When using an Enterprise Application in Azure AD with SAML SSO you need to have SAML Signing Certificate. If that certificate is going to expire, Azure AD will notify you about it and guide you on how to update it to prevent SSO outage.
The e-mail you may receive will be similar to the following
Figure 1: E-mail From Azure AD Warning You About An Upcoming SAML Signing Certificate Expiration –
Clicking on the link for the Azure Portal in numbered item 1, will redirect you to the application question. When I did that, I saw the following for the mentioned application
Figure 2: SSO Configuration For The Mentioned Application –
If you look at it, you see the SSO is disabled. So you might ask yourself why in the heck is Azure AD mailing about an upcoming SAML Signing certificate expiration, is SSO is not even configured? This surprised me a bit.
In this case, and I can’t even remember this, in the past I apparently configured SSO, or played with it, then disabled it while not cleaning up the SAML Signing Certificate. While being disabled, click on the SAML option, and then you will see there is indeed a SAML Signing Certificate, although not in use at all.
Figure 3: SAML Signing Certificate Configured While Not Being In Use At All –
Click on EDIT in the “SAML Signing Certificate” Section and you will see something similar as:
Figure 4: SAML Signing Certificates That Are Configured –
In THIS CASE (SAML Signing Certificate configured, but not in use at all), I clicked on the three dots on the right for the inactive SAML Signing certificate and selected “Delete Certificate” and confirmed with “YES”. Now if you try to delete the last active SAML Signing certificate, Azure AD will not let you do it. Because the SSO was not configured and the app was not even in use, the best option is to delete the complete app from Azure AD.
Lessons learned:
Cleanup you stuff! 🙂
If you do use a SAML SSO configured app, make sure to:
have specified one or more e-mail addresses to receive notifications like these
not ignore these e-mails to make sure SSO is not impacted and does not break
renew these SAML Signing certificates in time
when configuring Azure AD with a new SAML Signing certificate, to also update the Azure AD SAML configuration in the application itself
Cheers,
Jorge
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
[AD.6 – An Automation Account with a scheduled PowerShell Runbook for subsequent processing assignments]
To automate all this coolness you need an automation account that processes everything on a regular basis!
To create an automation account with all that is required, you can use the code below. Make sure to replace the parts corresponding to your own environment and requirements
Invoke-Command -ScriptBlock {
Function retrieveTenantIDFromTenantFDQN () {
Param (
[string]$tenantFQDN
)
# Specify The Tenant Specific Discovery Endpoint URL
$oidcConfigDiscoveryURL = $null
$oidcConfigDiscoveryURL = "https://login.microsoftonline.com/$tenantFQDN/v2.0/.well-known/openid-configuration"
$oidcConfigDiscoveryResult = $null
# Retrieve The Information From The Discovery Endpoint URL
$tenantID = $null
$oidcConfigDiscoveryResult = $null
Try {
$oidcConfigDiscoveryResult = Invoke-RestMethod -Uri $oidcConfigDiscoveryURL -ErrorAction Stop
}
Catch {
# Placeholder
}
# If There Is A Result Determine The Tenant ID
If ($null -ne $oidcConfigDiscoveryResult) {
$tenantID = $oidcConfigDiscoveryResult.authorization_endpoint.Split("/")[3]
}
Return $tenantID
}
Clear-Host
# Tenant Details
$tenantFQDN = "<SPECIFY YOUR TENANT FQDN>" # e.g. "<TENANT NAME>.ONMICROSOFT.COM"
$tenantID = retrieveTenantIDFromTenantFDQN -tenantFQDN $tenantFQDN
# Application Details
$msftGraphMgmtAppApplicationID = "<SPECIFY YOUR APPLICATION ID>" # e.g. "56a7b6fe-06f9-5635-9e93-7e5ccacdc08e"
# Private Key/Certificate Details
$subjectName = "<SPECIFY THE SUBJECT NAME OF THE CERTIFICATE TO ACCES THE REGISTERED APPLICATION>" # e.g. "mgmt-Admin-Units-MSFT-Graph"
$exportFolderPath = "<SPECIFY THE EXPORT FOLDER FOR THE PFX FILE>" # e.g. "C:\TEMP"
$pfxOutputPath = Join-Path $exportFolderPath "$subjectName.pfx"
$pfxPassword = '<SPECIFY THE PASSWORD PROTECTING THE PFX FILE>' # e.g. 'gLOPeVPMw93YaarLItOLFMF3Y5b6G90jehC1psMOfuZsyj04nElKc2yXrzf6YvHz'
$pfxPasswordSecure = $(ConvertTo-SecureString $pfxPassword -AsPlainText -Force)
# Connect Using Azure Automation
Connect-AzAccount -TenantId $tenantID
Get-AzSubscription -TenantId $tenantID
Set-AzContext -Subscription $(Read-Host "Subscription ID...")
# Details For The Automation Account And Runbook
$displayName = "<SPECIFY THE DISPLAY NAME OF THE AUTOMATION ACCOUNT>" # e.g. "Managing-Admin-Unit-Assignments"
$automationAccountDisplayName = "AutmationAccount-$displayName"
$automationAccountLocation = "<SPECIFY THE AZURE LOCATION TO HOST THE AUTOMATION ACCOUNT>" # e.g. "West Europe"
$automationAccountResourceGroup = "<SPECIFY THE RESOURCE GROUP NAME FOR THE AUTOMATION ACCOUNT>" # e.g. "RG-Automation"
$automationAccountRunbookFilePath = "<SPECIFY THE FULL PATH TO THE POWERSHELL CODE FOR THE RUNBOOK>" # e.g. "<FULL FOLDER PATH>\AAD-Automated-Administrative-Unit-Assignment_Auto-Account-Runbook.ps1"
# Create The Automation Account
New-AzAutomationAccount -Name $automationAccountDisplayName -Location $automationAccountLocation -ResourceGroupName $automationAccountResourceGroup
# Upload The PFX File Into The Automation Account
New-AzAutomationCertificate -AutomationAccountName $automationAccountDisplayName -Name $subjectName -Path $pfxOutputPath -Password $pfxPasswordSecure -ResourceGroupName $automationAccountResourceGroup
# Create The Required Variables
New-AzAutomationVariable -AutomationAccountName $automationAccountDisplayName -Name "tenantFQDN" -Encrypted $False -Value $tenantFQDN -ResourceGroupName $automationAccountResourceGroup
New-AzAutomationVariable -AutomationAccountName $automationAccountDisplayName -Name "appClientID" -Encrypted $False -Value $msftGraphMgmtAppApplicationID -ResourceGroupName $automationAccountResourceGroup
# Import The PowerShell Script Into The Runbook Of The Automation Account And Publish It
$runBookMgmtAUAssignments = Import-AzAutomationRunbook -Name "Runbook-$displayName" -Path $automationAccountRunbookFilePath -ResourceGroup $automationAccountResourceGroup -AutomationAccountName $automationAccountDisplayName -Type PowerShell -Published
# Define A Schedule In The Automation Account
$timeOfDayForRunbookToExec = "<SPECIFY THE TIME FOR THE RUNBOOK TO EXECUTE>" # e.g. "21:00:00"
$startTime = (Get-Date $timeOfDayForRunbookToExec).AddHours(24)
$autoAccountSchedule = New-AzAutomationSchedule -AutomationAccountName $automationAccountDisplayName -Name "Schedule-$displayName" -StartTime $startTime -DayInterval 1 -ResourceGroupName $automationAccountResourceGroup
# Register The Previous Schedule For The Runbook To Execute
Register-AzAutomationScheduledRunbook -RunbookName $($runBookMgmtAUAssignments.Name) -ResourceGroupName $automationAccountResourceGroup -AutomationAccountName $automationAccountDisplayName -ScheduleName $($autoAccountSchedule.Name)
}
Figure 1: Creation Of The Automation Account In Azure –Figure 2a: Configured Properties Of The Automation Account – Runbook –Figure 2b: Configured Properties Of The Automation Account – Schedule –Figure 2c: Configured Properties Of The Automation Account – Private Key And Certificate –Figure 2d: Configured Properties Of The Automation Account – Variables –
You can now wait until the runbook executes manually, or you can start it on-demand if you wish!. Just make sure that when you start the runbook manually it completes, before it starts automatically.
Have fun and enjoy!
Cheers,
Jorge
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
[AD.5 – A PowerShell script for the initial processing assignment]
In general you would not need this initial processing script. However, that really depends on the size (i.e. amount of objects that need to be processed and assigned to AUs. In my test environment, I tried what is described in AD.6 initially and that worked. But because I was working with 100000+ objects that needed to be assigned to AUs, after 3 hours Azure AD stopped the script due to fair use policy.
I saw the following error message:
Stopped The job has been stopped because it reached the fair share limit of job execution more than 3 hours. For long-running jobs, it’s recommended to use a Hybrid Runbook Worker. Hybrid Runbook Workers don’t have a limitation on how long a runbook can execute. Refer https://docs.microsoft.com/en-us/azure/automation/automation-runbook-execution#fair-share for more details.
Of course I could restarted the runbook or just wait until the schedule would kick in until it was stopped again. This happened at least 3 times. For long running runbooks, Microsoft suggest to use Hybrid Worker Runbooks. So, that’s why I decided to updated the script to be used from an on-premises computer/laptop/server/workstation after connecting to Azure AD. OK, that still takes quite some hours but, it was able to finish without being stopped after some hours of execution due to some limit. The script can be downloaded from HERE.
$tenantFQDN = "<SPECIFY YOUR TENANT FQDN>" # e.g. "<TENANT NAME>.ONMICROSOFT.COM"
$appClientID = "<SPECIFY THE APPLICATION CLIENT ID OF THE APP PREVIOUSLY CREATED>"
$pfxOutputPath = "<SPECIFY HERE THE FULL PATH TO THE PFX FILE>"
$pfxPassword = '<SPECIFY HERE THE PASSWORD PROTECTING THE PFX FILE>'
.\AAD-Automated-Administrative-Unit-Assignment.ps1 -tenantFQDN $tenantFQDN -appClientID $appClientID -pfxFilePath $pfxOutputPath -pfxPassword $pfxPassword
Figure 1a: The PowerShell Script Performing The Initial Assignment Of User And group Objects –Figure 1b: The PowerShell Script Performing The Initial Assignment Of User And group Objects –Figure 1c: The PowerShell Script Performing The Initial Assignment Of User And group Objects –Figure 1d: The PowerShell Script Performing The Initial Assignment Of User And group Objects –
The whole processing will be visible in the Azure AD Audit Logs
Figure 2: All User And Group Assignments Or Unassignments Visible In The Azure AD Audit Logs –
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
[AD.4 – A registered application with the correct permissions to manage the AU assignments]
To be able to assign objects (users and groups) in an automatic manner to Administrative Units, a registered application is needed with the correct application permissions (not delegated permissions) to assign the objects that match the filter to the corresponding Administrative Unit.
The following permissions are required:
Group.Read.All
User.Read.All
AdministrativeUnit.ReadWrite.All
After configuring the permissions, those permissions also need to be consented before you can actually use them.
To control the application in a secure authenticated manner, either a client secret can be used or a certificate. I those to use a certificate as that requires possession (private key) and knowledge (password for private key) instead of just knowledge (secret).
The code below will create a self-signed certificate on your local computer, export that to a CER and PFX (protected with a password) and then delete the certificate and private key from the local computer store. It will also present the password on screen for you to copy it to a secure location! Make sure to store the PFX file and its corresponding password in a secure place.
Invoke-Command -ScriptBlock {
Clear-Host
# The Subject Name
$subjectName = "<SPECFIFY THE SUBJECT NAME FOR THE CERTIFICATE>" # e.g. "mgmt-Admin-Units-MSFT-Graph"
# Tenant Details
$tenantFQDN = "<SPECFIFY YOUR TENANT FQDN>" # e.g. "<TENANT NAME>.ONMICROSOFT.COM"
# Certificate Store Location
$certStoreLocation = "Cert:\CurrentUser\My"
# Where To Export The Certificate And The Private Key
$exportFolderPath = "<Folder Path To Export The Certificate Data To>" # e.g. "C:\TEMP"
$cerOutputPath = Join-Path $exportFolderPath "$subjectName.cer"
$pfxOutputPath = Join-Path $exportFolderPath "$subjectName.pfx"
# Splat For Readability
$createCertificateSplat = @{
Type = "Custom"
Subject = $subjectName
KeyFriendlyName = $subjectName
KeyDescription = $subjectName
FriendlyName = $subjectName
DnsName = $tenantName
CertStoreLocation = $certStoreLocation
Provider = "Microsoft Enhanced RSA and AES Cryptographic Provider"
KeySpec = "KeyExchange"
KeyUsage = @("None")
HashAlgorithm = "SHA256"
KeyAlgorithm = "RSA"
KeyLength = 2048
NotBefore = $([datetime]::now.AddHours(-1))
NotAfter = $([datetime]::now.AddDays(1185)) # 3 Years and 3 months | This is to make sure the process always start in the same period as it otherwise will crawl back!
KeyExportPolicy = "Exportable"
}
# Create Certificate
$certificate = New-SelfSignedCertificate @createCertificateSplat
# Get Certificate Path
$certificatePath = Join-Path -Path $certStoreLocation -ChildPath $certificate.Thumbprint
# Generate A Password
# This only contains numeric and alphanumeroc characters and not any special characters to prevent issues when uploading the private keys and certs.
# The max length of the generated password depends on the number of available characters, hence repeating the list of characters to allow very long passwords if needed
$pfxPassword = $(-join (48..57+65..90+97..122+48..57+65..90+97..122+48..57+65..90+97..122+48..57+65..90+97..122 | ForEach-Object {[char]$_} | Get-Random -Count 64))
$pfxPasswordSecure = $(ConvertTo-SecureString $pfxPassword -AsPlainText -Force)
# Export Certificate Without Private Key
Export-Certificate -Cert $certificatePath -FilePath $cerOutputPath | Out-Null
Export-PfxCertificate -Cert $certificatePath -FilePath $pfxOutputPath -Password $pfxPasswordSecure | Out-Null
# Deleting The Private Key And Certificate
Set-Location $certStoreLocation
Get-ChildItem $($certificate.Thumbprint) | Remove-Item -DeleteKey -ErrorAction SilentlyContinue | Out-Null
# Displaying The File Paths Of The Exported CER/PFX File
Write-Host ""
Write-Host " > File Path For Exported CER File...: '$cerOutputPath'" -ForegroundColor Yellow
Write-Host " > File Path For Exported PFX File...: '$pfxOutputPath'" -ForegroundColor Yellow
# Displaying The Password For 60 Seconds. After That The Screen And The Variables Are Cleared
Write-Host ""
Write-Host "! ! ! Store The Password Of The Private Key In A Safe Location ! ! !" -ForegroundColor Red
Write-Host "WARNING: In 60 Seconds The Screen And Variables Will Be Cleared. Copy The Password Value A.S.A.P.!!!" -ForegroundColor White
Write-Host " > 'PFX Password'.................: '$pfxPassword'" -ForegroundColor Yellow
Write-Host "! ! ! Store The Password Of The Private Key In A Safe Location ! ! !" -ForegroundColor Red
Write-Host ""
Start-Sleep -s 60
$certificate = $null
$pfxPassword = $null
$pfxPasswordSecure = $null
Set-Location C:\
Clear-Host
}
Figure 1: Creating A Self-Signed Certificate And Exporting It –
Now we can create the application, configure the required permissions, consent those and upload the certificate to the registered application. Consenting will be done in a semi-automated manner using the device code flow. Run this code in the previous PowerShell window where you already connected to Azure AD.
Invoke-Command -ScriptBlock {
Function retrieveTenantIDFromTenantFDQN () {
Param (
[string]$tenantFQDN
)
# Specify The Tenant Specific Discovery Endpoint URL
$oidcConfigDiscoveryURL = $null
$oidcConfigDiscoveryURL = "https://login.microsoftonline.com/$tenantFQDN/v2.0/.well-known/openid-configuration"
$oidcConfigDiscoveryResult = $null
# Retrieve The Information From The Discovery Endpoint URL
$tenantID = $null
$oidcConfigDiscoveryResult = $null
Try {
$oidcConfigDiscoveryResult = Invoke-RestMethod -Uri $oidcConfigDiscoveryURL -ErrorAction Stop
}
Catch {
# Placeholder
}
# If There Is A Result Determine The Tenant ID
If ($null -ne $oidcConfigDiscoveryResult) {
$tenantID = $oidcConfigDiscoveryResult.authorization_endpoint.Split("/")[3]
}
Return $tenantID
}
Clear-Host
# Load Assembly To Use The URLEncode Function
Add-Type -AssemblyName System.Web
# Load Assembly To Use MessageBox
Add-Type -assemblyName PresentationFramework
# Generic Details
$msftGraphFQDN = "graph.microsoft.com" # FQDN For Microsoft Graph
# Tenant Details
$tenantFQDN = "<SPECFIFY YOUR TENANT FQDN>" # e.g. "<TENANT NAME>.ONMICROSOFT.COM"
$tenantID = retrieveTenantIDFromTenantFDQN -tenantFQDN $tenantFQDN
$tenantName = "<SPECFIFY YOUR TENANT NAME>"
# Where To Import The Certificate From
$subjectName = "<SPECFIFY THE SUBJECT NAME FOR THE CERTIFICATE>" # e.g. "mgmt-Admin-Units-MSFT-Graph"
$exportFolderPath = "<Folder Path To Export The Certificate Data To>" # e.g. "C:\TEMP"
$cerOutputPath = Join-Path $exportFolderPath "$subjectName.cer"
$pfxOutputPath = Join-Path $exportFolderPath "$subjectName.pfx"
# Azure AD Device Code Request Endpoint URL
$aadDeviceCodeRequestEndpointURL = "https://login.microsoftonline.com/$tenantID/oauth2/devicecode"
# Device Code Approval Endpoint URL
$deviceCodeApprovalEndpointURL = "https://www.microsoft.com/devicelogin"
# Application Details
$msftGraphMgmtAppDisplayName = "<SPECIFY THE APPLICATION DISPLAY NAME OF THE REGISTERED APPLICATION>" # Example: "<TENANT NAME>: Mgmt App - Managing Automatic AU Assignments"
$msftGraphMgmtAppIdentifierURI = "https://$tenantName.onmicrosoft.com/$($msftGraphMgmtAppDisplayName.Replace(" ","-").Replace("---","-").Replace(":-","-"))"
$msftGraphMgmtAppReplyURL = "https://$($msftGraphMgmtAppDisplayName.Replace(" ","-").Replace("---","-").Replace(":-","-"))"
# Required Resource Access, In Other Words The Required Permissions
$requiredResourceAccessPSObjectListMSFTGraphMgmtApp = @(
[PSCustomObject]@{
resourceAppId = "00000003-0000-0000-c000-000000000000" # MSFT Graph => (Get-AzureADServicePrincipal -filter "DisplayName eq 'Microsoft Graph'")
resourceAccess = @(
@{
id = "5eb59dd3-1da2-4329-8733-9dabdc435916" # AdministrativeUnit.ReadWrite.All => (Get-AzureADServicePrincipal -filter "DisplayName eq 'Microsoft Graph'").AppRoles | ?{$_.Value -eq "AdministrativeUnit.ReadWrite.All"}
type = "Role"
},
@{
id = "5b567255-7703-4780-807c-7be8301ae99b" # Group.Read.All => (Get-AzureADServicePrincipal -filter "DisplayName eq 'Microsoft Graph'").AppRoles | ?{$_.Value -eq "Group.Read.All"}
type = "Role"
},
@{
id = "df021288-bdef-4463-88db-98f22de89214" # User.Read.All => (Get-AzureADServicePrincipal -filter "DisplayName eq 'Microsoft Graph'").AppRoles | ?{$_.Value -eq "User.Read.All"}
type = "Role"
}
)
}
)
$requiredResourceAccessListMSFTGraphMgmtApp = @()
ForEach($resourceApp in $requiredResourceAccessPSObjectListMSFTGraphMgmtApp) {
$requiredResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$requiredResourceAccess.ResourceAppId = $resourceApp.resourceAppId
ForEach($resourceAccess in $resourceApp.resourceAccess) {
$requiredResourceAccess.resourceAccess += New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList $resourceAccess.Id,$resourceAccess.type
}
$requiredResourceAccessListMSFTGraphMgmtApp += $requiredResourceAccess
}
# Creating The App Registration
$msftGraphMgmtApp = New-AzureADApplication -DisplayName $msftGraphMgmtAppDisplayName -IdentifierUris $msftGraphMgmtAppIdentifierURI -ReplyUrls @($msftGraphMgmtAppReplyURL) -RequiredResourceAccess $requiredResourceAccessListMSFTGraphMgmtApp
$msftGraphMgmtAppObjectID = $msftGraphMgmtApp.ObjectID
$msftGraphMgmtAppApplicationID = $msftGraphMgmtApp.AppId
Start-Sleep -s 10
# Creating The Service Principal
$msftGraphMgmtSvcPrinc = New-AzureADServicePrincipal -DisplayName $msftGraphMgmtAppDisplayName -AppId $msftGraphMgmtAppApplicationID -AccountEnabled $true -AppRoleAssignmentRequired $false
$msftGraphMgmtSvcPrincObjectID = $msftGraphMgmtSvcPrinc.ObjectID
$msftGraphMgmtSvcPrincApplicationID = $msftGraphMgmtSvcPrinc.AppId
Start-Sleep -s 10
# Uploading The Certificate To The Application Registration
$msftGraphMgmtCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$msftGraphMgmtCert.Import($cerOutputPath)
$msftGraphMgmtCertRawData = $msftGraphMgmtCert.GetRawCertData()
$msftGraphMgmtCertCERBase64 = [System.Convert]::ToBase64String($msftGraphMgmtCertRawData) # Base64 Encode The Public Key
$msftGraphMgmtCertHash = $msftGraphMgmtCert.GetCertHash() # Get The Custom Key Identifier
$msftGraphMgmtCertCustomKeyIdentifier = [System.Convert]::ToBase64String($msftGraphMgmtCertHash)
$msftGraphMgmtCertNotBeforeISO8601Format = (Get-Date $($msftGraphMgmtCert.NotBefore)).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ") # Date In ISO8601Format
$msftGraphMgmtCertNotAfterISO8601Format = (Get-Date $($msftGraphMgmtCert.NotAfter)).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ") # Date In ISO8601Format
New-AzureADApplicationKeyCredential -ObjectId $msftGraphMgmtAppObjectID -Type AsymmetricX509Cert -Usage Verify -CustomKeyIdentifier $msftGraphMgmtCertCustomKeyIdentifier -Value $msftGraphMgmtCertCERBase64 -StartDate $msftGraphMgmtCertNotBeforeISO8601Format -EndDate $msftGraphMgmtCertNotAfterISO8601Format | Out-Null
# Grant Consent To The Required Permissions - Build The Request Body To Request A Device/User Code From MSFT Graph
$msftGraphDeviceCodeRequestBody = @()
$msftGraphDeviceCodeRequestBody += "resource=$([System.Web.HttpUtility]::UrlEncode($('https://' + $msftGraphFQDN + '/')))"
$msftGraphDeviceCodeRequestBody += "&client_id=$msftGraphMgmtAppApplicationID"
$deviceTokenRequestResponse = Invoke-RestMethod -uri $aadDeviceCodeRequestEndpointURL -ContentType "application/x-www-form-urlencoded" -Method POST -Body $msftGraphDeviceCodeRequestBody -ErrorAction Stop
$msftGraphDeviceCodeResponseUserCode = $deviceTokenRequestResponse.user_code
# Grant Consent To The Required Permissions - Put The User Code In The Clipboard To Paste It Later As Needed
Set-Clipboard -Value $msftGraphDeviceCodeResponseUserCode
# Grant Consent To The Required Permissions - Present A Notification On What To Do Next
[System.Windows.MessageBox]::Show("A device code has been requested from Azure AD. For this device code the corresponding user code ($msftGraphDeviceCodeResponseUserCode) has been copied to the clipboard. After clicking [OK] an authentication screen will be opened. On that new screen just paste the user code by pressing [CTRL]+[V] and then click [NEXT] to authenticate with your Global Admin Credentials for the AAD Tenant:`n`nTenant FQDN....: '$tenantFQDN'`nTenant ID..........: '$tenantID'`nUser Code.........: '$msftGraphDeviceCodeResponseUserCode'", "Device Code Authentication - Please Read Carefully", 0, 64) | Out-Null
# Grant Consent To The Required Permissions - Navigate To The Device Approcal URL For The Actual Consent
[System.Diagnostics.Process]::Start($deviceCodeApprovalEndpointURL)
}
Figure 2: After Requesting The Device Code And User Code To Consent The Application Permissions – Figure 3: Specifying The User Code To Continue Authentication Followed By Consent Of Application Permissions – Figure 4: Signing-In Before Consenting The Required Permissions For The Registered App – Figure 5: Reviewing The Required Permissions For The Registered App – Figure 6: Reviewing The Required Permissions For The Registered App –Figure 7: The Configured Certificate For The Registered App Managing The Automatic AU Assignments –Figure 8: The Configured And Consented Permissions For The Registered App Managing The Automatic AU Assignments –
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
[AD.3 – Administrative Units with logic to support some kind of query rules]
Now the data ended up in Azure AD, it is time to start configuring Azure (AD) to support the dynamic assignment for AUs. But first I needed to create the AUs in Azure AD, and although not needed for this exercise I also configured delegation along the way! For that I first created Azure AD security groups that could be assigned role, and then after creating the AU and the groups I assigned the group for the AU the corresponding role for that AU also.
Dynamic groups in Azure AD contain the property with the filter that looks for user objects matching that filter. In other words, the filter itself is stored on the object that needs and uses that filter. With that thought in mind I had to implement something similar for AUs. Unfortunately it appeared not to be possible to extend the Azure AD schema for “AdministrativeUnit” objects. That would have been the best option for this exercise. Therefore I had to reuse an existing attribute that I have control over. That list of attributes is not that big. I had “DisplayName” and “Description”. In this case I chose to (mis)use the “Description” attribute of the AdministrativeUnit object.
I came up with the following structure for the “Description” attribute:
”<real description|filter:user=<filter targeting user objects>|filter:group=<filter targeting user objects>”
Example: “All Test Accounts For AT – Austria|filter:user=Department eq ‘SampleData’ and Country eq ‘Austria’|filter:group=extension_b3d7ffeca7f24ab6bf35bb6ff4918986_department eq ‘SampleData’ and extension_b3d7ffeca7f24ab6bf35bb6ff4918986_location eq ‘Austria’
If you look at the code you see some sleep timers. I had to implement those to make sure that Azure AD had completely instantiated the group so that it could be used in the role assignment.
Invoke-Command -ScriptBlock {
Function retrieveTenantIDFromTenantFDQN () {
Param (
[string]$tenantFQDN
)
# Specify The Tenant Specific Discovery Endpoint URL
$oidcConfigDiscoveryURL = $null
$oidcConfigDiscoveryURL = "https://login.microsoftonline.com/$tenantFQDN/v2.0/.well-known/openid-configuration"
$oidcConfigDiscoveryResult = $null
# Retrieve The Information From The Discovery Endpoint URL
$tenantID = $null
$oidcConfigDiscoveryResult = $null
Try {
$oidcConfigDiscoveryResult = Invoke-RestMethod -Uri $oidcConfigDiscoveryURL -ErrorAction Stop
}
Catch {
# Placeholder
}
# If There Is A Result Determine The Tenant ID
If ($null -ne $oidcConfigDiscoveryResult) {
$tenantID = $oidcConfigDiscoveryResult.authorization_endpoint.Split("/")[3]
}
Return $tenantID
}
Clear-Host
# Tenant Details
$tenantFQDN = "<SPECFIFY YOUR TENANT FQDN>"
$tenantID = retrieveTenantIDFromTenantFDQN -tenantFQDN $tenantFQDN
# Connect To Azure AD
Connect-AzureAD -TenantId $tenantID
# Get The Required Azure AD Roles For The AU Delegation
$aadDirectoryRoles = Get-AzureADDirectoryRole
$adminRoleGroups = $aadDirectoryRoles | Where-Object { $_.DisplayName -eq "Groups Administrator" }
$adminRoleAuthN = $aadDirectoryRoles | Where-Object { $_.DisplayName -eq "Authentication Administrator" }
$adminRoleHelpdesk = $aadDirectoryRoles | Where-Object { $_.DisplayName -eq "Helpdesk Administrator" }
$adminRoleUsers = $aadDirectoryRoles | Where-Object { $_.DisplayName -eq "User Administrator" }
# Build A List Of Data To Create And Configure AUs
$auData = @()
$auData += "AT|Austria"
$auData += "AU|Australia"
$auData += "BE|Belgium"
$auData += "BR|Brazil"
$auData += "CA|Canada"
$auData += "CH|Switzerland"
$auData += "CY|Cyprus (Anglicized)"
$auData += "CZ|Czech Republic"
$auData += "DE|Germany"
$auData += "DK|Denmark"
$auData += "EE|Estonia"
$auData += "ES|Spain"
$auData += "FI|Finland"
$auData += "FR|France"
$auData += "GB|United Kingdom"
$auData += "GL|Greenland"
$auData += "HU|Hungary"
$auData += "IS|Iceland"
$auData += "IT|Italy"
$auData += "NL|Netherlands"
$auData += "NO|Norway"
$auData += "NZ|New Zealand"
$auData += "PL|Poland"
$auData += "PT|Portugal"
$auData += "SE|Sweden"
$auData += "SI|Slovenia"
$auData += "TN|Tunisia"
$auData += "US|United States"
$auData += "UY|Uruguay"
$auData += "ZA|South Africa"
$auData += "HIST1|HISTORY1"
$auData += "HIST2|HISTORY2"
$auData += "EDUC|EDUCATIONAL"
$auData += "EMPL|EMPLOYEES"
$auData += "CONT|CONTRACTORS"
Write-Host ""
Write-Host "Creating Administrative Units In The Azure AD Tenant..." -ForegroundColor Cyan
$auData | ForEach-Object {
$au = $_
$auCountryCode = $au.Split("|")[0]
$auCountry = $au.Split("|")[1]
# Creating The AU
Write-Host " > Creating Administrative Unit 'Accounts - Test - $auCountryCode - $auCountry'..." -ForegroundColor Magenta
If ($auCountryCode.Length -eq 2) {
$auObject = New-AzureADMSAdministrativeUnit -DisplayName "Accounts - Test - $auCountryCode - $auCountry" -Description "All Test Accounts For $auCountryCode - $auCountry|filter:user=Department eq 'SampleData' and Country eq '$auCountry'|filter:group=extension_b3d7ffeca7f24ab6bf35bb6ff4918986_department eq 'SampleData' and extension_b3d7ffeca7f24ab6bf35bb6ff4918986_location eq '$auCountry'"
}
Else {
$auObject = New-AzureADMSAdministrativeUnit -DisplayName "Accounts - Test - $auCountryCode - $auCountry" -Description "All Test Accounts For $auCountryCode - $auCountry|filter:user=extension_b3d7ffeca7f24ab6bf35bb6ff4918986_employeeType eq '$auCountry'|filter:group=NA"
}
Start-Sleep -s 5
# Creating Admin Groups For The AU
Write-Host " # Creating Admin Group 'cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-Groups-Admin' For The AU..." -ForegroundColor Yellow
$adminGroups = New-AzureADMSGroup -DisplayName "cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-Groups-Admin" -Description "Groups Admins For AU: Accounts - Test - $auCountryCode - $auCountry" -MailEnabled $false -MailNickName $( -join (48..57 + 65..90 + 97..122 | ForEach-Object { [char]$_ } | Get-Random -Count 10)) -SecurityEnabled $true -IsAssignableToRole $true
Write-Host " # Creating Admin Group 'cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-AuthN-Admin' For The AU..." -ForegroundColor Yellow
$adminAuthN = New-AzureADMSGroup -DisplayName "cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-AuthN-Admin" -Description "AuthN Admins For AU: Accounts - Test - $auCountryCode - $auCountry" -MailEnabled $false -MailNickName $( -join (48..57 + 65..90 + 97..122 | ForEach-Object { [char]$_ } | Get-Random -Count 10)) -SecurityEnabled $true -IsAssignableToRole $true
Write-Host " # Creating Admin Group 'cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-Helpdesk-Admin' For The AU..." -ForegroundColor Yellow
$adminHelpdesk = New-AzureADMSGroup -DisplayName "cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-Helpdesk-Admin" -Description "Helpdesk Admins For AU: Accounts - Test - $auCountryCode - $auCountry" -MailEnabled $false -MailNickName $( -join (48..57 + 65..90 + 97..122 | ForEach-Object { [char]$_ } | Get-Random -Count 10)) -SecurityEnabled $true -IsAssignableToRole $true
Write-Host " # Creating Admin Group 'cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-Users-Admin' For The AU..." -ForegroundColor Yellow
$adminUsers = New-AzureADMSGroup -DisplayName "cld-AAD-Mgmt-AU-$auCountryCode-$auCountry-Users-Admin" -Description "Users Admins For AU: Accounts - Test - $auCountryCode - $auCountry" -MailEnabled $false -MailNickName $( -join (48..57 + 65..90 + 97..122 | ForEach-Object { [char]$_ } | Get-Random -Count 10)) -SecurityEnabled $true -IsAssignableToRole $true
Start-Sleep -s 20
# Configure Admin Role Assignment For The AU
Write-Host " # Assigning The Role '$($adminRoleGroups.DisplayName)' To The Group '$($adminGroups.DisplayName)'..." -ForegroundColor Yellow
$adminGroupsRoleInfo = New-Object -TypeName Microsoft.Open.MSGraph.Model.MsRoleMemberInfo -Property @{Id = $adminGroups.Id }
Add-AzureADMSScopedRoleMembership -RoleId $adminRoleGroups.ObjectId -Id $auObject.Id -RoleMemberInfo $adminGroupsRoleInfo | Out-Null
Write-Host " # Assigning The Role '$($adminRoleAuthN.DisplayName)' To The Group '$($adminAuthN.DisplayName)'..." -ForegroundColor Yellow
$adminAuthNRoleInfo = New-Object -TypeName Microsoft.Open.MSGraph.Model.MsRoleMemberInfo -Property @{Id = $adminAuthN.Id }
Add-AzureADMSScopedRoleMembership -RoleId $adminRoleAuthN.ObjectId -Id $auObject.Id -RoleMemberInfo $adminAuthNRoleInfo | Out-Null
Write-Host " # Assigning The Role '$($adminRoleHelpdesk.DisplayName)' To The Group '$($adminHelpdesk.DisplayName)'..." -ForegroundColor Yellow
$adminHelpdeskRoleInfo = New-Object -TypeName Microsoft.Open.MSGraph.Model.MsRoleMemberInfo -Property @{Id = $adminHelpdesk.Id }
Add-AzureADMSScopedRoleMembership -RoleId $adminRoleHelpdesk.ObjectId -Id $auObject.Id -RoleMemberInfo $adminHelpdeskRoleInfo | Out-Null
Write-Host " # Assigning The Role '$($adminRoleUsers.DisplayName)' To The Group '$($adminUsers.DisplayName)'..." -ForegroundColor Yellow
$adminUsersRoleInfo = New-Object -TypeName Microsoft.Open.MSGraph.Model.MsRoleMemberInfo -Property @{Id = $adminUsers.Id }
Add-AzureADMSScopedRoleMembership -RoleId $adminRoleUsers.ObjectId -Id $auObject.Id -RoleMemberInfo $adminUsersRoleInfo | Out-Null
Write-Host ""
}
}
Figure 1: Creating The AUs, The Delegation Groups And Configuring The Delegation Roles In Azure AD –
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
[AD.2 – Azure AD Connect configuration to sync the required data to Azure AD]
Hybrid Scenario ONLY
Azure AD Connect is THE TOOL to sync data between AD and Azure AD and vice versa as supported. You need to check if the data you need in Azure AD from AD is already being synched or not. If it is not synched already because no sync rules exists, see if those attribute can be configured in sync rules (Inbound Sync from AD and Outbound Sync to Azure AD). If you cannot create a sync rule from existing attributes you need to update the Azure AD Connect configuration by either selecting the required attribute or use the Directory Extension Attribute Sync feature.
To do this start the Azure AD Connect Wizard and choose the option “Customize Synchronization Options”. When reaching the “Optional Features” section, if the option “Directory Extension Attribute Sync” feature is not yet checked, do not check it for now. Click [Next]
Figure 1: Azure AD Connect Configuration Wizard – Optional Features Section –
When reaching the “Azure AD Attributes” section, see if the required attribute is already selected or not. If it is not yet selected, selected it. If the attribute is not listed, then go back to the “Optional Features” section and check the option “Directory Extension Attribute Sync” feature if it was not yet selected. If it was already checked, then continue by clicking [Next].
Figure 2: Azure AD Connect Configuration Wizard – Azure AD Attributes Section –
When reaching the “Directory Extensions” section, select the attributes for which Azure AD Connect should create a new extension in the Azure AD schema for the scoped object. Continue by clicking [Next] and completing the wizard until the end.
Azure AD Connect implements the “Directory Extension Attribute Sync” feature by creating a app registration in Azure AD called “Tenant Schema Extension App”. That’s the app that stores all Azure AD Connect configured schema extensions for Azure AD. Looking up the app you can fond all the extensions (mine has more than needed for this exercise, but that’s due to different tests)
Figure 4: Extensions In The Azure AD Schema Implemented By Azure AD Connect –
After this, you need to create the sync rules. That is done by the Azure AD Connect Sync Rule Editor. For this exercise “Department” and “Country” for user objects was already being synched because during my initial installation I selected all the Azure AD Attributes (Figure 1 and 2). I only had to add sync rules for the extension attributes
WARNING: As soon as you edit any sync rule, during the next sync cycle, Azure AD Connect will perform a Ful Sync end-to-end. If you have many objects being synched this might take some time and because of that it may require planning!
Start the Azure AD Connect Sync Rule Editor.
Select the appropriate custom AD inbound sync for user objects and add the attributes that need to be synched. If no custom rule exists, select the appropriate default AD inbound sync rule for user objects and clone it. Then edit the clone.
Select the appropriate custom AD inbound sync for groups objects and add the attributes that need to be synched. If no custom rule exists, select the appropriate default AD inbound sync rule for group objects and clone it. Then edit the clone.
Select the appropriate custom AAD outbound sync for user objects and add the attributes that need to be synched.If no custom rule exists, select the appropriate default AAD outbound sync rule for user objects and clone it. Then edit the clone.
Select the appropriate custom AAD outbound sync for group objects and add the attributes that need to be synched.If no custom rule exists, select the appropriate default AAD outbound sync rule for group objects and clone it. Then edit the clone.
If you used the “Directory Extension Attribute Sync” feature then Azure AD Connect already updated the appropriate sync rules. Check for the sync rules for users and groups, inbound and outbound, that contain the word “DirectoryExtension”
Figure 5: Attribute Flow Transformation In The AD Inbound Sync Rule For User Objects And Directory Extensions –Figure 6: Attribute Flow Transformation In The AAD Outbound Sync Rule For User Objects And Directory Extensions –Figure 7: Attribute Flow Transformation In The AD Inbound Sync Rule For Group Objects And Directory Extensions –Figure 8: Attribute Flow Transformation In The AAD Outbound Sync Rule For Group Objects And Directory Extensions –Figure 9: Attribute Flow Transformation In The AD Inbound Sync Rule For Group Objects And Directory Extensions –Figure 10: Attribute Flow Transformation In The AAD Outbound Sync Rule For Group Objects And Directory Extensions –
After having this configured, I enabled the sync schedule again to allow Azure AD Connect perform a Full Sync
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
In my most recent article about Administrative Units I already summarized how interesting it is to use Administrative Units in those scenarios where delegation of admin is required. Nevertheless, I think one of the very interesting features is unfortunately not (yet) supported!
Figure 1: Administrative Units In Azure AD – Management Supported/Unsupported Options –
Automating assigning user and group objects to specific Administrative Units would seriously have a lot of manual work. Unless you have something external to Azure AD regarding the logic and execution leveraging the Microsoft graph, by default Azure AD does not support that, today. Hopefully it will be soon, as I think many want to get rid of the manual burden or any custom solution. Until automatic assignment is supported/possible by Azure AD itself, you may be able to use what is in this post. Please be aware this is an example and that if you want to use this for your own environment, you need to customize the filters/configurations to that data in your Azure AD tenant!
Interesting enough, I have found a way to automatically assign user/groups, based upon attributes of those objects, to specific administrative units. This blog is fully dedicated to that! So please hang on, keep reading and in the end you might end up with a solution that might work for you!
DISCLAIMER: please make sure to test this in a TEST environment/tenant first and improve where needed!
For all this to work we need the following components:
Objects with attributes and values in those attributes to be able to use in filters
Hybrid scenario
Cloud only scenario
Azure AD Connect configuration to sync the required data to Azure AD
Hybrid scenario ONLY
Administrative Units with logic to support some kind of query rules
A registered application with the correct permissions to manage the AU assignments
A PowerShell script for the initial processing assignment
An Automation Account with a scheduled PowerShell Runbook for subsequent processing assignments
So, let’s get started!
[AD.1 – Objects with attributes and values in those attributes to be able to use in filters]
Hybrid Scenario
In my on-premises test and demo AD I have about 100000+ user objects and also lots of groups. For this exercise I needed a data set of users and groups. For that I chose the objects in the 5 category OUs and the objects in the country OUs. For every of the yellow marked OUs, an AU will be created in Azure AD. In the country OUs both users and groups are (already) being synched to Azure AD. In the category OUs only users are being synched to Azure AD. In both cases Azure AD Connect is doing the synching,
Figure 2: OUs In AD With Objects Being Synched To Azure AD –
The AUs in Azure AD need to have objects assigned automatically based upon some data to be queried in filters. So you need to think about the AUs you want to create and how to decide, which objects will go into which AUs and what data will be used to make those decisions. If the data is not there (yet) you need to populate that data in AD from some system that has it.
In this example scenario I made the following decisions:
user objects in the country OUs
“department” attribute being equal to the fixed string “SampleData”
“country” attribute being equal to the string “<country name>” (e.g. Netherlands)
group objects in the country OUs
“department” attribute being equal to the fixed string “SampleData”
“location” attribute being equal to the string “<country name>” (e.g. Netherlands)
user objects in the category OUs
“employeeType” attribute being equal to the string “<employee category>” (e.g. CONTRACTORS)
group objects in the category OUs
N.A. (not being synched)
Figure 3: Sample Data For User Objects In The Country OUs –Figure 4: Sample Data For Group Objects In The Country OUs –Figure 5: Sample Data For User Objects In The Category OUs –
Cloud Scenario
For objects authoritatively created in Azure AD, you will have to make sure those objects (users and groups) have the required data stored in some attribute. You may even need to extend the Azure AD schema to store the data if no attribute contains the data you require.
To read more about extending the Azure AD schema, please check out the following posts:
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
Last week, as many of you, I became aware of the the Azure AD Password Brute Force “Flaw” that was found by ArsTechnica. Of course this raised my interest and I wanted to do some research myself to understand as best as possible what was going on.
This whole thing was focussed on an Azure AD endpoint mainly used for Seamless Sign-On when using either PHS only or PTA only for a specific domain in Azure AD.
So I will start at the beginning and walk you through what I found.
When I looked into my sign-in logs of my test/dev Azure AD tenant, I saw the following
Figure 1: Sign-In Events In The Sign-In Logs In Azure AD –
[1] the sign in to my Windows 10 using my Azure AD account in a managed domain (jorge@managed.domain) (Visible in Figure 1);
[2] the sign-in to Azure AD portal using an account with Global Admin privileges (Visible in Figure 1);
[3] the sign-in for Azure AD PowerShell (Connect-AzureAD) with my Azure AD account in a managed domain (jorge@managed.domain), where I on purpose provided a wrong password. Hence the failure result (Visible in Figure 1);
[4] the sign-in for Azure AD PowerShell (Connect-AzureAD) with my federated Azure AD account (jorge@federated.domain). Fiddler showed redirection to my ADFS farm in my test environment, but that test environment is shutdown so ADFS (and WAP) is not available (sign-in did not initiate therefore not visible in logs) (Not visible in Figure 1);
[5] the sign-in for Azure AD PowerShell (Connect-AzureAD) with my federated Azure AD account @ work. Fiddler showed redirection to the ADFS farm at work. I did not complete sign-in, therefore nothing visible in sign-in logs in that Azure AD tenant. If I would complete the sign-in it would be visible for sure (Not visible in Figure 1);
[6] using the code above and signing in with my federated Azure AD account (jorge@federated.domain) and a wrong password (PHS enabled!) (Not visible in Figure 1);
Fiddler DID NOT show a redirection to my ADFS farm in my test environment;
Nothing was visible in the Azure AD sign-in logs;
Output of the code was (figure 2);
Figure 2: Signing-In With A Federated Azure AD Account, And Wrong Password, Against The Azure AD UserNameMixed Endpoint –
[7] using the code above and signing in with my federated Azure AD account (jorge@federated.domain) and a correct password (PHS enabled!) (I confirmed PHS was enabled and working and the password for this account was synched!) (Not visible in Figure 1);
Fiddler DID NOT show a redirection to my ADFS farm in my test environment;
Nothing was visible in the Azure AD sign-in logs;
Output of the code was as above (figure 2);
[8] using the code above and signing in with my managed Azure AD account (jorge@managed.domain) and a wrong password (Not visible in Figure 1);
Nothing was visible in the Azure AD sign-in logs;
Output of the code was (figure 3);
Figure 3: Signing-In With A Managed Azure AD Account, And Wrong Password, Against The Azure AD UserNameMixed Endpoint –
[9] using the code above and signing in with my managed Azure AD account (jorge@managed.domain) and a correct password (Not visible in Figure 1);
Nothing was visible in the Azure AD sign-in logs;
Output of the code was: MFA kicks in due to conditional access being enabled in all occasions for this account and because no MFA was done, authentication fails (figure 4);
Figure 4: Signing-In With A Managed Azure AD Account, And Correct Password, Against The Azure AD UserNameMixed Endpoint (Conditional Access Policy ENABLED) –
[10] after disabling the conditional access policy impacting the managed Azure AD account and using the code above and signing in with my managed Azure AD account (jorge@managed.domain) and a correct password (Not visible in Figure 1);
Nothing was visible in the Azure AD sign-in logs;
Output of the code was: No MFA this time due to disabling conditional access policy, authentication now fully succeeds (figure 5);
Figure 5: Signing-In With A Managed Azure AD Account, And Correct Password, Against The Azure AD UserNameMixed Endpoint (Conditional Access Policy DISABLED) –
I wanted to go a step further and see what happens if I converted my federated domain to a managed domain. And that is exactly what I did!
I converted “@federated.domain” to “@managed.domain”. so, now the user jorge@federated.domain is jorge@federated.domain.converted.to.managed.domain (man I’m glad this is not my real mail address!)
[11] using the code above and signing in with my converted managed Azure AD account (jorge@federated.domain.converted.to.managed.domain) and a correct password (Not visible in Figure 1);
Nothing was visible in the Azure AD sign-in logs;
Output of the code was: (figure 6);
Figure 6: Signing-In With A Managed (Converted From Federated) Azure AD Account, And Correct Password, Against The Azure AD UserNameMixed Endpoint
[12] as soon as I reverted back from native to federated it failed again as in [7]
So based upon these findings my personal conclusion is:
This does allow password brute-force/spraying attacks to understand whether a password is correct or not
Nothing is logged in the sign-in logs in Azure AD, that applies to both success and failure sign-ins
It appears NOT to work (i.e. no security issue) when targeting accounts in federated domains, whether PHS is enabled or not. It looks like the Azure AD UserNameMixed endpoint ignores requests from accounts in federated domains (ADFS is not that bad after all! 😉 );
It appears to work (i.e. security issue) when targeting accounts in managed domains, when either using PHS (tested) and PTA (not tested) as those can use Seamless SSO;
It applies to PTA too because Azure AD receives the password and sends it to the PTA agent on-premises and because it can also use Seamless SSO;
Although NOT tested against ADFS/WAP using the code above, if the same endpoint is exposed in ADFS through WAP, then you have the exact same issue for accounts in AD. A recommendation is to have it published through ADFS, but NOT to publish it through WAP (proxy);
I do not consider this to be a vulnerability, but rather a bad “by design”-made decision, because:
Nothing is logged, either with failure of success;
The endpoint is always enabled whether or not you use Seamless SSO;
Although NOT mentioned previously by me, but in step [11] it only worked after disabling Azure AD Identity Protection Sign-in Risk. After I converted the domain from federated to managed, Azure AD Identity protection sign-in risk kicked in and forced me to change my password. After changing my password, I would be in the same boat as an normal managed account
Although nothing being logged in the Azure AD sign-in logs when targeting the Azure AD UserNameMixed, I think have Azure AD Identity Protection AND a conditional access policy forcing MFA at all times will save and protect your bacon. During my testing I experienced blockages due to Azure AD Identity Protection being enabled and Conditional Access forcing MFA at all times. Although MFA may be enabled, but because confirmation is given a password is correct or not, and when correct you just need to find another endpoint/app/whatever for which MFA is not enabled.
Recommendations for you:
Enable conditional access policy to always force MFA, especially in external scenarios and/or from untrusted devices
Enable Azure AD Identity Protection Sign-In and User-Risk
And while you are at it, not really related to this, do enable PHS if you are federated, to be able to leverage leaked credentials
————————————————————————————————————————————————————- This posting is provided “AS IS” with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### IAMTEC | Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
Since then many things have changed, and today it is a valuable feature to delegate management of a set of objects to other groups of people. It is different than OUs in Active Directory (AD). OUs in AD are for delegating management and applying policy. AUs in Azure AD are for delegating management only.
Figure 1: Administrative Units In Azure AD – From The Administrative Unit Perspective
–
Objects
Today AUs only support user and group objects, both cloud native and hybrid/synched. Those objects are not actually child objects of an AU. The objects are assigned to one or more AUs. The assignment basically behaves like a group membership. By allowing objects being assigned to multiple AUs, multiple groups of admins can manage the same set of objects.
Objects can be assigned to an AU
…from the AU perspective => select AU, then add member object
OR
…from the object perspective => select object, then assign an AU
Figure 2: User Objects Member Of A Certain Administrative Unit
–
Figure 3: Group Objects Member Of A Certain Administrative Unit
–
Figure 4: Administrative Units In Azure AD – From The Object (In This Case: User) Perspective
–
Administration
The main and only goal of AUs is the delegation of administration of user and group objects. At tenant level, Azure AD supports many administrative roles. Some of those roles, that focus on user and group objects throughout the complete Azure AD tenant, can therefore also be scoped at AU level allowing to perform the tasks supported by the administrative role on the objects that are assigned to the AU. In figure 5 you can see the administrative roles currently supported by an AU.
Figure 5: Administrative Units In Azure AD – Available Delegation Roles For Each Administrative Unit
–
This does not mean, delegation is configured by default. No, you still need to configure that by either assigning users and/or groups the respective role scoped for the corresponding AU. In terms of users you can assign any user the supported roles scoping the AU. With regards to groups, you can only assign groups only the supported Azure AD roles, if those groups have been created to support Azure AD role assignments. That support cannot be changed after the creation of the group. it must be configured when creating the group.
When looking at a specific Azure AD administrative role, you will be able to see what the scope of management is and which object (group or user) has been configured for that specific scope.
–
Assigning Objects To AUs
It is possible to add or remove assignments of individual objects, through either the Azure AD Portal, PowerShell or the Microsoft graph. Additionally, through the Azure AD Portal it is possible to bulk add or remove objects to/from the AU. When deleting an AU, only the AU, the delegating configuration (role assignment scoped to the AU, not the role itself) and the assignment of objects (users and groups, but not the objects themselves) will be deleted with it.
Figure 6: Administrative Units In Azure AD – Supported Bulk Operations
–
Another thing that would be very interesting is auto assigning users and groups to Administrative Units instead of all the current manual work that is needed. Dynamic assignment similar to dynamic groups would be very welcome and definitely a serious win!
Nevertheless, if you have something that can either leverage the Azure AD PowerShell module or the Microsoft Graph API, dynamic assignment is possible as long as you have something external to Azure AD (IAM System?) to determine the logic of adding or removing objects to/from AUs. More about these thoughts in a next blog post! Make sure to read that one!
–
PowerShell
The Azure AD PowerShell module supports CMDlets to manage AUs through either the Azure AD graph (deprecated!) (*-AzureADAdministrativeUnit*) or the Microsoft graph (preferred!) (*-AzureADMSAdministrativeUnit*)
–
Cheers,
Jorge
————————————————————————————————————————————————————- This posting is provided "AS IS" with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
About more than a year ago, around June 30th 2020, Microsoft announced the deprecation of Azure AD Graph. At the same time everyone was told to start migrating away from Azure AD graph to Microsoft Graph. The latter supports both Azure AD and different Microsoft online services such Exchange, Sharepoint, Teams, etc.
At a very high level Microsoft said:
Azure Active Directory (Azure AD) Graph is deprecated. To avoid loss of functionality, migrate your applications to Microsoft Graph before June 30, 2022 when Azure AD Graph API endpoints will stop responding to requests. Microsoft will continue technical support and apply security fixes for Azure AD Graph until June 30, 2022 when all functionality and support will end. If you fail to migrate your applications to Microsoft Graph before June 30, 2022, you put their functionality and stability at risk.
–
Most of the time people read this and may think: “I’ll look at that later”. With that thought, time goes by and suddenly it June 30th 2022! Oops!
Well, it’s not too late, yet. In less then a year, everything still using Azure AD graph will stop working. Microsoft provides documentation and guidance on how to determine where Azure AD graph is being used and how to migrate to Microsoft graph. Information about this can be found through the following links:
Please be aware that changes might be more work than you would expect. For example, if you look at the Azure AD PowerShell module it uses Azure AD graph in the backend. Today already the Azure AD PowerShell module already supports the Microsoft graph in addition to the Azure AD graph. For example, taking a the CMDLet “New-AzureADgroup” as example, Microsoft did not change that CMDlet to suddenly start using Microsoft graph. No, they introduced a replacement CMDlet “New-AzureADMSGroup” that targets Microsoft graph. If you have scripts, please be aware it might not be as simple as changing from *-AzureAD* to *-AzureADMS* . Due to the change of the CMDlet and therefore the endpint, there are also (subtle) schema changes. The easiest example is the change from ObjectID to ID.
–
Also be aware that new features will be implement in Microsoft graph only, and anything that leverages it. An example of such is the ability of assigning Azure AD groups to Azure (AD) roles. When creating a group in the Azure AD portal, you need to enabled the option “Azure AD roles can be assigned to the group”. Now, through PowerShell you need to use the CMDlet “New-AzureADMSGroup” with the parameter “-IsAssignableToRole”
–
Now, if you have not started yet migrating away from Azure AD graph to Microsoft graph, make sure to start A.S.A.P.!
–
Cheers,
Jorge
————————————————————————————————————————————————————- This posting is provided "AS IS" with no warranties and confers no rights! Always evaluate/test everything yourself first before using/implementing this in production! This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years! DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/ ————————————————————————————————————————————————————- ########################### Jorge’s Quest For Knowledge ########################## #################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
Jorge's Quest For Knowledge! 