Manage Continues Access Evaluation behaviour via Conditional Access Polices

When I first had a play with CAE for the 1st time, I wrote about on the importance of this setting and how to enable it in your environment. Please check the previous article below.

Continue reading “Manage Continues Access Evaluation behaviour via Conditional Access Polices”

Azure AD Break Glass Account: What to consider when creating one and how to monitor sign ins

With the growing threats around the world everyday, bad actors are targeting Microsoft 365 ecosystem like never before. Attacks are taking place everyday and if and when they have breached in, their end goal is to go for the “keys to the kingdom”. Usually its just the end of the story when they get them. Meaning the bad actors can basically do whatever the can and harm that companies M365 related activates or ask for a ransom to release the accounts. Either way its not for the organization and admins should have a proper and a quick way to recover the accounts ASAP.

Continue reading “Azure AD Break Glass Account: What to consider when creating one and how to monitor sign ins”

Azure AD Hidden Gems. Azure AD Temporary Access Pass

Temporary Access Pass or TAP, is a cool Azure AD feature which is still in Preview, but I see huge wins if Microsoft put this in to general availability so that the IT admins can provide uninterupted security over user accounts.

In real life, users may forget to bring the mobile phone to office or maybe out of battery so they can’t get in to the Authenticator app to complete the MFA challange.

When a user fails to complete a strong authentication step such as FIDO2 or Multi Factor, Temporary Access Pass can deply to save the day.

In this way if the user doesnt have the ability to complete the strong authentication, IT doesn’t need to take them out from the MFA Conditinal Access Policy for an example. Users have the option of entering the re-usable or one-time TAP to get in.

Continue reading “Azure AD Hidden Gems. Azure AD Temporary Access Pass”

How to Assign Admin Roles to Azure AD Groups with Access Reviews and Just in Time Access?

As of July 31 2021, this feature in Generally Available and was notified in the M365 Admin Center with the message MC274516

This approach is how you assign roles to Azure AD Groups along with the Privileged Identity Management features Just in Time access and Access Reviews options.

Continue reading “How to Assign Admin Roles to Azure AD Groups with Access Reviews and Just in Time Access?”

How to analyze Conditional Access Policies with ‘Report Only’ Mode?

Conditional Access Polices can be setup in 3 main modes. On/ Off/ Report Only.

On and Off modes are self explanatory where “Report Only” mode needs additional work. This post will go in detail on how to use the Report Only mode before you actually switch to ON.

Continue reading “How to analyze Conditional Access Policies with ‘Report Only’ Mode?”

Why Azure AD Continues Access Evaluation is Important?

Continues Access Evaluation or CAE is still in preview, but it has proven to refresh the near-real time refresh for Conditional Access Policies.

Ideally this is a very helpful feature in the world of Identity and Access Management, because there are frequent attacks happening and the IdAM Admins need to take action quickly.

Some actions including Reset user password, adding or removing Trusted IPs and specially when the user is moving from location to location and when the Conditional Access policies to govern the trusted locations.

Usually the token expiration and refresh interval is 1 hour and ideally when a client application that is Modern Authentication aware tries to connect, the API requests are authorized using OAuth 2.0 access tokens.

Every hour, when they are due to refresh, it reevaluates the user state, policies in order to enforce what’s in the policy.

The client app redirects back to the Azure AD to refresh the token and according to the user state, the new token will make sure whether the user access to be blocked or to be allowed.

Continue reading “Why Azure AD Continues Access Evaluation is Important?”

Automate Cross Tenant Resource Access With Azure AD Entitlement Management

With the Azure AD Identity Governance feature “Entitle Management” it is easier to automate the access requests, set expiry dates, justify why a user needs access and get the load out of the IT admins.

Azure B2B collaboration is a hot topic these days and the end result should be stresses access from the end user’s end, however security is a concern and who gets the right access is a consideration.

The feature I’m testing today is not specifically related to internal users, but it will be helpful in managing Guest User access to resources.

Continue reading “Automate Cross Tenant Resource Access With Azure AD Entitlement Management”

3 Ways to Enforce Azure AD MFA Registration in Azure AD/ M365 Tenant

Requirement of having MFA on Azure AD accounts are top priority at the moment and basically it has become a basic requirement.

There are couple of ways to enable MFA on to user accounts by default. This can make sure all users are protected without having t o run periodic reports etc.

Reason for collation of all the options in this article is the options are in few different locations and depending on your licensing tier (free or paid), the options are different

Continue reading “3 Ways to Enforce Azure AD MFA Registration in Azure AD/ M365 Tenant”

Azure AD Passwordless Authentication with Yubico FIDO2 key

Lately I got the opportunity to test the latest Identity Authentication method with Azure AD. None other than the Passwordless Authentication. I will post few related articles on FIDO2 and what it does rather than re-explaining what has already well explained by the FIDO Alliance and Microsoft.

The good thing is passwordless methods can be activated on top of the standard Azure MFA methods (Authenticator and/or phone SMS).

Continue reading “Azure AD Passwordless Authentication with Yubico FIDO2 key”

Cool and a Powerful feature to stop bulk accidental/ intentional deletion exports in an Azure AD Hybrid Environment

This is a hidden gem for Azure AD Sync connect configurations and I was looking for a feature like this for sometime now. Noticed this was available while trying to perform a migration of the tool to anew server and when reviewing the new confit before commuting.

Continue reading “Cool and a Powerful feature to stop bulk accidental/ intentional deletion exports in an Azure AD Hybrid Environment”

Effective use of Azure AD Administrative Units [Azure AD AUs]

I look at the Azure AD portal with curiosity to see what are the new features and then want to play around with them to better understand it’s usage. This is not a latest feature, but it’s out of the preview mode and this is me writing the effective use of Azure AD AUs.

Continue reading “Effective use of Azure AD Administrative Units [Azure AD AUs]”

How to federate Google (Gmail) accounts with Azure AD to access resources without a Microsoft account

My DIY project for this weekend is to try and implement a method to set Google as an identity provider for Azure AD resource access requirements. If someone can access apps or services on a different platform without having to create an account of the resource owner’s end, that makes lives more easier and simply takes off the hassle of registering another account.

Read mo