EvidianWeb Access Managerand Office 365
Evidian Web Access
Manager & Evidian
Identity Governanceand Administration,
Ready for Office 365

With more and more businesses hosting
applications externally, –Software as aService (SaaS) subscriptions gradually
overruns licenses-based software delivery
model.

Evidian Web Access Manager(WAM) is an Identity Provider
and Service Provider

Learn how Evidian Web
Access Manager (WAM) allows
you to meet these challenges

This trend towards the cloud has prevailed
with a global growth of the cloudinfrastructure services market by more than
30% per year according to several analysts.

Authentication& security

Increase the security
without impacting users

Context-Aware Authentication or Adaptive
authentication is the basic mechanism fordetermining the risk of the user’s session
before his authentication. The right secureauthentication policy is triggered dependingon the user’s context.

The major international SaaS vendors
are also major security researchers andinnovators, therefore security byconstruction
is at the core of their offers. But as often,
people remain the weakest link in the SaaS
security chain. Using your same usual
password anywhere, trusting any web server,
from your professional trusted applications
to your less trustable personal applications,
exposes you and your enterprise to security
breaches.

COVID-19 impacts are also accelerating thisphenomenon, especially considering remote
working’s wider application.
This model offers a greater agility toorganizations which can react faster andmore efficiently. In addition, the use of“as a Service” applications allows them toanticipate, smooth and sometimes deferexpenses.
However, this paradigm shift broadens thesecurity perimeter of organizations, forwhich it is necessary to adopt a strict access
control posture, which includes the following
elements:• Offer a strong authentication strategy toremove or limit password use

Single Sign-On
Authentication is a burden for users. Internal
applications, from SaaS applications, toWeb applications or Mobile applications
authentications are required everywhere.
Removing intelligently this burden increases
security and the productivity.

• Reduce the complexity and integrate
seamlessly the access and management
to both worlds

Self-Service• Increase the users’ productivity by giving
easy access to the best-in-class SaaSapplication portfolio at the right time.

By letting your users reset their own
passwords, enroll stronger authentication
methods, and deploy their SaaS or on
premise accounts whenever they request
them or need them, you can drastically cut
your costs.

• Enable a User Identity lifecycle, compatible
with on premises applications and Cloud
applications, for employees, contractors orcustomers• Decrease the cost of unused licenses andoptimize application related expenses• Deploy an active governance process atthe center of all application accesses, andestablish a compliance plan.

Facilitates compliance
Quickly list the access rights to yourinformation system your authenticated users
own. Easily obtain the report of IT resource
access rights for all your listed users.

Fortunately, SaaS vendors fully understandhow passwords can be a risk for theenterprise. It would be nonsensical to let
users access professional SaaS applications
without giving the real owner – the enterprise– the tools to address the who, when andhow, of applications access. Enterprises
must deploy their own Identity Providers
and Identity Governance and Accessmanagement. Wherever users come from,internal or external network, at any time,the enterprise manages its assets throughfederation mechanisms.

Business Oriented – Ready to use
Adaptive and multi-level
Authentication
Passwords are forgotten, and even worse,
they are corrupted. Only strong, long,complex and hard to remember passwords
can resist. Fortunately there is no reason touse them anymore. Multi-factors, multi-level
authentication, using tokens, OTP, or QR
code crypto-keys can effectively replacethem in any situation. Identification andauthentication now rely on what you know
and what you own. If you do not use yourusual device, additional authentication
steps are triggered: it is the Context-Aware
Authentication or Adaptive Authentication.
Your geo-location, your device, your accesstime, your IP are used to compute a risk
before opening sessions that will define theminimal level of the required authentication
method. This level will let you choose anauthentication method accordingly tothe authentication means you own. It is amore convenient way in a heterogeneous
population of users (employees,
partners, customers) to provide different
authentication means, and, for instance,
to consider that an intranet Kerberos
authentication has the same level as atwofactor authentication from an Internet
partner. Evidian Web Access Manager
supports all kinds of authentications from
simple credential authentication to multistep
multi-factor, with browser fingerprinting andContext-Aware Authentication. WAMprovides
many off-the-shelf authentication means.
It provides a simple configuration toolfor combining them as multi-factormultistep authentication methods. If built-in
methods are not strong enough for yourneeds, WAM is also able to use on-premise
external authentication services or SaaS
authentication servers like Gemalto-SafeNet
Authentication Service.

Single Sign On
With only one single login, give accessto all your applications, even when theyuse different identities or credentials. You
can also disconnect all applications withthe click of a single button. Your internal
Web applications still use login/password?
Never mind, Web Access Manager willkeep them secure without exposing themto the user’s browser. No need to modify
the protected application, Evidian WAM willturn any application into a service provider
and will play the application authentication
cinematic. SaaS applications and internal
Web applications will be reached seamlessly,
without any additional authentication

step by the users. One single login opens
securely the doors to all allowed applications,powering up the user’s productivity andreducing help-desk costs.

Self-Services
The shift to SaaS forces changes how users
access and consume IT applications —meaning our heuristics and best practices
must evolve. Web Access Manager gives
users complete autonomy for resetting
passwords, activating authenticationmeans, enrolling phones and stronger
authentication methods, filling secondary
accounts, editing profiles, requesting accessrights — using IGA — , …. WAM provides
simple, customizable Welcome pages, andeasy integration points in your own custom
welcome portal. Once again, you will reduce
your help-desk costs.

Cost-Efficient SaaS Provisioning
Dormant accounts are a risk for on premise
IT. When part of your IT is distributed in
the Cloud, in SaaS applications, dormant
accounts are not only risky but they also
generate additional costs: welcome to theshadow IT. Without Access Governance, it
is very difficult to identify these accounts
among active accounts. Decreasing thenumber of unused licenses is one of thekey objectives of the IT cost reduction
when moving to SaaS. Cost efficient SaaS
provisioning is an exclusive Evidian featurethat provisions the SaaS accounts at theexact time users need to access SaaS
applications, for the first time.

With Office365
A practical use case of this is Office365.
Creating federated users, provisioning
accounts, bulk-importing CSV identity files,assigning licenses, syncing directories,
and writing endless power-shell commandlines, are usually the first steps of theOffice365 move. It can be made simpler
and cheaper with WAM and IGA, byusing the Cost- Efficient provisioning andaccess management. When a user tries toaccess Office365, he is redirected to yourIdentity Provider; WAM, which issues astrong context-aware authentication. Onceauthenticated, if the user is granted accessto Office365, IGA will dynamically create
the federated identity in Office365, and will
request WAM to authorize the access forthis user and his newly federated identity. AnOffice365 license will be assigned to this newuser. Users have an instant access to theirFor more information: www.evidian.com© Eviden. Evidian is the registered trademark of Eviden. All products, brand names, service marks, trademarks and other names
mentioned in this document are proprietary to their respective owners and are protected by applicable trademark and copyrightlaws. Evidian reserves the right to modify the characteristics of its products without prior notice.
CT-201125-SC-FS-WEBACCESS

Office365 accounts, with strong adaptive
authentication, Single Sign-On across allother applications of your on-premise IT,
and Self-service to request the rights to use
applications. When a user loses his right touse Office365, as defined by your policy,
IGA will transparently unprovision the SaaS
account and will release the unused license.
No more expensive dormant accounts.
IT administrators may generate reports
about use, identify active accounts, handle
the policy and role management, deploy
approval workflows, and let approvers
validate the user’s self-service requests.
WAM manages the access of Office365
Web applications, Mobile applications
and Desktop applications. All yourOffice365application accesses are managed
by your own Identity Provider applying yourown policy rules with optimized costs.
• WAM: Web Access Manager 9 Evolution
2: WAM may be used separately or inassociation with IGA. Visit www.evidian.
com for more details about WAM features.
• IGA: Identity Governance andAdministration 10: IGA may be used
separately or in association with WAM orother products. Visit www.evidian.com formore details about IGA features.
• Cost-efficient provisioning initiated byIdentity Provider, is protected by thePatent WO2015173517. This feature requires
WAM and IGA.
Request a demonstration of WAM with
Office365 and Cost-Efficient Provisioning at
www.evidian.com or self-create an accounton https://iam-portal2.evidian.com

PowerPoint 2016 Office365 on Mac OSX.
The default Context-Aware Authentication panel proposedby WAM as Identity Provider.