From their docs - https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-how-it-works
As a pre-requisite for Pass-through Authentication to work, users need to be provisioned into Azure AD from on-premises Active Directory using Azure AD Connect. Pass-through Authentication does not apply to cloud-only users.
Doesn't this defeat the whole point of pass-through. If users need to be provisioned in AAD (using AD connect), what's the point of pass through? Or is it just that USERNAMES are provisioned and no passwords..?
Very confusing. Please only respond if you have actually implemented this.
We use this at my work. It's better described here: What is Azure Active Directory Pass-through Authentication?
Azure Active Directory (Azure AD) Pass-through Authentication allows your users to sign in to both on-premises and cloud-based applications using the same passwords. This feature provides your users a better experience - one less password to remember, and reduces IT helpdesk costs because your users are less likely to forget how to sign in. When users sign in using Azure AD, this feature validates users' passwords directly against your on-premises Active Directory.
To use cloud-based services, the account must exist in Azure AD. To use on-premises services, the account must exist on-premises. So everyone's account is actually duplicated between on-premises and Azure AD.
The only purpose of using pass-through authentication is being able to use both cloud and on-premises applications with the same password. Therefore, the password is not stored in Azure AD and Azure AD defers to the on-premises environment to perform the authentication.
Related
I have an on-premises Windows server 2022, which is running AD DS, NPS and DHCP. I also have Azure AD subscription, where my users are located. I would like to keep my users database (AD) in the cloud, since currently, I do not have any backup solutions and it is easier for me to manage. I want to have ieee 801.x on premises, as well as VPN service. Is it possible to force the NPS to authenticate against the Azure AD, where all my users are located? If yes, how can this be done?
I know that Azure AD Connect provides hybrid integration, but from what I read, it is only one way, i.e from on-premises AD to cloud synchronization, but not the other way around.
Yes, you are correct that the synchronization is only one-way and the workarounds currently are to use use PowerShell export/import or use a third-party tool. In the NPS article you linked, the on-premises users ultimately authenticate against Azure MFA. The NPS extension acts as an adapter between RADIUS and cloud-based Azure AD Multi-Factor Authentication to provide MFA for the federated or synced users. Your cloud users would just use regular Azure MFA without needing that adapter.
The most common workaround for the user writeback scenario is to create a PowerShell script that scans Azure AD regularly, finds the users in Azure, and then creates an on-premises user with the attributes in Azure AD.
The regular user writeback feature is on the roadmap and actively being worked on though. I've asked for an update from the PG and will edit this post once it is available.
For cloud VPN options, see: Azure AD Authentication - Open VPN.
Currently Azure AD only receives identity information through AD Connect. While this works and needs to remain in place, it obviously requires the data to be populated into AD first, which can present challenges from a technical and workflow aspect. If the data is only needed in Azure AD and not in on-prem AD then having to send the data through AD first increases the level of effort for adding new data to Azure AD.
Does Azure AD supports sources in addition to AD Connect or Cloud Sync for attribute population? We want to be able to sync certain data to Azure AD without having to ensure the data is present in our on-prem AD first.
If the user (or another identity) is required only in the cloud, you can create it in your Azure AD.
The is that you could only manage that identity in your Azure AD.
Azure AD Connect allows password writeback and groups writeback, you cannot sync anything else beyond that.
I have two separate web applications, one built with .NET Framework and the other built with .NET Core. Both web applications make up one solution which we ship to our customers. The solution itself is a SaaS subscription-based solution, where users would be able to sign-up with using either a Microsoft/Office 365, GSuite, or organizational account (basic username/password). We would like to restrict sign-up to organizational/business accounts only.
As I understood, Azure B2B is mainly useful when you have something internal and you would like to give external users some limited access to it. Given that I have a multi-tenant SaaS solution, I believe that Azure B2C makes more sense.
Furthermore, in our solution, we would also want the ability for external users to access Tabular Models in Azure Analysis Services and SSRS.
Is access to only organizational accounts, something that can be configured through Azure AD B2C?
Can access be granted to external users to Azure Analysis Services or other Azure tools when using Azure B2C?
You have two options
Option 1, Using Azure AD External identities solution - recommended
You can use newly released self service sign up solution in Azure AD external identities . You can very well restrict sign up to other Azure AD accounts only. However for sign up using other federation systems - you need to try on. I think as of today only Google and Facebook are supported apart from Azure AD.
Option 2, use Azure AD B2C and use app only authentication.
Azure AD B2C consumer accounts are by default not supported by Azure services or Office. But you can use app based authentication to provide these services. Your client app will call your backend api using Azure AD B2C token. Your backend app can perform all auth validations and then call the backend Azure or any other service using app only authentication mode.
I am trying to use MFA for on-premise APPS that are secured by AD and ADFS. We are uing MIM to provision accounts automatically to AD. However all accounts will not be synchronized to Azure AD. I have read following article
https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/use-azure-mfa-for-activation
Does it mean you can use Azure AD MFA withing MIM for on-premise Apps which are secured by ADFS? does it go to Azure AD to challenge the user for MFA? what about if the account exist only in AD not Azure AD?
Appreciate all kind of advice.
The article you cited above is only applicable to the use of Azure AD MFA within MIM for the privileged access management scenario, rather than for MFA for use within applications. I would recommend synchronizing accounts to Azure AD, and using conditional access and the application proxy where applicable. See https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-whichversion for more info on the options for applications.
What am I missing here? I'm thinking of moving my data center to Azure. I've created a corporate virtual network that has my ADs, my certificates, basically the family jewels of the company that I'm trying to build in the cloud. I've plugged up every obvious security hole that I can think of except one: the login to the Azure Portal is just a simple user id/password. If someone picked off my Microsoft Live user id, all they need is a password cracker. And a disgruntled or dismissed employee could easily cause havoc. Is there some way to lock down the portal? Does anyone in the security business think these Azure web sites are secure?
You can use Azure AD to properly secure the portal authentication. Azure AD is designed to securely authenticate applications in the cloud and it is supported by the majority of Microsoft solutions like Azure Portal. It will provide features like MFA, access control, self-service password reset, etc.
Although Microsoft Accounts also support some of these features, you can't force your users to specific policies, that's why Azure AD is important for enterprise level security.
Once you create a directory for your company through Azure Portal and synchronize your AD objects with Azure AD using the AAD Connect tool you will be able to login to Azure Portal using your corporate credentials and force users to use Multi-factor authentication or even apply other policies.
Azure Active Directory features and capabilities
Azure Active Directory Hybrid Identity Design Considerations
Integrating your on-premises identities with Azure Active Directory