Jorge's Quest For Knowledge!

All About Identity And Security On-Premises And In The Cloud – It's Just Like An Addiction, The More You Have, The More You Want To Have!

(2021-10-12) Azure AD Administrative Units – Dynamically Managing AU Assignments – Part 1

Posted by Jorge on 2021-10-12


Quite some time ago I blogged about Azure AD Administrative Units (AU). The details can be found in the found through the following blog posts:

And more recently:

Microsoft documentation: https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units

In my most recent article about Administrative Units I already summarized how interesting it is to use Administrative Units in those scenarios where delegation of admin is required. Nevertheless, I think one of the very interesting features is unfortunately not (yet) supported!

Figure 1: Administrative Units In Azure AD – Management Supported/Unsupported Options

Automating assigning user and group objects to specific Administrative Units would seriously have a lot of manual work. Unless you have something external to Azure AD regarding the logic and execution leveraging the Microsoft graph, by default Azure AD does not support that, today. Hopefully it will be soon, as I think many want to get rid of the manual burden or any custom solution. Until automatic assignment is supported/possible by Azure AD itself, you may be able to use what is in this post. Please be aware this is an example and that if you want to use this for your own environment, you need to customize the filters/configurations to that data in your Azure AD tenant!

Interesting enough, I have found a way to automatically assign user/groups, based upon attributes of those objects, to specific administrative units. This blog is fully dedicated to that! So please hang on, keep reading and in the end you might end up with a solution that might work for you!

DISCLAIMER: please make sure to test this in a TEST environment/tenant first and improve where needed!

For all this to work we need the following components:

  1. Objects with attributes and values in those attributes to be able to use in filters
    1. Hybrid scenario
    2. Cloud only scenario
  2. Azure AD Connect configuration to sync the required data to Azure AD
    1. Hybrid scenario ONLY
  3. Administrative Units with logic to support some kind of query rules
  4. A registered application with the correct permissions to manage the AU assignments
  5. A PowerShell script for the initial processing assignment
  6. An Automation Account with a scheduled PowerShell Runbook for subsequent processing assignments

So, let’s get started!

[AD.1 – Objects with attributes and values in those attributes to be able to use in filters]

Hybrid Scenario

In my on-premises test and demo AD I have about 100000+ user objects and also lots of groups. For this exercise I needed a data set of users and groups. For that I chose the objects in the 5 category OUs and the objects in the country OUs. For every of the yellow marked OUs, an AU will be created in Azure AD. In the country OUs both users and groups are (already) being synched to Azure AD. In the category OUs only users are being synched to Azure AD. In both cases Azure AD Connect is doing the synching,

Figure 2: OUs In AD With Objects Being Synched To Azure AD

The AUs in Azure AD need to have objects assigned automatically based upon some data to be queried in filters. So you need to think about the AUs you want to create and how to decide, which objects will go into which AUs and what data will be used to make those decisions. If the data is not there (yet) you need to populate that data in AD from some system that has it.

In this example scenario I made the following decisions:

  • user objects in the country OUs
    • “department” attribute being equal to the fixed string “SampleData”
    • “country” attribute being equal to the string “<country name>” (e.g. Netherlands)
  • group objects in the country OUs
    • “department” attribute being equal to the fixed string “SampleData”
    • “location” attribute being equal to the string “<country name>” (e.g. Netherlands)
  • user objects in the category OUs
    • “employeeType” attribute being equal to the string “<employee category>” (e.g. CONTRACTORS)
  • group objects in the category OUs
    • N.A. (not being synched)
Figure 3: Sample Data For User Objects In The Country OUs
Figure 4: Sample Data For Group Objects In The Country OUs
Figure 5: Sample Data For User Objects In The Category OUs

Cloud Scenario

For objects authoritatively created in Azure AD, you will have to make sure those objects (users and groups) have the required data stored in some attribute. You may even need to extend the Azure AD schema to store the data if no attribute contains the data you require.

To read more about extending the Azure AD schema, please check out the following posts:

To be continued in PART 2 of this series.

Cheers,

Jorge

————————————————————————————————————————————————————-
This posting is provided “AS IS” with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/

————————————————————————————————————————————————————-
########################### IAMTEC | Jorge’s Quest For Knowledge ##########################
#################### http://JorgeQuestForKnowledge.wordpress.com/ ###################

————————————————————————————————————————————————————

IAMTEC

Identity | Security | Recovery

————————————————————————————————————————————————————-

One Response to “(2021-10-12) Azure AD Administrative Units – Dynamically Managing AU Assignments – Part 1”

  1. […] « (2021-10-12) Azure AD Administrative Units – Dynamically Managing AU Assignments – Part&… […]

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

 
%d bloggers like this: