Azure/Intune newbie here.
We are planning to implement Intune in our org, and I have a question regarding user device log-in to Windows devices if Azure AD is Okta federated.
From the log-in/lock screen, do users use their Okta credentials to log in to their devices instantly without taking them to the company okta portal?
We are an Okta shop and wanted to use a single set of credentials for device logins and Okta SSO.
This is not yet implemented, so I am unsure how the device log in works.
If your organization is planning to use Intune for managing Windows devices and you have federated your Azure Active Directory tenant with Okta, it is possible to allow users to sign in to their Windows devices using their Okta credentials.
When users sign in to their Windows device, they will be presented with the Windows sign-in screen, which will prompt them to enter their credentials. If your organization has configured Windows Hello for Business or multi-factor authentication, users will be prompted to provide additional verification.
If you have set up federation between Azure AD and Okta using the Security Assertion Markup Language (SAML) protocol, the Okta sign-in page will not be shown to the user during the Windows sign-in process. Instead, the user's credentials will be validated by Okta behind the scenes, and the user will be signed in to their device directly. Which of course will take more effort to implement SAML (As I have experienced)
To enable this sign-in experience, you need to configure the Windows 10 device to use Azure AD for authentication. You can do this by joining the Windows device to Azure AD during the device setup process or by using the Azure AD join feature to join the device to Azure AD.
Once the device is joined to Azure AD, you can then deploy Intune policies to the device to manage its settings and applications. Additionally, you can also use Azure AD Conditional Access policies to control access to company resources based on factors such as the user's location, device compliance status, and authentication context.
Keep in mind that to use this sign-in experience, your users will need to have their Okta credentials synchronized to Azure AD using Azure AD Connect or another supported method. Additionally, you may need to configure the Azure AD and Okta federation settings to ensure that the authentication flow works correctly.
Related
I am trying to setup Azure AD integration with our partner identities. I have few providers that I need to support and they support SAML and WS-Fed. I am trying to use Azure AD External Identities to add these providers to my Azure AD tenant.
However, reading through this article, it seems like SAML integrations are invitation based.
I want users to be able to login without an invitation. How can I do this with Azure AD?
Here are my needs:
After adding the external idp, users should be able to login using their own credentails via their idp. No additional information needed to use an app.
I should be able to grant them access to custom apps (mandatory) and azure resources (optional)
Choose what idp's are allowed per app? (if possible)
Thanks in advance.
Question 1: After adding the external idp, users should be able to login using their own credentials via their idp. No additional information needed to use an app.
Answer:
We can implement Guest users redemption using direct link or a common endpoint instead of email invitation. A guest user clicks the app link, reviews and accepts the privacy terms, and then seamlessly accesses the app.
Using Common endpoint : Guest users can now sign in to your multi-tenant or Microsoft first-party apps through a common endpoint (URL), for example https://myapps.microsoft.com. Previously, a common URL would redirect a guest user to their home tenant instead of your resource tenant for authentication, so a tenant-specific link was required (for example https://myapps.microsoft.com/?tenantid=). Now the guest user can go to the application's common URL, choose Sign-in options, and then select Sign in to an organization. The user then types the name of your organization.
Using Direct Link: As an alternative to the invitation email or an application's common URL, you can give a guest a direct link to your app or portal. You first need to add the guest user to your directory via the Azure Portal or Powershell Then you can use any of the customizable ways to deploy applications to users, including direct sign-on links. When a guest uses a direct link instead of the invitation email, they’ll still be guided through the first-time consent experience.
Reference:
Add B2B guests without an invitation link or email - Azure AD
Invitation redemption in B2B collaboration - Azure AD
Question 2 : I should be able to grant them access to custom apps (mandatory) and azure resources (optional)
Answer: Add the Users as Guest to Azure active Directory but by default they will be sent an invitation even if they don’t open it you can assign an app in your enterprise application for them to use .
Most federated applications that support SAML 2.0, WS-Federation, or OpenID connect also support the ability for users to start at the application, and then get signed in through Azure AD either by automatic redirection or by clicking on a link to sign in. This is known as service provider-initiated sign-on, and most federated applications in the Azure AD application gallery
Reference:
End-user experiences for applications - Azure Active Directory
Quickstart: Add guest users in the Azure portal - Azure AD
To Provide the Guest user access to azure resources you can manually add a role to the users.
Question 3: Choose what idp's are allowed per app?
Answer: Create different user flows and add desired IDPs to the user flows and then assign applications registered in Azure AD to the user flows depending on which IDPs are needed for given application.
Reference:
Add a self-service sign-up user flow - Azure AD
Question 4: I added Okta as an External Identity using SAML in my Azure AD. Created an "App Registration" as multi-tenant. But I am getting this error.
AADSTS50020: User account 'xxx' from identity provider 'http://www.okta.com/xxxxx' does not exist in tenant '' and cannot access the application '0000000c-0000-0000-c000-000000000000'(Microsoft App Access Panel) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
Solution: Please Ensure User is added to one of the Partner Admin Groups i.e. AdminAgents in the Partner tenant.
Reference:
Manage Auth access for cloud solution providers.
Question 5: Steps for setting self service signup for an application.
Test Scenario in my Lab
Azure AD with an application registered in application registrations blade.
Another AD tenant with users.
Step 1: In the above external identities collaboration settings please make sure to have enable guest user self service enabled.
If it is not enabled then you can’t create a self service flow and you will get the below error when a user from other tenant is trying to access the app.
Step 2: Create a user flow by going to the user flow blade and creating a new flow.
Step 3: After you have created the user flow , click on the User flow and go to application blade and click add application.
Now search for the application you want to provide the self service signup to and click on select and you will have now enable the self service sign up for users when they try to access your application.
Output:
Once the above settings are done you can access the url to your app. Provide the user of the different ad tenant and you will get output as below .Click on create a new one .
Once the user from other AD tenant have accepted it they are successfully registered as guest users in your tenant.
If they accept the above then they will be able to access the app from now as a guest.
I have configured Virtual network gateway with Azure AD authentication OpenVPN SSL tunnel. While connecting via AzureVPN application using my office mail ID i'm not asked for MFA even though it is enforced by Administrator to ask MFA when ever a user logs in, plus i'm not even prompted for my password also. Why is this happening is it by design like this?
So If a User(AD Member) login from Azure AD registered, Azure AD joined, Hybrid Azure AD joined device they'll not be prompted for MFA since MFA token is already claimed(they'll be asked if token not claimed) if MFA is still needed then conditional access needs to be applied.
or Click on use different account so that new token is needed to be claimed and MFA is prompted.
Security reader role should be enough to access almost all the part of the this application.
I am using Azure B2C to connect my own openid connect server using OpenID onnect (Preview) provider. I configured every thing, system is working fine.
But one thing is when a new user logs in through my own openid connect server, Azure AD B2C creates this user in Azure AD which is connected to Azure B2C.
My intention is that, My client application has to call Azure B2C. Azure B2C should display list of identity providers. one among those providers is my own openid connect server. Then user can input his credential in my own openid connect server and verified and return back to Azure B2C with id_token. after this step Azure AD B2C is asking me to create this user in Azure AD. why this is happening ?
I cannot provide my user details to any intermediate systems. Please help me on this.
The same scenario is happening for gmail users also. but only first time login or when we change some signin policy attributes.
Based on my experience, even for externally authenticated users (social sign-in) AAD B2C always creates an object in its local store (which is actually an Azure AD directory). I can't speak authoritatively, but a couple of reasons for this would be 1) the ability to generate and maintain an immutable ID for a user that is somewhat independent of the social IdP, and 2) the ability to collect and store additional attributes which are not available from the social IdP.
I believe you can make the process invisible to your users - they don't necessarily have to be prompted to enter additional attributes or to create a user - but it will still happen in the background.
In AWS I was able to set up MFA so that when I log into the console I have to enter an MFA code from my phone in addition to a password?
Is there a way to set MFA for https://portal.azure.com?
Per my understanding, you are looking for Azure Multi-Factor Authentication.
Add protection for Azure administrator accounts
Multi-Factor Authentication adds a layer of security to your Azure administrator account at no additional cost. When it's turned on, you need to confirm your identity to spin up a virtual machine, manage storage, or use other Azure services.
Azure Multi-Factor Authentication is Microsoft's two-step verification solution.
It helps safeguard access to data and applications while meeting user demand for a simple sign-in process. It delivers authentication via a range of verification methods, including phone call, text message, or mobile app verification.
Azure Multi-Factor Authentication in the cloud
Enable Azure Multi-Factor Authentication
Turn on two-step verification for users
You could get start with it in the cloud by this article.
I have used Azure AD B2C sign-in and sign-up policy for user login and signup process with Multi factor Authentication. Also set password resetting policy.
Everything is working fine with Phone factor (MFA).
Now client wants to add security questions while signing up a user and password resetting.
I have enabled security question and selected 5 questions; however, it's not visible while signing up a user and password resetting.
I am not able to understand what is the exact problem.
Based on the official documentation, Azure AD B2C only supports using a verified email address as a recovery method.
Currently, we only support using a verified email address as a
recovery method. We will add additional recovery methods (verified
phone number, security questions, etc.) in the future.
In addition, Azure AD B2C only supports phone call and text message verification for Multi-Factor Authentication(MFA).
Azure Active Directory (Azure AD) B2C integrates directly with Azure
Multi-Factor Authentication so that you can add a second layer of
security to sign-up and sign-in experiences in your consumer-facing
applications. And you can do this without writing a single line of
code. Currently we support phone call and text message verification.
More information about MFA and password reset for Azure AD B2C, please refer to the following links.
Azure Active Directory B2C: Set up self-service password reset for
your consumers
Azure Active Directory B2C: Enable Multi-Factor
Authentication in your consumer-facing applications