Chapter 4. Building and Configuring a Suitable Azure AD

This chapter explains how to configure a suitable Azure AD tenant based on the decided cloud identity architecture. You will learn how to configure and manage users, groups, roles, and administrative units in order to provide a user and group-based application and self-service access, including audit functionality.

In this chapter we are going to cover the following topics:

• Implementation scenario overview

• Implementing a solid Azure Active Directory

• Creating and managing users and groups

• Assigning roles and administrative units

• Providing user and group-based application access

• Activating password reset self-service capabilities

• Using Standard Security Reports

• Integrating Azure AD join for Windows 10 clients

Implementation scenario overview

After completing the following configuration tasks, you will see the rich functionality of Microsoft Azure in the field of IAM for cloud identities. You will be able to demonstrate the different capabilities in your own Microsoft Azure environment. This guidance will focus on the most important feature sets to give you an idea of how to improve your design considerations. We will use the default directory, which we call domain.onmicrosoft.com, from now on. Domain stands for your desired name. Be aware that this name will be visible in various applications, such as SharePoint online and Skype for business, to the end user. We recommend using the company name without the company form, for example inovit GmbH will be inovit.onmicrosoft.com. The configuration will be the base for additional, different scenarios in this book. For this reason, we will use an Azure, Enterprise Mobility Suite, and an Office 365 subscription so as to use all the available features...

Implementing a solid Azure Active Directory

The first step we need to do is to get an Azure Active Directory tenant. There are many ways to reach this target. The following four examples build the main entry points:

• Start with an Office 365 subscription, http://bit.ly/1RVpFXe

  

• Use an Azure subscription associated with a Microsoft Account:

• A typical start from an MSDN subscription:

  

• Use an Azure subscription associated with an organizational account:

  

• Starting from scratch, http://bit.ly/1R2oIfx

We will start with the last option. Let's go on and configure our personal Azure AD tenant.

Configuring the requirements

First of all, we need to configure the prerequisites to work through this guide. You need to have a Windows 10 Enterprise client machine in a workgroup configuration. We recommend using a freshly installed Windows 10 Enterprise virtual machine. We need a Windows 10 device to use the Azure AD Join mentioned later in the book. If you are not able to access the Volume Licensed or MSDN...

Creating and managing users and groups

In the next steps, we will connect to our Azure AD and create test users and groups.

1. Start the Azure AD PowerShell console.

2. Connect to Azure AD.

3. Type $msolcred = get-credential and enter your fresh user ID.

4. Type connect-msolservice -credential$msolcred.

5. Start the script C:\Configuration\HRExports\HRImportToAAD.ps1.

   Tip

   Remember the Execution Policy settings of your PowerShell. More information can be found at: http://bit.ly/1EWLG03. Alternatively, you can also use connect-msolserviceto connect.

   After starting the script, go directly to https://manage.windowsazure.com with your [e-mail] credentials. Select the user's section under your Azure Active Directory. You should find the users from the HireUsers.csv  file.

   

6. Next, we will create three example groups to represent the company organization with the script C:\Configuration\HRExports\AddOrgGroups.ps1.

   

7. Open https://portal.office.com and navigate to Admin |Active Users; you will see your...

Assigning roles and administrative units

Top delegate tasks are used to create administrative units and assign roles for specific tasks. In this configuration, we will generate an HR and we will assign the role of managing user accounts to manager of the HR department.

Connecting to Azure Active Directory

First of all, we need to connect to our Azure AD with the PowerShell cmdlet Connect-MsolServicewith the [e-mail] user.

Creating an administrative unit

Type New-MsolAdministrativeUnit- DisplayName'HR' -Description'HumanResourcesUsers' to create the HR.

Adding users to an administrative unit

Next, we need to add the users of the HR department to the HR.

1. Type the following commands;

   $au = Get-MsolAdministrativeUnit -searchstring 'HR' 
   $user1 = Get-MsolUser -UserPrincipalName      
       '[e-mail]'
   $user2 = Get-MsolUser -UserPrincipalName
      '[e-mail]'
   

2. Test your variables, for example:

   

3. Type the following commands to...

Providing user-and group-based application access

In the next section, we need to configure a typical workplace that a user can access under the Access panel UI (myapps.microsoft.com). We will assign the applications to users and groups to see the different capabilities. These steps don't contain a scenario with user provisioning.

Note

Use the following links to integrate Salesforce at the end of this section:

Tutorial: http://bit.ly/1fQer6q

Video: http://bit.ly/1WCpf7V

Salesforce Sandbox: http://sforce.co/1O5XPS6

Adding several applications from the application gallery

In the first step, we will add some example applications for a typical workplace in Azure AD under the APPLICATIONS section. After adding the application, we will assign the accounts to provide the access.

1. Build a list of applications, such as the following, and assign all groups to access the applications, except the one with user provisioning.

   

2. Note the formatting differences depending on whether it is with or without user...

Activating password reset self-service capabilities

In this section, we will configure the password reset capabilities of Azure AD to reduce support costs and introduce 24/7 availability. We add no restrictions to the service, and we only require one verification option to reset the password. To verify the reset, we will use the Mobile Phone and Alternate Email Address methods.

1. The next option we will activate is that the user will be forced to register their mobile phone number or an alternative e-mail address.

2. We can also activate an option so that a user can unlock his account over this functionality.

   

Configuring notifications

In this section, we will configure notification options so that the administrator will be notified if anomalous sign-ins or administrator password resets happen. Configure the notifications as in the following screenshot:

Forcing password reset information

In this section, we will test our newly-configured feature and will see the required registration scenario...

Using standard security reports

In this section, we will configure and simulate some typical events that get reported in the Azure AD Reports section.

Configuring - sign-ins after multiple failures

1. Configure in sign ins after multiple failures to 10.

   

2. Lock out a user account with a limit of 10 wrong login warnings.

3. You should receive the following message:

   

4. Next, we need to unblock the user account

Possible ways to unblock a blocked user account

The following are two methods to unblock a user:

• Method 1: Wait 15 minutes

• Method 2: Unlock your account with the password reset process

Possible ways to unblock a blocked user account for administrators

• Method 1: Reset the user's password; as an Office 365 or Azure AD admin, perform a password reset for the user.

• Method 2: Make sure that the user is allowed to sign in. Sign in to the Office 365 portal as an admin.

  • Locate the user and then open the settings for that user

  • Under Set sign-in status, click Allowed and then click Save

• Method 3: Reset the user's...

Integrating Azure AD join for Windows 10 clients

In this section, we will configure the Azure AD join functionality and join our first Windows 10 client to Azure AD, with a maximum of five devices per user.

Join your Windows 10 client to Azure AD

1. Log in to your newly-installed Windows 10 client machine and navigate to Settings.

   

2. We will sign in with [e-mail]. Check your branding information.

   

3. Click through the next section and join the client.

4. Check the new status Organization as your Azure AD Directory name.

   
   

Verifyng the new joined Windows 10 client

Log in to https://manage.windowsazure.com as [e-mail] and view under the User | Devices section the newly joined Azure AD device.

Login and adopt security policies

1. Log in to the Windows 10 client with the credentials of [e-mail] and click through the security policy configuration. Click Enforce these policies.

   

2. Click through the PIN setup and finish the process

   

Testing the user...

Configuring a custom domain

After configuring the most relevant feature sets of your Azure AD tenant. We will prepare a registered domain name to set the configuration to a productive environment.

Note

This step is optional, because you need to register an official domain at a registrar in your country.

1. Click ADD A CUSTOM DOMAIN and see the verification options; note that you are the owner of the domain.

   

2. Add a TXT entry to your DNS zone to verify the domain.

3. Click the Verify button on your Azure portal.

   

4. After a successful verification the new DOMAIN NAME will appear under DOMAINS.

   

Configuring Azure AD Domain Services

To integrate a legacy application based on NTLM and Kerberos authentication in an Azure IaaS scenario, we need to configure the Azure AD Domain Services. In this section, we will configure only the basic service and will integrate an active example application in a hybrid scenario.

The first step is to create a new group called AAD DC Administrators; the group needs to have this exact name. Afterwards, you need to add your administrator account [e-mail] to the newly-created group.

Add the admin account as a member of the group.

Creating a virtual network

When enabling Azure AD Domain Services, you will need to specify which Azure virtual network is being used. We use the name LeanoAzureNet and a 192.168.x.x/20 as the range to configure the network.

Please note that you must satisfy the following criteria:

• The virtual network belongs to a region supported by Azure AD Domain Services. See the region page for details.

• Ensure the virtual...

Summary

After working through this implementation scenario, you will be able to configure and manage a suitable Azure AD tenant with the most important tasks. You will also be able to integrate Windows 10 and Office 365 to build a productive workforce for your users. Do not worry about the absence of functionalities such as MFA or other capabilities. We will integrate them in the following chapters, as they need to be explained in the context of their role in a hybrid identity infrastructure. In the next chapter, we will discuss the concepts required for providing an effective way to transition in an advanced scenario.