Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Azure Active Directory Domain Service

Step-by-Step Guide: How to setup Facebook federation with Azure AD?

Facebook federation with Azure AD allows external users to use their Facebook accounts to access corporate applications. In this demo, I am going to demonstrate how we can initiate federation with Facebook.

Before start configuration, make sure you have a valid Azure AD Subscription, an Application published through Azure AD, and a Facebook account.

Enable Self-service sign-up for guest users (preview)

Before we initiate federation with Facebook, we need to enable Self-service sign-up. To do this,

1. Log on to Azure Portal as Global Administrator
2. Click on Azure Active Directory

Azure Active Directory Service

3. On the Azure AD properties page, click on User settings

Azure AD user settings

4. Then under External Users, select Manage external collaboration settings

Manage external collaboration settings for External users

5. In the External collaboration settings page, Set the Enable guest self-service sign up via user flows (Preview) option to Yes. Then to apply settings click on Save.

Enable guest self-service sign up via user flows [Read more…] about Step-by-Step Guide: How to setup Facebook federation with Azure AD?

Step-by-Step Guide: Azure Active Directory Domain Services resiliency with replica sets

In an Active Directory Environment, we keep additional domain controllers to improve resiliency. In this way, if one domain controller fails it will not make a big impact. We can further improve the resiliency of infrastructure by keeping an additional domain controller and mission-critical servers in a different location. So, in the event of a site failure, we will still have a domain controller and mission-critical servers running on a remote location. When we create the Azure Active Directory Domain Services managed domain, we provide a unique domain name. In the back end, Azure will deploy two domain controllers with this unique domain in your selected Azure region. This setup is called a “replica set“. Now, to improve resiliency, we can create additional replica sets in other Azure regions.

Each replica set uses a virtual network. All these virtual networks must be peered to create a mesh network to support the replication between replica sets.

Azure Active Directory Domain Services replica sets have the following characteristics.

• This feature is still in the preview stage.
• Each replica set contains the same data. You can’t use different domains for different replica sets.
• All replica sets will be placed in the same Active Directory site. Because of that the replication between replica sets is faster.
• All replica sets should create under the same subscription. You cannot have replica sets between different subscriptions.
• In the preview, you can have up to four replica sets.
• Replica sets only ensure the availability of the authentication services. But to use the full benefits of it, you need to consider how your Azure VMs, applications will work during a site failure.

In this demo, I am going to demonstrate how to create a replica set of existing Azure Active Directory Domain Services managed domain.

In my current setup, I already have Azure Active Directory Domain Services managed domain configured.

Azure Active Directory Domain Services managed domain properties

This is using REBELVN1 virtual network and aadds-subnet.

Azure Active Directory Domain Services managed domain properties page

REBELVN1 virtual network is set up under REBELRG1 resource group. This resource group is using “East US” Azure region. The Virtual network is using 10.0.0.0/16 address space. It has two subnets.

vmsubnet – 10.0.2.0/24 for virtual machines
aadds-subnet – 10.0.0.0/24 for Azure Active Directory Domain Services managed domain

Azure Active Directory Domain Services managed domain virtual network settings

In this demo, I am going to create a new virtual network in “West US” Azure region. Later this will be used to host the additional replica test. [Read more…] about Step-by-Step Guide: Azure Active Directory Domain Services resiliency with replica sets

Step-by-Step Guide: Enable Windows 10 password-less authentication with FIDO2 security keys (Azure AD + Microsoft Intune)

In my previous blog post, I explained how we can use FIDO2 security keys to perform password-less authentication with Azure AD. You can access it using Step-by-Step Guide: Azure AD password-less sign-in using FIDO2 Security keys
We also can use FIDO2 security keys to sign-in to Azure AD Joined or Hybrid Azure AD Joined Windows 10 devices. In this demo, I am going to demonstrate how we can enable FIDO2 security key sign-in using Azure AD and Microsoft Intune.
Before enabling password-less authentication with FIDO2 security keys, make sure you have,

1. Azure AD and Intune – Make sure you have valid Azure AD and Intune subscription in place.
2. Azure AD Join on Hybrid Azure AD joined Windows 10 Devices – If it is Azure AD Join device, it should run at least Windows 10 version 1903. If it is Hybrid Azure AD joined device at least it should be running Windows 10 Insider Build 18945
3. FIDO2 Security keys – The good people at eWBM provided eWBM Goldengate security key G320 (USB-C) and eWBM Goldengate security key G310 (USB-A) for testing. I will be using eWBM Goldengate security key G320 (USB-C) in this demo with Surface Pro 7.

4. Azure AD user account which completed the FIDO2 security key enrolment process – This explained in details via my previous post https://www.rebeladmin.com/2020/03/step-step-guide-azure-ad-password-less-sign-using-fido2-security-keys/

In this demo, I am going to use a user called Megan Bowen (meganb@M365x620957.onmicrosoft.com) for testing. I already have an Azure AD join device ready for her. It is showing as compliant in the Microsoft Intune portal.

Enable Windows Hello for Business with Intune

Before we create a device configuration profile, we need to enable Windows Hello for Business with FIDO2 security key support. To do that,

1. Log in to Azure Portal as Global Administrator ( https://portal.azure.com/ )
2. Search for Intune in the search box and click on it.


3. Then click on Device Enrolment

4. In the new window click on Windows enrollment | Windows Hello for Business

5. Select Enable for Configure Windows Hello for Business. Then keep the default settings.

6. Also, select Enable for Use security keys for sign-in

This will enable FIOD2 security key support.

7. At the end click on Save to apply the changes.

[Read more…] about Step-by-Step Guide: Enable Windows 10 password-less authentication with FIDO2 security keys (Azure AD + Microsoft Intune)

Step-by-Step Guide: Bulk import/remove group members from Azure Active Directory (Public Preview)

So far in Azure Active Directory, if we need to add members to a group, we have to go through a few steps. 

To remove members from a group, we have to select members manually and then remove it. 

This process is still okay for small scale changes. But if it is large scale change, it will take time. Also, engineers can make mistakes by selecting the wrong users. Microsoft now allows us to add and remove users based on CSV files. This is still in the preview stage but it is not too early to test. In this demo, I am going to demonstrate how we can add/remove Azure AD group members using CSV files. 

Add Members 

To add members to Azure AD group using the new CSV method, 

1. Log in to Azure Portal (https://portal.azure.com) as Global Administrator or Group Owner.

2. Go to Azure Active Directory | Groups  

3. In this demo, I am going to add users to "Leadership" group. So, I went ahead and click on it.  [Read more…] about Step-by-Step Guide: Bulk import/remove group members from Azure Active Directory (Public Preview)

Step-by-Step Guide: How to standardize Desktop devices using Microsoft Intune Device configuration Profiles?

In my previous blog post, I have explained how we can apply Microsoft security settings to corporate devices using Intune Security Baselines (https://www.rebeladmin.com/2019/08/step-step-guide-apply-security-baselines-windows-10-devices-using-microsoft-intune/). We can apply similar settings to on-premises devices via group policies. Apart from security settings, we use group policies to standardize device configurations in on-premises environments. As an example, we can block user access to control panel settings by using group policy.

Microsoft Intune Device configuration Profiles allow us to push similar desktop settings to cloud-managed (Azure AD + Intune) devices. This allows organizations to maintain granular control over device settings. In this demo, I am going to demonstrate how to set up and apply Microsoft Intune Device configuration Profile. 

• Device configuration Profiles can use to standardize Android, iOS, macOS, Windows Phone 8.1, Windows 8.1, Windows 10 devices. 

• You need to have your devices enrolled with Intune to use this feature. You can find more info about device enrollment using my previous blog posts https://www.rebeladmin.com/2018/11/step-step-guide-enroll-windows-10-devices-microsoft-intune-using-autopilot/ 

In my demo environment, I have Azure AD joined & Intune enrolled windows 10 device called W2003.

Using device configuration profiles, I am going to,

• Disable user access to Control Panel Settings

• Push corporate proxy server settings to IE (server IP 10.10.10.10 with port 8080)

To do that, 

1. Log in to Azure Portal (https://portal.azure.com) as Global Administrator and go to All services | Intune or else log in to Intune device management portal directly via https://devicemanagement.microsoft.com 

2. Then click on Device configuration | Profiles 

3. In the profiles page, click on + Create profile

[Read more…] about Step-by-Step Guide: How to standardize Desktop devices using Microsoft Intune Device configuration Profiles?