App Registration API Permissions how to limit to ONE Site Collection
I would like to have my developer work on an app to connect to information in our SharePoint Online Site Collection /sites/"x" and yet the access doesn't need to be to the WHOLE Tenant! I tried with Microsoft Graph I had the same issue with SharePoint as I want to see can I limit it to just /sites/"x" instead of ALL! Is there a way to limit access to one or multiple site collections instead of ALL of them? Thank you.
How to correctly implement Entra ID Connect sync when users exists in Entra ID as cloud users?
Hi Everyone, I have a small on-premises exchange server 2016 setup which we're planning to make Hybrid. We do have a O365 environment (Business Standard Licensed) which is independent as users signed in for Teams and SharePoint Online usage. We now have to implement Entra ID Connect (Azure AD Connect) to facilitate Exchange Hybrid deployment. My questions are: 1. These users currently exists in Entra ID as cloud accounts (as they've been using Cloud Apps such as Teams, SPO with their Windows 10 joined to Entra ID) will there be any issues when sync is configured ? (i.e. duplicate of identity errors etc..) 2. What's the best approach to implement Entra ID Connect and sync these user from AD to Engtra ID without having to remove these accounts from Entra ID? Any inputs are highly appreciated ! Thank you!
Migrate from Hybrid Active Directory to Azure Active Directory
Hi everyone, Recently, our server running the Windows Domain Controller (our infrastructure is a hybrid AD) has suddenly stopped working. Thus, we are looking for a more permanent fix to replace the domain controller with Azure AD. However, we are lost on what we must do to migrate from a system like Azure active directory. Our domain controller has our domain name and employee details (name/email/passwords/client groups) and we wish to keep them when migrating to Azure AD. I just wanted to clarify whether is there any way or instructions guiding how to migrate from a virtual machine's domain controller to an Azure AD or a more cloud-based solution. Thanks, everyone.
Get a list of "Other organizations you belong to" from all users
Is it possible to get a list of all organizations where users of the own tenant are invited as guests? It's pretty easy and straight forward to get a list for my own organizations (https://myaccount.microsoft.com/organizations). But I don't find any option to get this list for all AAD users. And is it possible to leave organizations on behalf of my users?Cross tenant SQL Server Authentication using B2B Collaboration
Introduction The purpose of this article is to detail the proof of concept developed to showcase that existing SQL resources hosted in various Azure service models and leveraging Azure AD authentication methods (users, service principals, certificates, etc…) at Company A can have authentication succeed if such authentication methods are initiated by identities (Users) in the new company B tenant. Architecture Overview Company B has Azure SQL instances and SQL Server VMs hosted on tenant A Company B needs to carve out, for business reasons, and move into their own Azure Tenant. Company B cannot move those servers immediately because of on-premises dependencies that will cause unacceptable downtime during a move. Company B needs to validate that if they migrate their users to their own Azure tenant and, as such, identities reside in the new Tenant B Azure tenant, those users will be able to authenticate to the Azure SQL instances and Azure SQL servers located in the Tenant A B2B Collaboration Configuring cross-tenant access settings for B2B collaboration will allow the Company B identities to be invited as guest users to the Company A tenant. Using the external identities cross-tenant access settings to manage the collaboration between the two tenants. These settings determine both the level of inbound access and the level of outbound access for invited users. Default Settings Default cross-tenant access settings apply to all external tenants for which you haven't created organization-specific customized settings. Default settings for Company A Default Settings for Company B Organization Settings Adding the organization will configure a specific Azure AD organization. Any Azure AD organizations not listed here will use the default settings. Adding Company B as an organization to Company A will override the default settings and the defined settings for inbound and outbound settings will take precedence. Adding Company A as an organization to Company B will override the default settings and the defined settings for inbound and outbound settings will take precedence. Organization settings for Company A Organization settings for Company B Inbound Access Settings With inbound access settings, you select which external users and groups will be able to access the internal applications you choose. Specify the users that will be allowed to be invited from the Company B tenant to be added as guests in the Company A tenant. Define the users by adding the Object ID of each user. Define a group by adding the Object ID of the group. Any user not added in the inbound access settings cannot accept the invitation and will be blocked. B2B Collaboration inbound settings for Company B organization on Company A tenant As it’s a one-way trust from Company B to Company A. We will be blocking any inbound access coming from the Company A users. Users from the Company A cannot be invited and added as guests in the Company B tenant. B2B Collaboration inbound settings for Company A organization on Company B tenant Outbound Access Settings With outbound settings select which of your users and groups will be able to access the external applications you choose. As it’s a one-way trust from Company B to Company A, outbound access will be blocked coming from the Company A users. B2B Collaboration outbound settings for Company B organization on Company A tenant Specify the users that will be allowed to be invited from the Company B tenant to be added as guests in Company A tenant. Any user not added in the inbound access settings cannot accept the invitation and will be blocked. B2B Collaboration outbound settings for Company A organization on Company B tenant Guest Users You can invite guest users (Company B Users) to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest user must then redeem their invitation to access resources using the invitation email they received. The guest user will appear on Azure AD with a UPN and an Identity as external Azure AD user. SQL Cross-Tenant Permissions To grant your invited users’ permissions to access SQL databases, you can add them to a security group with access to the database(s). Granting an individual invited user access to SQL databases can be done by connecting to the SQL database instance using SQL admin rights, selecting the database, and run the following query: *Make sure to use the UPN of the invited user as it appears in Company A tenant. The user is added to Company A directory with a user principal name (UPN) in the format emailaddress#EXT#@domain, for example, user_CompanyB.onmicrosoft.com#EXT#@companyA.onmicrosoft.com, where: user_CompanyB.onmicrosoft.com is the email address invited from user_CompanyB directory #EXT# is the external identifier companyA.onmicrosoft.com is the organization from which you sent the invitations. CREATE USER [user_CompanyB.onmicrosoft.com#EXT#@companyA.onmicrosoft.com] FROM EXTERNAL PROVIDER And you user will appear in the Users security section of the database Try to access the database using the invited user’s credentials, to verify a successful sign in Summary In summary, B2B collaboration access settings secured a trust relationship between the two tenants for successful cross-tenant SQL authentication.How to give admin consent for an application only for the specific user who is asking for permission
We want to control consent to enterprise applications and therefore switched to: "User consent for applications: Allow user consent for apps from verified publishers, for selected permissions (Recommended)" This works as expected, and now most of the times a user wants to access to an application an admin consent request is generated. When I accept the admin consent request, the application is granted access on behalf of the whole organization. I don't like this behavior, because now the application has access to potentially too much data. Is it possible to use the "admin consent required" restriction, but only to grant access to the user asking for it? It seems to be possible with PowerShell, but it would be nice to use the Microsoft Entra Portal to achieve that.
Admin roles for external collaboration settings not working
We are attempting to grant access to the external collaboration settings in Entra to facilitate adding and removing domains. We've gone over all the documentation and tried every single role that supposedly grants this access, but none of them work. Those underlined below have some sort of domain changing access according to Microsoft's documentation. Even with all these roles, the screen remains completely grayed out. Even on the Entra side of things, we can see all the respective roles assigned to the user, but it still doesn't work. Are we missing something here? Maybe some sort of dependency role for these other ones to work?
