Archives for February 2019

New Azure AD combined MFA and password reset registration experience (Public Preview)

Last Updated on February 24, 2019 by Dishan M. Francis

Microsoft recently released the new combined registration experience for MFA and SSPR. This steamlined the registration experience and users can sign up by following up step-by-step process. This new portal also improve experience of managing user profile data.

To enable this new experience,

1) Log in to Azure portal as Global Administrator

2) Then go to Azure Active Direcotry | User Settings

3) Then click on Manage settings for access panel preview features under Access panel

4) Click on All under Users can use preview features for registering and managing security info – refresh to enable preview features for all users. If needed we can apply this to selected group of users by using Selected option.

Step-by-Step Guide : Using Microsoft Authenticator app (Public preview) to reset Azure AD user password

Last Updated on February 21, 2019 by Dishan M. Francis

Azure AD SSPR ( self-service password reset ) allow users to reset their own passwords according to policy define by their administrator. Before it was only allowed to use Email, Mobile phone, Office phone or security questions options to reset the passwords. If it was Azure AD admin they wasn’t able to use security questions option either. But now SSPR supports use of Microsoft Authenticator app notifications or a code from any mobile authenticator app or hardware token. This is applying for all the users including Azure AD administrators. In order to use mobile app or hardware token option, users need to sign up for at least 2 other methods ( Email, Mobile phone, Office phone or security questions).

To enable mobile app option,

1) Log in to Azure portal as Global Administrator

2) Go to Azure Active Directory | Password Reset

3) Go to Properties and make sure you have SSPR enabled

Step-by-Step Guide: Audit privileged access using Azure PIM

Last Updated on February 21, 2019 by Dishan M. Francis

Azure AD has near 35 different Directory roles. Each of these roles have different level of privileges. Using Azure PIM access reviews, we can review access and activities of member’s in these privilege groups and adjust their memberships accordingly. let’s see why it is important to review access of privilege accounts periodically.

• Too much administrators – How many of you aware of all the administrators (including local admins) of your local AD infrastructure? I got you isn’t it! in local AD environment it is handful of privilege user groups, but Azure AD have near 35 roles. So, yes it will be difficult to keep track of the administrator with out proper review.

• Not doing what they supposed to do – Azure AD roles have predefined level of privileges. you may assign a higher privilege role to member as he/she can’t match privilege available under existing roles. How we know they are only doing what they supposed to do? using access reviews we can track down their activities and make sure they not misuse the privileges.

• Audit takes time – We can review the group memberships & their activities manually. But it takes time. if its manual tasks and also if it takes time most probably administrators will not do it more regularly. PIM access review is fully automated so you can schedule it run according to your requirements.

[su_note]You need to have supported subscription to use Azure PIM. It is available under Azure AD Premium P2, Enterprise Mobility + Security (EMS) E5, Microsoft 365 M5[/su_note]

Now it is time to look in to implementation. In my demo I am going to create an access review for Global administrator role. To do this,

1. Log in to Azure portal as Global Administrator

2. Go to All Services and search for azure ad PIM then click on it.

3. If this is your first-time using PIM, you need to click on onboard and complete the process.

4. Then click on Azure AD Roles under Manage [Read more…] about Step-by-Step Guide: Audit privileged access using Azure PIM

Step-by-Step Guide: How to setup Google federation for Azure AD B2B?

Last Updated on February 4, 2019 by Dishan M. Francis

In on-premises Active Directory environments, we use “trusts” to establish identity infrastructure collaboration between businesses. In that way, partner organization can use their own user accounts to authenticate in to trusted organization resources. When it comes to cloud/hybrid identity, Azure AD B2B allow organizations to establish cross-organization identity connections. Unlike on-premises, it is not required additional infrastructure changes. In my previous article about Azure B2B explains how we can allow external users to authenticate in to cloud app using their own accounts. You can find it here https://www.rebeladmin.com/2018/11/cross-organization-collaboration-azure-ad-b2b/ . However, when external user’s sign up process it is asking to create “Microsoft Account” to continue.

If users are having Google Accounts, now Azure AD B2B can initiate federation with google to allow users to use their own google accounts to authenticate instead of Microsoft Accounts. In this demo I am going to demonstrate how we can initiate federation with google.

Prerequisites

• Valid Azure AD B2B Subscription – If the guest users are going to use Azure AD paid services, make sure you have enough licenses allocated. More info about licensing can find here https://docs.microsoft.com/en-us/azure/active-directory/b2b/licensing-guidance

• Shared Google Account – During the setup we need to create credentials at Google APIs. To do that we need to use existing google account. It is recommended to use separate google account for this instead of existing user account.

To start the configuration,

1. Go to https://console.developers.google.com and log in with the Google account you have selected for the task.