Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Azure Domain Services

Azure AD Self-Service password reset for Windows 7/8.1 Devices

Password resets requests are very common in any helpdesk. Azure AD self-service password reset service is allowing users to reset their passwords without IT helpdesk involvement. So far this was only supported on Windows 10 Azure AD join devices. Now with few modifications we can do the same thing with Windows 7 or Windows 8.1 devices. In this demo I am going to demonstrate how we can do self-service password reset with these non-windows 10 devices. 

This process required few prerequisites. 

1) Enable SSPR in Azure AD – We need to enable SSPR service in Azure AD first. I have explain those steps in here https://www.rebeladmin.com/2017/11/step-step-guide-reset-user-password-azure-ad-joined-windows-10-device/ 

2) Up to date Patches – Make sure the latest windows updates are applied to Windows 7/ Windows 8.1 devices. 

3) Users need to register with additional verification methods – As part enabling SSPR process, we also need to define how many methods it should use for user verifications. 

If you using multiple methods, make sure user is register with those method before use SSPR service. 

4) TLS 1.2 enabled – In Windows PC you must have TLS 1.2 enabled. It should not just set to auto negotiate. This can be done by using registry entries. 

Under HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols you will be able to see TLS 1.2 (if it is not, go ahead and create a key). under that folder there will be two sub folders called client & server. I prefer to do changes under both roles. In there we need to create a key with following values.

DisabledByDefault – DWORD value 0

[Read more…] about Azure AD Self-Service password reset for Windows 7/8.1 Devices

Step-by-Step guide to manage Impossible travel activity alert using Azure cloud app security

Let’s assume one of user in your sales team log in to https://myapps.microsoft.com and launch salesforce app successfully from his office in UK. Few minutes later the same user made successful login from Canada. Unless user is using remote connection, it is not impossible. Still someone can’t travel that fast ?. Azure Active Directory capable of detect this type of impossible sign-in activities. However, detection type for this kind of activities is “offline”. Which means reporting latency for these alerts are between 2 to 4 hours. 

Azure cloud app security also capable of detecting these types of activities but it is real-time as it detects activities based on sessions. It helps administrators to react faster and protect infrastructure from potential breach. In this demo, I am going to demonstrate how to fine tune built in azure cloud app security policy for Impossible travel activity and prevent breach. 

Before we start, first we need to integrate SaaS app with cloud app security. In my previous post I demonstrate how to do that. So please go ahead and read it on https://www.rebeladmin.com/2018/09/step-step-guide-block-data-download-using-azure-cloud-app-security/

In my demo I am using salesforce app. 

1. Once integration is done, log in to https://portal.cloudappsecurity.com as global administrator.

2. Then go to Settings | Conditional access app control

3. There you should be able to see your app under Conditional access app control tab. It should be in healthy connected status. 

4. Then click on Control | Policies

5. Under policies, click on impossible travel policy 

6. This is a built-in policy. as you can see it doesn’t have any actions attached to it. if CAS detect such activity, it will still be reported under CAS dashboards. 

7. In my environment, I like to get an alert if its detect such activity. To do that, click on Send alert as email option under Alerts. Then define email address in text box.  [Read more…] about Step-by-Step guide to manage Impossible travel activity alert using Azure cloud app security

Step-by-Step guide to configure your own app with Azure AD Password-based single-sign on

Azure AD application gallery contains thousands of applications already but there can be situations where organizations uses their own applications. In such scenario Azure AD allows to bring these apps to azure.  

In my previous blog post “Step-by-Step guide to Azure AD Password-based single-sign on”, I explained Azure AD password-based single-sign on and how we can use it. If you not read it yet, you can access it  using https://www.rebeladmin.com/2018/09/step-step-guide-azure-ad-password-based-single-sign/ . In this blog post, I am going to demonstrate how we can bring our own app to Azure AD and use Password-based single-sign on with it. 

In my demo environment I have cloud app called Woodgrove Expense Manager and I can access it using https://woodgroveexpensemanager.azurewebsites.net I need my sales and marketing team to use it. Also, I need them to share one login. However, I do not want end user to know these credentials. 

As first part of this demo, I need to integrate my app with Azure AD. To do that,

1. Log in to https://portal.azure.com as global admin.

2. Click on Azure Active Directory on the left-hand panel.

3. Then click on Enterprise applications 

4. In new window, click on + New application 

5. In application panel, click on Non-gallery application 

6. Then in new wizard, type name for app and click on Add

7. In new app window, click on Single sign-on 

8. Then select password-based single sign-on as SSO mode. Under sign-on URL define the application URL. in my demo it is https://woodgroveexpensemanager.azurewebsites.net . at last click on Save to apply the changes. 

9. Once settings are saved, click on Configure Woodgrove Expense Manager Password Single Sign-on Settings

10. In new window, select Manually detect sign-in fields and then capture sign in fields.

11. This will load up new tab with application page. Type the sign in details and then click on sign-in.

12. Then in app window it asks if we want to save captured login details. Click on Ok to capture data. 

13. After that, it will go back to sign-on page, in this page click on Ok, I was able to sign-in to the app successfully and then Ok to save the config.

14. Once configuration is saved, click on user & groups.

15. Then click on Add user

16. From the list of user & groups, I have selected group for my sales & marketing team. Once selection is done, click on Assign credentials.

17. In new window Set Assign credentials to be shared among all group members to Yes and type credentials for the https://woodgroveexpensemanager.azurewebsites.net . To complete the process, click on Ok & then Assign

18. This completes the configuration part. Next step is to test it. for that I am log in to https://myapps.microsoft.com as a user from sales & marketing group. Then click on Woodgrove Expense Manager

19. As expected, without any other additional logins, it log me in to the Woodgrove Expense Manager. cool ha? 

This marks the end of this blog post. Hope now you have better understanding how to bring your own app to Azure AD and use password-based single sign-on with it. If you have any further questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Step-by-Step guide to enable MFA for applications using Azure conditional access

Azure AD conditional access allows to apply MFA (multi factor authentication) rules per application based on groups, locations, sign-in risks. In this demo I am going to show how we can create conditional access policy to control MFA per application. 

1) As first step, I am logging in to https://portal.azure.com as global admin. 

2) Then go to Azure Active Directory

3) Then click on Conditional access 

4) Click on New Policy to create new MFA policy.

5) Then give it a name first, in my demo, my target group is sales & marketing team. So, I click on users & groups and then select the sales & marketing group. 

6) Then click on clouds app and select the application. In my demo I am using Microsoft teams.

7) Then click on Access control. after click on Grant Access and select Require multi-factor authentication. At last click on Select to finish the config. 

8) Then click On under enable policy and after click on create to activate the policy.  

9) Now it is time to test, I am going to log in to https://myapps.microsoft.com with an account belong to sales & marketing group. 

10) Then I click on Microsoft Teams. 

11) Then right away it gave me this new window. This is because I do not have MFA setup for this user. In order to use MFA, first it asking to set it up. 

12) Now, next time when I launch the Microsoft Team, its bring me straight to MFA verification page. This confirms the policy is working as expected. cool ha? 

This marks the end of this blog post. Hope now you have better understanding how to create conditional access policy to control MFA for application. This allows administrators to add additional layer of security to sensitive applications. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Step-by-Step Guide to manage Azure Active Directory Domain Service (AAD-DS) managed domain using Virtual Server

In my last two blog post I explain how to enable Azure Active Directory Domain Service and how to configure it properly. If you still not read those you can find those in following links.

Step-by-Step Guide to enable Azure AD Domain Services

Step-by-Step Guide to enable password synchronization to Azure Active Directory Domain Services (AAD DS)

In this post I am going to demonstrate how to add a virtual server which is setup on azure in to the managed domain and how to use Active Directory administration tools to manage the AAD-DS managed domain.

One thing I need to make clear is since it’s a managed domain services you do not going to have same manageability as in house domain controller.

According to Microsoft, 

Administrative tasks you can perform on a managed domain

•    Join machines to the managed domain.
•    Configure the built-in GPO for the 'AADDC Computers' and 'AADDC Users' containers in the managed domain.
•    Administer DNS on the managed domain.
•    Create and administer custom Organizational Units (OUs) on the managed domain.
•    Gain administrative access to computers joined to the managed domain.

Administrative privileges you do not have on a managed domain

•    You are not granted Domain Administrator or Enterprise Administrator privileges for the managed domain.
•    You cannot extend the schema of the managed domain.
•    You cannot connect to domain controllers for the managed domain using Remote Desktop.
•    You cannot add domain controllers to the managed domain.

Create VM

As the first step I am going to setup new VM under the same virtual network as the managed domain.

1)    In order to join VM to the same virtual network, we have to use Azure classic portal to build the VM.
2)    Log in to the azure classic portal > New > Compute > Virtual Machine > From Gallery ( The reason is using this option can define the advanced options)

md1

3)    Then select the template from the list. I am going to use windows server 2016 TP 5. Click on arrow to proceed.

md2

4)    In next window provide the info for the new VM (such as name, resources and local admin account) and click proceed arrow.

md3

5)    In Next window select the Virtual network as same as the one you setup the AAD-DS managed domain. If you do not select correct virtual network you will not be able to connect this vm to the managed domain. Once done, click on button to proceed.

md4

6)    In next window can add the extensions you like and click to button to setup the vm.

md5

Connect VM to the Managed Domain

1)    Once New VM is up and running, click on connect to log in to the VM

md6

2)    Now the server is ready, next step is to join it to the domain.

md7

3)    In domain, type the managed domain name and type the credentials. The use account used for authentication should be member of AAD DC Administrators group ( I explain on my first article how to setup this group)

md8

md9

md10

4)    Once connected to the domain, reboot it to complete the process.

Manage domain using AD administration tools

In this step I am going to install AD admin tools using that we can manage the Azure managed domain.
Note – This also can do using desktop operating system as well. Ex- windows 10. To do it, need to install RSAT for windows 10. (https://www.microsoft.com/en-gb/download/details.aspx?id=45520)

1)    Log in to the server as member of AAD DC Administrators group
2)    Server Manager > Add Roles and Features

md11

3)    Click next in the wizard

md12

4)    In next window keep the default and click next

md13

5)    In next window keep the default and click next to proceed

md14

6)    On the roles page, keep default values and click next

md15

7)    In features select Remote server administration tools > Role administration tools > AD DS and AD LDS Tools and then click next to proceed.

md16

8)    In next window click on install to proceed with the installation

md17

9)    Once install done go to Server Manager > Tools > Active Directory Users and Computers
Here we can see the AD console which Admins familiar with.

md18

md19

md20

Hope this is helpful and if you have any question feel free to contact me on rebeladm@live.com