ON-PREMISES MIGRATION TO AWS – PART 1

October 24, 2023 By Everton

Planning is the first step for you to have a successful migration.

In this Project, we have an average of 100 people on the IT team moving to AWS.

Our role, as the Cloud Solutions Engineer, will be to create a migration solution using automation.

In addition to migrating these users, it will be necessary to associate permissions to groups and users, which are required to have the MFA(Multi-factor authentication) enabled, adding an additional layer of security.

Change language in Microsoft 365 portal in hybrid environment.

January 10, 2023 By Everton

How can I change the preferred language on an user Hybrid Environment Microsoft 365?

Recently I had customer put in a support case for this question.

How can I change the preferred language on an user Hybrid Environment Microsoft 365? After researching and looking at documentation online I was able to repo this.

The administrator makes a change by setting up a language code in the preferredLanguage attribute for the selected user in Active Directory:

Set your default language in this scenario I set it to español (Bolivia) Spanish (Bolivia) es-bo

Refer to the language list What languages does Office for the web support?

For example, if the administrator provides the es-bo value for the preferredLanguage attribute in the String Attribute Editor – the language in Microsoft 365 portal will change to español (Bolivia) Spanish (Bolivia) , and when they set up en-GB – the language will switch to English (United Kingdom). Changing the attribute’s value to <not set> will allow users to control the language of Microsoft 365 portal by using the web browser’s settings.

preferredLanguage-AD

After adjusting language settings, you need to wait 30 minutes for changes to take effect. If you don’t want to wait, the administrator can also force the synchronization with Microsoft 365 by running this cmdlet on the server with Azure AD Connect:

Run a delta sync to update Azure AD user with the language change.

Start-ADSyncSyncCycle -PolicyType Delta

preferredLanguage-AD2-sync

Here you will see the Microsoft 365 portal default language is in Spanish es-bo (Bolivia).

If you need to change your Microsoft 365 portal language again, simply follow the steps above.

Basic Identity Services and Identity Types of Azure AD

June 15, 2022 By Everton

Identity Types within Azure AD

There are four identity types within Azure Active Directory

The variations of each identity type and the benefits and use cases:

User
Service Principal
Managed Identity
Device

User identity – a representation of an entity that is managed by Azure AD both employees and guests are represented as users. A guest is external to the company, like a business partner or vendor collaborating with employees. Azure AD (B2B) business-to-business collaboration: A feature within external Identities that includes the capability to add guest users. Enables organizations to securely share applications and services with guest users from other organizations.

Service Principal – An identity for an application, Enables features like authentication and authorization of the application to resources that are secured by the Azure AD tenant. An application must first be registered with Azure AD to enable identity and access integration. Once registered, a service principal is created in each Azure AD tenant where the application is used to enable authentication and authorization in resource access.

Managed Identity – A special type of service principal that is automatically managed in Azure AD. This eliminates the need for admins and developers to manage credentials. Managed identities come in two varieties.

User-assigned – which can be shared by multiple resources and has a lifecycle independent of these resources. eg: (You could assign this user-assigned ID to many virtual machines).

System-assigned – which is tied to the lifecycle of a specific service or resource and cannot be shared. eg: (when the system or resource is retired and deleted that system-assigned identity is deleted with it).

The preference when you have a choice would be to use system-assigned managed identities over user-assigned as they minimize our administrative effort.

Device Identity – entities can be:

Azure AD-registered – provides users with support for bring-your-own-device (BYOD) mobile device scenarios.

Azure AD-joined – A device joined to Azure AD through an organizational account, which is then used to sign into the device.

Hybrid Azure AD-joined – Domain joined to Azure AD and on-premises Active Directory.

Benefits of Device registration

Single sign-on (SSO) – registering and joining devices to Azure AD gives users single sign-on (SSO) to cloud-based resources.
Azure AD-joined devices also benefit from the SSO experience to resources and apps that reply on on-premises Active Directory.
Device Management – registration enables device management options with Intune to control how an organization’s devices are used.

Mobile device management (MDM) for company-owned devices

Mobile application management (MAM) for personal devices. (BYOD)

Overview of the Hybrid of the Hybrid Identity Model

All of these scenarios require an on-premise Active Directory (source of truth).

Azure AD password hash-synchronization – The simplest way to enable authentication for on-premises directory objects in Azure AD. The user is authenticated by Azure AD.

Azure AD pass-through authentication (PTA) – While password-hash is synchronized to Azure AD, the user is authenticated directly against your on-premises Active Directory. Can be used to enforce Active Directory restrictions not present in Azure AD, like “login hours”.

Azure AD Federation authentication – Authentication for organizations that need advanced measures not currently supported in Azure AD, like smart cards and certificates. Again, Azure AD passes the request to on-premises Active Directory.

Why are External Identities Necessary?

Employees today are more commonly working with people both inside and outside of their organization.
External users (vendors, partners) may need access to resources inside your organization.
Azure AD External Identities is a set of capabilities that enables organizations to allow access to external users.

Types of External Identities

Enable your customer’s partners, and other guest users to “bring their own identities” to sign in.

Two different types of Azure AD External Identities:

B2B (business-to-business) – collaboration allows you to share apps and resources with external users.

B2C (business-to-consumer) – is an identity management solution for consumer-facing apps.

Azure AD B2B (business-to-business) – Enables organizations to share apps and resources with guest users from organizations, partners and collaborators use their own identity management solutions, so there is no external admin overhead:

Uses an invitation and redemption process.
Can perform SSPR through their usual process. (identity is managed elsewhere).
Admins can also enable self-service sign-up user flows to allow external users to sign up without admin intervention.

Azure AD B2C (business-to-consumer) – Enables external users to use their preferred social, work, or local identities for single sign-on to an organization’s apps. External users are managed in the Azure AD B2C directory, separately from the organization’s employee and partner directory.

A customer identity access management (CIAM) solution.
Supports millions of users and billions of authentications per day.
Automatically handles threats like denial-of-service, password spray, or brute-force attacks.

Microsoft 365 EnterPrise Tenant Sign-up

February 21, 2020 By Everton

What is Microsoft M365?

Microsoft 365 for enterprise consists of: Office 365, Windows 10 Enterprise, Enterprise Mobility + Security

Although designed for large organizations, Microsoft 365 for enterprise can also be used for medium-sized and small businesses that need the most advanced security and productivity capabilities.


Local and cloud-based apps and productivity services	Includes both Office 365 ProPlus, the latest Office apps for your PC and Mac (such as Word, Excel, PowerPoint, Outlook, and others), and a full suite of online services for email, file storage and collaboration, meetings, and more.
Windows 10 Enterprise	Addresses the needs of both large and midsize organizations, providing users with the most productive and secure version of Windows and IT professionals with comprehensive deployment, device, and app management.
Device management and advanced security services	Includes Microsoft Intune, which is a cloud-based enterprise mobility management (EMM) service that helps enable your workforce to be productive while keeping your corporate data protected.

Manage your enterprise deployment with modern tools from Microsoft 365 or M365. Empower your users and IT to benefit from the easy deployment and productivity enhancements from Windows 10, while still maintaining your standards for security and manageability. Microsoft 365 for enterprise documentation and resources

In our post today we want to sign-up for a Microsoft 365 Trial account and setup some basic settings to protect the account. 365

There a several versions of Microsoft 365; however we’ll be dealing with the Enterprise and Business versions of Microsoft 365.

We need to first sign-up for a free trial account by visiting the sign-up link

Once we have signed up for a Microsoft M365 trial we can setup some basic security policies, here are several screen using the wizard from the default setup screen. We have already added our domain.onmicrosoft domain and created a administrators account, the following policies are for protecting the domain.

Microsoft 365 for enterprise deployment guide

The Microsoft 365 for enterprise deployment guide steps you through the correct and required configuration of Microsoft 365 for enterprise products and features.

To deploy Microsoft 365 for enterprise yourself, you can:

Deploy the foundation infrastructure for built-in security and integration for simplified management, which makes it easier to ensure your client software is updated with the latest productivity and security enhancements. The foundation infrastructure is organized as a series of numbered phases that build upon each other and towards an environment that supports Microsoft 365 for enterprise workloads and scenarios.If you are a smaller or newer organization, follow the phases in order to methodically build out your infrastructure.However, you can deploy phases or the portions of phases of this infrastructure in any order as needed, one after the other or in parallel, to integrate with your current infrastructure, fit your IT plans and resources, and meet your business needs. For a simplified deployment for non-enterprises, click here.If you are an enterprise organization, view the phases as layers of IT infrastructure, rather than a defined path, and determine how to best work toward eventual adherence to the requirements of each layer across your organization.
Deploy key productivity workloads and scenarios on top of your infrastructure. These unlock creativity and teamwork in your organization.

Here’s the relationship between the foundation infrastructure and the workloads and

Listed below are several resources to assist you in realizing the value of Microsoft 365; and how this productivity suite can secure, defend and safeguard your enterprise in today’s modern world of security threats.

Googe: Improving data regions with expanded coverage and group-based admin controls

February 18, 2020 By Everton

G Suite data regions allows G Suite customers to choose a specific geographic location for their covered data. We’re enhancing data regions with three key updates:

Coverage of user indices for Gmail and Calendar
Coverage of Google Keep primary data at rest and backups
More granular group-based controls

In addition to these new features, we’re also moving the location of the data region reporting dashboard from Admin Console > Dashboard to Admin Console > Reports > Data Regions.

With Google G suite data regions, you can now Control the geographical location of your G Suite data at rest.

For organizations that want more geo-control, the data regions feature for G Suite gives you the choice to pick where covered data for select G Suite apps is stored at rest — whether globally distributed, in the US, or across Europe.

Admins

Why you’d use it

G Suite’s globally distributed cloud infrastructure reduces latency and protects data with geo redundancy. Therefore, most organizations choose not to geo-restrict their data. However, some organizations have preferences around where their data is stored at rest.

To support those customers, we launched data region controls in 2018. Data regions lets customers designate the region in which covered data is stored when at rest—globally, in the US, or in Europe. Last year, we enhanced data regions with increased coverage of apps and data types.

By covering more apps, additional data types, and more granular admin controls, we hope to better support our customers’ data location preferences.

Below a graphic of company data at rest in United States data centers, and the Company Profile of data regions.

For more please see the following Google docs: