The IT Division holds responsibility for securing the City’s business systems and information, including sensitive personal information, financial information relating to both the City and constituents, employee protected health information and law enforcement information, among other sensitive and legislatively protected information sets. Consequently, as the threat to local government entities continues to increase, the IT Division identifies ways to reduce the risk of compromise and potential data breaches.

Implementing multi-factor authentication represents the single most effective option not already implemented by the IT Division. In simplest form, multi-factor authentication augments an access-ID and password combination with additional step(s) to validate that the individual requesting to access City computers and business systems is indeed authorized. The most common additional step is sending a one-time access code to an individual’s pre-authorized cell phone. This precludes a malicious actor’s ability to guess or “hack” the ID and password to gain access, since access requires three pieces of information-the ID, password, and one-time access code. Without all three, no access is granted.

After extensive research and pilot implementations of other protection systems, the IT division believes that the Microsoft Azure Active director Premium 2 product and associated license provides the best value to the City in meeting the need to evolve beyond readily compromise-able ID and password pairings.

The attached proposed resolution authorizes the city manager to enter into an agreement with Microsoft via authorized retailer SoftwareOne to upgrade the City's existing Microsoft Enterprise agreement from Azure Active Directory Premium 1 licensing to Azure Active Directory Premium 2 licensing. The resolution also authorizes the appropriation of $107,191.50 to cover the additional licensing cost for the remainder of the Microsoft Enterprise agreement, plus a not-to-exceed amount of $50,000 that may be required over the term of the agreement for additional employee hires that increase the licensing count yearly true-up.  The upgrade provides additional security features needed to protect the City from malicious infiltration attempts and ransom attempts.  Azure Active Directory Premium 2 provides licensing that is not covered under the existing Premium 1 licensing, including multifactor authentication for City endpoints, assessing vulnerabilities and suspicious accounts, risk event notification and investigation, risk-based conditional access policies, privileged identity access management and Microsoft alerting when accounts may have been compromised.

Eudora Fleischman, IT Infrastructure Manager

(707) 428-7527

esindicic@fairfield.ca.gov