Azure Ad on JanBakker.tech

Company branding and custom CSS in Azure Active Directory

Wed, 21 Jun 2023 18:32:01 +0000

Company branding in Azure AD is a nice feature that allows administrators to prettify the sign-in experience for their end-users. It also comes with the possibility of ingesting custom CSS code.

A client recently moved from ADFS to Azure AD, and they wanted to update the sign-in screen to look more like the good old ADFS theme. Now, this is pretty easy to do, but by default, the background image comes with an overlay to improve contrast and legibility.

Send an email on a new Azure MFA method registration

Fri, 02 Jun 2023 09:50:08 +0000

I’ve done quite some Azure MFA projects over time (and counting), and as we mainly focus on the technical side, there are also practical sides to consider. Every project has its own approach and challenges, and more importantly: the user is impacted more or less, and that asks for some guidance.

Authenticator Lite - Approve Azure MFA prompts with the Outlook app

Tue, 14 Mar 2023 12:28:09 +0000

Microsoft released a new feature where the Outlook mobile app now has some of the Microsoft Authenticator App features onboard. Users can now enroll for Azure MFA using just their Outlook mobile app. No additional installation of the Microsoft Authenticator app is needed. This preview brings both push notifications and TOTP to the Outlook mobile app. Users are prompted for enrollment or can manually register their app to work with a Microsoft 365 account once this feature is enabled.

System-preferred multifactor authentication in Azure AD. Don't settle for less.

Fri, 03 Mar 2023 14:39:38 +0000

A new feature has popped up in Azure AD: System-preferred multifactor authentication (MFA). This will allow administrators to enforce the most secure method for Azure MFA. For example, if a user has multiple methods registered, the most secure method will be prompted first. How do I know what method is the strongest, you may ask? Here is the current order from most to least secure methods, currently supported in Azure Active Directory:

Azure Active Directory Identity Governance – Azure AD Entitlement Management

Sun, 20 Dec 2020 18:34:00 +0000

In this series, we take a look at Azure Active Directory Identity Governance. This premium feature provides you with all the tools that you need to take and keep control over your (external) identities and access to roles, resources, applications, and groups. In short, Identity Governance gives you three ways to do this:

Azure Active Directory Identity Governance – Privileged Identity Management

Wed, 09 Dec 2020 19:46:30 +0000

Azure Active Directory Identity Governance - Access Reviews

Mon, 23 Nov 2020 18:53:14 +0000

License on-demand with Power Automate and Azure AD

Sun, 18 Oct 2020 15:49:41 +0000

Most organizations are using group-based licensing in Azure Active Directory. This is often integrated with the onboarding process of the users. But there are some use cases where you have some non-standard licenses attached to your tenant that you hand out on demand. You could still use group-based licensing, but users are added manually to the group.

Microsoft Secure Score Series – 15 – Do not expire passwords

Sun, 06 Sep 2020 18:13:53 +0000

In this series, I’ll be covering the Microsoft Secure Score improvement actions. Although Microsoft does a great job on telling you what to do, some actions have a much bigger impact and need to be balanced against business needs. Some actions might not even have value for your organization. In the end, Microsoft Secure Score is meant to strengthen your security, not a contest to reach the highest score possible. In this series, I’ll pick out random actions and try to make it as simple as possible, backed with notes from the field.

Use Power Automate or Logic Apps to keep an eye on your licenses

Sat, 27 Jun 2020 18:37:43 +0000

I guess we’ve all been there; you ran out of licenses in your Azure AD or Office 365 tenant. Despite you hang out in your admin portal every day, you were still taken by surprise when you discover an issue, caused by a license shortage. More often this is caused by the fact that the people who are responsible to buy these licenses, are not always IT admins. So it’s easy to run out of licenses. Time to get this fixed.

Microsoft Secure Score Series – 09 – Do not allow users to grant consent to unmanaged applications

Sat, 30 May 2020 19:30:39 +0000

Use Graph API data in Power BI using Logic Apps

Sat, 09 May 2020 12:50:34 +0000

Some things in the modern connected world seem so common that you just assume it’s possible by nature. Getting your Microsoft Graph API data into Microsoft Power BI for example. That must be easy peasy right? Well….

When I start looking for ways to do this, I assumed there was a builtin connector available in Power BI that I could use. Guess what? There is not (yet). There is a connector for the Microsoft Security Graph, but that one “only” gives back the data from the security products. Just good to know that it’s out there, but that’s not what we’re looking for.

What admins should know about the combined registration portal for Azure MFA and Self Service Password Reset

Sat, 02 May 2020 12:06:20 +0000

This post is outdated. There is a new way to manage authentication methods#

Learn more

The (long) title pretty much reveals the purpose of this blog post. This one was on my to-do list for a while now, and now the combined registration portal is General Available, the time was there. In my previous MFA-related blogs, I always encouraged my readers to turn on the combined registration portal, even when it was in public preview. But if you start using this portal, there are quite some settings that can change the user experience of the registration. And that’s mainly what this blog post is about. Let’s see how each setting reflects to the end user.

Use Power Automate for your custom "dynamic" groups

Wed, 01 Apr 2020 19:52:46 +0000

Azure AD Dynamic Groups#

Dynamic groups in Azure AD are awesome. I use them a lot. Dynamic groups can create groups based on attributes. For example, you can create a group that includes all the users from the Sales Team. The query for the group would look like this:

Microsoft Secure Score Series – 04 – Ensure all users can complete multi-factor authentication for secure access

Fri, 27 Mar 2020 21:19:07 +0000

How to publish on-premises applications and protect them with MFA

Fri, 13 Mar 2020 18:56:31 +0000

Using Azure Application Proxy you can publish your on-premises web applications in a secure way. Combining this with Conditional Access, you can configure MFA for example. Now Coronavirus is hitting us hard, you might have to take a look at this feature.

Microsoft Secure Score Series – 02 – Require MFA for administrative roles

Wed, 11 Mar 2020 20:25:28 +0000

Azure AD tenant branding; size does matter!

Wed, 26 Feb 2020 19:39:57 +0000

Earlier today, I read this article from Alex Simons about the change that is coming to the Azure AD sign-in experience. In this change the background image of the login screen is being replaced for a smaller one, so the page loads faster. Good news for the low bandwidth offices out there! The article states: If you’ve configured a custom background image in Company Branding for your tenant there is no change to your users. That got me thinking.

Require trusted location for MFA and SSPR registration

Sat, 22 Feb 2020 20:02:48 +0000

This article shows how you can block MFA and SSPR registrations from untrusted locations using Azure AD Conditional Acces.

When you want to enable MultiFactor Authentication and Self Service Password Reset for your users, they need to register their security settings first. Since the combined portal arrived, users can do this easily in just one place. Using this combined portal is also a requirement in order to make this possible. Although this portal is still in preview, it has great user experience and wizards run smoothly.