Category: Azure

  • AZURE AD – EXTERNAL IDENTITIES (IV) Advanced flowS

    In all our previous posts we had the user sign-up flow take control of the actual creation of the user in Azure AD. The problem with that flow is that if we want to add the user to a group or perform other functions on it (like adding additional attributes) we would have to reply…

  • AZURE AD – EXTERNAL IDENTITIES (III) Custom ATTRIBUTES

    In the previous two posts I explained how to connect External Identities to a Logic App. This allows us to define advanced workflows for signing up external users. The power of Logic Apps is virtually unlimited and the built-in connectors can help us with lots of things. I created a logic app that adds the…

  • AZURE AD – EXTERNAL IDENTITIES (II) Logic Apps

    First of all, I have a confession to make: I’m not a developer to the extend that I cannot write an API from scratch or any other application that isn’t based on pure PowerShell or VBS scripting. Which means integrating an API into External Identities is going to be a challenge for me. I wish…

  • Azure AD – External Identities (I)

    Let’s say you have an application that you want your vendors to access. If this application is Azure AD joined you could create a separate account, you could invite them as a guest using their email address, you can even add their domain name as a connected organization, or you could use external identities. That…

  • F5 – AZURE AD – V16 INTEGRATION

    With the release of v16 of the Big-IP software, F5 has created a fully guided integration with Azure AD. This allows F5 administrators to publish their published services directly into Azure AD including assignment to the application to users and groups. This post goes over the step by step guide and shows you the field…

  • F5 – AZURE AD – ROLE assignments to Header based apps

    In a previous post I talked about using F5 in front of an Header based application using AAD as the identity provider. While we managed to convert claims into headers, we did not yet integrate the capability of user roles into the equation. Perhaps your application uses “roles” based on headers and users are assigned…

  • Active Directory is dead, long live Azure Active Directory

    [this post is my personal view on Azure AD and AD – and does not contain technical instructions – happy to go into discussion on this topic – you know how to find me… ] Last few weeks, out of nostalgia I’ve been installing Windows Server 2000 on a Compaq Proliant with dual Pentium Pro…

  • F5 – AZURE AD – RADIUS MFA AGENT – PART 2

    This post is the second in a short series that uses another Azure AD feature, the NPS agent that allows the Network Policy Server (Radius) in Windows Server to act as an MFA provider using Azure AD MFA. – read the first post on: https://blog.azureinfra.com/2020/05/28/f5-azure-ad-radius-mfa-agent-part-1/ The scenario is still a user logging into an F5…

  • F5 – Azure AD – Radius MFA agent – part 1

    I’ve posted a lot already on the integration between F5 APM and Azure AD to achieve SSO, improve the user experience and even link VPN’s to Azure AD. This post is the first in a short series that uses another Azure AD feature, the NPS agent that allows the Network Policy Server (Radius) in Windows…

  • B2B USERS & INTERNAL APPS – MIM deployment

    In many of my previous posts I talked about B2B users being replicated to your own AD for guest users to be able to login to your backend (Kerberos) applications. This adding of guest users to your AD can be done using my PowerShell script, the MIM guide from Microsoft – although it seems to…

  • F5 – AAD – HEADER BASED – EXTERNAL ATTRIBUTES

    In earlier posts I talked about my favorite authentication protocol ‘Kerberos’, but obviously there are many more authentication protocols such as HEADER based authentication. While we won’t be sending the password of users straight to the backend webserver we can send additional information. Azure AD App Proxy in combination with Ping Access can already do…

  • F5 – AAD – VPN with MFA

    In earlier posts I talked about using F5 as a reverse proxy to Kerberos based resources using Azure AD authentication. This post takes it a step further. Creating an SSL VPN based on Azure AD identities with Conditional Access (if needed). So, the architecture: As you might have seen, there is no Active directory in…