Category: Azure

  • Azure P2S VPN with MFA

    As Microsoft enabled the Radius option in the Azure Gateway VPN configuration, it now means you can enable MFA on your P2S connections! There is a caveat however. It only works if you have replicated your users from an Active Directory into Azure Active Directory. If you have cloud-only user, it doesn’t work (yet..) I’ll…

  • Enable/Disable Accelerated Networking on Azure VM’s

    Microsoft Azure has the option to enable Accelerated Networking on VM’s. More information on the feature can be found here but this post is not to tell you about what good it does nor how it works.. no, this post is to introduce a new script that will enable/disable the function for you! update: it’s…

  • Even strong passwords are… stupid

    While this blog is mostly focused around passwords and how to ensure people can login, the new direction within Microsoft is to get rid of passwords. I can already feel the shock from many security officers reading this post, but hear us (eeuh Microsoft) out on this one. Passwords are by default unsecure, they require…

  • Azure Active Directory Pass-through Authentication part 2

    In the initial post, we looked at PTA from a high-level perspective. This post goes into the actuals and internals of the PTA to ensure you can convince your security department on why PtA is a very good idea. Inside Azure AD there are multiple components that work together to ensure the safety of your…

  • ImmutableID – mS-DS-ConsistencyGuid – ADConnect – final part

    One of the most looked at topics on this blogpost is the ImmutableID series for Azure AD Connect and AADSync. And I wanted to give an update to this, given the latest versions of Azure AD Connect seemed to have adopted the idea to use the ms-ds-ConsistencyGuid (or any other value) to replace the ImmutableID…

  • Azure Stack Development Kit – moving around (changing IP’s)

    When you have your Azure Stack Development Kit, you might want to show it off to your customers or simply change the external IP address for some other reasons.. as we have seen earlier there is a dual NAT mode inside the Azure Stack Dev Kit box. The AzS-BGPNAT01 VM receives an external IP address…

  • Azure Stack Development Kit – BGP

    Now that we have our Azure Stack Development Kit in routing mode, we can also send the BGP information from within the Stack to the Juniper Firewalls (or any FW you have..). This will ensure that the new “external IP addresses” that are assigned to our workloads are accessible via our intranet route information and…

  • Azure Stack Development Kit – Deployment overview (troubles)

    Side Note: The experience of ASDK as described in this post are based on the late July bits of Azure Stack on a Dell T710. Future experience might (I certainly hope so..) be better and more integrated..  The T710 described in an earlier topic was purchased to run Azure Stack. And while I’m still waiting…

  • Azure AD – PtA – SSO – Office 365 ProPlus Auto Activation

    You invested in Office 365 for you users, but you don’t want to annoy them with prompts where they have to put their usernames and passwords in, certainly as you have domain joined devices. For Office 365 ProPlus License Activation utilizing the SSO capabilities, you either had to put in an ADFS infrastructure or.. available…

  • Azure AD – Pass-through Authentication SSO – reset password

    We’ve already covered Azure AD PtA with SSO. Where a local computer object is created in your on-premises AD to help with the authentication. While the password of the object is changed periodically.  Many organizations have the requirement to reset the computer password on the fly or at a faster interval. Microsoft has released a…

  • Multi-domain ADFS with alternateID login

    So, I got a question the other day on using ADFS in combination with some 3rd party applications in a very large AD environment. Basically the problem statement was: “ we don’t want to use UPN and we don’t want to use domain\username. Users should be able to login using either (only) their employeeID or…

  • Azure AD Lockout configurations – avoiding AD account locks

    On Monday morning, the office opened, and everyone tried to login to their computers, however no-one seemed to be able to login. The helpdesk was quickly flooded with calls and it seems everyone’s account was locked-out. It could happen to almost every company that does not have a good policy on lockouts. Hackers try as…