active directory Archives - Apostolidis Cloud Corner

Azure Client VPN with Azure AD auth & MFA | Step by step guide

Pantelis Apostolidis — Tue, 02 Jun 2020 21:16:37 +0000

Azure Client VPN using Azure AD & MFA

Azure Virtual Network Gateway provides the ability to connect to your Azure Virtual Network with Azure Client VPN (SSL) connections using your Azure AD or hybrid identity, with Multi Factor Authentication (MFA) and your Conditional Access policies.

We can have an Enterprise grade SSL VPN, with Active Directory authentication and Single Sign on (SSO) from your corporate laptops and apply all your conditional access policies, like MFA, Compliance devices, trused locations, etc.

How to create the VPN Gateway

Go to your Virtual Network’s subnets and create a Gateway subnet by clicking the “+ Gateway subnet”

Create a Virtual network gateway, by searching for the “Virtual network gateways” service and press Add.

Select “VPN”, “Route-based” and at the SKU select any size except the Basic. Basic SKU does not support Azure AD authentication.

Create a Public IP and leave all other settings default and create the Gateway.

After about 20 minutes the VPN Gateway is ready. In the meantime we will prepare the Azure AD and give concern to use the Azure AD with the Azure client VPN. Using a Global Admin account, go to the “Azure Active Directory” and copy the “Tenant ID” from the Overview blade, and keep it on a notepad.

Then copy the url and paste the below url to your browser’s address bar. You need to log in with a Global Admin non guest non Microsoft account.

https://login.microsoftonline.com/common/oauth2/authorize?client_id=41b23e61-6c1e-4545-b367-cd054e0ed4b4&response_type=code&redirect_uri=https://portal.azure.com&nonce=1234&prompt=admin_consent

With a guest or Microsoft account, even if it is Global Admin, you will be propted to login with an admin account, meaning a member work account.

Once you login with a member work Global Admin account, you can accept the permissions to create the Azure VPN application

You can navigate to the Azure Active Directory / Enterprise Application and view / manage the Azure AD application.

Open the Azure VPN enterprise application and copy the “Application ID” to a notepad.

Go to the VPN Gateway, select the “Point to site configuration” and click the “Configure now”

Add the Address Pool that you want the VPN clients to have, for Tunnel type select “OpenVPN (SSL) as it is the only type that supports Azure AD authentication.

Then use the details that you have copied to the notepad, the Tenant ID and the Application ID, and add them to the required fields and press save.

Tenant: https://login.microsoftonline.com/paste-your-tenant-id-here
Audience: paste-the-azure-vpn-application-id-here
Issuer: https://sts.windows.net/paste-your-tenant-id-here/

How to Download the VPN Client and Connect to the Gateway

Download the VPN client, using the button.

Extrack the downloadded zip file

And at the AzureVPN folder you will find the configuration xml.

Open the Microsoft Store and get the Azure VPN Client

Open the Azure VPN Client and at the lower left corner, press the + and Import the xml configuration file

accept all the settings and press save

The Azure VPN connection will appear at the Azure VPN client and also at the Windows 10 network connections, like any other VPN

Azure VPN Client:

Windows 10 Network Connections:

Once you press connect, it will prompt you to connect using the account(s) that you are already using at your Windows 10 machine, or use a different account

You will be prompted for MFA or any other conditional access policy you have applied, and the you will be connected.

Conditional Access & Multi-Factor Authentication (MFA)

You can add Conditional Access to the Azure client VPN connection. Go to Azure Active Directory / Security / Conditional Access and create a new Policy.

Select the “Azure VPN” at the “Cloud apps or actions” section

At the Access Controls / Grand section, you can require multi-factor authentication, or AD Joined device, or compliant device, or all of that

At the “Conditions” section you can controll the location that the policy will apply. Lets say, you can apply the MFA requirement at “Any location” and exclude the “Trusted locations”, in order to not require MFA when the device is at a trusted location, like your company’s network.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Client VPN with Azure AD auth & MFA | Step by step guide appeared first on Apostolidis Cloud Corner.

How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario

Pantelis Apostolidis — Wed, 21 Jun 2017 10:32:34 +0000

How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario

Scenario objectives: We have an Exchange Hybrid setup between on-premises and Exchange Online (Office 365). All users are synced and the mailbox is located at Exchange Online.

We need to separate an existing mailbox from its user account and re-connect this mailbox to a new user account. If the mailbox in this scenario was located at the on-premises Exchange it would be an easy process just using the Exchange Management Console. But in a Hybrid scenario, the process includes many steps since the mailbox is not directory conencted to the Active Directory user account but it is conected to the Azure AD Synced User Account.

For the ease of the guide we will name the Existing User Account: OLDUSER and the New User Account: NEWUSER.

We will disconnect the Exchange Online Mailbox from the OLDUSER and connect it to the NEWUSER.

Step 1.

At the on-premises Active Directory, at an OU that is not synced with Azure AD, create the new user account. The “NEWUSER”. Ensure that you do not enter nothing at the email field. Just a user account with no email attributes.

Step 2.

Move the “OLDUSER” to an OU that is not synced with Azure AD

Step 3.

Run a Delta Sync. Go to the server that the AD Connect is installed, open the PowerShell and run “Start-ADSyncSyncCycle”

Step 4.

We need to get the GUID of the NEWUSER. To do so login to a Domain Controller, open PowerShell and run:

[system.convert]::ToBase64String((Get-Aduser NEWUSER).objectGUid.ToByteArray())

Copy the GUID to a Notepad

Step 5.

Open the Office 365 Admin Center and Restore the deleted user “OLDUSER”

Go to Users –> Deleted Users –> Select the user “OLDUSER” –>Click Restore

Step 6.

Connect to Azure AD and set the GUID of the “NEWUSER” to the Office 365 “OLD USER”. Details for connecting to Azure AD “https://technet.microsoft.com/en-us/library/dn975125.aspx“

Connect-MsolService

Set-MsolUser -UserPrincipalName olduser@mydomain.com -ImmutableId vMZGJpW6CUGY09bduJ5dlw==

Step 5.

Open the Office 365 Admin Center and Delete the old user “OLDUSER”

Go to Users –> Active users –> Select the “OLDUSER” –> click Delete user

Step 6.

Clean the on-premises Active Directory account of the old user “OLDUSER” from all attributes that will be added to the new user, like Proxy addresses, Target, address, Alias name, nickname etc.

Step 7.

Make the “NEWUSER” user account a Remote Mailbox object

At the on-premises Exchange, open the Exchange Management Shell and run:

Enable-RemoteMailbox -Identity NEWUSER -DisplayName "NEW USER" -RemoteRoutingAddress newuser@mydomain.onmicrosoft.com -Alias newuser -PrimarySmtpAddress newuser@mydomain.com

Step 8.

Move the “NEWUSER” to an OU that is Synced with Azure AD and run a Delta Sync like Step 3.

After that the “NEWUSER” active directory account will be connected with the “OLDUSER” Exchange Online mailbox and all attributes of the Exchange Online mailbox will be replaced with the “NEWUSER’s” values.

I suppose there are other ways, maybe easier, to accomplish this task, but following this process you will have the desired result without problems.

Pantelis Apostolidis

www.cloudcorner.gr

The post How to disconnect a mailbox & re-assign it to new user in a Hybrid Scenario appeared first on Apostolidis Cloud Corner.

Match OnPrem Active Directory users to existing Office365 Users

Pantelis Apostolidis — Fri, 29 Jul 2016 09:27:03 +0000

Lets say you have an Office 365 account and cloud only users with mailboxes and now you decide that you want to sync it and match the Office 365 users with your Active Directory users.

I prepared a lab with one DC and I created a trial Office 365 E3 account with custom domain. I created users with the same username to both. At Active Directory I set the UPN to match the Office 365 user name and also added the email address.

Next I enabled directory synchronization from Office 365 and installed Azure AD Connect to DC2. After the initial sync i got this error:

Unable to update this object because the following attributes associated with this object have values that may already be associated with another object in your local directory services: [Mail test1@xxxxx.gr;].

I realized that Office 365 could not map the users, it was trying to create new. So there must be an attribute that needs correction. The solution came form the following blog:

http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

and specifically at the “manual match method” section:

In order to match the user with the cloud user you have to set the Immutable ID of onPremise Active Directory user’s ObjectGUID to the immutableID value of the Office365 user.
To retrieve the ObjectGUID you can use the following command:

Ldifde –d “CN=xxx…,OU=xxx,DC=xxxx,DC=xx” –f c:\temp\exportuser1.txt

“CN=xxx…,OU=xxx,DC=xxxx,DC=xx” is the distinguished name of the user. You can use ADSIEdit or the AD Users & Computer (attribute editor) to find this value

In the Textfile exportuser1.txt look for the ObjectGUID. You will find a string like z2Xbu0xFTUapOeDqHRTN1A==

Then connect to Windows Azure Active Director and use the command

set-MsolUser -UserPrincipalName user1.surname1@customerdomain.com -ImmutableId z2Xbu0xFTUapOeDqHRTN1A==

After that I just forced a delta sync “Start-ADSyncSyncCycle -PolicyType Delta” , the sync was successful and the users in Office 365 changed from “In Clout” to “Synced with Active Directory”

How to Map OnPrem Active Directory users to existing Office365 Users

source: http://blogs.4ward.it/how-to-map-onprem-active-directory-users-to-existing-office365-users/

Pantelis Apostolidis

www.cloudcorner.gr

The post Match OnPrem Active Directory users to existing Office365 Users appeared first on Apostolidis Cloud Corner.

Find AD accounts that are expiring

Pantelis Apostolidis — Thu, 25 Sep 2014 07:42:59 +0000

[sourcecode language=”powershell”]
Search-ADAccount -AccountExpiring -TimeSpan ([TimeSpan]::FromDays(7)) | Select-Object name*,userpri*,accou*
[/sourcecode]
“FromDays(7)” = this will search accounts that are expiring in 7 days
Select-Object name*,userpri*,accou* = this will print a table with account names, UPN and accountexpirationdate

Pantelis Apostolidis

www.cloudcorner.gr

The post Find AD accounts that are expiring appeared first on Apostolidis Cloud Corner.

Manage Office 365 password expiration

Pantelis Apostolidis — Mon, 22 Sep 2014 14:03:27 +0000

Check if the password is set to never expire for one user:

Get-MSOLUser -UserPrincipalName username | Select PasswordNeverExpires

Check if the password is set to never expire for all users:

Get-MSOLUser | Select UserPrincipalName, PasswordNeverExpires

Check if the password is set to never expire for a list of users:
create a txt file listing the required users, line by line with title “username”, and save it as c:pwdexpire.txt, like this:

username
testuser1
testuser2
testuser3

then run:

Import-csv c:pwdexpire.txt | for each { Get-MSOLUser -UserPrincipalName $_.username | Select PasswordNeverExpires }

Set password to never expire for one user:

Set-MsolUser -UserPrincipalName username -PasswordNeverExpires $true

Set password to never expire for all users:

Get-MSOLUser | Set-MsolUser -PasswordNeverExpires $true

Set password to never expire for a list of users:
like before create a txt list and run:

Import-csv c:pwdexpire.txt | for each { Set-MsolUser -UserPrincipalName $_.username -PasswordNeverExpires $true }

to re-set the password to expire just replace the $true with $false (please note that is the organization’s password expiration period has passed then the user/users will be locked and you will need to reset their passwords)

Pantelis Apostolidis

www.cloudcorner.gr

The post Manage Office 365 password expiration appeared first on Apostolidis Cloud Corner.

Delete user from Office 365 with DirSync

Pantelis Apostolidis — Wed, 06 Aug 2014 10:44:00 +0000

First you need to remove the user from DirSync:

Open the “Synchronization Service Manager” (cn be fount at “C:Program FilesWindowsAzureActiveDirectorySyncSYNCBUSSynchronization ServiceUIShellmiisclient.exe”)

Navigate to “Metaverse Search” and click on “Add Clause”

Be sure that you choose Displayname as Attribute, and then configure your search, in my case Show all objects starting with svc

Double click an entry, and open the tab connectors

Activate the line with the “Active Directory Connector” Management Agent and click on “Disconnect…

In the disconnect object accept question, choose “Disconnector (Default)” to remove the connector. Explicit Disconnector will lock the object to be a connector again.

Disconnect Object

You can then rerun your search, and the specific account will not be shown anymore. And after a sync, the object will also be be removed from the azure Directory

Then you need to remove the user object from the Office 365 portal using the PowerShell

Open PowerShell “Windows Azure Active Directory Module”

$msolcred = get-credential

connect-msolservice -credential $msolcred

Get-MsolUser -ReturnDeletedUsers | FT UserP*,ObjectId

Remove-MsolUser -ObjectId abc1234-12abc-123a-ab12-a12b3c4d5f6gah -RemoveFromRecycleBin -Force

Get-MsolUser -ReturnDeletedUsers | Remove-MsolUser -RemoveFromRecycleBin -Force

Then at the next scheduled sync of te DirSync the user will be recreated. Also you can force the DirSync to creaate the user faster.

Pantelis Apostolidis

www.cloudcorner.gr

The post Delete user from Office 365 with DirSync appeared first on Apostolidis Cloud Corner.

Register Active Directory Schema Snap-In

Pantelis Apostolidis — Tue, 17 Jun 2014 13:21:14 +0000

To be able to add the Active Directory Schema Snap-In at an MMC you need to register thschema management dll. To do so, open an elevated command prompt and run:

regsvr32 schmmgmt.dll

Pantelis Apostolidis

www.cloudcorner.gr

The post Register Active Directory Schema Snap-In appeared first on Apostolidis Cloud Corner.