SOLVED

Did I accidentally provision Apple Internet Accounts with my own Azure AD user account

%3CLINGO-SUB%20id%3D%22lingo-sub-1318135%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1318135%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F627270%22%20target%3D%22_blank%22%3E%40madcat%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20haven't%20created%20an%20Apple%20account.%3C%2FP%3E%3CP%3EThe%20enterprise%20application%20'Apple%20Internet%20Accounts'%20was%20created.%20This%20enables%20Apple%20to%20view%20your%20mailbox%20and%20utilize%20their%20native%20'mail'%20app.%3C%2FP%3E%3CP%3ECheck%20out%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevelop%2Fapp-objects-and-service-principals%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ethis%20doc%20article%3C%2FA%3E%20for%20more%20information%20about%20applications.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20remove%20this%20application%20from%20your%20tenant%2C%20but%20then%20you%20won't%20be%20able%20to%20utilize%20the%20Apple%20Mail%20app.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAll%20in%20all%2C%20there%20is%20no%20harm%20done%20with%20having%20this%20application%20in%20your%20tenant.%20It%20just%20enables%20you%20to%20utilize%20the%20Apple%20Mail%20app.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1318159%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1318159%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20the%20reply%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E!%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Fhtml%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat%20sounds%20like%20it%20could%20be%20useful%20although%20it%20does%20add%20an%20additional%20security%20concern%20as%20our%20O365%20deployment%20is%20purely%20cloud%20based%20at%20the%20moment%20and%20adding%20the%20macOS%20mail%20client%20to%20the%20ecosystem%20would%20increase%20our%20attack%20surface%20a%20little.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EWhat%20would%20happen%20if%20I%20deleted%20the%20account%20I%20used%20to%20provision%20it%20or%20changed%20that%20account's%20role%20memberships%3F%3C%2FSTRONG%3E%20Would%20Apple%20Internet%20Accounts%20still%20work%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%20to%20the%20best%20of%20my%20knowledge%20we%20don't%20have%20or%20use%20Apple%20Business%20Manager.%20More%20to%20the%20point%20the%20only%20Apple%20ID%20on%20my%20iPhone%20is%20my%20personal%20one%20and%20I%20certainly%20don't%20have%20it%20so%20I%20wonder%20what%20triggered%20that%20prompt%20on%20my%20device%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1318174%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1318174%22%20slang%3D%22en-US%22%3EThese%20application%20do%20have%20a%20security%20concern%20indeed.%20I%20blogged%20about%20it%20a%20while%20ago%3A%20%3CA%20href%3D%22https%3A%2F%2F365bythijs.be%2F2020%2F01%2F05%2Fprotecting-against-oauth-attacks-setting-up-admin-consent-workflow%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2F365bythijs.be%2F2020%2F01%2F05%2Fprotecting-against-oauth-attacks-setting-up-admin-consent-workflow%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3ENothing%20would%20happen%20if%20you%20made%20changes%20to%20the%20account.%3CBR%20%2F%3EAn%20enterprise%20application%20is%20not%20dependent%20on%20a%20user%20account%2C%20it's%20an%20entity%20on%20it's%20own.%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20received%20this%20prompt%20because%20you%20tried%20to%20configure%20the%20Apple%20Mail%20app%20on%20your%20iPhone.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1318381%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1318381%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20so%20much%20for%20your%20response%20and%20the%20blog%20links.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDo%20you%20think%20Azure%20Basic%20has%20sufficient%20functionality%20to%20secure%20our%20tenant%20against%20such%20threats%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20only%20on%20Office%20365%20Essentials%20and%20trying%20to%20minimise%20costs%20at%20this%20difficult%20time%20(COVID)%20but%20I%20keep%20coming%20across%20documentation%20about%20elements%20such%20as%20conditional%20access%20policies%2C%20MDM%2C%20PIM%20etc.%20and%20wonder%20if%20they%20are%20necessary%20even%20for%20a%20small%20business.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1318387%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1318387%22%20slang%3D%22en-US%22%3EAzure%20Basic%20has%20functionality%20to%20keep%20a%20tenant%20secure%2C%20but%20it%20is%2C%20well...%20basic%3CBR%20%2F%3E%3CBR%20%2F%3EFirst%20of%20all%2C%20I%20would%20recommend%20turning%20off%20User%20Application%20consent%20(like%20mentioned%20in%20the%20blog%20I%20added%20previously).%3CBR%20%2F%3E%3CBR%20%2F%3ESecondly%2C%20I%20would%20really%20recommend%20configuring%20Multifactor%20Authentication.%3CBR%20%2F%3EMFA%20can%20be%20configured%20through%20two%20ways%3A%20Conditional%20Access%20and%20Security%20Defaults.%3CBR%20%2F%3E%3CBR%20%2F%3ESecurity%20Defaults%20are%20a%20free%20option%2C%20check%20out%20this%20blog%20for%20more%20information%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2F365bythijs.be%2F2019%2F11%2F26%2Fwhat-is-azure-ad-security-defaults-should-you-be-using-it%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2F365bythijs.be%2F2019%2F11%2F26%2Fwhat-is-azure-ad-security-defaults-should-you-be-using-it%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EI%20wouldn't%20worry%20about%20MDM%20and%20PIM%20during%20this%20time.%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20you%20have%20configured%20MFA%2C%20you%20have%20a%20good%20baseline%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1318395%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1318395%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20so%20much%20for%20your%20time%20your%20responses%20have%20been%20invaluable.%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Fhtml%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1334285%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1334285%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%2C%20a%3CSPAN%3E%26nbsp%3Buser%20told%20me%20that%20they%20got%20the%20prompt%20when%20they%20tried%20to%20configure%20email%20on%20a%20Mac.%20I%3C%2FSPAN%3Es%20this%20possible%3CSPAN%3E%26nbsp%3Bon%20a%20Mac%20and%20ipad%20as%20well%3F%20I%20may%20have%20misunderstood%20the%20user%2C%20but%20I%20would%20love%20to%20know%20the%20difference.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1335637%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1335637%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F592929%22%20target%3D%22_blank%22%3E%40Kdships%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt's%20possible.%20I%20don't%20know%20exactly%20how%20the%20Mail%20app%20on%20MacOS%20works.%3C%2FP%3E%3CP%3EMost%20third%20party%20apps%20that%20integrate%20with%20Office%20365%20(like%20reading%20emails)%20will%20provide%20these%20pop-ups%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1317884%22%20slang%3D%22en-US%22%3EDid%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1317884%22%20slang%3D%22en-US%22%3E%3CP%3EI%20was%20adding%20my%20O365%20email%20account%20to%20my%20iPhone%20(Exchange%20Active-Sync)%20when%20I%20was%20prompted%20with%20the%20request%20below.%20I%20blindly%20tapped%20Accept%20(yes%20really%20should%20have%20read%20the%20fine%20print)%20and%20realised%20I%20probably%20should%20have%20lingered%20there%20a%20bit%20longer.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESure%20enough%20in%20Azure%20AD%20user%20audit%20log%20is%20a%26nbsp%3B%3CSTRONG%3EAdd%20app%20role%20assignment%20grant%20to%20user%3C%2FSTRONG%3E%20event%20followed%20by%20the%20following%20events%20from%26nbsp%3BApple%20Internet%20Accounts%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3EAdd%20app%20role%20assignment%20grant%20to%20user%20(my%20account%20now%20a%20member%20of%20Exchange%20Admin%2C%20Helpdesk%20admin%2C%20Service%20Support%20and%20a%20few%20others%3C%2FLI%3E%3CLI%3EA%20Remove%20app%20role%20assignment%20from%20user%20event%20(not%20sure%20which%20one)%3C%2FLI%3E%3CLI%3EAdd%20a%20deletion-marked%20app%20role%20assignment%20grant%20to%20user%20as%20part%20of%20link%20removal%3C%2FLI%3E%3C%2FUL%3E%3CP%3EI'm%20not%20even%20sure%20I%20want%20to%20provision%26nbsp%3BApple%20Internet%20Accounts%20in%20my%20tenant%20and%20certainly%20not%20with%20any%20of%20its%20services%20tied%20to%20my%20current%20account%20which%20was%20set%20up%20for%20me%20as%20global%20admin.%20(I%20am%20converting%20it%20to%20a%20regular%20account%20and%20setting%20up%20a%20separate%20admin%20account%20-%20see%20my%20other%20post%20on%20this%20matter%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fadmin-center%2Fo365-azure-ad-two-accounts-for-admins-v-pim%2Ftd-p%2F1317857%22%20target%3D%22_self%22%3EO365%20%2F%20Azure%20AD%20-%20two%20accounts%20for%20admins%20v.%20PIM)%3C%2FA%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20I%20remove%20my%20user%20account%20from%20all%20those%20admin%20roles%3F%3C%2FP%3E%3CP%3EDo%20I%20want%20to%20use%20Apple%20Internet%20Accounts%20even%3F%20I%20would%20think%20not%3F%3F%20as%20we%20don't%20provision%20devices%20(BYOD).%3C%2FP%3E%3CP%3ECan%20I%20un%20provision%20Apple%20Internet%20Accounts%20for%20now%3F%3C%2FP%3E%3CP%3ECan%20they%20make%20that%20sign%20in%20page%20look%20less%20like%20a%20phishing%20attempt%20lol%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-left%22%20image-alt%3D%22IMG_0584.PNG%22%20style%3D%22width%3A%20420px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F185149iB92A8EB69098DB5A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22IMG_0584.PNG%22%20alt%3D%22IMG_0584.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1317884%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1777906%22%20slang%3D%22en-US%22%3ERe%3A%20Did%20I%20accidentally%20provision%20Apple%20Internet%20Accounts%20with%20my%20own%20Azure%20AD%20user%20account%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1777906%22%20slang%3D%22en-US%22%3ESo%20a%20GA%20user%20granted%20consent%20(admin%20consent)%20but%20the%20app%20isn%E2%80%99t%20showing%20under%20enterprise%20apps%20(or%20app%20registration)%2C%20any%20ideas%3F%3CBR%20%2F%3ECan%20we%20allow%20certain%20users%20or%20groups%20to%20be%20able%20to%20do%20that%3F%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I was adding my O365 email account to my iPhone (Exchange Active-Sync) when I was prompted with the request below. I blindly tapped Accept (yes really should have read the fine print) and realised I probably should have lingered there a bit longer.

 

Sure enough in Azure AD user audit log is a Add app role assignment grant to user event followed by the following events from Apple Internet Accounts:

 

  • Add app role assignment grant to user (my account now a member of Exchange Admin, Helpdesk admin, Service Support and a few others
  • A Remove app role assignment from user event (not sure which one)
  • Add a deletion-marked app role assignment grant to user as part of link removal

I'm not even sure I want to provision Apple Internet Accounts in my tenant and certainly not with any of its services tied to my current account which was set up for me as global admin. (I am converting it to a regular account and setting up a separate admin account - see my other post on this matter: O365 / Azure AD - two accounts for admins v. PIM).

 

Can I remove my user account from all those admin roles?

Do I want to use Apple Internet Accounts even? I would think not?? as we don't provision devices (BYOD).

Can I un provision Apple Internet Accounts for now?

Can they make that sign in page look less like a phishing attempt lol?

 

IMG_0584.PNG

9 Replies

Hi @madcat 

 

You haven't created an Apple account.

The enterprise application 'Apple Internet Accounts' was created. This enables Apple to view your mailbox and utilize their native 'mail' app.

Check out this doc article for more information about applications.

 

You can remove this application from your tenant, but then you won't be able to utilize the Apple Mail app.

 

All in all, there is no harm done with having this application in your tenant. It just enables you to utilize the Apple Mail app.

Thanks for the reply @Thijs Lecomte:smile:

 

That sounds like it could be useful although it does add an additional security concern as our O365 deployment is purely cloud based at the moment and adding the macOS mail client to the ecosystem would increase our attack surface a little.

 

What would happen if I deleted the account I used to provision it or changed that account's role memberships? Would Apple Internet Accounts still work?

 

Also to the best of my knowledge we don't have or use Apple Business Manager. More to the point the only Apple ID on my iPhone is my personal one and I certainly don't have it so I wonder what triggered that prompt on my device?

These application do have a security concern indeed. I blogged about it a while ago: https://365bythijs.be/2020/01/05/protecting-against-oauth-attacks-setting-up-admin-consent-workflow/

Nothing would happen if you made changes to the account.
An enterprise application is not dependent on a user account, it's an entity on it's own.

You received this prompt because you tried to configure the Apple Mail app on your iPhone.

Thank you so much for your response and the blog links.

 

Do you think Azure Basic has sufficient functionality to secure our tenant against such threats?

 

We are only on Office 365 Essentials and trying to minimise costs at this difficult time (COVID) but I keep coming across documentation about elements such as conditional access policies, MDM, PIM etc. and wonder if they are necessary even for a small business.

best response confirmed by madcat (Occasional Contributor)
Solution
Azure Basic has functionality to keep a tenant secure, but it is, well... basic

First of all, I would recommend turning off User Application consent (like mentioned in the blog I added previously).

Secondly, I would really recommend configuring Multifactor Authentication.
MFA can be configured through two ways: Conditional Access and Security Defaults.

Security Defaults are a free option, check out this blog for more information:
https://365bythijs.be/2019/11/26/what-is-azure-ad-security-defaults-should-you-be-using-it/

I wouldn't worry about MDM and PIM during this time.

If you have configured MFA, you have a good baseline

Thank you so much for your time your responses have been invaluable. :smile:

@Thijs Lecomte, a user told me that they got the prompt when they tried to configure email on a Mac. Is this possible on a Mac and ipad as well? I may have misunderstood the user, but I would love to know the difference.

@Kdships 

 

It's possible. I don't know exactly how the Mail app on MacOS works.

Most third party apps that integrate with Office 365 (like reading emails) will provide these pop-ups

So a GA user granted consent (admin consent) but the app isn’t showing under enterprise apps (or app registration), any ideas?
Can we allow certain users or groups to be able to do that?