bulk-Jobs müssen Paging, Delta-Abfragen, Exponential Backoff und kontrollierte Parallelität verwenden. Graph and Entra APIs enforce dynamic service protection limits. Bulk jobs must use paging, delta queries, exponential backoff, and controlled parallelism.

foreach ($user in $users) {
    try {
        Update-MgUser -UserId $user.Id -Department $user.Department
    }
    catch {
        if ($_.Exception.ResponseHeaders["Retry-After"]) {
            Start-Sleep -Seconds [int]$_.Exception.ResponseHeaders["Retry-After"]
        } else {
            throw
        }
    }
}
                

Tenant-Konfiguration Tenant configuration

Connect-MgGraph -Scopes "Organization.Read.All","Policy.Read.All","Directory.Read.All"
$org = Get-MgOrganization
$domains = Get-MgDomain
$authz = Get-MgPolicyAuthorizationPolicy
[pscustomobject]@{
    TenantId = $org.Id
    DisplayName = $org.DisplayName
    InitialDomain = ($domains | Where-Object IsInitial).Id
    GuestInviteEnabled = $authz.AllowInvitesFrom
}
                

Health-Check-Automatisierung Health-check automation

Connect-MgGraph -Scopes "Directory.Read.All","AuditLog.Read.All"
$breakGlass = @("breakglass1@contoso.com","breakglass2@contoso.com")
$recent = Get-MgAuditLogSignIn -Filter "createdDateTime ge $(Get-Date).AddDays(-30).ToString('s')Z"
[pscustomobject]@{
    BreakGlassSignIns = ($recent | Where-Object { $breakGlass -contains $_.UserPrincipalName }).Count
    SignInsObserved = ($recent | Measure-Object).Count
}
                

SecOps-Monitoring und Reporting SecOps monitoring and reporting

Connect-MgGraph -Scopes "AuditLog.Read.All","IdentityRiskEvent.Read.All"
$riskyUsers = Get-MgRiskyUser -All
[pscustomobject]@{
    RiskyUsers = $riskyUsers.Count
    Generated = (Get-Date)
} | Export-Csv ".\reports\entra-secops-summary.csv" -NoTypeInformation
                

Bulk-Operations Bulk operations

$users = Import-Csv ".\bulk\department-updates.csv"
foreach ($user in $users) {
    Update-MgUser -UserId $user.UserPrincipalName -Department $user.Department -UsageLocation $user.UsageLocation
}
                

Wichtige Graph-Endpunkte Key Graph endpoints

GET https://graph.microsoft.com/v1.0/organization
GET https://graph.microsoft.com/v1.0/domains
GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy
GET https://graph.microsoft.com/beta/identity/conditionalAccess/policies
GET https://graph.microsoft.com/v1.0/servicePrincipals?$select=id,displayName,appId
                

Entscheidungsbaum: Authentifizierungsmethode Decision tree: authentication method

1. Braucht das Unternehmen zwingend lokale Kennwortvalidierung? Wenn nein: PHS. Does the organization require on-prem password validation? If no: PHS.
2. Wenn ja: kann PTA die Anforderung erfüllen? Wenn ja: PTA. If yes: can PTA satisfy the requirement? If yes: PTA.
3. Nur wenn PTA nicht reicht und ein klarer Zwang existiert: Federation. Only if PTA is insufficient and a clear dependency exists: federation.
4. Für jedes Nicht-PHS-Modell muss ein dokumentierter Cloud-Fallback existieren. For every non-PHS model, a documented cloud fallback must exist.

Troubleshooting: globale Anmeldeprobleme Troubleshooting: global sign-in failure