Section 6 and further Flashcards
(44 cards)
Connecting on prem to Azure ADD
Domain name must be available, DNS must be accessible online.
Seamless SSO
Users logging in on prem also get logged on through the cloud
Create new DNS database
Add this to your domains
See where this is located via a user
DNS > Forward Lookup Zones > zone = abccorp.com > finish
Tools > AD Domains and Trusts > Right click AD Domains and trust > properties > add abccorp.com > ok
AD Users and Computers > right click your user > properties > account > drop down box with logon name suffix > you’ll see domain
Sync your domain with Microsoft 365 admin center
admin.microsoft.com > show all > settings > domains > Domain name = abccorp.com > Create a text record with one of the values
From local server
DNS > right click abccorp.com > other new records > TXT > create > Don’t worry about record name, add MS=ms3298638 in text and that’s it.
This needs to be internet facing
TXT record - generic record
MX record - mail exchange record
GoDaddy - put in creds and it will just fill everything out for you.
Make your domain the primary domain on microsoft365
portal.microsoft.com
or
admin.microsoft.com?
Show all > settings > domains > Click domain > set as default
Now if got to Users > active users > add users > it will be primary domain
If users added ahead of time, before domain was connected, etc
Do via powershell and via microsoft365
admin.microsoft.com
Users > Active Users > click user > manage username > drop down domain for upn > if user has office365 liscence their email with exchange online will get updated
Licenses and Apps > give the user whatever stuff you want like office 365 E5
connect-msolserver <- connect to microsoft365
set-msoluserprincipalname -userprincipalname bobjones@examlaprcactice0920.onmicrosoft.com -newuserprincipalname bobjones@examlabpractice.com
get-msoluser
You’ll need to refresh on Microsoft365
Look up what records you need to link up with microsoft365
Lookup external domain name system records for office 365
DNS > right click examlabpractice.com >
What are the two options for authentication with the hybrid identity model?
Managed Authentication - Azure AD will handle the authentication process by using a locally-stored hashed version for the password or sends the creds to an on-premise software agent to be authenticated by on-premise AD DS
(Azure gets copy of encrypted creds, so it has what it needs)
Federated Authentication - Azure AD redirects the client computer requesting authentication to another identity provider.
(Federated server can go to an ADFS AD federated server on premist that handles it or it could be authenticated by someone else)
What are the two types of managed authentication?
Password hash Synchronization (PHS)
- Azure does Authentication itself
(recommended) Even if contact with lost connection to domain, you can still log in
Pass-Through Authentication (PTA)
- Azure AD has AD DS perform authentication and they don’t know the passwords.
If we lose our domain people authenticating via cloud won’t be able to login
What is PHS
Password Hash Synchronization
You sync your ADDS user accounts with Microsoft 365 and manager your users on-premise. Hashes of user passwords are synced from your AD DS to Azure AD so that the users have the same password on-premise and in the cloud. This is the simplest way to enable authentication for AD DS identities in Azure AD.
What is PTA
Pass-through authentication
This provides a simple password validation for Azure AD authentication services using a softward agent running on one or more on-premises servers to validate users. You sync ADDS user accounts with Microsoft 365 and manage users on premise
Agent is installed on computer that communicates with AzureAD and authenticates.
What is federated authentication
Large Organization
3rd party authentication.
AD DS identities are synced with Microsoft 364 and user accounts are managed on-premises.
Same password on-premises and in cloud, they don’t have to sign in again to user Microsoft 365
Supports smartcard-based authentication or 3rd party multi factor authentication and is typically required when organizations have authentication requirement not natively supported by Azure AD.
If Azure can’t connect with your federated server then everyone outside can’t logon.
What to do before syncing to the cloud
IDFix - for Cleanup
Azure AD Connect Helath - Health of the environment
Look back 100 days of errors
Remove object that are un-needed
service accounts, groups, etc
Sync failover and disaster recovery
If the Azure AD Connect Sync Server goes offline what happens and what is a solution?
There can only be one sync server
Changes to on-premises cannot be updated in the cloud and can result in access issues for users.
Deploy Azure AD Connect Server in staging mode. - Allows admins to promote the staging server to production by a simple config switch. It sits passive until other server goes down.
OR
Use Virtualization - if Azure AD connect is deployed in a VM, admins can leverage their virtualization stack to live migrate or quickly redeploy the VM and resume sync
Where can you enable staging mode?
At the end of the Microsoft Azure Active Directory Connect menu, on Configure, click the box.
What is a Source Anchor
VIDEO 55
Attribute that on-premises and Azure AD have, it’s also called immutableID.
Links objects in Azure AD with objects on-premises. For instance, my account on premises is actually different than the account on Azure, technically. This makes them linked/look the same.
Using ms-DS-consistencyguid as source anchor allows easier migration of object across forest and domains, which is common in AD Domain consolidation/cleanup, mergers, acquisitions, and divestitures
What is Seamless SSO?
Eliminates unnecessary prompts when users are signed in.
Create a group for who get synced first
Server Manager > ADUC > RIght click IT OU > New group > Cloud Admins > add someone to it > add administrator and whoever else.
Describe how the Password Hash Sync works
Server running AD > Azure AD Connect installed on server maybe this is a different server > AD Connect creates password hashes and send to AzureAD and can communicate with it > Users can authenticate with Azure AD and he can access Micrsoft365.
Microsoft will monitor passwords to see if they’re on the dark web
How does pass-through Authentication work?
On Prem ADDS > Azure AD Connect Server > PTA agents (two of them), should be installed on two different servers, they can be on any type of server, like a file server >
Authentication Agents pull from Azure AD constantly. Nothing’s actually coming in, so no ports are open, so no DMZ or anything needed. They’re waiting for user authentication from the cloud.
How does Federated Authentication work?
On premise ADDS > Azure AD connect > Need two ADFS (Active Directory Federation servers) > Tell Azure AD connect about the two servers > We don’t want the ADFS exposed online so use two Federated proxy servers port 443. FIrewall between everything and these, then between those and online.
Federation servers give users an access token to authenticate with azure AD.
User tries to authenticate with Azure AD > Azure AD tells the computer to go to federated proxy > federated proxy will talk to federation server and it will talk to ADDS which will verify creds and get back with Federation Server which creates access token > Federated proxy > User > User is then authenticated with Azure AD > AzureAD generates an access token the allows user to access their cloud products like microsoft 365
REMEMBER THAT AZURE AD CONNECT IS JUST THERE TO TRANSLATE BETWEEN AZURE AD AND YOUR DOMAIN. DIFFERENT PROTOCOLS ARE USED ON A LOCAL DOMAIN RATHER THAN AZURE AD, LIKE LDAP AND KERBEROS AREN’T USED IN AZURE AD.
Cleanup AD DS before using Azure AD Connect
Azure AD won’t allow invalid characters like no spaces
Server Manager > tool > ADUC > create new user Sam Jones and make a space in the UPN.
On windows 10 > google search download idfix > grab from github > ClickOnce Launch > run > Install
From IDFIX > query (this will locate problem users > Action should be edit > Apply > rerun query to confirm
Download Azure AD Connect
After you’re finished go to Azure Active Directory Connect Health
portal.azure.com
Entrai ID AD
Azure AD connect/entra id connect
Download
Agree to terms
Customize
Don’t choose any of these options
Install
You have your sign in options
choose Password Hash Sync
enable single sign-on
enter global AD creds
AD Forest account - account that create syncronization (has to be global admin)
GAMESHARKS\administrator
password
Domain and OU Filtering - information and users that you want synced.
Sync selected domains and OUs > drop down to IT like we set up earlier (you can sync the rest later)
Optional Features
Azure ad app and attribute filtering -
This syncs attributes from the cloud to on premises.
Password writeback - change password on cloud and it reflect back to on premises.
Directory extension attribute sync - attributes from inside are synced out.
Directory Extensions -
Select what you want to sync
Staging - sets everything up but doesn’t sync. Primary server you wouldn’t want staging mode, you do this on another server for redundancy.
Now on portal.azure.com
Look up Users and it will show the synced users.
Entra-id Connect, will show sync status enabled
Click Azure Active Directory Connect Health
Click for Sync errors
Click for Sync Services to see if healthy
AD DS services < - any problem with syncing with AD Services < you have to install on domain controlled to get this though
Edit group policy object for password
Server Manager > Tools > Group Policy MGMT console > Group Policy Objects > Right click Default Domain Policy > edit > computer configuration > policies > Windows Settings > Security Settings > Account Policies > Password policies.
Look at options
Minimum Password length audit policies > gives warning messages
Reversable encryption - old > dos computers couldn’t store passwords that were encrypted so passwords wouldn’t be encrypted on their machines. It should be turned off ALWAYS.
ACCOUNT LOCKOUT POLICY
When accounts locked out due to attempts
duration < - how long they’re locked out
threshold <- how many times failed
Lockout counter after <- counter between each bad password before it is viewed as one duration.
