There are four identity types within Azure Active Directory

The variations of each identity type and the benefits and use cases: 

• User 
• Service Principal
• Managed Identity
• Device

User identity – a representation of an entity that is managed by Azure AD both employees and guests are represented as users.  A guest is external to the company, like a business partner or vendor collaborating with employees.  Azure AD (B2B) business-to-business collaboration: A feature within external Identities that includes the capability to add guest users. Enables organizations to securely share applications and services with guest users from other organizations.

Service Principal – An identity for an application, Enables features like authentication and authorization of the application to resources that are secured by the Azure AD tenant. An application must first be registered with Azure AD to enable identity and access integration.  Once registered, a service principal is created in each Azure AD tenant where the application is used to enable authentication and authorization in resource access. 

Managed Identity – A special type of service principal that is automatically managed in Azure AD.  This eliminates the need for admins and developers to manage credentials. Managed identities come in two varieties.

User-assigned – which can be shared by multiple resources and has a lifecycle independent of these resources. eg: (You could assign this user-assigned ID to many virtual machines).

System-assigned – which is tied to the lifecycle of a specific service or resource and cannot be shared. eg: (when the system or resource is retired and deleted that system-assigned identity is deleted with it).

The preference when you have a choice would be to use system-assigned managed identities over user-assigned as they minimize our administrative effort.

Device Identity – entities can be:

Azure AD-registered – provides users with support for bring-your-own-device (BYOD) mobile device scenarios.

Azure AD-joined – A device joined to Azure AD through an organizational account, which is then used to sign into the device.

Hybrid Azure AD-joined – Domain joined to Azure AD and on-premises Active Directory.

Benefits of Device registration

• Single sign-on (SSO) – registering and joining devices to Azure AD gives users single sign-on (SSO) to cloud-based resources.
• Azure AD-joined devices also benefit from the SSO experience to resources and apps that reply on on-premises Active Directory.
• Device Management – registration enables device management options with Intune to control how an organization’s devices are used.

Mobile device management (MDM) for company-owned devices

Mobile application management (MAM) for personal devices. (BYOD)

Overview of the Hybrid of the Hybrid Identity Model

All of these scenarios require an on-premise Active Directory (source of truth).

Azure AD password hash-synchronization – The simplest way to enable authentication for on-premises directory objects in Azure AD.  The user is authenticated by Azure AD.

Azure AD pass-through authentication (PTA) – While password-hash is synchronized to Azure AD, the user is authenticated directly against your on-premises Active Directory.  Can be used to enforce Active Directory restrictions not present in Azure AD, like “login hours”.

Azure AD Federation authentication – Authentication for organizations that need advanced measures not currently supported in Azure AD, like smart cards and certificates.  Again, Azure AD passes the request to on-premises Active Directory.

Why are External Identities Necessary?

• Employees today are more commonly working with people both inside and outside of their organization.  
• External users (vendors, partners) may need access to resources inside your organization.
• Azure AD External Identities is a set of capabilities that enables organizations to allow access to external users.

Types of External Identities

Enable your customer’s partners, and other guest users to “bring their own identities” to sign in.

Two different types of Azure AD External Identities:

B2B (business-to-business) – collaboration allows you to share apps and resources with external users.

B2C (business-to-consumer) – is an identity management solution for consumer-facing apps. 

Azure AD B2B (business-to-business) – Enables organizations to share apps and resources with guest users from organizations, partners and collaborators use their own identity management solutions, so there is no external admin overhead:

• Uses an invitation and redemption process.
• Can perform SSPR through their usual process. (identity is managed elsewhere).
• Admins can also enable self-service sign-up user flows to allow external users to sign up without admin intervention.

Azure AD B2C (business-to-consumer) – Enables external users to use their preferred social, work, or local identities for single sign-on to an organization’s apps. External users are managed in the Azure AD B2C directory, separately from the organization’s employee and partner directory.

• A customer identity access management (CIAM) solution.
• Supports millions of users and billions of authentications per day.
• Automatically handles threats like denial-of-service, password spray, or brute-force attacks.

• Deploy your identity infrastructure for Microsoft 365
• Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals

The post Basic Identity Services and Identity Types of Azure AD first appeared on Cloud Engineer - Everton Collins.

Microsoft 365 for enterprise consists of: Office 365, Windows 10 Enterprise, Enterprise Mobility + Security

Although designed for large organizations, Microsoft 365 for enterprise can also be used for medium-sized and small businesses that need the most advanced security and productivity capabilities.

Manage your enterprise deployment with modern tools from Microsoft 365 or M365. Empower your users and IT to benefit from the easy deployment and productivity enhancements from Windows 10, while still maintaining your standards for security and manageability.  Microsoft 365 for enterprise documentation and resources

In our post today we want to sign-up for a Microsoft 365 Trial account and setup some basic settings to protect the account.  365

There a several versions of Microsoft 365; however we’ll be dealing with the Enterprise and Business versions of Microsoft 365.

• Microsoft 365 Education
• Microsoft 365 Business
• Microsoft 365 Enterprise

We need to first sign-up for a free trial account by visiting the sign-up link

Once we have signed up for a Microsoft M365 trial we can setup some basic security policies, here are several screen using the wizard from the default setup screen.  We have already added our domain.onmicrosoft domain and created a administrators account, the following policies are for protecting the domain.

Microsoft 365 for enterprise deployment guide

The Microsoft 365 for enterprise deployment guide steps you through the correct and required configuration of Microsoft 365 for enterprise products and features.

To deploy Microsoft 365 for enterprise yourself, you can:

• Deploy the foundation infrastructure for built-in security and integration for simplified management, which makes it easier to ensure your client software is updated with the latest productivity and security enhancements. The foundation infrastructure is organized as a series of numbered phases that build upon each other and towards an environment that supports Microsoft 365 for enterprise workloads and scenarios.If you are a smaller or newer organization, follow the phases in order to methodically build out your infrastructure.However, you can deploy phases or the portions of phases of this infrastructure in any order as needed, one after the other or in parallel, to integrate with your current infrastructure, fit your IT plans and resources, and meet your business needs. For a simplified deployment for non-enterprises, click here.If you are an enterprise organization, view the phases as layers of IT infrastructure, rather than a defined path, and determine how to best work toward eventual adherence to the requirements of each layer across your organization.
• Deploy key productivity workloads and scenarios on top of your infrastructure. These unlock creativity and teamwork in your organization.

Here’s the relationship between the foundation infrastructure and the workloads and

Listed below are several resources to assist you in realizing the value of Microsoft 365; and how this productivity suite can secure, defend and safeguard your enterprise in today’s modern world of security threats.

• Will your enterprise realize a 123% ROI?
• Deploy Microsoft 365 for Enterprise
• Microsoft 365 for enterprise documentation and resources
• Microsoft 365 for enterprise Test Lab Guides
• Microsoft 365 compliance documentation
• Microsoft Managed Desktop documentation and resources
• Microsoft 365 Fundamentals
• Microsoft 365 for enterprise Test Lab Guides
• PowerShell Licensing SKU’s in Office 365

The post Microsoft 365 EnterPrise Tenant Sign-up first appeared on Cloud Engineer - Everton Collins.

Description

The Get-AzureADSubscribedSku cmdlet gets subscribed SKUs to Microsoft services.

The post Azure Command – Gets subscribed SKUs to Microsoft services. first appeared on Cloud Engineer - Everton Collins.

Azure Identity Protection is a feature of Microsoft Enterprise Mobility + Security and is a premium feature in EMS E5.  We conducted a test to see if a user would be blocked while trying to log in from 2 separate locations.

We went to https://portal.azure.com/ and logged in with credentials normally from our home office server.  I then created a 2012 Server virtual machine setting up and configuring Active Directory and azure AD Connect.

Using the Tor browser I went to portal.azure.com to login with the same user a 2nd time.

Our Results

Your sign-in was blocked

We’ve detected something unusual about this sign-in.

For example, you might be signing in from a new location, device, or app.

Before you can continue, we need to verify your identity.  Please contact your admin.

The post Azure Identity Protection – Enterprise Mobility + Security first appeared on Cloud Engineer - Everton Collins.

Subject: Unhealthy Identity synchronization Notification

As you can see below from the image, we haven’t had a directory sync for the last 54 hours.

Last directory sync Warning: last synced 54 hours ago

We will have to click on the link and see what the particular error is reporting with our Azure AD Connect Synchronization or use the link to troubleshoot our error.

Fixing problems with directory synchronization for Office 365 

Ok, time now to review the version of AD Connect we are running on our local Active Directory and do a in-place upgrade to solve this issue, often times upgrading the AD Connect Sync client will resolve issues with the synchronization.  Let see what’s the current version and what version we are running on our member server and see if we need to do the in-place upgrade.

The current version is 1.1.561.0 so there must be another issue going on, at this point we’ll try and run a few Power Shell Commands to push a sync.  We will run

Start-ADSyncSyncCycle -PolicyType Initial  - To push an initial sync over to office 365.

At this point when we ran the command we got a message back stating the sync was busy.

We also ran this command to see the health of the sync:

Get-ADSyncConnectorRunStatus

So we then opened to the Synchronization Scheduler to check the connectors, stopped them and ran a full synchronization, after that we restarted the member server.

This eventually cleared up our sync issue and from the portal we can see a healthy sync.

A great link you can use to troubleshoot your AD Connect Sync; also you may want to keep an eye on your syncs using the Azure AD Connect Health Dashboard that comes with Azure Active Directory Premium.

The post Azure: Fix Unhealthy Identity synchronization first appeared on Cloud Engineer - Everton Collins.

There are many common daily tasks a Skype for Business Administrator will need to complete in their daily management of Office 365  Skype for business; one such task is that of managing user accounts.  You want to see what users have been enabled for Skype for Business.

You will want to sign-in to Skype for Business PowerShell to run these commands

Connecting to Skype for Business Online by using Windows PowerShell

After you have installed the prerequisite software, you are ready to begin using Windows PowerShell to manage Skype for Business Online. To do that, you begin by opening a standard instance of Windows PowerShell. You don’t need to open a special instance of Windows PowerShell (similar to, say, the Lync Server Management Shell), nor do you need to open a Control Panel app or any other special type of application. This is because Skype for Business Online management is performed by using a remote session of Windows PowerShell.

In turn, this means that:

1. You use a regular session of Windows PowerShell to connect to Skype for Business Online. When connecting remotely, you work on your local computer and you use your local copy of Windows PowerShell, but you manage objects found on a remote system (that is, Skype for Business Online).
2. All the cmdlets, scripts, and other items needed to manage Skype for Business Online are downloaded to your computer. These items are kept in memory and are available only in the remote session established with Skype for Business Online. This is important to keep in mind. When you make a remote connection to Skype for Business Online, the Skype for Business Online cmdlets—such as Get-CsTenant—will be copied, in memory, to your computer. In your remote session, you’ll be able to run these cmdlets. However, these cmdlets are available only in that remote session. For example, you might start a second session of Windows PowerShell, but without connecting to Skype for Business Online in this session. If you try to run the Get-CsTenant cmdlet from within that session, you’ll receive the following error message:

Get-CsTenant : The term 'Get-CsTenant' is not recognized as the name of a cmdlet, function, script file, or operable program.

Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

User Account Management:

Return information about all your Skype for Business Online users

Get-CsOnlineUser  - To return information about all your users who have been enabled for Skype for Business Online

(this can be a very long report)

Get-CsOnlineUser -ResultSize 1 - To return information for a single, randomly-selected user

(for example, to use this account for test purposes), call the Get-CsOnlineUser cmdlet and set the ResultSize parameter to 1:

Lets say you want to get the results for many users, in our case we'll say 6 users.

You can run the following command.
Get-CsOnlineUser -ResultSize 6 - Run this command to get the results back for 6 users

The post Skype for Business Online management tasks – Commands first appeared on Cloud Engineer - Everton Collins.

Azure sign-in activity reports, show those users that have signed into Microsoft Teams, Skype for Business, Azure Portal sign-in and actively using those services.  Well there are several ways you get get a report of who has signed into Microsoft Teams, Skype for Business and Azure Portal.

You can always sign into the portal https://portal.office.com/ and pull down a report of those users assigned licenses or run a PowerShell command to get those results.

Azure Portal Sign-in

We can login to the Old Azure portal view https://manage.windowsazure.com/  or new https://portal.azure.com/ portal  using our admin credentials and view Azure sign-in activity reports specifically of someone who has signed in and using Microsoft teams or get a report by user.

Using the old portal view:

1. Sign into your old Azure Portal – https://manage.windowsazure.com/
2. Go to Azure Active Directory
3. View the Sign-ins and this should show a list of those that have signed into Teams/Skype for Business etc.

Step 1. – Signing into the portal and your Active Directory

Step 2. – Once signed into your Active Directory go to the Reports tab.

Step 3.  –  Azure Active Directory – Select Reports by Dates or by users

Using the new azure portal view:

Follow these steps:

1. Sign into your Azure Portal – https://portal.azure.com/
2. Go to Azure Active Directory
3. View the Sign-ins and this should show a list of those that have signed into Teams/Skype for Business etc.

Step 1. – Sign-in to Dashboard for https://portal.azure.com/  and go to your Active Directory.

Step 2. – Left hand side go to your active directory, and then sign-ins.

Step 3. – After selecting your Active Directory, go to sign-ins where you will be presented to a report view where you can select from any of the following:

Time interval, User, Application, Client, sign-in status.

The reporting architecture in Azure Active Directory consists of the following components:+

• Activity
  • Sign-in activities – Information about the usage of managed applications and user sign-in activities
  • Audit logs – System activity information about users and group management, your managed applications and directory activities.
• Security
  • Risky sign-ins – A risky sign-in is an indicator for a sign-in attempt that might have been performed by someone who is not the legitimate owner of a user account. For more details, see Risky sign-ins.
  • Users flagged for risk – A risky user is an indicator for a user account that might have been compromised. For more details, see Users flagged for risk.

Refer to Microsoft Sign-in activity reports in the Azure Active Directory portal – preview

The post Microsoft Azure sign-in: See who has been using Microsoft Teams, etc first appeared on Cloud Engineer - Everton Collins.

In earlier releases, the scheduler for objects and attributes was external to the sync engine. It used Windows task scheduler or a separate Windows service to trigger the synchronization process. The scheduler is with the 1.1 releases built-in to the sync engine and do allow some customization. The new default synchronization frequency is 30 minutes.

The scheduler is responsible for two tasks:

• Synchronization cycle. The process to import, sync, and export changes.
• Maintenance tasks. Renew keys and certificates for Password reset and Device Registration Service (DRS). Purge old entries in the operations log.

The scheduler itself is always running, but it can be configured to only run one or none of these tasks. For example, if you need to have your own synchronization cycle process, you can disable this task in the scheduler but still run the maintenance task.

Scheduler Configuration

We can view the current configuration settings by using PowerShell run the following command. (view article connecting to Azure PowerShell )

Get-ADSyncScheduler

It will show you something like this:

Starting the scheduler

By default AAD Connect will run every 30 minutes, I wanted to change the scheduler sync from every 30 minutes to every hour, so I would run the following command, changing the time to 1 hr

Example: Set-ADSyncScheduler -CustomizedSyncCycleInterval 01:00:00

See the results

There will be times and quick regular where you will have created users on premise and made edits to user account in Active Directory and then want to resync those changes back over to the cloud in between regular cycles or you need to run different types.

Delta Sync cycle:

A Delta sync cycle includes the following steps:

• Delta import on all Connectors
• Delta sync on all Connectors
• Export on all Connectors

You may have the need for an urgent change that must be synchronized immediately, which is why you need to manually run a cycle. If you need to manually run a cycle, then from PowerShell run Start-ADSyncSyncCycle -PolicyType Delta.

Full sync Cycle:

If you have made one of the following configuration changes, you will need to run a full sync cycle ( or initial sync)

• Added more objects or attributes to be imported from a source directory
• Made changes to the Synchronization rules
• Changed filtering so a different number of objects should be included

If you have made one of these changes, then you need to run a full sync cycle so the sync engine has the opportunity to reconsolidate the connector spaces. A full sync cycle includes the following steps:

• Full Import on all Connectors
• Full Sync on all Connectors
• Export on all Connectors

To initiate a full sync cycle, run Start-ADSyncSyncCycle -PolicyType Initial from a PowerShell prompt.

This command starts a full sync cycle.

The post Azure AD Connect sync: Scheduler first appeared on Cloud Engineer - Everton Collins.

Using the Exchange Management Shell, it pretty easy to use Powershell and find your Exchange Server build numbers and release dates.  Listed below is the command you can run to find your current Exchange Build and release number.

Below we have checked the build for an Exchange Server 2013.

Exchange Server 2016

Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion

Exchange Server 2013

Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion

 Exchange Server 2010

Get-Command ExSetup | ForEach {$_.FileVersionInfo}

You can use the information in this topic to verify the version of Exchange that is running in your organization.

Compare your Build and release to the current Microsoft Exchange Server Updates and build numbers:

The post Find your Exchange Server build numbers – and release dates first appeared on Cloud Engineer - Everton Collins.

Powershell allows you to do many things within office 365, which makes it a very Powerful tool. There are times you will want to check the SKU’s in Office 365 Tenant and if you have many subscriptions and licenses, there is a simple way to check license counts with Powershell and provide a report to management.

Connect to Exchange Powershell Office 365

Use our previous article to connect to office 365 Exchange Online with PowerShell

To get the AccountSkuId and included ServicePlans for your tenant, do the following:

Enter Get-MsolAccountSku

As you can see we also get the Microsoft Online Domain, Active Units, Warning Units and consumed units. Now I have the account SKU’s, we can enter the following to get the included service plans.

Get-MsolAccountSku | Where-Object {$_.SkuPartNumber -eq "ENTERPRISEPREMIUM_FACULTY"} | ForEach-Object {$_.ServiceStatus}

Office 365 Service Plan SKU’s

Related Posts:

• Connect to Exchange Online using Windows PowerShell

The post PowerShell Licensing SKU’s in Office 365 first appeared on Cloud Engineer - Everton Collins.