Questions tagged [entra-id]
Microsoft Entra ID, formerly known as Azure Active Directory, is a cloud-based platform for handling identity and access management, identity lifecycle, and identity governance workflows.
622
questions
0
votes
0
answers
18
views
How does Azure determine the directory on logon and where is this documented?
On logging on to Azure (for example when going to portal.azure.com), a simple email address is enough for Azure to determine which Entra directory should be looked into to determine the method of ...
0
votes
0
answers
19
views
Azure Entra Proxy images load on Edge but not Chrome Authentication Issue
I've noticed an odd issue that occurs only on Chrome, but not on Edge.
We have a web app server (IIS) and an image server. Both are accessed externally by users via an Azure Entra Proxy service.
-if ...
0
votes
0
answers
75
views
AD FS doesn't do MFA enrollment properly for non-English browsers
We have an on-premise AD FS 2019 server for SSO, connected to Azure AD (sigh, now Entra ID) for MFA. We closely followed this documentation when setting things up, and it has worked well for some time ...
0
votes
0
answers
73
views
Having Trouble Excluding the Company Portal App In Entra Conditional Access, It does not exist
I need to exclude Intune Company Portal from Conditional Access so that a user can sign into it. Otherwise they get the message that their sign in was successful but they cannot access it. I already ...
0
votes
0
answers
47
views
Verify a JWT Token issued by Entra AD App Registration in Asp .NET core
I right now have an Entra/Azure AD App registration that is being used by a small Angular SPA to authenticate it to .net core APIs.
when I decode the JWT the iss is
"iss": "https://sts....
0
votes
0
answers
45
views
Windows11: How do I find out exactly where SAML-WebLogIn on Windows fails after redirect back to Windows?
I managed to enable federated Logins for our Microsoft tenant so that if you login to, say, office.com and enter your username (e.g. "[email protected]") you're then redirected to our Keycloak ...
-1
votes
1
answer
140
views
Proper way of connecting to third party Outlook calendars
We are doing an Outlook integration where we have an app for meeting rooms and we want to connect to other companies meeting rooms which were configured in Outlook. If someone reserves a meeting room ...
0
votes
0
answers
241
views
Entra ID (Azure AD) - Account Login Fail (Password Incorrect) After Joining Entra ID (Adding work account)
I have a windows 11 desktop with a local administrator account and added a work account using the Entra ID link on the join prompt (following a MS docs article to the letter).
The join was successful, ...
0
votes
0
answers
61
views
Transform multiple Group Claim values into a single comma-separated string in Entra ID
We've created a new Enterprise Application in our Entra ID (cloud) for connecting to a third-party SaaS solution. Part of their requirements is that we need to supply a claim "teams", whose ...
3
votes
1
answer
216
views
Configuring passwordless authentication in Microsoft Entra ID
I've been working with conditional policies to lab up scenarios for deploying passwordless authentication and have been unable to figure out the best approach for new users.
If you create a policy for ...
0
votes
1
answer
69
views
Addressing 'Insufficient Access' When Blocking Senders in Outlook M365
Whenever I block a sender in the Outlook M365 desktop app by right-clicking on an email and selecting "Block Sender" to move it to junk email, an error occurs in AD/Entra Connect, indicating ...
1
vote
0
answers
335
views
Intune error 80180014 enrolling Windows 10 laptop
I'm trying to use Microsoft Intune for the first time. I have an A3 license which includes Intune and Entra ID/Azure Premium P1. I have Directory Sync running on one of our servers to sync our local ...
0
votes
1
answer
50
views
Grant Azure Enterprise App role to B2B external group
In the "External Identities" section of MS Entra, in "Cross-tenant access settings" I've added an Organization and in "Inbound access", "B2B collaboration", I'...
0
votes
0
answers
21
views
Azure AD B2C: Cannot disable federated accounts
In an Active Directory B2C Tenant, all users that have a federated identity only are shown in the Azure Portal as "Enabled: No". Still, they can sign in. Also, changing the property using ...
1
vote
2
answers
278
views
New MS Entra MFA users with AD FS not correctly bypassing MFA requirement to allow initial ProofUp
I'm preparing to onboard a new set of users for MFA authentication with Entra/AD FS, and running into some trouble (thankfully still during the testing phase!)
The environment is an on-premise AD/AD ...
1
vote
0
answers
450
views
Entra Id (AAD) certificate based authentication (CBA) client certificate validation failed ("invalid request") error
I'm trying to get CBA to work according to this article:
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication
I created a self-signed CA for testing ...
0
votes
0
answers
138
views
Migrating from Windows Server 2008 R2 to Azure AD
Windows Server 2008 R2 (I am aware that it is out of support) Active Directory Domain Controller and file server.
I am considering migrating users and files to Azure AD. Our users currently have ...
0
votes
2
answers
638
views
Azure AD Connect says my User is synced, but it isn't
I use Azure AD Connect to sync Users, Computers and Groups from my local Active Directory to Azure. Before I set up Azure AD Connect, every User already existed in local AD and in Azure AD, so I had ...
0
votes
0
answers
107
views
OpenVPN setup with MS authenticator
I have set up openvpn with active directory authentization in our company.
Now I set up microsoft atuhenticator (in pam.d with pam_unix.so and pam_google_authenticator.so).
It is working fine.
Is some ...
1
vote
2
answers
693
views
Azure AD/Entra-ID, syncing single domain on-prem environment, to single Azure tenant with multiple exchange mailbox domains
We currently have our Azure tenant, with the verified domain "superiorproducts.com".
We also have our on-prem traditional AD domain, which is "supprod.local", with 4 domain ...
-1
votes
1
answer
123
views
Setting up school wifi network with SSO linked to azure AD without local server
I am trying to restrict school Wi-Fi usage to staff and students. In addition would like to get user-wise usage data. Our current Wi-Fi network and access points are built on Cisco Access points and ...
0
votes
1
answer
156
views
Azure CLI `AZ LOGIN` ERROR: "Found multiple accounts with the same username"
I'm getting this error whenever I try to login to Azure via the CLI. Here are the details:
PS C:\Users\MyName> az login
Please select the account you want to log in with
(Now I get a popup ...
0
votes
0
answers
691
views
Azure AD - Intune device mismatch, not joined properly
I have something of a mess on my hands. When these devices were joined, or "registered" with Azure AD, they had already been through OOBE and had local accounts created on them. I realize ...
0
votes
0
answers
153
views
Resetting user password from hybrid ad desktop without azure writeback
Within an environment with a "local" ad setup with its on directly connected desktops as well as having an azure AD with a connection between the two ADs, password writeback is not to be ...
0
votes
0
answers
28
views
Is `id_token_signing_alg_values_supported` administrated by Microsoft or the tenant's administrators?
I have created a custom OIDC authorizer for a AWS API Gateway (REST). It currently support tokens signed using the RS256 algorithm, and will otherwise fail.
The .well-known OIDC endpoint lists the ...
0
votes
0
answers
43
views
Why am I not able to revoke GraphAPI Permissions in Graph Explorer Sandbox?
When I go to https://developer.microsoft.com/en-us/graph/graph-explorer and log in with my Azure account, I cannot revoke access to mail.send:
And am presented with this message:
"You require ...
4
votes
1
answer
695
views
How can I design conditional access policies for geofencing that allow single user country exceptions?
In AzureAD, I have a global conditional access policy (cap) that prevents users from accessing their accounts from non approved countries (I do realize this is not an accurate/reliable means of ...
0
votes
0
answers
95
views
In an Azure Web App how can I bypass authentication for internal API endpoint calls?
I have an Asp.Net Core application running in an Azure Web App and I need it to be able to call itself.
Part of a long-running process in the app needs to be able to open a connection to https://my-...
0
votes
1
answer
64
views
No events after Audit Detailed Directory Service Replication GPO applied to DC
I have created GPO for Audit Detailed Directory Service Replication and applied to DCs. But no events in log, like: 4928(S, F): An Active Directory replica source naming context was established.
4929(...
1
vote
1
answer
219
views
Should I use one admin email account to join all computers to Azure Ad
I have a scenario where the client has no on-premises AD and wants to use Azure AD. Now my first question is, should I use one account like [email protected] to join all the computers to Azure AD and once ...
0
votes
0
answers
223
views
Adding multiple tenants with Microsoft Partner Center
I am working to get two Azure tenants associated through the partner center. The two global admin accounts being used by the administrator do not have the same email address, but are both set to ...
0
votes
0
answers
178
views
Is the Global Administrator role required to manage Enterprise State Roaming in Azure AD?
As a new system admin, I was provided with access to some standard role assignments from the 365 admin center, which include the following:
Authentication Policy Administrator
Exchange Administrator
...
0
votes
0
answers
198
views
Does Azure AD Temporary Access Pass work on Hybrid Join
I have setup Temporary access pass, conditional access, temporary access authentication method and web sign in. I am only able to get this to work if I logon through a Azure AD joined computer. If I ...
2
votes
0
answers
43
views
Microsoft account locks everytime PC goes to sleep, user cannot change password
In this case I'm a frustrated user asking as my company (who shall remain nameless) IT department seems unable to diagnose the issue with this, and my own web searching can't find anything either.
My ...
1
vote
1
answer
1k
views
Azure equivalent for logon script or Group Policy to launch programs on user login
We have a tool (portable exe) that runs from an on premises server in a traditional domain that launches on user login via GP (and can also run from logon script). It references a location on the ...
2
votes
1
answer
828
views
Hybrid Azure AD Join - Not joining correctly
Another day, another Hybrid Azure AD Join issue.
Having set up Hybrid Join, it looked like it was working. The device I onboarded via autopilot was created in "on-prem" AD, was in Azure AD, ...
0
votes
1
answer
58
views
Hybrid AD Joined and Autopilot
I've been working on setting up our Autopilot onboarding with our Hybrid AD. I have managed to join a device to the domain successfully, but I have noticed some differences against when we do this ...
0
votes
1
answer
190
views
hybrid azure ad join devices
We have a hybrid active directory set up between our servers held in a DC and our Azure AD.I am currently working on the configuration of our Autopilot and Intune deployment. At the moment we deploy ...
0
votes
0
answers
63
views
Which service principal role will provide the minimum permissions necessary to automate installation of a website certificate?
I wish to grant a third-party application API access to my Azure tenant for purposes of installing a TLS certificate on a certain website ("App Service," in Azure terminology).
However, ...
0
votes
0
answers
176
views
Access multple tenants as Global Administrator with principal from single tenant (PowerShell 7)
My goal here is to be able to use the service principal of an Enterprise Application in source tenant to authenticate towards/connect to destination tenants as Global Administrator.
In source tenant I ...
0
votes
0
answers
477
views
Integrate PowerDNS into Windows DC's DNS, use same domain
We have the following setup:
dc01.our.domain 10.10.10.101
dc02.our.domain 10.10.10.102
phpipam.our.domain 10.10.10.250
We need all our hosts to use our DC's as the primary and secondary DNS servers, ...
0
votes
1
answer
220
views
How to configure the Azure AD 'Security Group' membership policy in the Azure AD Portal?
In my Azure AD tenant that has an active Azure AD Premium 2 license, I have enabled Self-Service Group Management.
Users are able to create security groups and then configure the membership policy ...
0
votes
0
answers
587
views
azure app registration redirect uri not working for a spa application but only for one server
m a little stumped on this and just wondering if anyone had any ideas.
I have registered in azure an application with 3 spa redirects It is a .net core react application
http://localhost:3000/eem/ (...
0
votes
1
answer
395
views
Convert AD-integrated DNS zones to Primary DNS zones
We have inherited a domain with 2008 R2 domain controllers running DNS on them. We want to add Windows Server 2019 to the domain then demote the 2008 R2 domain controllers to just DNS servers. We are ...
0
votes
1
answer
145
views
No longer able to forward emails from exchange online
I have a couple of developers helping me out with a project so I've given them access to my teams so we can collaborate. I am in Office 365 and exchange online.
Last summer I set up forwarding on ...
0
votes
1
answer
329
views
Unable to sign in to Microsoft Learn
As of around February 2023, only when our forward web proxy solution is enabled, signing in to a Microsoft Account (personal / consumer) works fine in general (e.g., at https://login.live.com/) except ...
0
votes
0
answers
110
views
Cannot delete Azure Active Directory Tenant
I'm attempting to delete an unused Azure Active Directory Tenant.
All initial checks have passed:
However, when I click "Delete", I get a popup saying "Unable to delete tenant. Known ...
2
votes
2
answers
599
views
Provision Azure AD from Google Workspace
When trying to set up Azure AD and Google Workspace integration it seems that all suggested setups assume that one want to use AD to administrate users. We are using Google Workspace as our source of ...
0
votes
0
answers
116
views
How to define custom Azure AD Conditional Access policy for blob service on specific Storage Account?
Good day,
Is it possible to define a Conditional Access policy regulating access to a blob service of a particular Storage Account?
Let's say, our general policy is too restrictive (say, it requires ...
-1
votes
1
answer
998
views
why active directory computer object has machine password?
The active directory computer object (ie machine object) also have password , as far as i know only the user's logon name and users password is used when logging into the domain joined computer ? But ...