Have you seen the “My” URLs of Azure Active Directory?

[Brian Tirch]

Microsoft has long talked about how identity is the new security perimeter and using modern identity management tools like Azure Active Directory (Azure AD) can help, but have you ever visited the “My” URLs of Azure AD?

What are “My” URLs?

There are 4 user driven URLs for Azure Active Directory that many people have never seen and can empowers end users, reduce load on helpdesk employees, optimize organizations access to applications, and improve end user experience.

1. MyAccess.Microsoft.com
2. MyApplications.Microsoft.com
3. MyWorkAccount.Microsoft.com
4. MySignins.Microsoft.com

How does it help?

Have you ever logged onto https://myworkaccount.microsoft.com/  with your corporate ID?

Last fall Microsoft updated features in Azure AD to empower end users to gain more insights and control over their own identity management.

Myworkaccount allows individuals to manage the following:

1. Security info related to Multi-Factor Authentication (MFA)
2. Managed lost devices
3. Reset password
4. Manage Azure AD org membership
5. Access Office Apps
6. View subscriptions
7. View their recent sign-in information

How do I provide Access to Application?

Microsoft released a feature of Azure AD called Identity Governance; Identity Governance allows organizations to create workflows that allow users to request access to applications through an automation process.  A part of this process is a feature called Access Reviews, Access Reviews wraps a review process around each application request that provides controls to keep access limited to the correct user(s) and can limit how long users have access to applications.

Users connect to https://myaccess.microsoft.com and once a user has logged in, they are presented with a list of access packages, request history, approvals, and access reviews.

How do I access my applications that I requested?

For years we have talked about how organizations can use Azure AD App proxy to publish applications for your organization. Recently, Microsoft updated the MyApps portal to a new look and feel providing a place where users can connect ( https://MyApplications.Microsoft.com) and are presented with a list of applications they are authorized to use.  The MyApps portal now allows organizations to create categories of applications to simplify the users experience.

The new “My” URLs are another way an organization can allow users to manage their account settings, add additional security controls to web based applications, create governance around user’s access, and off load some help desk tasks.

**Please note URLs for Azure Gov and GCC-H will have .US extensions vs .COM and not all URLs have been updated yet for the new experience. For Azure Gov customers you can use MyAccess.Microsoft.US and account.activedirectory.windows.us until all URLs have been updated.

[SpartanWaycomau]

For organisations that are adopting MFA and SSPR ( and not just ), myaccess portal should be part of the onboarding and training. Awareness and education are additional defenses in the arsenal.

Good post :thumbs_up:

[James van den Berg]

Thanks for Sharing with the Community 

[Paul-UK]

Some of the "my" pages/sites seem to use pop-ups as part of the auth process. Not sure that's a good design!  It's not compatible with pop-up blockers (such as the default one in Firefox).

[Admin O'Meara]

Any chance that these URLs will support the ?whr=example.com smart link functionality?

Presently we've set up a URL shortener at our organization to point https[:]//go[.]example[.]com/account to http[:]//myapps[.]microsoft[.]com/example[.]com and we've got a few others set up to use ?whr=example.com (https[:]//go[.]example[.]com/sspr points to https[:]//passwordreset.microsoftonline.com/?whr=example[.]com for example)

I'd love to be able to do something like https[:]//myworkaccount.microsoft.com/?whr=example.com or https[:]//myworkaccount.microsoft.com/example.com and and have it take you directly to our organization branded login endpoint like the rest of our smart links do, rather than having to first enter johnsmith@example.com  and then being sent to the branded login.

[Loganathan Venkatesan]

Thank you for posting this and this is really useful. I'm facing issue in accessing the myaccess.microsoft.com for the newly created users, it redirects to office.com website. 

@Brian Tirch , Any idea why this is behaving like this?

Regards,

Loganathan

[Ecrofirt]

Hi there. I'm the same poster as Admin O'Meara above, just posting from my regular account now.

I was able to resolve my question above by adding in a new URL parameter to the My Urls.

Here's the way to have the myworkaccount.microsoft.com link direct you to your tenant's login without first bouncing you through the generic Office.com login:

https://myworkaccount.microsoft.com/security-info?tenant=XXXX-XXXX-XXXX-XXXX-XXXX where you replaces the Xs with your tenant ID from Azure AD. It worked line a charm for us in places where the ?whr= parameters no longer worked.

I know this might not be useful to everyone, but as I found a solution to my problem I wanted to let others know.