Let’s go password less, because passwords are bad! Part 1

Quite a statement, passwords are bad? Today I’d like to explain why you should work on better security by using other authentication methods than just 1 password.

Gerelateerde afbeelding

Why passwords are bad

Password are problematic, very often you see that passwords fall in the hands of unpleasant people. Here are a few things that might happen with a password:

Continue reading “Let’s go password less, because passwords are bad! Part 1”

Reset Azure AD User password with a predefined password

In the Azure portal you can reset the password of a user, but this is always a temporary password. But PowerShell to the resque again, lets set the password in Azure AD with PowerShell with a predefined password! On your Windows device open a PowerShell prompt and connect to Azure AD. (Click here if you don’t know how to)

First we need to get the object ID from the user where we want the password to be reset. Run the following command (replace emailadres):

Get-AzureADUser -filter "userPrincipalName eq 'username@2azure.nl'"

Copy the ObjectId from the user where you want to have the password reset. And run the following commands (replace the password text for the new password):

$password = ConvertTo-SecureString 'Please enter the new password' -AsPlainText -Force

Set-AzureADUserPassword -ObjectId  "a8d5e982-6c3d-406e-a533-a21b275e3d37" -Password $password

How to deploy Azure Active Directory Domain Services (AD DS)

Today we will learn how to deploy Azure AD Domain services. So let’s go to the Azure portal and let’s get you started!

Step 1: Go to Azure AD Domain Services and create a new Azure AD Domain services!

Step 2: Now we can start te setup of ADDS, fill in your preferred domain name. You can leave the default which is the same as your Azure Active Directory name ending with .onmicrosoft.com, but I would recommend a public URL like in my case adds.2azure.nl.

Continue reading “How to deploy Azure Active Directory Domain Services (AD DS)”

Office 365 MFA is free of charge!

Where Azure MFA is only included in the paid Azure Active Directory Premium subscriptions (P1/P2 and EM+S suites), there is a free version for the Office 365 apps.

It is always a good idea to enable multi factor authentication, in case your credentials get stolen, the thief will not be able to use them because of the 2nd authentication factor. Microsoft is encouraging all their users to start using MFA, so the made it free of charge for all the apps of the office 365 suite, including Outlook, Teams, Excel, Word and many more.

First Sign in screen

The 2 factor authentication can be setup up fairly easily by the end users self. This can be enforced by the administrator by requiring 2 factor authentication. The first time a user logs on, he or she will get a notification message to setup MFA. Or you can redirect your users to the following portal to setup MFA: https://aka.ms/mfasetup

How to setup MFA for your end users?

In the office 365 portal go to the Active Users tab, and go to the Setup multifactor authentication page (see below)

In the preview version of the admin center, the More menu on the Active Users page, with Setup Azure multi-factor auth selected.
Continue reading “Office 365 MFA is free of charge!”

What is Microsoft Enterprise Mobility + Security (EM+S)?

Enterprise Mobility + Security is a Microsoft solution specially developed for management and securing users, company data and applications. This gives you and your users always secured access to your company information without ever worrying about security!

With EM+S we are moving from a managed device to data management and security. This means that it will not only protect your device, but most important, it will take care of security on a document level where you can prevent that confidential data is readable by unauthorized persons.

By using this security suite you can prevent abuse of stolen credentials when one of your users is tricked by a phishing email. You can limit access to company data to only trusted devices (Company and BYOD) by using the Intune portal. But we can limit access to it as well with IP black / white listing. This includes Geoblocking as well, it is impossible to travel from the Netherlands to Russia for example in 5 minutes.

To protect your valuable company data I recommend to always use EM+S for optimal protection. If you want the security to be at its best, E5 is your way to go!

Main features

  • Simple management and security of your devices
  • Multifactor authentication (MFA)
  • Selfservice portal for password reset en securitygroep management
  • Application company portal
  • Mobile device management (MDM)
  • Integrated device management (Laptop/Desktop)
  • Securing company data en restrict access to company data
  • Conditional access (geo-blocking and more)
  • Advanced Threat Protection with reporting
  • Risk-Based conditional access (E5 only)
  • Privileged identity management (E5 only)
  • Intelligent data classification and labeling (E5 only)
Continue reading “What is Microsoft Enterprise Mobility + Security (EM+S)?”

Sync existing office 365 tenant with local active directory

Recently we created an AAD tenant that has no on-premises AD domain counterpart.
Now we are facing an issue where we want to be able to use the identities in this tenant to log into some servers. It would appear that we would need to domain join these servers, but we can’t do this without AD. The question is, how can we continue to setup these servers?

If the servers are hosted on the Azure IaaS platform you can choose to go ahead with Azure AD Domain services as I wrote before:
https://www.cordenboer.nl/2019/04/22/azure-ad-domain-services-an-option-or-not/

But today we are going to install a new domain on-premise. The domain name isn’t relevant for the sync with Azure AD / Office 365. But the UPN for the end users is important! So first we can add the UPN domains by going to the Domain and Trusts console. Add the required domain names.

Continue reading “Sync existing office 365 tenant with local active directory”

Azure MFA NPS extension replacing MFA Server

Within Azure there are multiple ways to setup MFA. Where you would install MFA server in the past, there is a new extension. Microsoft is going to leave the MFA server behind in the near future (security updates will remain being published for now).

Besides the NPS extension and the MFA on-premise server the best practice is to run MFA from the Azure cloud where possible. But that isn’t always an option. So let’s move on to the NPS extension. Lets start with the requirements.

Requirements:
– Server 2016/2019 with ADFS version 4
– Server 2016/2019 hosting NPS services which performs Radius authentication.
– Users must be synchronized between local Active directory and Azure Active Directory
– Azure AD Premium or EM+S license must be assigned to the user
– NPS Extension for Azure MFA (Download link: https://aka.ms/npsmfa)

Continue reading “Azure MFA NPS extension replacing MFA Server”

Azure AD Domain Services an option or not?

Frequently I get the question, how are we going to manage our legacy Azure IaaS servers? Should we deploy domain controllers? or should we setup a VPN connection with our on-premise environment?

Before we can start answering these questions we will need to learn more about AD DS.

Azure AD Domain Services provides managed domain services such as domain join, group policy, LDAP, Kerberos/NTLM authentication that are the same as traditional domain controllers. You can consume these domain services without the need for you to deploy, manage, and patch domain controllers in the cloud. Azure AD Domain Services integrates with your existing Azure AD tenant, thus making it possible for users to log in using their corporate credentials. The AD DS is available in a VNet of your choice.

Azure AD Domain Services Overview

AD DS works with cloud-only or synced with on-premise AD. Important to know is that Password hash synchronization is mandatory for hybrid organizations to use Azure AD domain services. This requirements is because users credentials are needed in the managed domain to authenticate using NTML or Kerberos.

Continue reading “Azure AD Domain Services an option or not?”

Microsoft Advanced Threat Protecion

Microsoft bied op verschillende diensten Advanced Threat protection aan. Helaas zit er marketing technisch nog steeds hier en daar de naam Defender aan vast, waar het onder water een compleet ander product is. Het is inmiddels geen simpel antivirus pakket meer, maar een all-in-one oplossing tegen aanvallen van buitenaf en binnenuit. Dit gebeurt door Windows ATP voor bescherming van je device, Office 365 ATP voor bescherming van je Email, SharePoint, OneDrive en teams data en als laatste Azure ATP voor bescherming van alle identiteiten.

Als kers op de taart is er voor on-premise omgevingen is het Azure Security center ontworpen, die net als Windows, constant in contact staat met de Microsoft Azure datacenters om data en informatie uit te wisselen. Inmiddels zijn alle bedreigingen zo uitgebreid en geavanceerd geworden dat 1 enkele computer de rekenkracht ontbreekt om alles te analyseren. De kracht van de Cloud komt hier om de hoek kijken. Informatie die verzameld is bij andere klanten wordt gebruikt om jouw omgeving en apparaat veilig te houden. Het mooie is dat de ATP client standaard in Windows 10 is ingebouwd waardoor er relatief weinig hoeft te gebeuren om het in te zetten.

Continue reading “Microsoft Advanced Threat Protecion”

Modernizeer je identiteits en toegangs beheer met Azure AD

Door Azure AD als je centrale Identiteit opslag te gebruiken word beheer een stuk makkelijker en veiliger. Door Azure AD te gebruiken kan je voortaan makkelijk samen werken met andere bedrijven. Door gebruikers van een andere organisatie uit te nodigen, is het niet meer noodzakelijk om deze ook nog is lokaal in je eigen AD aan te maken. Mocht een medewerker van een ander bedrijf uit dienst gaan hoeft deze alleen nog maar uitgeschakeld te worden in de partner organisatie. Doordat er alleen een koppeling is vanuit jouw Azure AD wordt ook automatisch de toegang ontzegt tot de data van jouw organisatie.


Hoe zorg je er voor dat je huidige Active Directory modern beschikbaar komt?

Microsoft heeft een tool beschikbaar gesteld waarmee je alle identiteiten, of een selectie daarvan, kan synchroniseren naar Azure AD. Deze tool heet AD Connect en dient lokaal geïnstalleerd te worden op een server. Er zijn 3 mogelijke synchronisatie scenario’s.

Continue reading “Modernizeer je identiteits en toegangs beheer met Azure AD”

Microsoft Secure Score

Microsoft Secure Score is een manier om te meten hoe veilig je organisatie is in Office 365, Windows 10 en EM+S (Enterprise Management + Security). Hiermee kan je zien hoe veilig je organisatie is ten opzichte van het door Microsoft geadviseerde beleid, als ook andere bedrijven in dezelfde sector.

Microsoft laat met deze tool, die beschikbaar is via EM+S E3 of E5, zien hoe veilig je organisatie nu is, maar ook in het verleden. Door analyses en trends te bekijken kunnen er specifieke aanbevelingen voor jouw organisatie gemaakt worden waardoor je snel ziet hoe je je beveiliging kan verbeteren.

Door de aanbevelingen van Microsoft op te volgen kunnen we de ideale bedrijf score bepalen en deze samen behalen. Het kan soms wenselijk zijn om een aanbeveling niet op te volgen omdat dit de bedrijfsprocessen teveel beperken. In alle aanbevelingen word ook aangegeven wat de mogelijke gebruiksimpact kan zijn door een impact classificatie: Low, Medium en High.

Continue reading “Microsoft Secure Score”

Regelmatig je wachtwoord wijzigen, zinvol of niet?

Mensen blijken zich op een voorspelbare wijze te gedragen wanneer ze een wachtwoord moeten maken wat aan bepaalde vereisten voldoet. Op deze manier werken de eisen die we stellen aan de wachtwoorden die ze bedenken contraproductief, en worden de wachtwoorden dus zwakker.

Afdwingen van lange wachtwoorden werkt niet

Vereisen dat een wachtwoord minimaal 10 karakters lang is, heeft tot gevolg dat wachtwoorden eenvoudiger te raden worden. Mensen hebben namelijk de nijging om korte woorden te herhalen tot de vereiste lengte. Denk aan combinaties als “loginlogin”, “abcabcabc” en “passwordpassword”.

Continue reading “Regelmatig je wachtwoord wijzigen, zinvol of niet?”

Azure AD exclude user from password experation policy

Connect to Azure AD with PowerShell:

Connect-azuread

Now we would like to get an overview of all users, run the following command:

Get-azureAduser

If you have the UserPrincipalName or email address we might shorten the list to just that single user bij adding a filter:

Get-AzureADUser -ObjectId <UserPrincipleName> 

Next task is to link the default password policy without a password expiration to this user. Run the following command:

Set-AzureADUser -ObjectId <UserPrincipalName> -PasswordPolicies DisablePasswordExpiration

Once this has been completed, verify if the policy has been set correctly with the following command:

Get-AzureADUser -ObjectId <UserPrincipalName> | fl UserPrincipalName,passwordpolicies

Connect to Azure AD with PowerShell

On your Windows device open a PowerShell prompt. To be able to connect we first need to make sure that the PowerShell module has been installed. Run the following command and confirm all questions with yes

Install-Module -Name AzureAD

Now we are ready to connect to Azure AD. Because of the different Office 365 clouds, it might be required to add the option -AzureEnvironmentName. Please review your environment below, by default you are hosted in Worldwide.

Office 365 cloud Command
Office 365 Worldwide (+GCC) Connect-AzureAD
Office 365 operated by 21 Vianet Connect-AzureAD
-AzureEnvironmentName AzureChinaCloud
Office 365 Germany Connect-AzureAD
-AzureEnvironmentName AzureGermanyCloud
Office 365 U.S. Government Connect-AzureAD
-AzureEnvironmentName AzureUSGovernment

Run the command:

Connect-AzureAD

You will now be prompted with a sign-in prompt. After sign-in you are connected

Log in screen