7 ms·
Got a company-wide mail last week that we're moving from Okta to Azure AD. 100,000 seats. This isn't going to be fun, but it's making more sense every day.
by joezydeco 3y ago
Got a company-wide mail last week that we're moving from Okta to Azure AD. 100,000 seats.
This isn't going to be fun, but it's making more sense every day.
- bink 3y agoDon't look up Azure AD security issues if you think Okta is bad.
- joezydeco 3y agoHeh. True.
- technion 3y agoMost companies making this jump are already using azure and vulnerable to any azure compromise. And for a long time, adding in okta was some kind of trendy thing to do "for security" but all its adds at this point is another point of failure. Organisations that can rely exclusively on azure much better off doing so imo, the argument about the mfa being somehow better in okta just isn't right in 2023.
- wkat4242 3y agoEspecially because if you use azure ad (or entra now) as a backend behind okta (as we do at work too), you now have two vendors that might get hacked instead of one. If I have a valid azure cookie it bypasses all IDP login rules (eg this cloud service may only be connected to from the company network). Also, Microsoft and Google have one big thing in their favour: they run consumer services with billions of customers that they get a ton of experience from. And which are a huge target which rarely gets breached. Those consumer services are not running on the same IDP services e.g. "Entra ID" but as a company it does prove they know what they're doing. I have to give them that. I know MS got breached recently too but they have a decent track record overall. Saying this as a MS critic by the way.
- psanford 3y agoThe recent microsoft key compromise was significantly worse than this: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...
- tristor 3y agoAnd still has no final resolution to my understanding
- perlgeek 3y agoWhat kind of resolution are you hoping for? Or asked differently, what kind of threads do you still see as open? For me, the biggest bummer was the lacking security culture that let a cert validation component to not properly validate certs, in at least two ways (didn't enforce tier separation; accepted tokens signed by an expired or revoked CA).
- jedmeyers 3y ago> Azure AD Nobody Gets Fired For Buying _Microsoft, I guess.
- Unfrozen0688 3y agoWHAT should we use instead? A frankenmonster of Google Workspace, Slack, Zoom, Duo Security and Okta?? OR!!!?? just buy Microsoft 365 Though call huh
- deleted 3y ago[deleted]
- nativeit 3y agoI think I just broke out in hives.
- Unfrozen0688 3y agoTake antihistamine and rub some cream on it.
- etc-hosts 3y ago> A frankenmonster of Google Workspace, Slack, Zoom, Duo Security and Okta?? You work here too?
- joezydeco 3y agoDid you forget to renew your Atlassian subs?
- loginatnine 3y agoIt's now called Entra ID btw.
- wkat4242 3y agoYeah gotta love Microsoft marketing goons that rebrand everything every few years. Though azure ad was actually a bit confusing. But usually their rebranding makes zero sense. Like from lync to Skype or msdn to my visual studio. Or sms to sccm to mem.
- macintux 3y agoRebranding Yammer is a complete head-scratcher to me. At least "Azure AD" might be a little confusing since it's independent (I think?) from Azure itself.
- creshal 3y agoAzure AD is distinct from both Azure and AD, so the naming never made much sense. Switching over to "Entra ID" is probably the only actually useful rebranding Microsoft did in the past 30 years.
- wkat4242 3y agoOh yeah Yammer and Viva something (I forget the full name even)... :X I didn't even remember that one.
- switch007 3y agoOut of the frying pan in to the fire!