Mastering Identity and Access Management with Microsoft Azure: Empower users by managing and protecting identities and data, Second Edition

First of all, we need to set a functional administrative workstation to work through this guide. You need to have a Windows 10 Enterprise client machine in a work group configuration. We recommend using a freshly installed Windows 10 Enterprise virtual machine. We need a Windows 10 device to use the Azure AD Join later in the book. If you are not able to access the Volume Licensed or MSDN version, you can use the Enterprise Evaluation version at https://www.microsoft.com/en-gb/evalcenter/evaluate-windows-10-enterprise.

In the code section of this chapter, you will find the following cmdlets to install the needed administrative tools on your client machine, basically, the Azure AD, MSOnline and the Azure Resource Manager PowerShell modules:

Install-Module -Name AzureADPreview

Install-Module -Name MSOnline

Install-Module AzureRM

Connect-MsolService
# Provide your global administrator credentials
# View your assigned subscriptions
Get-MsolAccountSku
# View all actual users
Get-MsolUser

New-MsolUser -UserPrincipalName "jochen.nickel@inovitcloudlabs.onmicrosoft.com" -DisplayName "Jochen Nickel" -FirstName "Jochen" -LastName "Nickel" -UsageLocation "CH" -LicenseAssignment "inovitlabs:ENTERPRISEPREMIUM","inovitcloudlabs:EMSPREMIUM"

Get-MsolUser -UserPrincipalName jochen.nickel@inovitcloudlabs.onmicrosoft.com | fl

Connect-AzureAD
Get-AzureADUser -all $true | where userprincipalname -eq jochen.nickel@inovitcloudlabs.onmicrosoft.com | fl

Example script set

In the HRImportToAAD.ps1 script, the following important variables will be used:

$domain = Get-MsolDomain | where {$_.Name -notlike "*mail*"}
$dir = "C:\Configuration\HRExports"

# Also configure your PowerShell Execution Policy to RemoteSigned with the following cmdlet
# More information about this topic can be found under http://bit.ly/1EWLG03
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

The domain variable will contain the domain.onmicrosoft.com name of your Azure AD default directory. We use this directory and not a registered domain name for different steps. At the end of the chapter, we will change to a custom domain so that you can explore the needed tasks. As you can see, the dir variable contains the path to the scripts and the simple HR export file called NewHire.csv. The contoso.com domain in the file will be replaced with your domain name, stored in the domain variable.

The NewHire.csv file contains the following demo user set, which will be used in future configurations to demonstrate the different functionalities:

userPrincipalName,DisplayName,FirstName,LastName,password
Don.Hall@contoso.com,Don Hall,Don,Hall,Pass@word1
Ellen.Adams@contoso.com,Ellen Adams,Ellen,Adams,Pass@word1
Jeff.Simpson@contoso.com,Jeff Simpson,Jeff,Simpson,Pass@word1
Brian.Cox@contoso.com,Brian Cox,Brian,Cox,Pass@word1
Doris.Sutton@contoso.com,Doris Sutton,Doris,Sutton,Pass@word1
Petro.Mitchell@contoso.com,Petro Mitchell,Petro,Mitchell,Pass@word1

With the next step, we will assign an EMS E5 plan license to our global administrator, admin@domain.onmicrosoft.com. The Office 365 E5 was already assigned through the creation process. Later in the chapter, we will assign licenses through dynamic group membership, which is an Azure AD Premium P2 license feature:

License assignment operation

Click Assign and add the EMS E5 plan license to your global administrator. The expected result will be as follows:

Assigned license overview

We will get the correct message that we have no active subscription assigned to this user ID. Next, sign up for a Microsoft Azure subscription.

Most companies like to see how they can apply their corporate identity to Azure services. With a few easy steps, you can show the most important capabilities. To add custom branding, you need to use an Azure Active Directory Premium 1, Premium 2, Basic, or Office 365 license. With the following simple example, you can see what you can customize. You can provide the customizing in different languages to address your own or your customers' needs. These configuration tasks are always a good starting point in a demo or a proof of concept. You are free to use your pictures and designs for this setup:

Customized portal example

The first thing we are going to change is the Name of the directory in the properties section. Just enter your desired name. We used INOVITCLOUDLABS by inovit GmbH. You can also provide your own technical and privacy contacts and links on the login page:

Azure AD tenant properties

Click Customize Branding, and you will see the following options. So that you can prepare your pictures and brands, we summarized the help information provided in Microsoft TechNet:

Azure AD portal-customizing options

Next, you will see a configuration summary.

Summary and recommendations of the help information 

The following section provides you with several capabilities and summarizes the most important corporate identity features to customize your environment:

• Banner logo: Choose between the following options:
  • Displayed on the Azure AD sign-in page and myapps.microsoft.com
  • PNG or JPEG
  • Can't be taller than 36 pixels or more extensive than 245 pixels
  • Recommendation—no padding around the image    
• Sign-in page text body: Choose between the following options:
  • Appears at the bottom of the Azure AD sign-in page
  • Unicode text only with a maximum length of 256 characters
  • Use to communicate the phone number to your help desk or include a legal statement
  • Recommendation—don't add links or HTML tags
• Sign-in page background image: Choose from the following options:
  • Displayed on the side of the Azure AD sign-in page
  • PNG or JPEG
  • Recommended 1420 x 1200 with a supported file size of 300 KB (max. 500 KB)
  • Keep the exciting part in the top-left corner (image gets resized and cropped)
• Username hint: Hint text that appears to users if they forget their username:
  • Unicode, without links or code
  • Maximum 64 characters

• Show option to remain signed in: Let your users remain signed in to Azure AD until explicitly signing out:

Login experience

Note

You are also able to do some extensive customization with the help of the following article https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/customize-branding.

Your expected result should be this:

Portal-customizing effect

Now that we have provided an essential company branding, we can start to create and manage users and groups.

To provide group management by the manager of a department, we will assign the following users as owners of their department groups:

Group - user assignment

Do the same for:

Now that we have configured the owners, we will start to delegate management.

The default configuration of Azure AD allows an owner of a security or Office 365 group to manage the group members based on the data owner concept in the Azure AD Access Panel and the Azure portal.

Furthermore, you can limit this functionality, based on your needs:

Group options in Azure AD

Log in as Don.Hall@domain.onmicrosoft.com to https://myapps.microsoft.com. Click on the HR group and add Ellen.Adams@domain.onmicrosoft.com to the HR group:

Group view in Azure AD access panel UI

Review the Join policy under Edit details.

In the next section, we will configure the group self-service options.

Another request may be that users need to be able to create request-based security or Office 365 groups, for instance for projects or distribution groups. For this, they need the capability of an approval process. You can provide this functionality by activating the option under the group management general section. The feature set requires Azure Active Directory Premium:

Self-Service Group Management options

An Office 365 group includes a distribution list but also consists of these shared tools:

Create the sales internal news group as an Office 365 (distribution group)

Log in as Doris.Sutton@domain.onmicrosoft.com to https://myapps.microsoft.com and create the Sales Internal News group as an Office 365 group. Check that the Group policyshows This group is open to join for all users:

Azure AD access panel UI - group creation

Review the Join policy of your newly created group:

Group dialog - Azure AD access panel UI

In your Azure AD, under Groups, you will also find the newly created group:

Group overview - Azure AD access panel UI

Now, as the group owner, we change the group to request a managers' approval with the group policy setting:

Group editing dialog

Test the new configuration and log in as Don.Hall@domain.onmicrosoft.com to https://myapps.microsoft.com. Navigate to groups. Choose Sales Internal News:

Join group dialog

Join the Sales Internal News group and type a Business justification, click Request, and the process should be started.

Log in as Doris.Sutton@domain.onmicrosoft.com to https://myapps.microsoft.com.

Check your inbox. You should have received the join request mail and a notification, shown in the Access Panel UI.

Click on this request and approve it:

Group join - Notifications

Note

Note: Next, you will see the group members of the Sales Internal News group.

Log in as Don.Hall@domain.onmicrosoft.com on https://myapps.microsoft.com.

Check your inbox, and you should have received a successful approval message:

Approval message - group membership

Check your group membership, and you should be a member of the Sales Internal News group:

Group management in Azure AD access panel UI

Next, we will configure dynamic group memberships.

In the next section, we will configure straightforward dynamic group memberships to use the department attribute to add users to their department group and build up a dynamic licensing assignment. Group-based licensing currently does not support groups that contain other groups (nested groups).

As the admin@domain.onmicrosoft.com, choose the Accounting group, navigate to properties, and change the membership type to Dynamic User.

Create a simple rule, department Equals (-eq) Accounting:

Dynamic group membership rule configuration

Set the department attribute (profile section) on the accounting users Brian Cox and Jeff Simpson to Accounting:

Filling user attributes for dynamic group usage

The member should be added automatically. Check the group membership and verify the two new members:

Freshly calculated dynamic group membership

Next, we will provide an automatic licensing solution.

Create the following security group:

Group properties dialog

Under Licenses | Products, assign the Office 365 E5 plan. Don't choose any assignment options at the moment:

Group assignment options

Wait until the membership has updated and check the license assignment for Don.Hall@domain.onmicrosoft.com.

You will see that the user gets the license through a direct and group-based assignment:

License assignment overview

In the next section, we will configure role assignments to administrative units.

First of all, we need to connect to our Azure AD with the PowerShell cmdlet Connect-AzureAD for the admin@domain.onmicrosoft.com user.

Use the following cmdlets to create the HR [AU]:

New-AzureADAdministrativeUnit -Description "Human Resources Users" -DisplayName "HR"

View the expected output:

Newly created administrative unit

Next, we will add the related users.

Next, we add the users of the HR department to the HR [AU]. Use the following cmdlets to do this:

$HRAU = Get-AzureADAdministrativeUnit -Filter "displayname eq 'HR'"
$initialDomain = (Get-AzureADDomain)[0].Name
$HRUser1 = Get-AzureADUser -Filter "UserPrincipalName eq 'don.hall@$InitialDomain'"
$HRUser2 = Get-AzureADUser -Filter "UserPrincipalName eq 'ellen.adams@$InitialDomain'"
Add-AzureADAdministrativeUnitMember -ObjectId $HRAU.ObjectId -RefObjectId $HRUser1.ObjectId
Add-AzureADAdministrativeUnitMember -ObjectId $HRAU.ObjectId -RefObjectId $HRUser2.ObjectId
Get-AzureADAdministrativeUnitMember -ObjectId $HRAU.ObjectId | Get-AzureADUser

The output of the preceding command is as follows:

Newly added users overview

Next, we will use the scoping options.

In the next step, we assign the user account administrator role. Verify available roles with the following cmdlet:

Get-AzureADDirectoryRoleTemplate

Now, we enable the user account administrator role with the following cmdlet:

Enable-AzureADDirectoryRole -RoleTemplateId fe930be7-5e62-47db-91af-98c3a49a38b1

Set variables and assign the user to the role:

$admins = Get-AzureADDirectoryRole
foreach($i in $admins) {
    if($i.DisplayName -eq "User Account Administrator") {
        $uaAdmin = $i
       }
    }

$HRUA = Get-AzureADUser -Filter "UserPrincipalName eq 'Don.Hall@$InitialDomain'"
$uaRoleMemberInfo = New-Object -TypeName Microsoft.Open.AzureAD.Model.RoleMemberInfo -Property @{ ObjectId = $HRUA.ObjectId }
Add-AzureADScopedRoleMembership -RoleObjectId $uaAdmin.ObjectId -ObjectId $HRAU.ObjectId -RoleMemberInfo $uaRoleMemberInfo

The output of the preceding command is as follows:

User Account Administrator assignment

Next, we will test our configuration.

Open a new PowerShell and connect with the Connect-MsolService command to the Azure AD, and log in with Don.Hall@domain.onmicrosoft.com credentials.

Modify a user account assigned to the HR administrative unit:

Set-MsolUser -UserPrincipalName ellen.adams@domain.onmicrosoft.com -Department HR

Verify your modification:

Get-MsolUser -UserPrincipalName ellen.adams@domain.onmicrosoft.com | select Department

Next, we will protect an administrative account with the Privileged Identity Management (PIM) features of Azure AD Premium P2. We recommend using Azure MFA to protect your administrative accounts, if you don't want to invest in Azure AD Premium P2.

In the next step, we will assign the LinkedIn application to Don Hall, with the company credentials. Don Hall will not be able to see the credentials. So, if he leaves the company, the credentials are still protected.

Add the LinkedIn application from the application gallery and assign Don Hall to access this application:

Application - Users and Groups assignment

Next, we provide valid LinkedIn credentials. If you don't have a LinkedIn account, register a demo one:

Azure AD Credentials store

The following options for working with credential sets are available:

Test this behavior with the user account, assign applications to groups, and define login information.

In the next steps, we do the same for groups, such as an HR group that uses these groups to get news from an individual Twitter channel:

Filling the Azure AD Credentials store for application access

Add the Twitter app from the application gallery. Assign the HR group and configure the credentials. Check the application at https://myapps.microsoft.com with a user of the HR group.

Now, we can configure the self-service application management.

In this section, we allow users to add their applications to their workplace under https://myapps.microsoft.com to enjoy the Single Sign-On feature. Under your Azure AD in the Configure section, navigate to Enterprise applications. Activate the function shown here:

Enterprise applications management options

Log in as Ellen.Adams@domain.onmicrosoft.com to https://myapps.microsoft.com. Click Get more applications and add MailChimp. After you add MailChimp, click Manage applications and choose MailChimp.

As admin@domain.onmicrosoft.com on https://manage.windowsazure.com, you can see the newly added application under the Enterprise applications section of your Azure AD.

Configure the application, add some users, and test it!

In this section, we configure the notifications options so that the administrator will be notified if anomalous sign-ins or administrator password resets happen:

Password reset - NotificationS options

Registration enforcement

Now, we will test our newly configured feature and will see the registration scenario required for your verification options. Next, we will check the password reset.

Test the newly configured settings and log in as Don.Hall@domain.onmicrosoft.com to https://myapps.microsoft.com.

You will receive a message that you need to register for a password reset:

Authenticator app - setup procedure

Add your preferred method for Don Hall. You will receive an SMS text message, an email to your mailbox, or another of your defined response methods.

Log in as admin@domain.onmicrosoft.com to https://myapps.microsoft.com , and you will see the request for two verification options.

In the next steps, we will verify the functionality.

Open https://myapps.microsoft.com in your preferred browser and enter Don.Hall@domain.onmicrosoft.com. Click the Can't access your account? option or use the following link, https://passwordreset.microsoftonline.com, to start the password reset process. You will come into the verification process, and you need to follow the tasks. Finish the process and log in with the new password.

Log in to your freshly installed Windows 10 client machine and go to Settings. Choose Connect in the Access work or school section:

Azure AD Join process dialog

We sign in with don.hall@domain.onmicrosoft.com and join the Windows 10 client to Azure AD:

Join actions overview

Click through the Next sections and finish joining the client. Afterwards, we will check the new status. The expected result will be the connection to your Azure AD name:

Azure AD joined client message

Afterward, we will verify the Azure AD Join process.

Log in to the Windows 10 client with the credentials of don.hall@domain.onmicrosoft.com and click through the security policy configuration. Click Enforce these policies. Click through the PIN setup and finish the process, then test the user experience:

Different mail account options

After verifying the Azure AD Join, we will configure a custom domain. Be aware that you need to register a domain if you want to test the associated functionality.

To test the Domain Services, we complete the following tasks:

VM deployment configuration

Install-WindowsFeature RSAT-ADDS,DNS-Server-Tools

Azure AD Domain Services structure including synchronized objects

IIS Authentication configuration for Kerberos example application

# inovitcloudlabs represents the computer name
$ConnectorComputerAccount = Get-ADComputer -Identity inovitcloudlabs
Set-ADComputer inovitcloudlabs -PrincipalsAllowedToDelegateToAccount $ConnectorComputerAccount
setspn -S HTTP/kerb.inovitlabs.ch inovitlabs\inovitcloudlabs

Server Manager IE Enhanced Security Configuration

Application Proxy agent download and configuration

To configure the connector on the server, you need to provide a user with global administrator rights.

Azure AD App Proxy Connector group configuration options

Kerberos example configuration

Application IWA configuration

Finally, we assign some users or groups and test the application at https://myapps.microsoft.com. As a result, you should see the IIS test page. We provided a sample Kerberos-based application to Azure AD Domain Services and used the Azure AD App Proxy functionality.