Questions tagged [entra-id]

Microsoft Entra ID, formerly known as Azure Active Directory, is a cloud-based platform for handling identity and access management, identity lifecycle, and identity governance workflows.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

How does Azure determine the directory on logon and where is this documented?

On logging on to Azure (for example when going to portal.azure.com), a simple email address is enough for Azure to determine which Entra directory should be looked into to determine the method of ...
John's user avatar
  • 123
0 votes
0 answers
19 views

Azure Entra Proxy images load on Edge but not Chrome Authentication Issue

I've noticed an odd issue that occurs only on Chrome, but not on Edge. We have a web app server (IIS) and an image server. Both are accessed externally by users via an Azure Entra Proxy service. -if ...
taraz's user avatar
  • 291
0 votes
0 answers
75 views

AD FS doesn't do MFA enrollment properly for non-English browsers

We have an on-premise AD FS 2019 server for SSO, connected to Azure AD (sigh, now Entra ID) for MFA. We closely followed this documentation when setting things up, and it has worked well for some time ...
Joel Coel's user avatar
  • 13k
0 votes
0 answers
73 views

Having Trouble Excluding the Company Portal App In Entra Conditional Access, It does not exist

I need to exclude Intune Company Portal from Conditional Access so that a user can sign into it. Otherwise they get the message that their sign in was successful but they cannot access it. I already ...
Karbashi's user avatar
0 votes
0 answers
47 views

Verify a JWT Token issued by Entra AD App Registration in Asp .NET core

I right now have an Entra/Azure AD App registration that is being used by a small Angular SPA to authenticate it to .net core APIs. when I decode the JWT the iss is "iss": "https://sts....
Kevin's user avatar
  • 101
0 votes
0 answers
45 views

Windows11: How do I find out exactly where SAML-WebLogIn on Windows fails after redirect back to Windows?

I managed to enable federated Logins for our Microsoft tenant so that if you login to, say, office.com and enter your username (e.g. "[email protected]") you're then redirected to our Keycloak ...
Rhywden's user avatar
  • 101
-1 votes
1 answer
140 views

Proper way of connecting to third party Outlook calendars

We are doing an Outlook integration where we have an app for meeting rooms and we want to connect to other companies meeting rooms which were configured in Outlook. If someone reserves a meeting room ...
Michał J. Gąsior's user avatar
0 votes
0 answers
241 views

Entra ID (Azure AD) - Account Login Fail (Password Incorrect) After Joining Entra ID (Adding work account)

I have a windows 11 desktop with a local administrator account and added a work account using the Entra ID link on the join prompt (following a MS docs article to the letter). The join was successful, ...
lifostack's user avatar
0 votes
0 answers
61 views

Transform multiple Group Claim values into a single comma-separated string in Entra ID

We've created a new Enterprise Application in our Entra ID (cloud) for connecting to a third-party SaaS solution. Part of their requirements is that we need to supply a claim "teams", whose ...
LeonZandman's user avatar
3 votes
1 answer
216 views

Configuring passwordless authentication in Microsoft Entra ID

I've been working with conditional policies to lab up scenarios for deploying passwordless authentication and have been unable to figure out the best approach for new users. If you create a policy for ...
Ritmo2k's user avatar
  • 175
0 votes
1 answer
69 views

Addressing 'Insufficient Access' When Blocking Senders in Outlook M365

Whenever I block a sender in the Outlook M365 desktop app by right-clicking on an email and selecting "Block Sender" to move it to junk email, an error occurs in AD/Entra Connect, indicating ...
Pimp Juice IT's user avatar
1 vote
0 answers
335 views

Intune error 80180014 enrolling Windows 10 laptop

I'm trying to use Microsoft Intune for the first time. I have an A3 license which includes Intune and Entra ID/Azure Premium P1. I have Directory Sync running on one of our servers to sync our local ...
Daniel's user avatar
  • 253
0 votes
1 answer
50 views

Grant Azure Enterprise App role to B2B external group

In the "External Identities" section of MS Entra, in "Cross-tenant access settings" I've added an Organization and in "Inbound access", "B2B collaboration", I'...
Glen Little's user avatar
0 votes
0 answers
21 views

Azure AD B2C: Cannot disable federated accounts

In an Active Directory B2C Tenant, all users that have a federated identity only are shown in the Azure Portal as "Enabled: No". Still, they can sign in. Also, changing the property using ...
muxmuse's user avatar
  • 103
1 vote
2 answers
278 views

New MS Entra MFA users with AD FS not correctly bypassing MFA requirement to allow initial ProofUp

I'm preparing to onboard a new set of users for MFA authentication with Entra/AD FS, and running into some trouble (thankfully still during the testing phase!) The environment is an on-premise AD/AD ...
Joel Coel's user avatar
  • 13k
1 vote
0 answers
450 views

Entra Id (AAD) certificate based authentication (CBA) client certificate validation failed ("invalid request") error

I'm trying to get CBA to work according to this article: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication I created a self-signed CA for testing ...
The F's user avatar
  • 11
0 votes
0 answers
138 views

Migrating from Windows Server 2008 R2 to Azure AD

Windows Server 2008 R2 (I am aware that it is out of support) Active Directory Domain Controller and file server. I am considering migrating users and files to Azure AD. Our users currently have ...
Jargo's user avatar
  • 121
0 votes
2 answers
638 views

Azure AD Connect says my User is synced, but it isn't

I use Azure AD Connect to sync Users, Computers and Groups from my local Active Directory to Azure. Before I set up Azure AD Connect, every User already existed in local AD and in Azure AD, so I had ...
SimonS's user avatar
  • 787
0 votes
0 answers
107 views

OpenVPN setup with MS authenticator

I have set up openvpn with active directory authentization in our company. Now I set up microsoft atuhenticator (in pam.d with pam_unix.so and pam_google_authenticator.so). It is working fine. Is some ...
Dave's user avatar
  • 25
1 vote
2 answers
693 views

Azure AD/Entra-ID, syncing single domain on-prem environment, to single Azure tenant with multiple exchange mailbox domains

We currently have our Azure tenant, with the verified domain "superiorproducts.com". We also have our on-prem traditional AD domain, which is "supprod.local", with 4 domain ...
boog's user avatar
  • 240
-1 votes
1 answer
123 views

Setting up school wifi network with SSO linked to azure AD without local server

I am trying to restrict school Wi-Fi usage to staff and students. In addition would like to get user-wise usage data. Our current Wi-Fi network and access points are built on Cisco Access points and ...
user899893's user avatar
0 votes
1 answer
156 views

Azure CLI `AZ LOGIN` ERROR: "Found multiple accounts with the same username"

I'm getting this error whenever I try to login to Azure via the CLI. Here are the details: PS C:\Users\MyName> az login Please select the account you want to log in with (Now I get a popup ...
Flak DiNenno's user avatar
0 votes
0 answers
691 views

Azure AD - Intune device mismatch, not joined properly

I have something of a mess on my hands. When these devices were joined, or "registered" with Azure AD, they had already been through OOBE and had local accounts created on them. I realize ...
boog's user avatar
  • 240
0 votes
0 answers
153 views

Resetting user password from hybrid ad desktop without azure writeback

Within an environment with a "local" ad setup with its on directly connected desktops as well as having an azure AD with a connection between the two ADs, password writeback is not to be ...
Mason Kerr's user avatar
0 votes
0 answers
28 views

Is `id_token_signing_alg_values_supported` administrated by Microsoft or the tenant's administrators?

I have created a custom OIDC authorizer for a AWS API Gateway (REST). It currently support tokens signed using the RS256 algorithm, and will otherwise fail. The .well-known OIDC endpoint lists the ...
Shuzheng's user avatar
  • 429
0 votes
0 answers
43 views

Why am I not able to revoke GraphAPI Permissions in Graph Explorer Sandbox?

When I go to https://developer.microsoft.com/en-us/graph/graph-explorer and log in with my Azure account, I cannot revoke access to mail.send: And am presented with this message: "You require ...
Tikhon's user avatar
  • 97
4 votes
1 answer
695 views

How can I design conditional access policies for geofencing that allow single user country exceptions?

In AzureAD, I have a global conditional access policy (cap) that prevents users from accessing their accounts from non approved countries (I do realize this is not an accurate/reliable means of ...
Matt's user avatar
  • 670
0 votes
0 answers
95 views

In an Azure Web App how can I bypass authentication for internal API endpoint calls?

I have an Asp.Net Core application running in an Azure Web App and I need it to be able to call itself. Part of a long-running process in the app needs to be able to open a connection to https://my-...
glenatron's user avatar
  • 235
0 votes
1 answer
64 views

No events after Audit Detailed Directory Service Replication GPO applied to DC

I have created GPO for Audit Detailed Directory Service Replication and applied to DCs. But no events in log, like: 4928(S, F): An Active Directory replica source naming context was established. 4929(...
MYGMYGMYG's user avatar
1 vote
1 answer
219 views

Should I use one admin email account to join all computers to Azure Ad

I have a scenario where the client has no on-premises AD and wants to use Azure AD. Now my first question is, should I use one account like [email protected] to join all the computers to Azure AD and once ...
Vic85's user avatar
  • 93
0 votes
0 answers
223 views

Adding multiple tenants with Microsoft Partner Center

I am working to get two Azure tenants associated through the partner center. The two global admin accounts being used by the administrator do not have the same email address, but are both set to ...
Geoffrey Lee Shaw-Cullen's user avatar
0 votes
0 answers
178 views

Is the Global Administrator role required to manage Enterprise State Roaming in Azure AD?

As a new system admin, I was provided with access to some standard role assignments from the 365 admin center, which include the following: Authentication Policy Administrator Exchange Administrator ...
ShawnJJB's user avatar
0 votes
0 answers
198 views

Does Azure AD Temporary Access Pass work on Hybrid Join

I have setup Temporary access pass, conditional access, temporary access authentication method and web sign in. I am only able to get this to work if I logon through a Azure AD joined computer. If I ...
user3594093's user avatar
2 votes
0 answers
43 views

Microsoft account locks everytime PC goes to sleep, user cannot change password

In this case I'm a frustrated user asking as my company (who shall remain nameless) IT department seems unable to diagnose the issue with this, and my own web searching can't find anything either. My ...
Morvael's user avatar
  • 311
1 vote
1 answer
1k views

Azure equivalent for logon script or Group Policy to launch programs on user login

We have a tool (portable exe) that runs from an on premises server in a traditional domain that launches on user login via GP (and can also run from logon script). It references a location on the ...
SKidd's user avatar
  • 61
2 votes
1 answer
828 views

Hybrid Azure AD Join - Not joining correctly

Another day, another Hybrid Azure AD Join issue. Having set up Hybrid Join, it looked like it was working.  The device I onboarded via autopilot was created in "on-prem" AD, was in Azure AD, ...
AngryDog's user avatar
0 votes
1 answer
58 views

Hybrid AD Joined and Autopilot

I've been working on setting up our Autopilot onboarding with our Hybrid AD. I have managed to join a device to the domain successfully, but I have noticed some differences against when we do this ...
AngryDog's user avatar
0 votes
1 answer
190 views

hybrid azure ad join devices

We have a hybrid active directory set up between our servers held in a DC and our Azure AD.I am currently working on the configuration of our Autopilot and Intune deployment. At the moment we deploy ...
AngryDog's user avatar
0 votes
0 answers
63 views

Which service principal role will provide the minimum permissions necessary to automate installation of a website certificate?

I wish to grant a third-party application API access to my Azure tenant for purposes of installing a TLS certificate on a certain website ("App Service," in Azure terminology). However, ...
InteXX's user avatar
  • 765
0 votes
0 answers
176 views

Access multple tenants as Global Administrator with principal from single tenant (PowerShell 7)

My goal here is to be able to use the service principal of an Enterprise Application in source tenant to authenticate towards/connect to destination tenants as Global Administrator. In source tenant I ...
Tedd Hansen's user avatar
0 votes
0 answers
477 views

Integrate PowerDNS into Windows DC's DNS, use same domain

We have the following setup: dc01.our.domain 10.10.10.101 dc02.our.domain 10.10.10.102 phpipam.our.domain 10.10.10.250 We need all our hosts to use our DC's as the primary and secondary DNS servers, ...
Dave's user avatar
  • 326
0 votes
1 answer
220 views

How to configure the Azure AD 'Security Group' membership policy in the Azure AD Portal?

In my Azure AD tenant that has an active Azure AD Premium 2 license, I have enabled Self-Service Group Management. Users are able to create security groups and then configure the membership policy ...
Daniel's user avatar
  • 7,049
0 votes
0 answers
587 views

azure app registration redirect uri not working for a spa application but only for one server

m a little stumped on this and just wondering if anyone had any ideas. I have registered in azure an application with 3 spa redirects It is a .net core react application http://localhost:3000/eem/ (...
Bryan Dellinger's user avatar
0 votes
1 answer
395 views

Convert AD-integrated DNS zones to Primary DNS zones

We have inherited a domain with 2008 R2 domain controllers running DNS on them. We want to add Windows Server 2019 to the domain then demote the 2008 R2 domain controllers to just DNS servers. We are ...
Glenn Dalton's user avatar
0 votes
1 answer
145 views

No longer able to forward emails from exchange online

I have a couple of developers helping me out with a project so I've given them access to my teams so we can collaborate. I am in Office 365 and exchange online. Last summer I set up forwarding on ...
Zonus's user avatar
  • 203
0 votes
1 answer
329 views

Unable to sign in to Microsoft Learn

As of around February 2023, only when our forward web proxy solution is enabled, signing in to a Microsoft Account (personal / consumer) works fine in general (e.g., at https://login.live.com/) except ...
mythofechelon's user avatar
0 votes
0 answers
110 views

Cannot delete Azure Active Directory Tenant

I'm attempting to delete an unused Azure Active Directory Tenant. All initial checks have passed: However, when I click "Delete", I get a popup saying "Unable to delete tenant. Known ...
Hannah Vernon's user avatar
2 votes
2 answers
599 views

Provision Azure AD from Google Workspace

When trying to set up Azure AD and Google Workspace integration it seems that all suggested setups assume that one want to use AD to administrate users. We are using Google Workspace as our source of ...
Rohde Fischer's user avatar
0 votes
0 answers
116 views

How to define custom Azure AD Conditional Access policy for blob service on specific Storage Account?

Good day, Is it possible to define a Conditional Access policy regulating access to a blob service of a particular Storage Account? Let's say, our general policy is too restrictive (say, it requires ...
Cat Mucius's user avatar
-1 votes
1 answer
998 views

why active directory computer object has machine password?

The active directory computer object (ie machine object) also have password , as far as i know only the user's logon name and users password is used when logging into the domain joined computer ? But ...
ironmanAJ's user avatar

1
2 3 4 5
13