identity management

603 Topics

Issues with Microsoft Authenticator not popping up Approval message
We have recently implemented MFA with a conditional access policy. We turned off the ability to receive texts/calls and are forcing the Authenticator app. This is causing issues when users need to re set up the account in the Authenticator app. I have had multiple scenarios this week where the Microsoft Authenticator app has stopped displaying the approve/deny message. The end users try to fix the issue themselves and will remove their accounts from the app and try to reenroll by going to myapps.microsoft.com and restarting the setup process. The problem lies in that even though they are visiting the portal from devices that are excluded from MFA via conditional access (Compliant/Hybrid AD Joined) the myapps.microsoft.com portal is still enforcing MFA to log in. Since they have removed their account from the application they can not authenticate to the portal. There is no alternate method since Phone/Text are disabled. In order to get the end user back into the portal I have to go to the regular MFA Setup page, enable phone calls or texts, enable and enforce MFA on the end user, and they can finally get in to re-set up the account. All of this could be fixed with a one time bypass for cloud!
Solved
Robert Woods
Oct 06, 2018 Place Microsoft Entra
1MViews
1like
40Comments
Google Authenticator app & Office 365 MFA
Is it possible to use the Google Authenticator iOS app with Office 365 MFA instead of the Microsoft Authenticator app? I tried adding to Google Authenticator with both QR code and manually but got failures each time.
Bryan Callicott
Sep 21, 2017 Place Microsoft Entra
276KViews
5likes
31Comments
ADFS vs Azure AD for SSO
Hi there Bit of a newbie question but what is the difference between using Azure AD and ADFS as a SAML identity provider? We have on-premises AD and ADFS servers and a federation with Azure AD using AD Connect. We want to integrate with a SaaS app that is listed in the Azure AD application gallery but I can't find any definitive information that guides me whether it would be better to use Azure AD or ADFS as the identity provider. Any help would be appreciated. Regards Neil
Solved
Neil Manley
Apr 24, 2017 Place Microsoft Entra
271KViews
0likes
10Comments
Powershell CMDlets for MFA Settings?
Does anyone know if there are Powershell Cmdlets available to allow inspection of a user's MFA settings related to which verification options were configured and which option is considered primary? I am mostly focused on Office 365, but I think that this is an Azure AD question in general. Here's the use case that I am considering. We have a number of Office 365 users with MFA enabled. There was configuration guidance given at setup time, but not all users chose to follow that guidance. Specifically, many chose SMS notification, but our facility is notorious for poor cellular reception. Mobile app is preferred in this environment. In some cases, they deviated from the suggested method intentionally and, other times, unintentionally. This leads to support calls and it would be very useful for the support tech to know up front which methods are configured and which is the user's primary verification method. I've looked at the Azure AD module, but haven't found what I'm looking for yet. Thanks, Andy Baerst
Solved
ABaerst
Feb 13, 2018 Place Microsoft Entra
236KViews
4likes
30Comments
Migrating On Prem AD to Azure AD and doing away completely with On Prem AD
One of my customers is presently using Azure AD and they are syncing with their On Prem AD using Azure AD Connect. The authentication being used is PHS. Now, they would like to get rid of their On Prem AD completely and would like to know what are the implications in doing so and how users would be affected during the cutover. Since there is no straightforward migration option of On Prem AD to Azure AD completely, what options do i have here ? Will it help to setup an IaaS VM in Azure and promote it as a domain controller and sync it with On Prem Domain Controller? Or we can make use of Azure AD DS service. Any help on this would be appreciated
palchak
Mar 13, 2020 Place Microsoft Entra
135KViews
0likes
19Comments
AADSTS75011 by which the user authenticated with the service doesn't match requested authentication
We're experiencing problems with a certain application that we've registred in Azure. Sorry, but we're having trouble signing you in. We received a bad request. AADSTS75011 by which the user authenticated with the service doesn't match requested authentication method 'Password Protected transport' Situation: user logs in (Citrix-environment) IE11 is auto-started. Default startpage = our intranet on SharePoint Online (at this moment SSO kicks in and the user will be logged in automatically in office.com / SharePoint Online) User starts new tab in IE11, navigates to the application's login-url (external SaaS application) and poof; the error shows up When user starts Chrome at this moment and navigates to the application's login-url again, he WILL be logged in automatically. The software-developer says it has something to do with our Azure settings or Windows environment, but we have a lot more applications registred the same way where this error never occurs. Does anyone have a clue on how to fix this? It looks like the SaaS application does not accept Windows Integrated authentication?
Josse Huizen
May 22, 2018 Place Microsoft Entra
100KViews
0likes
9Comments
Azure AD Connect is not synchronizing Computer objects
Hi, I installed and configured Azure AD Connect like a few times before but now Computer objects are not synchronizing. They are included in filtering but there is not export to Azure AD, no error or warning, nothing. Azure AD Connect Troubleshooter just saying "Object is not available in AAD Connector Space" (everything else is green/ok). I just reinstalled it but without success. Any ideas? Kind regards Patrick
Solved
Patrick B
Jul 24, 2019 Place Microsoft Entra
96KViews
0likes
15Comments
Official recommendation to UPN equal to SMTP/email address
I know that the UPN should be set to the same value as the email address for many reasons, but I can't find the official documentation from Microsoft where they recommend this. Can someone please point me to it?
Solved
Dean_Gross
Jul 11, 2019 Place Microsoft Entra
84KViews
1like
4Comments
Federation between two Azure AD tenants
Is there a way i can federate identities between two Azure AD tenants to manage Azure Resources? Following is the scenario i have at hand. Organization - ABC has two business units X and Y. Both these units want separate Azure AD tenants however IT staff will be the same to manage Azure resources so need to provide access to subscriptions created under both the tenants to IT staff. I tried to look at AD B2B option, but thought it would be a bit complex to implement. Was looking for sometime similar to trust relationship in ADDS. Any direction would be helpful.
Solved
kulman
Apr 10, 2020 Place Microsoft Entra
82KViews
0likes
6Comments
Azure AD Conditional Access - Require Domain Joined Device
Does the ‘Domain Join’ checkbox in Azure AD Conditional Access require Azure AD Domain join, or does it mean on-premises Domain Join? The attached screen shot says ‘Not Azure AD Domain Join’ but the documentation shown in the screen shot seems to contradict this.
Solved
Joe Stocker
Jul 18, 2017 Place Microsoft Entra
72KViews
0likes
24Comments