Category Archives: Azure

Azure AD Connect (Dirsync) Password Sync taking too long

I was assisting a customer who reported that Azure AD Connect (aka Dirsync) was taking too long for passwords to synchronize. It was such a huge lag that they assumed it was broken entirely.

Upon inspecting the Application Event Log on the Dirsync server for event ID 656, I observed a large gap between when the password was set on the Domain Controller and when the Event log on the Dirsync server picked up the change.

SNAGHTML61bdfde

This is not expected because the synchronization service polls on-premises AD for password changes every 2 minutes for password updates. The overhead to then hash the password, transfer it to Azure AD’s connector, and received on the far end is an additional minute (if all the stars are aligned). So three minutes is a reasonable expectation for passwords to sync to Azure AD. However, 14 minutes? Something ain’t right!

Upon inspection in the MIIS client, I observed that the domain controller that Dirsync was connecting to was 62 milliseconds away, and *not* the nearby DC in the same site as Dirsync. This is viewable in the ‘last used’ field in the screen shot below.

The Fix

Configuring Azure AD Connect to use preferred domain controllers solved the problem.

SNAGHTML6259900

Results

This reduced the synchronization lag from 14 minutes to 40 seconds! That is a 95% percent reduction in lag!

SNAGHTML623b3f5

Need help with an Office 365 Project? Visit our website at www.PatriotConsultingTech.com or drop us a line at [email protected]

When to use an Instance Level IP (ILPIP) in Azure

Instance Level IP addresses (ILPIP) are distinct from other types of IP addresses in Azure and have a very specific purpose and benefit. They are limited to 5 per Azure Subscription and intended to permit applications such as passive FTP to function, which requires a lot of open ports. They bypass the load balancer and firewall, allowing direct access to the VM. They do not take the place of the VIP assigned to the load balancer, but they can only be added alongside a VIP. At this time, an ILPIP cannot be added to VM’s that have multiple NICs (yet?).

image

Instance Level IP’s cannot be reserved and therefore are lost when the VM is shut down. They can dynamically register to a hostname that can be used in a CNAME record, so that if the IP changes, you are still fine as long as you point things to the CNAME record and not the IP address.  Another benefit is that the source IP address comes from the VM rather than from the IP of the load balancer.

Something to be aware of is that ILPIP’s do not use the Endpoints feature in Azure, and therefore all internet ports are open – requiring the use of a host-based firewall to be running on the VM to filter traffic.

You can assign ILPIP to an existing or new VM by piping set-AzurePublicIP as follows:

Get-AzureVM -ServiceName ftp01 -Name ftp01 | Set-AzurePublicIP -PublicIPName ftp01pip01 -IdleTimeoutInMinutes 4 -DomainNameLabel ftp01pip01 | Update-AzureVM

Then the CNAME record would point to the PublicIPFQDNs that is revealed when you run a get-AzureVM command. For example: ftppip01.ftp01.cloudapp.net

To request an ILPIP during VM creation you would use this command:

New-AzureService -ServiceName FTPService -Location "Central US"
$image = Get-AzureVMImage|?{$_.ImageName -like "*RightImage-Windows-2012R2-x64*"}
New-AzureVMConfig -Name FTPInstance -InstanceSize Small -ImageName $image.ImageName `
| Add-AzureProvisioningConfig -Windows -AdminUsername adminuser -Password [email protected]!! `
| Set-AzurePublicIP -PublicIPName ftpip | New-AzureVM -ServiceName FTPService -Location "Central US"

References:

https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-instance-level-public-ip/

http://blog.siliconvalve.com/2015/06/29/setting-instance-level-public-ips-on-azure-vms/

Containers in Windows Server 2016

Mark Russinovich demonstrates containers in Windows Server 2016. There are enhancements to the windows 2016 server kernel that allows multiple instances of user mode processes.

https://azure.microsoft.com/en-us/blog/an-early-look-containers-windows-server-2016-hyper-v-and-azure-with-mark-russinovich/

After watching the 15 minute video, here is the quiz:  what is the difference between a Windows Server 2016 Container and a Windows Server 2016 HyperV Container?

Answer: Hyper-V Containers provide isolation whereas Server 2016 Containers do not isolate the container processes form the host.

Which is right for you? A HyperV container or a Windows Server container?  Mark answers that question at 9:45.

When does a Windows Server container make sense over a HyperV container? It seems that when you do not require isolation, you would use Windows Server Containers.

Both of the above options are relevant for on-premises data centers. A 3rd option to evaluate is Azure Container Services, which is what cloud first companies will select first.

Azure AD Connect Password Sync fails for multiple forests

In two different environments I have reproduced behavior where Azure AD Connect does not synchronize passwords when it is configured for multiple source AD forests.

The fix has been to change the ‘Configure Directory Partitions’ credential setting from ‘Use default forest credentials’ to ‘Alternate credentials for this directory partition’

No service restart or reboot required. The way to test it is to reset a password and then monitor the Application event log on the Azure AD Connect Server. Within 2 to 3 minutes you should see an event log entry that the password has been successfully set.

image

How to see console output from a VM in Azure IaaS

Earlier this month (Sep ‘15) Microsoft announced a new diagnostic capability for VMs running in IaaS – the ability to see serial and console output from a running Virtual Machine. We take this capability for granted when we host our own data center, but having this capability for VM’s running in the public cloud is useful when troubleshooting boot failures.

This capability is available for new and existing version 2.0 virtual machines (aka Azure Resource Manager (ARM) created in the preview portal.

stackSelector

Then toggle the monitoring option

enableMonitoring

Note, screenshots and output can take up to 10 minutes to appear in your storage account.

What I learned at the Microsoft Ignite Conference (Chicago 2015)

The 2015 Microsoft Ignite Conference (May 4 – 8) was held in Chicago and included over 1,000 sessions on a range of Microsoft technologies.  The conference sessions and focused intent seemed to me to be predominately focused on the new “Cloud First” and “Mobile First” mission statement for Microsoft.

Historically, Microsoft uses events like Ignite to announce new products and features, so it is always an exciting time for IT Pro’s and customers alike.

I was fortunate enough to attend several of the sessions on Azure and Office 365, and I’m eager to share some of the highlights here. This is not intended to be an exhaustive or comprehensive list of what was unveiled, but rather, just my own individual experience and take-aways. I plan on watching several sessions that I missed – and you can too (see ‘Catching Up’ at the bottom of this blog post). 

For Julia White’s (General Manager of O365 Marketing) overview of Ignite, I recommend reading her blog post (here). Jennifer Marsman also wrote a great recap of the Build conference (here).

Azure Stack

Azure Stack is the private cloud version of what is known as Azure today. There was some initial confusion at the conference on whether this was a replacement for Azure Pack. When I spoke to the product managers at Microsoft, they said if customers are happy with their existing Azure Pack, that’s great, keep using it. But for those customers who want the same exact code as what is running in the Public Cloud, then Azure Stack is for them. Azure Pack relied upon System Center whereas Azure Stack will not. I would not be too shocked if Azure Pack is shelved because there appears to be clear overlap between these two private cloud offerings.

Azure Stack is scheduled for GA in H2 2015. When Azure Stack is released, it will not have all 48+ of the features in the public version of Azure, but it will have Compute and a few others.

Azure

  • Azure now has datacenters in more locations than Google and AWS combined
  • Venkat Gattamneni posted that Azure shines bright at Ignite! that “…in the last 12 months, we’re proud to have added over 500 features and services to the platform.”
  • Azure Resource Manager will allow you to deploy Gallery templates to both Azure Stack and Azure IaaS Public Cloud.
    In his blog post, Corey Sanders goes into lots of detail about ARM, templates etc. He says “This new template language will enable you to easily stitch together VMs, Virtual Networks, Storage Accounts, NICs, Load-balancers, and other PaaS services, like App Service and SQL Databases, in a single coherent application model.”
    The construction of a .JSON file is all that is required. Azure Resource Manager enables you to build and manage large scale applications in an agile and repeatable manner. Complex networking infrastructures can now be composed using simple JSON templates. Azure Resource Manager enables additional capabilities such as Role Based Access Control (RBAC), tagging of resources, and advanced auditing for resource usage. The significant change that ARM introduces is that when creating a VM in ARM mode, there is no dependency upon a cloud service. This enables ARM to spin up thousands of VM’s without the previous limitation that a cloud service imposed on a VM. For example, previously you could only deploy 50 virtual machines in a cloud service. So now, with a .JSON file, you can spin up 100 VM’s without the limitation of a cloud service holding you back.
  • DNS as a Service.  Think GTM (Global Traffic Management) in the Cloud. Azure DNS uses anycast networking, so that each DNS query is answered by the closest available DNS server. The only drawback is there is no GUI interface (yet) – just PowerShell management for now.  50 cents per DNS zone and 20 cents per million DNS queries.
  • Azure Cloud Service now supports multiple VIP’s
  • Several security enhancements: Host Guardian Service, Virtual Secure Mode, and Shielded VM: This is a virtualized vTPM module to support the encryption of guest virtual machines. Requires TPM 2.0.
  • Several network enhancements, ex: User defined routes, IP Forwarding, Floating Nics, ExpressRoute Premium Add-on. This add-on enables up to 10,000 BGP routes. Once your traffic enters an ExpressRoute meet-me site, you can reach ANY Azure region across the globe. Reserved IP addresses can now be moved between services. This supports scenarios where you want to quickly move an external IP between VMs.
  • Azure VPN gateway now supports Site-to-Site VPN and ExpressRoute coexistence.
    For additional details: http://azure.microsoft.com/blog/2015/05/05/new-networking-capabilities-for-a-consistent-connected-and-hybrid-cloud/
  • I learned that the Azure AD Proxy connector supports multiple connectors for automatic load balancing. On the roadmap is the ability to pin a particular app to a connector.
  • Azure Data Lake is “A hyper scale repository for big data analytic workloads.” See “What’s a Data Lake?” And check out Introducing Azure Data Lake for more info and to sign up to get notified when a preview is available. You might also watch this 3 minute video.
  • The public preview of client-side encryption in the Azure Storage client library for .NET. You can use client-side encryption to encrypt blob data, table data (you select the properties to encrypt), and queue messages. Client-side encryption also integrates with Azure Key Vault and allows for integrating with other key management systems if you prefer. client-side encryption blog post
  • Import/Export now also supports up to 6 TB hard drives. Click (here) for more information.
  • Azure Site Recovery enables customers to deploy application-aware availability on demand solutions. Azure Site Recovery solutions have been tested and are now supported for SharePoint, Dynamics AX, Exchange 2013, Remote Desktop Services, SQL Server, IIS applications and System Center family like Operations Manager. Read all the details in Abhishek Agrawal’s blog post
  • The Cloud Application Discovery feature is now Generally Available and integrated into the Azure preview portal. This tool can help identify ‘shadow IT’ where users are using 3rd party SaaS apps like DropBox without letting IT know about it. You get started by adding “Azure AD Cloud App Discovery” in the new Azure portal. You must first have an Azure AD Premium license assigned before you can use this tool. Cloud App Discovery enables you to:
    • Discover cloud applications in use within your organization
    • Identify which users in your organization are using an application
    • Export data so you can analyze it offline in other tools
    • Prioritize applications to bring under IT control, with single sign-on and user management.

Office 365

  • Equinix, AT&T, and BT will be the first MPLS carriers to enable connectivity between Office 365 and on-premises network (coming) Q3 2015. This enables end-to-end QoS which is particularly helpful when considering the Skype for Business Online (Formerly Lync Online) capabilities coming in September that will enable PSTN (dial tone) for outbound and inbound enterprise voice phone calls in the Cloud.
  • Sway is now part of Office 365. See this blog post for more information.

  • Office Delve organizational analytics. Provides an interactive dashboard for teams and individuals to identify key trends across employee engagement, team connections and even views like work life balance

  • Significant improvements in Office 365 Video management are coming. Admins will have the ability to remove or manage posted videos. Ability to share externally is coming too.

  • Significant improvements in Office 365 Groups management are coming (naming conventions, etc). A mobile app for Groups is coming.

  • Riverbed WAN optimization appliances can de-dupe Exchange Online traffic and SharePoint Online traffic by having your internal CA issue a certificate to masquerade as Outlook.com or Sharepoint.com. 90% traffic reduction in Exchange Online traffic! Downloading a 20 megabyte file from SharePoint Online would normally take ~60 seconds whereas with Riverbed it is 33x faster.

  • There is a new compliance center for Office 365 coming that will allow you to create one DLP policy that will then apply to SharePoint Online, OneDrive, Exchange and also the Office 2016 clients. For example, you can be in an Excel worksheet and type in a credit card number and you will get a policy tip notification that it is a violation of policy to have credit card data in Excel. Interesting!

  • There is a new Knowledge Management Portal for Office 365. Delve Boards are the building blocks. “Add to board” button will be added everywhere throughout Office 365.

  • This doesn’t belong in this category, but SharePoint 2010 farms will not have a direct upgrade path to SharePoint 2016. They will have to be upgraded to 2013 first (double-hop migration).

  • Modern Authentication for Office 2013 clients. http://channel9.msdn.com/Events/Ignite/2015/BRK3136

Exchange 2016

  • Architecture. CAS Role goes away. http://blogs.technet.com/b/exchange/archive/2015/05/05/exchange-server-2016-architecture.aspx
  • Deploying 2016
  • Exchange Server is now supported in Azure IaaS on Azure premium storage. Why anyone would do this… is for another blog post.
  • OAUTH now has a wizard in Exchange 2013 and 2016. This enables cross-premises Discovery and MRM. Also, cross-premises free/busy will attempt to use OAUTH first before the MSFT Federation Gateway, so it is a good idea to use OAUTH when possible. Why not?

Skype for Business

  • Broadcast Meetings up to 10,000 participants (up from 250 in Lync Online)
  • IIS ARR servers can be configured for Edge Caching – this enables users to view the skype broadcast meeting from the local cache rather than hammering the internet egress.
  • Call Quality Dashboard is available for download. Offers aggregated call quality information for on-premise deployments. In addition to a set of system reports that will be created as part of the install to help you view and diagnose network infrastructure issues affecting call quality, you will also be able to quickly and easily create additional reports tailored to your needs.
    http://www.microsoft.com/en-us/download/details.aspx?id=46916
  • To get the new Skype directory to appear, you need to remove the previously configured Skype Public Provider.
    See this article for more information: Enabling Skype Federation with Skype for Business Server or Skype for Business Online

Microsoft Operations Management Suite (OMS)

  • Click (here) for more details.
  • Includes Security Threat Analysis

Windows 10

  • Cortana is connected to PowerBI in the Windows 10 start menu

  • Device Guard in Windows 10

  • Windows Update for Business

Devops

Nano server is a tiny version of Windows Server.  Remember Windows Server Core? It’s like that but is 20x times smaller, hence the name “Nano.” In the demo I saw, the whole server consumed only 128 MB of Ram, and only 500 MB of hard disk space. Wow! From what I can tell, it is only managed externally through WMI or PowerShell, so there is no GUI or security logon inside of it.

Windows Nano Server was previously announced in April, but there were several more sessions on it at Ignite. Nano Server is best understood in the context of DevOps and the containerization of Docker. From what I can tell, Nano has little use outside of a development strategy that includes containerization (aka Docker).

Catching Up

All the ignite sessions and PPT presentations are available at Channel9 and here.

Vlad Catrinescu (MVP) posted a powershell script on Technet that allows you to download all the Ignite Videos and presentations. Or if you don’t have 300GB of disk space, you can also create a filter to just download the content you want, ex:

.\downloadignitevideosandslidesv4.ps1 -keyword “SharePoint,Azure,System Center
https://gallery.technet.microsoft.com/all-the-Ignite-Videos-and-b952f5ac

Read my LinkedIN post “Suggestions for staying on top of technology trends

Random Insights

VM level backups now available in Azure Backup

As far as Azure IaaS goes, this is the biggest improvement to the platform since the ExpressRoute offering.

The announcement is here, and I highly recommend reading it:
http://azure.microsoft.com/blog/2015/03/26/azure-backup-announcing-support-for-backup-of-azure-iaas-vms/

The highlights:

  • With Azure Backup, you can now get application consistent backup of Windows VMs without having to shut down the VM.
  • “In order to backup IaaS VMs, the customer needs to deploy absolutely nothing”*
    Note: This is accurate insofar as you have the Azure VM Agent installed (see Prerequisites below)
  • Azure Backup truly achieves “set-and-forget” for VM backups.
  • Azure Backup does additional processing to determine the incremental changes between the last recovery point and the current VM state. By transferring and storing only the incremental changes, Azure Backup is highly storage efficient.

Azure VM Agent Prerequisite

  • A very important prerequisite is that the Azure VM Agent must be installed. This is performed when the VM is first created, but if you uncheck the box to install the agent, then you will not be able to back it up with the new VM level backup feature.
    image
  • If you do not have the Azure VM Agent installed, you will get an error message during the registration job step:
    ”Failed to install the Azure Recovery Services extension on the selected item. VM Agent is a pre-requisite for Azure Recovery Services Extension. Please install the Azure VM agent and restart the registration operation.”
  • You can manually download and install the VM Agent if it is not installed on the VM, see this article for more information:
    https://msdn.microsoft.com/en-us/library/dn832621.aspx
  • The VM agent itself can be downloaded directly from (here) and is very small and takes seconds to install.
  • After manually installing the agent, it is necessary to set the ProvisionGuestAgent value to true using Powershell or a REST call. If you do not set this value after manually installing the VM Agent, the addition of the VM Agent is not detected properly.)
  • See my blog post for manually installing the VM agent for step by step instructions:
    http://tctblgs.azurewebsites.net/manually-install-the-azure-vm-agent/

Seeing it in Action!

Assuming you have already setup your recovery vault, and your VM’s have the VM Agent installed, then there are three easy steps to start backing up VM’s in Azure IaaS

image

After clicking on ‘Discover Virtual Machines’ you then click on the Discover button at the bottom of the screen.

image

After discovery completes, you then click on the Register button.

image

This brings you to a screen to select the VM’s that you want to protect.

image

Clicking on the checkmark will spawn a register job that can be viewed on the Jobs tab. In my case, this job took 4 minutes to run.

image

Now that we have a VM registered, the next step to perform is step number 3, “Protect Registered Azure Virtual Machines.

image

image

Select the item you want to protect

image

You can then select an existing policy or create a new policy

image

When the backup has taken place, you can view it under protected items.

image

You can force a new backup or you can click on Restore to bring the VM back to life as a new VM standing next to the old one (it does not overwrite the existing VM).

image

Restoring a backup

A backup is only “good” if you can verify it by performing a restore. Until then, you should not trust your backups. I have learned this the hard way in the trenches =)

It is interesting that when you restore a VM, it does not overwrite the existing VM, but it instead deploys it alongside the current VM.

image

You can check the Jobs tab to see how long the restore will take. In my case, the restore took 23 minutes.

image

When the restore job completes, you can view the job notes:

image

To view the restored VM, I had to sign out and back into the Azure Management portal, but then I saw the restored VM amongst my other VM’s:

image

This raises a practical operational question where you need to be sure to shut off the old one before the new one starts up otherwise in a batch environment you wouldn’t want two VM’s running the same batch (you get the idea, you need to know what your VM’s are doing and coordinate properly).

Therefore, it would be good to have an option during the restore process for Azure to automatically shut down the original VM on your behalf to tighten-up the handoff, as you want to avoid having two machines with the same computer name and SID running on the network.

For example, in my restored VM, I can see it still has the original computer name (as I would expect) and so even though the name of the VM in Azure shows as ‘MyRestoredVM’ the actual computer name maintains the original name. (This is okay behavior, but just remember we need to shut off the original VM now too). I posted this feedback on the Azure Feedback portal, please click (here) to vote if you agree and would like the Azure Product team to include this feature in a future release.

image

Manually install the Azure VM Agent

 

When you first deploy a Virtual Machine to Azure using the Gallery, you have the option of installing the VM Agent. You should always leave this box selected because it adds tremendous value.

image_thumb[8]

VM extensions can help you:

  • Modify security and identity features, such as resetting account values and using antimalware
  • Start, stop, or configure monitoring and diagnostics
  • Reset or install connectivity features, such as RDP and SSH
  • Diagnose, monitor, and manage your VMs
  • Backup your VMs with the new Azure VM level Backup feature (see my blog post here for more information on that feature announced March 26, 2015).

The agent allows you to add extensions to the VM, for more information, see this article:
https://msdn.microsoft.com/en-us/library/dn832621.aspx

You can manually download and install the VM Agent if it is not installed on the VM, see this article for more information:
https://msdn.microsoft.com/en-us/library/dn832621.aspx

The VM agent itself can be downloaded directly from (here) and is very small and takes seconds to install.

After manually installing the agent, it is necessary to set the ProvisionGuestAgent value to true using Powershell or a REST call. If you do not set this value after manually installing the VM Agent, the addition of the VM Agent is not detected properly.) The following code example shows how to do this using PowerShell where the $svc and $name arguments have already been determined

$vm = Get-AzureVM –serviceName $svc –Name $name
$vm.VM.ProvisionGuestAgent = $TRUE
Update-AzureVM –Name $name –VM $vm.VM –ServiceName $svc

Before you can run the powershell commands above, you first need to install the Azure Active Directory powershell module and then run the add-azureaccount command. Then to make sure you can see your VM’s, you can run get-azurevm.
image_thumb[9]

In this screenshot you can see I have two VM’s, one with the agent installed and one without it.

image_thumb[12]

So after manually installing the VM Agent, I can then run these commands to update Azure so that it knows the agent has been installed inside the guest VM:

$vm = Get-AzureVM –serviceName TCTCloudService –Name MyBackupTest
$vm.VM.ProvisionGuestAgent = $TRUE
Update-AzureVM –Name MyBackupTest –VM $vm.VM –ServiceName TCTCloudService

image_thumb[14]

Now when I check for guest agent status, I can now see the same for both VM’s:

image_thumb[16]

Upgrading Dirsync to Azure Active Directory Connect Public Preview – March 2015 update

In this blog post I am going to review the upgrade process of Dirsync to the new AAD-Connect. The March 2015 preview now makes it possible to perform an in-place upgrade from Dirsync to AAD-Connect. This entire process took 30 minutes for me in my lab environment, but your performance and time may vary because I am running a small environment on SSD hard disks =).

Important: You must read the “Azure AD Connect Public Preview 2 Readme” file – there are too many requirements and prerequisites in that Readme file to summarize in this blog post, so please do not skip that reading.

I also recommend reading the “New Sync features in Azure AD Connect Public Preview 2.docx”

You can download the AAD-Connect March Preview, Readme file, and the New Sync Features document from the Connect site here:
https://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=53949

image

image

After the prerequisites are installed, AAD-Connect detects Dirsync and will now upgrade it in-place:

image

Next, I am prompted to enter my Azure AD Administrator Credentials

image

Lastly, I am ready to click Install. I recommend unchecking the box to start synchronizing after install. You can always start it manually later when you are ready.

image

This part of the wizard took about 10 minutes to uninstall Dirsync and install AAD-Connect.

image

Next, I clicked on the icon on the desktop “Azure AD Connect”

image

I then signed in.

image

image

I then type in an Enterprise Admin account

image

If I want to connect to an additional forest, I can do that here:

image

Next, I select that I want to enable password writeback. You will notice that user, group and device writeback are greyed out and not selectable. This is because we have not yet run the AD preparation steps necessary to enable those features. See the bottom of this blog post for details on enabling those features.

image

And one last confirmation by clicking Install

image

And one last confirmation that the installation was successful

image

Enabling User, Group and Device Writeback

In the readme file, it describes the powershell commands to run that will enable this enhanced functionality.

For group writeback, your on-prem Exchange server must be running Exchange 2013 CU8. Also, the default Sync Rules will not add the address book attribute. Find the value from your Exchange server and add this as a custom attribute flow.

The Initialize-ADSyncDomainJoinedComputerSync Function will initialize your Active Directory forest to sync Windows 10 domain joined computers to Azure AD. This function will need to be run on each forest to allow Windows 10 computers to authenticate against ADRS.

image

The Initialize-ADSyncDeviceWriteBack Function will initialize your Active Directory forest for write-back of device objects from Azure AD to your Active Directory. It will also set up the necessary permissions on the AD Connector account. This only needs to be run on one forest even if AzureADConnect is being installed on multiple forests.

Note: I received errors when running this command.
image

The Initialize-ADSyncGroupWriteBack Function will initialize your Active Directory forest for write-back of group objects from Azure AD to your Active Directory. It will grant permissions to an AD Connector account for modifying objects in a pre-existing group WirteBack container. Please use this same container for Group WriteBack when you run the wizard. This function only needs to be run in one forest.

I created a new organizational unit for these objects called “CloudUsersAndGroups”

image

Initialize-ADSyncGroupWriteBack -GroupWriteBackContainerDN “OU=CloudUsersAndGroups,DC=thecloudtechnologist,DC=com”

image

The Initialize-ADSyncUserWriteBack Function will initialize your Active Directory forest for write-back of user objects from Azure AD to your Active Directory. The users will be created with a random password so you have to reset the password in ADDS for the user to actually be able to login.

Initialize-ADSyncUserWriteBack –UserWriteBackContainerDN “OU=CloudUsersAndGroups,DC=thecloudtechnologist,DC=com”

image

Note: The Azure AD Premium feature password writeback does not work for users configured for user writeback. In other words, if you have a cloud identity, and that user is synced to the on-premises AD, then the password writeback feature will not update the newly created on-prem AD account version of the cloud identity user. I assume it would still reset the cloud identity portion.

After running these commands, I went back to the wizard but the options were still greyed out. This may be because my AD Schema is not running Exchange 2013 CU8, so I will update my schema and then update this blog post after that is done.

image

Next, read how to configure Azure AD Password Write-back on MSDN (I recommend reading all seven (7) articles under ‘Password Management’
https://msdn.microsoft.com/en-us/library/azure/dn510386.aspx 

image

In the Azure AD Tenant, I enabled the toggle “USERS ENABLED FOR PASSWORD RESET”

image

And when I scroll down, I now see that Password write back service status is ‘Configured’

image

What does the user experience look like for self service password reset?

Typically, the user will click on the “Can’t access your account” link below the Office 365 sign-in page at http://portal.office.com

image

Otherwise, they can also bookmark directly to the self-service password reset page:
https://passwordreset.microsoftonline.com

SNAGHTMLa144c75

They will be prompted to authenticate with text message, email or phone call. You can configure which of these options you want the user to enter. The user can also register for self service password reset and populate this contact information in advance, or an administrator can pre-populate it (again, please read the MSDN articles above for more details).

image

The user can then select the new password which must conform to the on-premises password policy.

image

Controlling Access to Application Proxy (Optional)

This is a follow-on post from my post on Azure Application Proxy. Assuming that you have published your first application via the Azure Application proxy, you may now want to secure it with Multifactor authentication.

You can enable access rules to limit access to the application you publish with Application Proxy to specific groups, you can require multi-factor authentication, or only require MFA when the user is outside a specific network location (external IP address of NAT firewall).

image

The first time MFA is enabled for an application published by Azure Application proxy, the user will be required to enroll in MFA.

image

After enrolling, the user will be sent a text message or a phone call to their phone number registered in AD. Then they will logon to the application with two forms of authentication (password + phone call or text message).

The next time they browse to the application, after authenticating with their username and password, the application will automatically send them a text message and they can then sign in after entering the SMS code sent to their smart phone.

image

 

The intranet application hosted internally at https://intranet will then load up fine.

image