Forum Widgets
Latest Discussions
Best setup for multiple machines
I have a live account for my email address as I have a surface and originally registered for an account to use for machine backups, browsing syncing etc. I also use onenote and wanted it syncing to a 365 onedrive account so I signed up for office 365 business basics so that I could sync onedrive and all of the associated attachments, audio records etc to it. I would love to use use the paid business account but I cant sign into the surface with the business account, only home accounts as I dont have pro. The next issue is that I use another laptop, android tablet and phone also signing into the business 365 account. These all used to sync fine but now, all other devices disconnect as the one you have signed into it connects. Not a major issue, you sign into the device you want to use, sync and then continue However i jump from device to device that often that it starts to grate on me that i cant just grab a device and sync. Is there any way I can register each device so that they are trusted and then more than one device can stay connected.
Token replay question
I had a case of a user being phished and their token being used in a replay attack. The replay appeared in the sign in logs from a different IP address to the "true" users IP. I then saw activity on the account originating from the original IP until we killed the session a few hours later. I had someone suggest that in a token replay the M365 audit\activity logs and Entra ID signing logs will show the original persons IP, not the attackers. Can anyone confirm this?Web Sign-In: Alert QR Code/Code for Mobile
Had 2FA turned off in the work account, on the web login screen a reminder only a few logins allowed without the Authenticator. Fair enough so instead of logging in, got out the Android tablet and installed the Authenticator and logged in with the account there, no problems. A few minutes later attempted to log in to the account on web, this time it presented a QR code with the link "phonefactor:/activateaccount .... mobileappcommunicator.auth ..." which didn't seem to go well in Android using QR scanner or camera. The web login suggested an alternative to the QR code, an 8? digit code, but nothing in the Authenticator app seemed to want it. All of a sudden everything seems to work fine, the web login (with a note that 2FA was used in the login) and the Authenticator on the tablet, thus turning out as a good news ending to a slightly shaky start. :)Azure MFA "Activation Failed" error with Microsoft Authenticator App
We've opened a premier ticket, but has anyone in the community seen this error before? We've got a few users that can't set up the Microsoft Authenticator app, and nothing we do is working. This is rolling out to all of our users overnight tonight, and none of our global testing has run into anything like this.
CA policy for corporate devices
I would like to create a conditional access policy to block all non corporate devices from accessing Office 365 resources. I created a policy: Applies to -> User Group Applies to -> all resources Applies to -> Win 10 Filter for devices exception-> Ownership: company & trust type: Entra Hybrid joined. Action: block The above works fine for office desktop login, i.e. blocks non corporate devices and allows corporate devices. However, a side effect is that sign ins from browser on a corporate device is still blocked.
Evolution with business account (oauth2)
Recently domainFactory migrated mail to Microsoft 365 business accounts. I used to use the Evolution mail client (Fedora Linux, flatpak version) for mail. Unfortunately I am not able to login to my account with Evolution. You can find my discussion here: https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/515#note_2384010 I also noticed that the login is no problem with a personal account. Does anybody have experience with this?
Unlink a users workplace join account while device is also Entra ID joined
We have a number of users on Entra ID joined devices that were prompted to register their devices when signing into teams with another org account. My question has two parts - how can we programmatically remove the Workplace Join account and how do we avoid users from doing it again?User with hundreds of Interactive Sign-In log entries that are "Interrupted"
I have one user in our organization that has hundreds of Interactive Sign-in logs in EntraID that are marked as "Interrupted". I don't even know where to start with the user. Does anyone have a recommendation for isolating the cause of these logs? Recent entries are 95% related to Office Online Core SSO application.Entra-ID Privileged Identity Management for Groups
We have used PIM for groups to assign certain Azure Security groups to eligible users. For example a group which provides the contributor role to a certain subscription. This group is added in PIM for groups, and eligible users have been assigned to the group, in which they can provide themselves with the privileges if required to do so for maximum 8 hours. However, when we assign a user to a PIM protected group, then there is no way to tell from the user's properties, that the user has been assigned (eligible) to a PIM protected group. Therefore wouldn't it be better to create PIM groups and add the assigned user as a member of a PIM group, and assign the PIM group as eligible to the PIM protected group? Then you would able to see from the Groups list if the user is illegible for any PIM groups.
