Skip to main content

Questions tagged [entra-id]

Microsoft Entra ID, formerly known as Azure Active Directory, is a cloud-based platform for handling identity and access management, identity lifecycle, and identity governance workflows.

Filter by
Sorted by
Tagged with
0 votes
0 answers
91 views

MacOS Intune Platform SSO not prompting to register device until Company Portal is opened

I'm deploying Platform SSO to allow our Mac users to sign into their devices without the need for a "build process", similar to autopilot on Windows. I've followed this guide and it all ...
Mark Winckle's user avatar
0 votes
0 answers
23 views

Which MS Graph permissions are Entra ID members granted by default and are they related to their assigned roles?

Consider the following Azure CLI command for fetching an access token for MS Graph after signing into the Azure: az account get-access-token --resource-type ms-graph In this case, the access token has ...
Shuzheng's user avatar
  • 439
1 vote
0 answers
38 views

How is consent recorded in Entra ID and does it ever expire?

A user may consent to permissions for an application in Entra ID, thereby authorizing the application to perform actions on behalf of the user. Furthermore, admins may consent to permissions on behalf ...
Shuzheng's user avatar
  • 439
0 votes
0 answers
26 views

How to fetch a token for MS Graph given a resource with the `User.Read` scope in its list of configured permissions using Azure CLI?

After having preauthorized the Azure CLI for an application object (resource), I often use the following command to fetch a token for the preauthorized scope(s), e.g. user_impersonation: az account ...
Shuzheng's user avatar
  • 439
-1 votes
1 answer
308 views

Entra joined device seamless SSO not working for on premise web app configured for Windows authentication on https

Our device is Entra registered and has line of sight to our Active Directory Domain Controller. We have passwordless authentication setup using FIDO security key per the following microsoft site, ...
Salman Hasrat Khan's user avatar
0 votes
0 answers
27 views

MS Azure | Cannot create administrator account

I have setup an Azure account, but under users, I can only see my account and it is marked as member. I cannot change this to admin as I do not have permissions. How can I grant admin permission to my ...
Alexis's user avatar
  • 1
0 votes
0 answers
38 views

How to implement Entra ID External authentication method with AD FS

Microsoft is introducing External authentication ID (currently in preview) in Entra and points out that the external provider is to be implemented over OID Connect. Following this, I assume we can use ...
Roman Kuznetsov's user avatar
2 votes
1 answer
857 views

Problems with Windows Hello for Business in hybrid Cloud Trust scenario, but only on Windows 10

So I went through the process of deploying WHFB. I set up all the prereqs (as far as I know) following the Cloud Trust deployment guide. I added four test machines to the test OU with the appropriate ...
THE JOATMON's user avatar
0 votes
0 answers
51 views

How to configure Entra ID app registration to return the user's email in access tokens?

How can I configure Entra ID app registrations to return the user's email in access tokens? In "Token configuration", I specify that the email should be included in access tokens. However, ...
Shuzheng's user avatar
  • 439
1 vote
2 answers
534 views

Sensitivity label works in Outlook web app but not desktop app

We are currently using M365 Business Premium licence and hence are using Azure Information Protection Premium Plan 1. We created an 'Internal' sensitivity label on compliance.microsoft.com, with "...
Vishal Bakshi's user avatar
0 votes
0 answers
157 views

Azure Entra Id vs AWS Cognito

I'm looking at migrating from AWS Cognito to Azure Entra ID. The documentation flows are unclear on using external SAML provider when users don't exist in Azure AD, and only are added on the first ...
Nicolas Smith's user avatar
0 votes
2 answers
116 views

Is it ok to just discard a certificate authority if there is only one valid certificate?

I have inherited a Windows Server 2019 domain controller on a small network (approx. 30 client pc's) with AD CS installed. I want to set up a dedicated server for AD CS since having the AD CS on the ...
Thomas's user avatar
  • 13
0 votes
0 answers
39 views

How does Azure determine the directory on logon and where is this documented?

On logging on to Azure (for example when going to portal.azure.com), a simple email address is enough for Azure to determine which Entra directory should be looked into to determine the method of ...
John's user avatar
  • 123
0 votes
0 answers
55 views

Azure Entra Proxy images load on Edge but not Chrome Authentication Issue

I've noticed an odd issue that occurs only on Chrome, but not on Edge. We have a web app server (IIS) and an image server. Both are accessed externally by users via an Azure Entra Proxy service. -if ...
taraz's user avatar
  • 291
0 votes
0 answers
86 views

AD FS doesn't do MFA enrollment properly for non-English browsers

We have an on-premise AD FS 2019 server for SSO, connected to Azure AD (sigh, now Entra ID) for MFA. We closely followed this documentation when setting things up, and it has worked well for some time ...
Joel Coel's user avatar
  • 13k
0 votes
0 answers
394 views

Having Trouble Excluding the Company Portal App In Entra Conditional Access, It does not exist

I need to exclude Intune Company Portal from Conditional Access so that a user can sign into it. Otherwise they get the message that their sign in was successful but they cannot access it. I already ...
Karbashi's user avatar
0 votes
0 answers
139 views

Verify a JWT Token issued by Entra AD App Registration in Asp .NET core

I right now have an Entra/Azure AD App registration that is being used by a small Angular SPA to authenticate it to .net core APIs. when I decode the JWT the iss is "iss": "https://sts....
Kevin's user avatar
  • 101
0 votes
0 answers
88 views

Windows11: How do I find out exactly where SAML-WebLogIn on Windows fails after redirect back to Windows?

I managed to enable federated Logins for our Microsoft tenant so that if you login to, say, office.com and enter your username (e.g. "[email protected]") you're then redirected to our Keycloak ...
Rhywden's user avatar
  • 101
-1 votes
1 answer
159 views

Proper way of connecting to third party Outlook calendars

We are doing an Outlook integration where we have an app for meeting rooms and we want to connect to other companies meeting rooms which were configured in Outlook. If someone reserves a meeting room ...
Michał J. Gąsior's user avatar
0 votes
0 answers
1k views

Entra ID (Azure AD) - Account Login Fail (Password Incorrect) After Joining Entra ID (Adding work account)

I have a windows 11 desktop with a local administrator account and added a work account using the Entra ID link on the join prompt (following a MS docs article to the letter). The join was successful, ...
lifostack's user avatar
0 votes
0 answers
136 views

Transform multiple Group Claim values into a single comma-separated string in Entra ID

We've created a new Enterprise Application in our Entra ID (cloud) for connecting to a third-party SaaS solution. Part of their requirements is that we need to supply a claim "teams", whose ...
LeonZandman's user avatar
3 votes
1 answer
316 views

Configuring passwordless authentication in Microsoft Entra ID

I've been working with conditional policies to lab up scenarios for deploying passwordless authentication and have been unable to figure out the best approach for new users. If you create a policy for ...
Ritmo2k's user avatar
  • 185
0 votes
1 answer
93 views

Addressing 'Insufficient Access' When Blocking Senders in Outlook M365

Whenever I block a sender in the Outlook M365 desktop app by right-clicking on an email and selecting "Block Sender" to move it to junk email, an error occurs in AD/Entra Connect, indicating ...
Pimp Juice IT's user avatar
1 vote
0 answers
795 views

Intune error 80180014 enrolling Windows 10 laptop

I'm trying to use Microsoft Intune for the first time. I have an A3 license which includes Intune and Entra ID/Azure Premium P1. I have Directory Sync running on one of our servers to sync our local ...
Daniel's user avatar
  • 253
0 votes
1 answer
133 views

Grant Azure Enterprise App role to B2B external group

In the "External Identities" section of MS Entra, in "Cross-tenant access settings" I've added an Organization and in "Inbound access", "B2B collaboration", I'...
Glen Little's user avatar
0 votes
0 answers
36 views

Azure AD B2C: Cannot disable federated accounts

In an Active Directory B2C Tenant, all users that have a federated identity only are shown in the Azure Portal as "Enabled: No". Still, they can sign in. Also, changing the property using ...
muxmuse's user avatar
  • 113
1 vote
2 answers
446 views

New MS Entra MFA users with AD FS not correctly bypassing MFA requirement to allow initial ProofUp

I'm preparing to onboard a new set of users for MFA authentication with Entra/AD FS, and running into some trouble (thankfully still during the testing phase!) The environment is an on-premise AD/AD ...
Joel Coel's user avatar
  • 13k
1 vote
0 answers
869 views

Entra Id (AAD) certificate based authentication (CBA) client certificate validation failed ("invalid request") error

I'm trying to get CBA to work according to this article: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-certificate-based-authentication I created a self-signed CA for testing ...
The F's user avatar
  • 11
0 votes
0 answers
219 views

Migrating from Windows Server 2008 R2 to Azure AD

Windows Server 2008 R2 (I am aware that it is out of support) Active Directory Domain Controller and file server. I am considering migrating users and files to Azure AD. Our users currently have ...
Jargo's user avatar
  • 121
0 votes
2 answers
2k views

Azure AD Connect says my User is synced, but it isn't

I use Azure AD Connect to sync Users, Computers and Groups from my local Active Directory to Azure. Before I set up Azure AD Connect, every User already existed in local AD and in Azure AD, so I had ...
SimonS's user avatar
  • 787
1 vote
2 answers
1k views

Azure AD/Entra-ID, syncing single domain on-prem environment, to single Azure tenant with multiple exchange mailbox domains

We currently have our Azure tenant, with the verified domain "superiorproducts.com". We also have our on-prem traditional AD domain, which is "supprod.local", with 4 domain ...
boog's user avatar
  • 240
-1 votes
1 answer
172 views

Setting up school wifi network with SSO linked to azure AD without local server

I am trying to restrict school Wi-Fi usage to staff and students. In addition would like to get user-wise usage data. Our current Wi-Fi network and access points are built on Cisco Access points and ...
user899893's user avatar
0 votes
1 answer
274 views

Azure CLI `AZ LOGIN` ERROR: "Found multiple accounts with the same username"

I'm getting this error whenever I try to login to Azure via the CLI. Here are the details: PS C:\Users\MyName> az login Please select the account you want to log in with (Now I get a popup ...
Flak DiNenno's user avatar
0 votes
0 answers
953 views

Azure AD - Intune device mismatch, not joined properly

I have something of a mess on my hands. When these devices were joined, or "registered" with Azure AD, they had already been through OOBE and had local accounts created on them. I realize ...
boog's user avatar
  • 240
0 votes
1 answer
214 views

Resetting user password from hybrid ad desktop without azure writeback

Within an environment with a "local" ad setup with its on directly connected desktops as well as having an azure AD with a connection between the two ADs, password writeback is not to be ...
Mason Kerr's user avatar
0 votes
0 answers
45 views

Is `id_token_signing_alg_values_supported` administrated by Microsoft or the tenant's administrators?

I have created a custom OIDC authorizer for a AWS API Gateway (REST). It currently support tokens signed using the RS256 algorithm, and will otherwise fail. The .well-known OIDC endpoint lists the ...
Shuzheng's user avatar
  • 439
0 votes
0 answers
54 views

Why am I not able to revoke GraphAPI Permissions in Graph Explorer Sandbox?

When I go to https://developer.microsoft.com/en-us/graph/graph-explorer and log in with my Azure account, I cannot revoke access to mail.send: And am presented with this message: "You require ...
Tikhon's user avatar
  • 97
4 votes
1 answer
892 views

How can I design conditional access policies for geofencing that allow single user country exceptions?

In AzureAD, I have a global conditional access policy (cap) that prevents users from accessing their accounts from non approved countries (I do realize this is not an accurate/reliable means of ...
Matt's user avatar
  • 670
0 votes
0 answers
134 views

In an Azure Web App how can I bypass authentication for internal API endpoint calls?

I have an Asp.Net Core application running in an Azure Web App and I need it to be able to call itself. Part of a long-running process in the app needs to be able to open a connection to https://my-...
glenatron's user avatar
  • 235
0 votes
1 answer
88 views

No events after Audit Detailed Directory Service Replication GPO applied to DC

I have created GPO for Audit Detailed Directory Service Replication and applied to DCs. But no events in log, like: 4928(S, F): An Active Directory replica source naming context was established. 4929(...
MYGMYGMYG's user avatar
1 vote
1 answer
596 views

Should I use one admin email account to join all computers to Azure Ad

I have a scenario where the client has no on-premises AD and wants to use Azure AD. Now my first question is, should I use one account like [email protected] to join all the computers to Azure AD and once ...
Vic85's user avatar
  • 103
2 votes
0 answers
54 views

Microsoft account locks everytime PC goes to sleep, user cannot change password

In this case I'm a frustrated user asking as my company (who shall remain nameless) IT department seems unable to diagnose the issue with this, and my own web searching can't find anything either. My ...
Morvael's user avatar
  • 311
1 vote
1 answer
2k views

Azure equivalent for logon script or Group Policy to launch programs on user login

We have a tool (portable exe) that runs from an on premises server in a traditional domain that launches on user login via GP (and can also run from logon script). It references a location on the ...
SKidd's user avatar
  • 61
2 votes
2 answers
1k views

Hybrid Azure AD Join - Not joining correctly

Another day, another Hybrid Azure AD Join issue. Having set up Hybrid Join, it looked like it was working.  The device I onboarded via autopilot was created in "on-prem" AD, was in Azure AD, ...
AngryDog's user avatar
0 votes
1 answer
82 views

Hybrid AD Joined and Autopilot

I've been working on setting up our Autopilot onboarding with our Hybrid AD. I have managed to join a device to the domain successfully, but I have noticed some differences against when we do this ...
AngryDog's user avatar
0 votes
1 answer
231 views

hybrid azure ad join devices

We have a hybrid active directory set up between our servers held in a DC and our Azure AD.I am currently working on the configuration of our Autopilot and Intune deployment. At the moment we deploy ...
AngryDog's user avatar
0 votes
0 answers
68 views

Which service principal role will provide the minimum permissions necessary to automate installation of a website certificate?

I wish to grant a third-party application API access to my Azure tenant for purposes of installing a TLS certificate on a certain website ("App Service," in Azure terminology). However, ...
InteXX's user avatar
  • 765
0 votes
0 answers
203 views

Access multple tenants as Global Administrator with principal from single tenant (PowerShell 7)

My goal here is to be able to use the service principal of an Enterprise Application in source tenant to authenticate towards/connect to destination tenants as Global Administrator. In source tenant I ...
Tedd Hansen's user avatar
0 votes
0 answers
578 views

Integrate PowerDNS into Windows DC's DNS, use same domain

We have the following setup: dc01.our.domain 10.10.10.101 dc02.our.domain 10.10.10.102 phpipam.our.domain 10.10.10.250 We need all our hosts to use our DC's as the primary and secondary DNS servers, ...
Dave's user avatar
  • 376
0 votes
1 answer
294 views

How to configure the Azure AD 'Security Group' membership policy in the Azure AD Portal?

In my Azure AD tenant that has an active Azure AD Premium 2 license, I have enabled Self-Service Group Management. Users are able to create security groups and then configure the membership policy ...
Daniel's user avatar
  • 7,059

1
2 3 4 5
13