Skip to content

Multi-stage approval for privileged roles using Azure AD Identity Governance

Privileged Identity Management is a great feature within Azure AD to provide just-in-time access to your admin roles and Azure resources. But some roles may require an extra level of security, for the simple fact the role is highly privileged, and (hopefully) rarely used. With the current capabilities, you are able to activate an approval step, but that is only limited to one approver. In this article, I will show you how you can use Azure AD Identity Governance to create… 

KB – mobile phone number not in sync Azure AD Connect

This is a knowledgebase item. Hope it helps you out someday. The issue Some users reported that the mobile phone number in Azure Active Directory / Office 365 was different from the number in on-prem Active Directory. Even though these users were synced with Azure AD Connect, the mobile phone attribute was no longer in sync. Cause After some investigation, it seemed that the affected accounts were previously edited with the Set-MsolUser cmdlet from the MSOnline PowerShell module. To make… 

Download Intune PowerShell scripts with Graph Explorer

This quick post will show an easy method to fetch your PowerShell scripts after you have uploaded them using the Intune management portal. Unfortunately, the portal does not provide a UI to download the script content as soon as you hit that save button. Graph Explorer to the rescue There are multiple ways to do this using PowerShell scripts. If you want to bulk download all the scripts in your tenant, I recommend using this method, created by Oliver Kieselbach.… 

10 tips to secure your identities in Microsoft 365

I was recently invited by the Dutch Virtual Desktop User Group to present a session about Identity Security. Now, because this was in Dutch (my native language), I decided to do a ‘short’ write-up in English, so everybody can benefit from this. I shared 10 tips on how to secure your identities, but not before I showed how easy it is to phish Office 365 credentials, even if they are protected with MFA. You can also check the recording in… 

Get started with multi-stage access reviews in Azure AD

  • Azure AD
  • 6 min read

Access reviews, part of the Azure AD Identity Governance module, is a great feature to reduce the risk associated with stale access assignments. Administrators can use Azure Active Directory (Azure AD) to create access reviews for group members or application access. Reviews can be delegated to group owners, managers, or specific users, but there is also the self-review option where users can review their own access. By default, this is a single-stage process. Now in preview, there is the option… 

KB – SelfServicePasswordReset write-back problem – error hr=80230818

This is a knowledgebase item. Hope it helps you out someday. Now, since you landed on this page, I assume you’ve got the following issue: Azure AD SelfService Password Reset worked like a charm for quite some time. All of the sudden it stopped working, and you have no idea why. You have checked the permissions on the service account, and all looks good. You are in a hybrid setup, and use password write back. All checkmarks are green. Azure… 

ADMX ingestion for Centero Agent and Carillon Client using Intune

This article is about the ADMX templates for Centero Agent and Carillon client, that you can use to configure the settings on your endpoints. Microsoft Endpoint Manager (Intune) is capable of ADMX ingestion, but this process can be complex sometimes. This article will explain the ADMX ingestion and has a couple of examples, on how to handle various settings. ADMX ingestion Before the client can use settings from the ADMX template, you need to ingest them with Microsoft Endpoint Manager/Intune… 

Access reviews for Azure AD directory roles

This blog post is for all those organizations out there with stale, overprivileged accounts having standing access to Azure AD roles, that nobody knows about, far away from the HR systems and on/offboarding processes. This is often a huge problem and the elephant in the (security) room. Now, what can we do about it? I assume you are already aware of Azure AD Privileged Identity Management, and the great features that it brings. In short: with PIM you can reduce… 

Microsoft 365 self-service using Power Apps

This article was originally posted on the Microsoft 365 PnP Blog. I was inspired by this post from Loryan Strant, that used Microsoft Forms to add users to an Azure AD group so that they were upgraded to Windows 11. With that in mind, I created a mock-up and posted it on Twitter. Based on the reactions, I added this idea to my ToDo list. Fellow MVP Albert-Jan Schot also replied, and I asked him if he would like to… 

Act on group membership changes in Azure Active Directory

Did you ever want to act on a change in group membership in Azure AD, for example, when a user is added to or removed from a specific group? I have found an easy way to do this with the use of Power Automate. You can use this for a lot of use-cases. What do we need? For this solution, we use the Office 365 Groups connector in Power Automate that holds the trigger: ‘When a group member is added…