Loading...

The hardware

Sometimes I get the question; what do you work with.? as in .. which computers.. and to provide an answer: This “oh look at my hardware” post.. or more like “the hardware pissing contest equivalent” on many of the blogs.. In short, I don’t like to buy brand new stuff.. its expensive, it looses value like […]

Read more

Multi-domain ADFS with alternateID login

So, I got a question the other day on using ADFS in combination with some 3rd party applications in a very large AD environment. Basically the problem statement was: “ we don’t want to use UPN and we don’t want to use domain\username. Users should be able to login using either (only) their employeeID or […]

Read more

Azure AD Lockout configurations – avoiding AD account locks

On Monday morning, the office opened, and everyone tried to login to their computers, however no-one seemed to be able to login. The helpdesk was quickly flooded with calls and it seems everyone’s account was locked-out.

It could happen to almost every company that does not have a good policy on lockouts. Hackers try as many usernames and passwords as possible to get in or to deliberately lock everyone out. A Denial of Service attack in a different form.

When you are using Azure Active Directory with a password on-premises, this might become a reality. As many attempts are made on the ADFS server in a Federated architecture, the account in AD itself gets locked out.

But there is a way to avoid that. It is possible to have a pre-emptive lockout on ADFS while the internal AD account is still usable. This means users will not be able to login remotely to ADFS anymore for a period, but they will still be able to logon to their domain joined machines. When configuring this, make sure that the lockout is set to a lower standard than your internal AD policies. For example, if your AD policy states 5 attempts, 10 minute lockout, ensure that the ADFS policy is set to a maximum of 4 attempts.

(more…)

Read more

Azure AD Dynamic Group Membership on Custom attributes

In Azure Active Directory you have the option to create dynamic groups. These are groups where members are added based on a formula that uses the attributes known on a user object in Azure AD. For example you can create a dynamic group of all users that have a specific job title: But what if […]

Read more

Your applications in a Cloud World

The existing method of controlling user accounts and workstations in another mayor (and smaller) company is usually based on the proven technology of Active Directory. The advantage of domain joined workstations is that it is easy for IT to impose limits and enable features that make it easy for users to start working. Mapped drives, […]

Read more

ADLS: The portal is having issues getting authentication tokens….

The portal is having issues getting authentication tokens for Microsoft_Azure_DataLakeStore a common error that happens under certain conditions and only if you did not read my previous post azure-data-lake-managing-data-access. In short, the error comes when the ADLS administrator has added your account to ADLS without adding the user to Azure AD (inviting you as a guest). […]

Read more

How to connect to Azure Services

When deploying services in Azure, the connection to those services is important. Some services might require public access, while for other services you want to have a more private connection.. this post goes into the different options.. and what to take into account when connecting to services deployed in Azure.. Within Azure there is a […]

Read more

Azure Data Lake – managing data access

When setting up Azure Data Lake services, it is possible to combine access to the actual data with Azure Active Directory B2B. The combination of these services allow external vendors and or partners to connect to the data in Azure Data Lake, but under the governance of your and their company. The logins for accessing […]

Read more

Highly Available Azure GW’s and Juniper SRX

Pretty quietly Azure has released the option of using redundant VPN connections. In this case, the gateway in Azure actually gets 2 external IP addresses that our on-premises Firewall can connect to. In this chapter, a small update on the Juniper SRX, BGP to Azure post. So that after following this guide, you can actually […]

Read more

AAD Pass-Through Authentication – SSO without ADFS

There are multiple options for authenticating users against Azure AD. But until now, full support for SSO based logins was only possible using two options. Azure AD joined devices, or a local ADFS service to your on-premises Active Directory. The latter being the most used option it also had its problems, first of all you […]

Read more