Windows 10 Domain Join + AAD and MFA Trusted IPs

24th of July, 2017 / David Lee / 11 Comments

Background

Those who have rolled out Azure MFA (in the cloud) to non-administrative users are probably well aware of the nifty Trusted IPs feature. For those that are new to this, the short version is that this capability is designed to make it a little easier on the end user experience by allowing you to define a set of ‘trusted locations’ (e.g. your corporate network) in which MFA is not required.
This capability works via two methods:

Defining a set of ‘Trusted” IP addresses.

… [Keep reading]

Resolving the 'Double Auth' prompt issue in ADFS with Azure AD Conditional Access MFA

4th of July, 2017 / David Lee / 2 Comments

As mentioned in my previous post, Using ADFS on-premises MFA with Azure AD Conditional Access, if you have implemented Azure AD Conditional Access to enforce MFA for all your Cloud Apps and you are using the SupportsMFA=true parameter to direct MFA execution to your ADFS on-premises MFA server you may have encountered what I call the ‘Double Auth’ prompt issue.
While this doesn’t happen across all Cloud Apps, you will see it on the odd occasion (in particular the Intune Company Portal and Azure AD Powershell Cmdlets) and it has the following symptoms:

User signs into Azure AD App (e.g.

… [Keep reading]

Using ADFS on-premises MFA with Azure AD Conditional Access

1st of July, 2017 / David Lee / 9 Comments

With the recent announcement of General Availability of the Azure AD Conditional Access policies in the Azure Portal, it is a good time to reassess your current MFA policies particularly if you are utilising ADFS with on-premises MFA; either via a third party provider or with something like Azure MFA Server.
Prior to conditional MFA policies being possible, when utilising on-premises MFA with Office 365 and/or Azure AD the MFA rules were generally enabled on the ADFS relying party trust itself. … [Keep reading] “Using ADFS on-premises MFA with Azure AD Conditional Access”

Debugging an Office 365 ADFS/SSO issue when accessing Office Store in browser

1st of August, 2016 / David Lee / 2 Comments

We recently came across an issue with a customer where they had configured a standard SSO experience with Office 365 using ADFS and it was working perfectly except for a specific use case. When a user accesses the office store via the Office 365 portal (e.g. portal.office.com/store) they got into an endless SSO login loop. Specfically, they would see the following:

Connection to Portal.Office.com
Redirection to login.microsoftonline.com
Redirection to adfs.customerdomain.com (automatically signed in because of WIA SSO)
Redirection to login.microsftonline.com

… [Keep reading]

Modern Authentication and MAPI-HTTP

27th of July, 2016 / David Lee / No Comments

If you haven’t heard, Modern Authentication (aka ADAL), has now officially gone GA (https://blogs.office.com/2015/11/19/updated-office-365-modern-authentication-public-preview/) – which means that if you are utilising Office 365 services, particularly Exchange Online, and Office 2013/2016 as your client, you should really be looking at enabling this functionality for your end users.

For those unfamiliar with Modern Auth, there are numerous benefits, but one of the most obvious for end users is it removes the need for the use of ‘save my credentials’ when signing into Exchange Online and provides a true SSO experience when combined with ADFS Federation.… [Keep reading] “Modern Authentication and MAPI-HTTP”

Configuring Intune Service to Service Connector for Exchange Online with a Service Account

4th of May, 2016 / David Lee / 2 Comments

If you are considering the use of Intune Conditional Access with Exchange Online it is generally recommended that you configure the Intune Service to Service Connector. While it is not mandatory, it does provide your Intune Administrators the ability to report on the effectiveness of the Conditional Access Policies on your mobile ActiveSync clients within your Exchange Online environment. In addition, if you wanted to enforce the use of the Outlook iOS/Android app using Exchange ActiveSync policies, as per my previous blog post here, setting up the connector would allow you to configure the ActiveSync access rules straight from the Intune Admin Portal.… [Keep reading] “Configuring Intune Service to Service Connector for Exchange Online with a Service Account”

Enforcing Outlook App in Exchange Online and Intune Conditional Access

29th of April, 2016 / David Lee / 25 Comments

[UPDATE 23/11/16] Microsoft have announced a new method of doing what I describe in this blog post. Matt Shadbolt from the Intune Engineering team has a nice blog post that describe how to use this new process, based on Intune MAM policies. The below information is still useful though if you want to do more specific restrictions (e.g. iOS vs Android native clients).

What is Intune Conditional Access?

Intune Conditional Access is a pretty neat feature that allows administrators to enforce compliance policies to devices prior to allowing them access to sync their mail with Exchange Online. … [Keep reading] “Enforcing Outlook App in Exchange Online and Intune Conditional Access”

Using saved credentials securely in PowerShell scripts

21st of April, 2016 / David Lee / 30 Comments

One of the most common tasks out in the field is the need to run PowerShell scripts that require credentials to be saved in some form of another so that they can be fed into scripts to be executed autonomously. This is particularly common in cloud environments where the current user context in which the scripts are run (e.g. within a scheduled task) are insufficient or not appropriate for the remote execution. Office 365 management is a perfect example of this, where often a credential object must be passed in order to connect and execute the cmdlets.… [Keep reading] “Using saved credentials securely in PowerShell scripts”