GSA - Web content filtering - Custom blocked page
Hello everyone, I have a quick question. I just tested the 'Web Content Filtering' of Global Secure Access. However, in Microsoft's documentation, two processes are mentioned for displaying blocked sites (related to HTTP and HTTPS). I wanted to know if it is possible to create a custom page (for example, adding the company logo, indicating the reason for blocking such as the associated web category, etc.). I tried to search, but no documentation related to this is available (or at least I couldn't find it). Thanks in advance for the help!
Get a list of "Other organizations you belong to" from all users
Is it possible to get a list of all organizations where users of the own tenant are invited as guests? It's pretty easy and straight forward to get a list for my own organizations (https://myaccount.microsoft.com/organizations). But I don't find any option to get this list for all AAD users. And is it possible to leave organizations on behalf of my users?Join Merill Fernando and other guests for our Identity and Network Practitioner Webinar Series!
This October, we’re hosting a three-part webinar series led by expert Merill Fernando for Identity and Network Access practitioners. Join us as we journey from high-level strategy to hands-on implementation, unifying identity and network access every step of the way. Each session builds on the last, helping you move from understanding why a unified approach matters to what are the foundations to get started, and finally to how to configure in practice. The goal is to equip you with actionable skills, expert insights, and resources to secure your organization in a unified, Zero Trust way. Register below: Identity and Network Security Practitioner Webinar Series | Microsoft Community HubHow to manage external admins in a secure environment
Are you requiring your admin users to work from managed and compliant devices? Then how do you deal with external admin users working from their own devices? Do you exclude them from your conditional access policies? Or is there a better way? Today, we’ll compare three options for providing access for external admins: regular user accounts, guest accounts, or through GDAP. We’ll compare them by looking at them from three perspectives: least-privilege access to permissions, the user experience, and our main problem today, device compliance. Read my new blog post to find out! https://myronhelgering.com/how-to-manage-external-admins-in-a-secure-environment/How to give admin consent for an application only for the specific user who is asking for permission
We want to control consent to enterprise applications and therefore switched to: "User consent for applications: Allow user consent for apps from verified publishers, for selected permissions (Recommended)" This works as expected, and now most of the times a user wants to access to an application an admin consent request is generated. When I accept the admin consent request, the application is granted access on behalf of the whole organization. I don't like this behavior, because now the application has access to potentially too much data. Is it possible to use the "admin consent required" restriction, but only to grant access to the user asking for it? It seems to be possible with PowerShell, but it would be nice to use the Microsoft Entra Portal to achieve that.
New Blog | Introducing Restricted Management Administrative Units in Microsoft Entra ID
We’re excited to share the public preview of restricted management administrative units, a new role-based access control (RBAC) feature in Microsoft Entra ID. Read the blog here: Introducing Restricted Management Administrative Units in Microsoft Entra ID - Microsoft Community HubCross tenant SQL Server Authentication using B2B Collaboration
Introduction The purpose of this article is to detail the proof of concept developed to showcase that existing SQL resources hosted in various Azure service models and leveraging Azure AD authentication methods (users, service principals, certificates, etc…) at Company A can have authentication succeed if such authentication methods are initiated by identities (Users) in the new company B tenant. Architecture Overview Company B has Azure SQL instances and SQL Server VMs hosted on tenant A Company B needs to carve out, for business reasons, and move into their own Azure Tenant. Company B cannot move those servers immediately because of on-premises dependencies that will cause unacceptable downtime during a move. Company B needs to validate that if they migrate their users to their own Azure tenant and, as such, identities reside in the new Tenant B Azure tenant, those users will be able to authenticate to the Azure SQL instances and Azure SQL servers located in the Tenant A B2B Collaboration Configuring cross-tenant access settings for B2B collaboration will allow the Company B identities to be invited as guest users to the Company A tenant. Using the external identities cross-tenant access settings to manage the collaboration between the two tenants. These settings determine both the level of inbound access and the level of outbound access for invited users. Default Settings Default cross-tenant access settings apply to all external tenants for which you haven't created organization-specific customized settings. Default settings for Company A Default Settings for Company B Organization Settings Adding the organization will configure a specific Azure AD organization. Any Azure AD organizations not listed here will use the default settings. Adding Company B as an organization to Company A will override the default settings and the defined settings for inbound and outbound settings will take precedence. Adding Company A as an organization to Company B will override the default settings and the defined settings for inbound and outbound settings will take precedence. Organization settings for Company A Organization settings for Company B Inbound Access Settings With inbound access settings, you select which external users and groups will be able to access the internal applications you choose. Specify the users that will be allowed to be invited from the Company B tenant to be added as guests in the Company A tenant. Define the users by adding the Object ID of each user. Define a group by adding the Object ID of the group. Any user not added in the inbound access settings cannot accept the invitation and will be blocked. B2B Collaboration inbound settings for Company B organization on Company A tenant As it’s a one-way trust from Company B to Company A. We will be blocking any inbound access coming from the Company A users. Users from the Company A cannot be invited and added as guests in the Company B tenant. B2B Collaboration inbound settings for Company A organization on Company B tenant Outbound Access Settings With outbound settings select which of your users and groups will be able to access the external applications you choose. As it’s a one-way trust from Company B to Company A, outbound access will be blocked coming from the Company A users. B2B Collaboration outbound settings for Company B organization on Company A tenant Specify the users that will be allowed to be invited from the Company B tenant to be added as guests in Company A tenant. Any user not added in the inbound access settings cannot accept the invitation and will be blocked. B2B Collaboration outbound settings for Company A organization on Company B tenant Guest Users You can invite guest users (Company B Users) to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest user must then redeem their invitation to access resources using the invitation email they received. The guest user will appear on Azure AD with a UPN and an Identity as external Azure AD user. SQL Cross-Tenant Permissions To grant your invited users’ permissions to access SQL databases, you can add them to a security group with access to the database(s). Granting an individual invited user access to SQL databases can be done by connecting to the SQL database instance using SQL admin rights, selecting the database, and run the following query: *Make sure to use the UPN of the invited user as it appears in Company A tenant. The user is added to Company A directory with a user principal name (UPN) in the format emailaddress#EXT#@domain, for example, user_CompanyB.onmicrosoft.com#EXT#@companyA.onmicrosoft.com, where: user_CompanyB.onmicrosoft.com is the email address invited from user_CompanyB directory #EXT# is the external identifier companyA.onmicrosoft.com is the organization from which you sent the invitations. CREATE USER [user_CompanyB.onmicrosoft.com#EXT#@companyA.onmicrosoft.com] FROM EXTERNAL PROVIDER And you user will appear in the Users security section of the database Try to access the database using the invited user’s credentials, to verify a successful sign in Summary In summary, B2B collaboration access settings secured a trust relationship between the two tenants for successful cross-tenant SQL authentication.
License delegation to Role Based groups
Hello good people! I have recently encountered an issue with delegating licenses to role based groups. It has worked for the duration of whole 2022. I have used this feature to cover my PIM/PAG groups with the correct licensing. Today when i was going to create these groups in a new tenant (which i do every month) i was unable to. Something must have changed recently and i can not find any information on it. Usually i had the "licensing" blade enabled under the group (i still do for regular groups). So instead i went into the specific licens in Azure AD and chosed "group assigned", there i could see my previous added role-based groups, but when i try to add a new one they are grayed out with "Role assignable groups are not allowed." on them. All i could find was an update to MicrosoftDOCS on github to get the documentation changed: https://github.com/MicrosoftDocs/azure-docs/pull/102870/commits/eab96510be5331bc665872e29c54a681c41137d3 (from 17 dec 2022) Do anyone have any additional information on what have changed, when and why? Im wondering how i should cover these groups now with the licensing. Maybe its now automatic? (All Role-based groups are automatically assigned P1 to members and if converted to PIM/PAG, it gets a P2 licenses for members?). Thank you!
