AAD

Step-by-Step guide to setup temporally privilege access using Azure AD Privileged Identity Management

Just-in-Time Administrations protects high-privileged accounts been compromised. Administrators will have their privileges when they “required”. It minimizes the lateral movements of identity attack. Azure AD PIM allows to create time-based temporally admin accounts. In this demo I am going to demonstrate how to create time-based admin accounts in azure using PIM. If you are new to privilege identity management, I highly recommend to check my previous blog post about it. you can access it using https://www.rebeladmin.com/2016/07/step-step-guide-azure-ad-privileged-identity-management-part-1/

In my demo environment I have a user called Isaiah Langer from finance department. At the end of every month this user runs some reports which required admin privileges. I do not want to make this user a permanent global administrator. I like to give these privileges when “required”. Let’s see how we can configure it.

1. Log in to Azure portal https://portal.azure.com as global admin.

2. Click on More Services from the left-hand panel and search for Azure AD PIM.

3. In first window it asks me to verify my MFA before proceed. This is because I do not have MFA setup for my account. Click on verify my identity option.

4. Then it goes through MFA setup process. Please complete sign up process to continue.

5. Once process is completed it will load the PIM page again. Click on Consent to proceed.

6. Then click on Yes to proceed.

7. After service is initiated, click on Azure AD directory roles.

8. Then click on Sign up to proceed. [Read more…] about Step-by-Step guide to setup temporally privilege access using Azure AD Privileged Identity Management

Step-by-Step guide to connect down-level devices to Azure AD (in hybrid environment)

Devices runs with Windows 10 and Windows Server 2016 can directly connect to Azure AD. I have used it on my last few posts and explain different features available for Domain Joined Devices. However not every device in an infrastructure runs with Windows 10 or Windows Server 2016. If it is cloud only environment, you can simply connect your VMs in Azure to Azure AD without issue. but if it is remote devices you do not have option than upgrading to windows 10 and windows 2016. In Hybrid Environment with some configuration changes, Azure AD allow to join devices runs with,

• Windows 8.1

• Windows 7

• Windows Server 2012 R2

• Windows Server 2012

• Windows Server 2008 R2

In this demo, I am going to explain how we can connect these down-level devices to Azure AD.

If it is hybrid environment, it will be either federated or non-federated environment. In this post, I am only going to focus on non-federated environment. The configuration and prerequisites are different from one method to another.

In non-federated environment,

1. You must have healthy AD synchronization using Azure AD Connect

2. If you are using Seamless single sign-on with Azure AD Connect, it is still supported configuration. more info about it can find using https://www.rebeladmin.com/2017/09/azure-active-directory-seamless-single-sign-azure-ad-seamless-sso/

3. If down-level devices are using roaming profiles it is not going to work with Azure AD. In that case you need to move to Windows 10

4. You need to have Azure Global Administrator Account and Domain Admin Account to do the configuration changes.

Create Service Connection Point

First step of the configuration is to create service connection point (SCP) in local AD so devices can discover Azure AD tenant information during the registration process.

In order do that we need to run following PowerShell script in Azure AD Connect server.

Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1";

$aadAdmin = Get-Credential;

Initialize-ADSyncDomainJoinedComputerSync –AdConnectorAccount [AD connector account] -AzureADCredentials $aadAdmin;

In above,

$aadAdmin – Parameter is to represent the Azure AD admin account used in the configuration.

[AD connector account] – This should replace with the AD account used for Azure AD Sync

Note –

• This must run from the server you have AD Connect configured

• It is recommended to run it from Microsoft Azure Active Directory Module for PowerShell tool. If you use it you do not need to import the module.

• You must have AD DS tools installed on the same server otherwise command will fail.

Verify Service Connection Point Details

After you run the command successfully we can verify SCP using,

$scp = New-Object System.DirectoryServices.DirectoryEntry;

$scp.Path = "LDAP://CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=therebeladmin,DC=com";

$scp.Keywords;

In above DC=therebeladmin,DC=com represents the domain.

If it was successful, you will get response like below.

Allow Users to Join Devices to Azure AD

Before you joined the devices, first verify if you allow users to connect devices to Azure AD.

To do that,

1. Log in to Azure Portal

2. Go to Azure Active Directory

3. Then Devices

4. Then click on Device Settings

5. Then the settings can find under, User may join devices to Azure AD option. In my demo setup, I am allowing all the users to join devices.

Join down-level devices to Azure AD

Now we have all the prerequisites ready. Next step is to register device with Azure AD. In my demo, I have a VM which runs Windows 8.1. I am going to add it to Azure AD.

1. Log in to the Device as Administrator

2. Download msi from https://www.microsoft.com/en-us/download/details.aspx?id=53554

3. Double click on the MSI after download and click on Install to proceed.

Note – This VM is already part of the local domain.

4. Then go to Start > Search > PC Settings after that click on Network

5. The click on Workplace > Join

6. It will prompt for the login and provide the relevant password.

7. After successful join, it will show following

8. Now I can see the device under Azure AD Devices.

This marks the end of this blog post. Hope this was useful. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Step-by-Step guide to enable Enterprise State Roaming with Azure Active Directory

If you work with Active Directory you may already know what is roaming profiles is. Roaming profiles allows to sync application and user settings to a file share. When same user login from another computer in to same domain, those settings will sync back from file share. It allows users to have same user experience and data in different corporate devices. Azure Active Directory users may also login from multiple Azure domain joined devices. Enterprise state roaming allows to sync user settings and application settings securely across corporate azure domain joined devices.

Secured Sync – When this feature enables it will activate free limited Azure Rights Management subscription. It will use to encrypt and decrypt data which is sync to cloud. This will ensure the security of data used by Enterprise State Roaming feature.

Data Storage – Data storage location for Enterprise State Roaming feature will be align with your Azure Active Directory subscription region. It will not sync between different regions.

Better Control – This feature can be enable for entire directory or only for selected users. Sync data for each device can review using portal. With help of Azure Support, administrators also can forcefully remove sync data for a device.

Data Retention – If user account been deleted from directory, profile data will be deleted after 90 days. Administrators also can request (from azure support) to delete specific data from a user profile. If data not been access for 1 year it will consider it as stale data and remove forcefully. It will also happen if Enterprise State Roaming feature is disable in later time.

Let’s see how we can enable this feature. In order to enable this feature, you must have Azure AD Premium or Enterprise Mobility + Security (EMS) license. Azure AD join devices must be running with Windows 10 (Version 1511, Build 10586 or greater)

1) Log in to Azure Portal as a Global Administrator

2) Go to Azure Active Directory | Devices

3) Then click on Device Settings

4) Under device settings there is option says Users may sync settings and app data across devices. In there you can select All or Selected. If you use selected option, you will need to define the users. in my demo, I am going to enable Enterprise State Roaming for entire directory. Once selection is made click on Save.

After the feature is enabled we can review the sync status using Azure Active Directory Admin Center. To do this,

1) Log in to Azure Active Directory Admin Center using https://aad.portal.azure.com

2) Go to Azure Active Directory | Users and Groups

3) In next window, Click on All users and then click on the relevant user. In my demo it is user RA722725@therebeladmin.com

4) Then click on Device in new window.

5) Then in right hand window select Device sync settings and app data option from show drop down menu.

6) In list it shows the devices, that user logged in and the last sync time.

Now we have everything ready for testing. Before we start there is few things to remind. This is only sync user and app settings. Not user data. Also, sync is not happening at login/log off event. It happens once user is log in. so if you do not see sync data right away after login, allow sometime and keep eye on last sync time value.

In my demo, I am login to a pc called REBEL-PC01 as RA722725@therebeladmin.com. In that pc, I have done certain settings changes.

Under IE, I added few links to favorites.

I also change setting on code writer App and change font and default text size to 20.

After initial sync, I login in to another pc called REBEL-PC02 as RA722725@therebeladmin.com. In there I expect to see the changes I made. (The sync cycles can take up to 30 minutes. So far I didn’t find way to override this setting)

As expected I can see same IE favorites list.

Also, code writer app settings are there.

As we can see it helps to streamline user experience across corporate devices. This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO)

I am sure most of you aware what is single sign-on (SSO) in Active Directory infrastructure and how it works. When we extend identity infrastructures to Azure by using Azure AD, it also allows to extend Single Sign-On capabilities to authenticate in to cloud workloads. it can be done using on-premises ADFS farm. Password Hash Synchronization or Pass-through Authentication allow users to use same user name and password to log in to cloud applications but this is not a “Seamless” access. Even they are using same user name and password, when log in to Azure workloads it will prompt for password.

In my below example, I have an Azure AD instance integrated with on-premises AD using Pass-through Authentication. In there I have a user R272845. I logged in to a domain joined computer with this user and try to access application published using Azure. when I type the URL and press enter, it redirects me to Azure AD login page.

Azure Active Directory Seamless Single Sign-On is a feature which allow users to authenticate in to Azure AD without providing password again when login from domain join/ corporate device. This can be integrated with Password Hash Synchronization or Pass-through Authentication. This is still on preview which means cannot use in production environment yet. However, if it doesn’t work in environment, it will always issue the typical Azure AD authentication page, so it will not prevent you from accessing any application. This feature is not supported if you using ADFS option already.

According to Microsoft, following can list as key features of Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO)

• Users are automatically signed into both on-premises and cloud-based applications.

• Users don't have to enter their passwords repeatedly.

• No additional components needed on-premises to make this work.

• Works with any method of cloud authentication – Password Hash Synchronization or Pass-through Authentication.

• Can be rolled out to some or all your users using Group Policy.

• Register non-Windows 10 devices with Azure AD without the need for any AD FS infrastructure. This capability needs you to use version 2.1 or later of the workplace-join client.

• Seamless SSO is an opportunistic feature. If it fails for any reason, the user sign-in experience goes back to its regular behavior – i.e, the user needs to enter their password on the sign-in page.

• It can be enabled via Azure AD Connect.

• It is a free feature, and you don't need any paid editions of Azure AD to use it.

• It is supported on web browser-based clients and Office clients that support modern authentication on platforms and browsers capable of Kerberos authentication

According to Microsoft, following environments are supported.

OS\Browser

Internet Explorer

Edge

Google Chrome

Mozilla Firefox

Safari

Windows 10

Yes