Identity
117 TopicsHow to disable option to stay signed in
The option for users to choose to stay signed in to Office 365 is a potential security problem. We have MFA turned on, but if users stay signed in another person may access the tenant if the computer is left unattended or is hacked. It was possible to turn this option off in Company Branding in AAD until the latest (preview) version of Company Branding was released. For some reason that feature is not available in the latest version. I assume I can revert to the previous version, and then turn it off, but when doing that, I receive a warning that it may have negative consequences for SharePoint Online, but it doesn't say what those consequences are. So, my questions are: 1. Can I turn it off by reverting to the previous version of Company Branding and what are the consequences? 2. Is it possible to achieve the same result in another way? PowerShell or Conditional Access maybe?42KViews1like4CommentsWindows AD account password expired but user can still send/receive email and use Teams
Hi. I recently discovered that some users with expired AD passwords are still working as if nothing has changed, which caught me by surprise. All the users affected do not use the VPN on a regular basis, or sign into Office 365. They all use desktop office for their email (Outlook) and chats (Teams). We are all still working from home. It appears as if a user is only challenged to update their expired password once they physically authenticate against the domain controller(s). But what if they never do? This means a user with an expired password will continue to send/receive emails and send chats in Teams regardless of when their password expired, unless they perform some form of "logon". I ran a PowerShell script to elucidate more and found that we have dozens of users in this boat. Some users have passwords that expired YEARS ago! Is this by design? In that the password expiration attribute is pointless until said account actively connects or authenticates to the domain? Why is the "expiration" attribute not part of the user SID? I'm baffled. We have on premise domain controllers which syncs out to Office 365 via ADSync and this is syncing fine with no errors, including password sync. Any help appreciated.Solved32KViews0likes2CommentsAzure AD SSPR Password write back issue
Hi all, A company I work for have issues with the reset password function with AD Connect. In the SSPR audit logs in Azure AD, we face on 'Reset password (self-service)' the status reason 'OnPremisesAdminActionRequired', with a follow up event log within the AD connect server: event ID: 33004 with error "hr=80230626, message=The password could not be updated because the management agent credentials were denied access" I face this issue before and this was causing because the AD DS connector account did not have the right permissions. In this case this is not. What I have done so far: - Updated AD Connect from 2.0.89.0 to 2.0.91.0 - enforced TLS 1.2: https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Freference-connect-tls-enforcement&data=04%7C01%7CRicardo.van.der.Linden%40wortell.nl%7C99649d63055b44e871c308d9ec7ff08b%7Cb1a6616c94734cab82b6b6affeed3e12%7C1%7C0%7C637800856524039043%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=GRdHd0Swz7JMK45OAg4Z0MmOC2TwvwT6iu%2BlSbiIC%2BY%3D&reserved=0 - Checked AD DS connecter account 'MSOL_xxxxxxxx' permissions: https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fauthentication%2Ftroubleshoot-sspr-writeback%23verify-that-azure-ad-connect-has-the-required-permissions&data=04%7C01%7CRicardo.van.der.Linden%40wortell.nl%7C99649d63055b44e871c308d9ec7ff08b%7Cb1a6616c94734cab82b6b6affeed3e12%7C1%7C0%7C637800856524195272%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=eUD%2Fdx9FTc0VvcjXxvGksfS30ZD9SKsbl9LQK1d1eA0%3D&reserved=0 - the user do not have the options 'password never expires' or 'user cannot change password' configured - Let AD connect talk to another DC dc02 instead of dc01 - Checked connection to SSPR service from DC's : Test-NetConnection -ComputerName ssprdedicatedsbprodscu.servicebus.windows.net -Port 443 - The action 'Change password (self-service)' are successful (via my account portal) , only action 'Reset password (self-service)' face this issue (via passwordreset.microsoftonline.com) -- both use the same OnPremisesAgent ->> AADConnect Have anyone a idea what else I can try more? Regards, RicardoSolved25KViews0likes13CommentsAZ-500: Microsoft Azure Security Technologies Study Guide
The AZ-500 certification provides professionals with the skills and knowledge needed to secure Azure infrastructure, services, and data. The exam covers identity and access management, data protection, platform security, and governance in Azure. Learners can prepare for the exam with Microsoft's self-paced curriculum, instructor-led course, and documentation. The certification measures the learner’s knowledge of managing, monitoring, and implementing security for resources in Azure, multi-cloud, and hybrid environments. Azure Firewall, Key Vault, and Azure Active Directory are some of the topics covered in the exam.22KViews4likes3CommentsProtecting your user identities
Explore Microsoft identity security features. From password attacks to token replay, we will guide you through the technologies we have in place to help defenders like yourselves mitigate, investigate and use up to date best practice to protect your users and business. This session is part of the Microsoft Secure Tech Accelerator. RSVP for event reminders, add it to your calendar, and post your questions and comments below! This session will also be recorded and available on demand shortly after conclusion of the live event.18KViews8likes22CommentsOffice 365 MFA using code sent to email, instead of getting request on Microsoft Authenticator
I am working on a tenant which have 400++ sites, and we need to force this permission settings for external user sharing:- Set the share permissions on all sites to allow for only external users if they are invited by email and requires MFA for a code sent to their email to authenticate So is this something we can achieve, to force the MFA code to be sent to email rather than mobile phone? Second question, If the answer to the above question is Yes, then will this need to be done on the site level or on the tenant level? If this need to be set on each site separately, then can we do this using Power shell, where we can loop through all the sites inside the Power-shell, but how we can set this setting using Power shell?Solved18KViews0likes1CommentUsing Azure AD B2C as an identity provider in Power Pages
Azure AD B2C provides a highly customizable User Experience to suit and blend with your brand seamlessly. Allowing you to customize every page when a user signs up, signs in, and modifies their profile information, providing a native look and feel that follows your web, mobile, and other applications.16KViews3likes1Comment