Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Azure Domain Service

Step-by-Step Guide: Enroll Windows 10 Devices in to Microsoft Intune using Autopilot

If you worked with SCCM or VDI solutions you may already know that creating & managing system images is a painful task. If you are using Microsoft Intune as your MDM solution, we can use Intune & Windows autopilot feature to enroll & prepare device for the production use without worrying about re-build or applying custom operating system images. Windows autopilot is a windows 10 feature which can use to pre-configure, reset, repurpose, recover devices. In this demo I am going to demonstrate how to prepare & enroll windows 10 device in to Microsoft Intune using Windows autopilot. 

Prerequisites

1. Windows 10 version 1703 or higher must be used. Supported editions are:

• Pro

• Pro Education

• Pro for Workstations

• Enterprise

• Education

2. One of the Azure Active Directory (automatic MDM enrollment and company branding features) and MDM subscription:

• Microsoft 365 Business subscriptions

• Microsoft 365 F1 subscriptions

• Microsoft 365 Enterprise E3 or E5 subscriptions, which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune)

• Enterprise Mobility + Security E3 or E5 subscriptions, which include all needed Azure AD and Intune features

• Azure Active Directory Premium P1 or P2 and Intune subscriptions (or an alternative MDM service)   

In my demo environment, I have windows 10 enterprise virtual machine with latest windows updates. Let’s see how we can enroll it to Azure Intune with Autopilot. 

1. Log in to Azure Portal as Global Administrator

2. Go to Azure Active Directory | Devices | Device Settings

3. Check settings under Users may join devices to Azure AD, if you have selected users or group, make sure you going to use those accounts for the enrollment process. in my environment I allow All.

4. Then go to Azure Active Directory | Users. Then go to the user you going to use for the enrollment and verify relevant licenses are assigned. 

5. In order to import devices, we need find out serial numbers, Windows product IDs & hardware hashes. To do that log in to your windows 10 machine and install following script. Then we can create CSV with relevant info. 

Install-Script -Name Get-WindowsAutoPilotInfo

You also can download script from https://aka.ms/Autopilotshell and install manually. 

[Read more…] about Step-by-Step Guide: Enroll Windows 10 Devices in to Microsoft Intune using Autopilot

Cross-Organization Collaboration with Azure AD B2B

In on-premises Active Directory environment, we use “trusts” to establish identity infrastructure connection between businesses. Based on trust type and access permissions, users from one organization can access resources/services in other infrastructure using their own domain credentials. Azure AD B2B does the same thing for cloud resources but in much more easier way. In this demo I am going to demonstrate how easily we can allow users from other organizations to access our cloud resources using Azure AD B2B. 

In my demo environment, I do have an Azure AD user group called sg-Finance . All the users from Finance department are members of this group. I have assign several SaaS applications to them. Company Contoso recently merge with another company. Few privileged users from new company like to access some financial data belongs to Contoso. The relevant data is currently available via SaaS applications which is used by sg-Finance group members. In this demo, I am going to invite external user to be part of sg-Finance group so they can access same applications. 

1. To start, log in to Azure Portal https://portal.azure.com as Global Administrator

2. Then go to Azure Active Directory | Groups

3. Then go to sg-Finance group and then Members.

4. In here, Megan is a member of this group. I log in to http://myapps.microsoft.com as Megan to verify SaaS application access. In this demo I am using Box as sample app. 

5. Now go back to group page and click on Add members

[Read more…] about Cross-Organization Collaboration with Azure AD B2B

Step-by-Step guide to Azure AD Password protection

Complex passwords are a basic requirement to protect a system from cyber-attack. Even today most of the cyber-attack could have prevented if users were using complex, un-guessable passwords. I agree this is not the best solution especially as we are moving towards password-less authentication (Azure AD already released preview for it you can find more about it via https://www.rebeladmin.com/2018/09/step-step-guide-azure-ad-password-less-authentication-public-preview/). However, attackers always try the low hanging fruits first. In on-premises AD environment we can force users to use complex passwords via group policy. however, we couldn’t ban passwords using this method. Now Azure AD support banned password lists and smart lockout for Azure AD & on-premise AD in hybrid setup. Smart lockout is using cloud intelligence to detect password spoofing attempts from attackers. In this demo I am going to demonstrate, how to enable this feature in hybrid environment to protect both sides. 

As the first step, let’s enable the password protection. 

1. Log in to Azure Portal as global admin

2. Click on Azure Active Directory

3. Then Authentication Method

4. New window is to define password protection settings. In this demo, I am keeping the default thresholds for custom smart lockout. To define ban password list, click on Yes for Enforce custom list and then type the passwords you like to ban. 

[Read more…] about Step-by-Step guide to Azure AD Password protection

Step-by-Step Guide to Azure AD Password-less Authentication (public-preview)

From early days of computing “password” is used to protect access to services or data. Passwords are breakable so people start using multi-factor authentication to add extra security to authentication process. With multifactor authentication we have to provide additional PIN or secret. However, it still not eliminates the password fact. The modern identity attacks are getting more and more sophisticated. So, we need to think about all possibilities of a breach. 

Microsoft Azure AD is now ready to provide password-less authentication experience to Azure AD connected apps using Microsoft Authenticator mobile app. with authenticator app we can replace password with fingerprint, face recognition, or PIN. This is still in public preview but it is not too soon to try it out. In this demo I am going to demonstrate how to enable password-less authentication with Azure AD.

1. As first step we need to enable public preview for password less authentication. To do that first install the public preview release of the Azure Active Directory V2 PowerShell Module using https://www.powershellgallery.com/packages/AzureADPreview/2.0.0.114

2. Then type Connect-AzureAD and login with global admin account. 

3. Once successfully authenticated, run New-AzureADPolicy -Type AuthenticatorAppSignInPolicy -Definition '{"AuthenticatorAppSignInPolicy":{"Enabled":true}}' -isOrganizationDefault $true -DisplayName AuthenticatorAppSignIn

4. As next step I need to enable MFA for the Azure AD user that I am going to test. To do that, log in to https://portal.azure.com as Global Administrator. 

5. Then go to Azure Active Directory | Users

[Read more…] about Step-by-Step Guide to Azure AD Password-less Authentication (public-preview)

Step-by-Step guide to connect down-level devices to Azure AD (in hybrid environment)

Devices runs with Windows 10 and Windows Server 2016 can directly connect to Azure AD. I have used it on my last few posts and explain different features available for Domain Joined Devices. However not every device in an infrastructure runs with Windows 10 or Windows Server 2016. If it is cloud only environment, you can simply connect your VMs in Azure to Azure AD without issue. but if it is remote devices you do not have option than upgrading to windows 10 and windows 2016. In Hybrid Environment with some configuration changes, Azure AD allow to join devices runs with, 

• Windows 8.1

• Windows 7

• Windows Server 2012 R2

• Windows Server 2012

• Windows Server 2008 R2

In this demo, I am going to explain how we can connect these down-level devices to Azure AD. 

If it is hybrid environment, it will be either federated or non-federated environment. In this post, I am only going to focus on non-federated environment. The configuration and prerequisites are different from one method to another. 

In non-federated environment, 

1. You must have healthy AD synchronization using Azure AD Connect
2. If you are using Seamless single sign-on with Azure AD Connect, it is still supported configuration. more info about it can find using https://www.rebeladmin.com/2017/09/azure-active-directory-seamless-single-sign-azure-ad-seamless-sso/ 
3. If down-level devices are using roaming profiles it is not going to work with Azure AD. In that case you need to move to Windows 10
4. You need to have Azure Global Administrator Account and Domain Admin Account to do the configuration changes. 

Create Service Connection Point 
 
First step of the configuration is to create service connection point (SCP) in local AD so devices can discover Azure AD tenant information during the registration process. 
In order do that we need to run following PowerShell script in Azure AD Connect server. 

Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1";

$aadAdmin = Get-Credential;

Initialize-ADSyncDomainJoinedComputerSync –AdConnectorAccount [AD connector account] -AzureADCredentials $aadAdmin;
 
In above,
 
$aadAdmin – Parameter is to represent the Azure AD admin account used in the configuration. 
 
[AD connector account] – This should replace with the AD account used for Azure AD Sync
 
Note – 
• This must run from the server you have AD Connect configured
• It is recommended to run it from Microsoft Azure Active Directory Module for PowerShell tool. If you use it you do not need to import the module. 
• You must have AD DS tools installed on the same server otherwise command will fail. 
 
Azurec1
 
Verify Service Connection Point Details
 
After you run the command successfully we can verify SCP using,

$scp = New-Object System.DirectoryServices.DirectoryEntry;

$scp.Path = "LDAP://CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=therebeladmin,DC=com";

$scp.Keywords;
 
In above DC=therebeladmin,DC=com represents the domain. 
 
If it was successful, you will get response like below. 
 
Azurec2
 
Allow Users to Join Devices to Azure AD
 
Before you joined the devices, first verify if you allow users to connect devices to Azure AD. 
To do that, 
 
1. Log in to Azure Portal
2. Go to Azure Active Directory 
3. Then Devices
 
Azurec3
 
4. Then click on Device Settings
 
Azurec4
 
5. Then the settings can find under, User may join devices to Azure AD option. In my demo setup, I am allowing all the users to join devices. 
 
Azurec5
 
Join down-level devices to Azure AD
 
Now we have all the prerequisites ready. Next step is to register device with Azure AD. In my demo, I have a VM which runs Windows 8.1. I am going to add it to Azure AD.
 
1. Log in to the Device as Administrator
 
 
Azurec6
 
3. Double click on the MSI after download and click on Install to proceed. 
 
Azurec7
 
Note – This VM is already part of the local domain. 
 
4. Then go to Start > Search > PC Settings after that click on Network 
 
Azurec8
 
5. The click on Workplace > Join
 
Azurec9
 
6. It will prompt for the login and provide the relevant password. 
 
Azurec10
 
7. After successful join, it will show following
 
Azurec11
 
8. Now I can see the device under Azure AD Devices. 
 
Azurec12
 
This marks the end of this blog post. Hope this was useful. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.