Switch Directory/Tenant for Azure subscription

Do you have Azure subscription for your organization and decided that you would like to test something out, but you do not want to mess or include users from your current Azure AD?

Well simply switch the user directory. This is perfect if you have a test Office 365 tenant or a testing environment and would like to test azure features with that directory.

Here is how:

Create a new subscription in Azure portal
Give that subscription to the user in your environment that is responsible for the subscription by adding him as an owner
That user logs on to azure portal and navigates to Subscriptions
Click on the subscription and select Change Directory / Bytt Katalog
Select your new user catalog
Log out and log in to the other directory (or click your profile image and click change directory
Under Subscriptions you should see it.

Images below for visual aid:

This simple guide was created from here: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory

April 3, 2020 0

Activate Azure Enterprise Subscription

Hi, here is a quick walkthrough of how to activate your top level Azure Enterprise Subscription Account on https://ea.azure.com

This is where you define your organization, departments and organizational structure down to the individual faculty level.

NOTE: You do this before you log into https://portal.azure.com .

NOTE 2: DO NOT add student and teachers here. This is for administration, IT and some researchers. You add teachers and students later in https://portal.azure.com

Find your activation email and copy or click the link (if you click it, make sure you are not logged into any other account.)
Use your OFFICE 365/AZURE AD ACCOUNT for your enterprise. Do not use a Microsoft account such as @hotmail.com
Verify that you are using your correct workplace account to login to the service.
Verify that again. I am serious. Make sure you are using the right account. If you are unsure, stop what you are doing and email me hhauk@microsoft.com
Your EA subscription is now linked to your workplace account. You are done.

Now you should add extra administrators. Click on Manage and “Enrollment” and add minimum 2 named admins.

AddAdmin

Now, look at your organizational structure and start to add Departments. Remember to add administrators to each department.

AddDepartment (1)

AddAdmin2

Once you have set up your departments and accounts you may add additional subscriptions. Remember that services that run on different subscriptions do not talk to each other. Click Subscriptions and add extra subscriptions. You may create as many as you would like.

As you have multiple subscriptions with the same name, it is smart to change the name of each subscription. you do that in the https://portal.azure.com click on “Subscriptions” then select the subscription you would like to rename and click “Rename”

ChangeSubscriptionName

Finally it is time to add users or co-editors to your subscriptions. This can be students or teachers that only need access to this subscription for teaching or learning reasons.

September 21, 2018 0

Enable Bitlocker Check in Intune MDM

When joining a Windows 10 device to Azure AD which supports “InstantGo” or “Connected standby” e.g. Surface. Microsoft Automatically enables bitlocker.

For all other devices you need to manually enable bitlocker on your drive.

As an IT admin you can create a Compliance Policy that checks if Bitlocker has been enabled. Here is how:

Log in to http://manage.microsoft.com
Click Policies and Compliance Policy
Click Add
Name: Bitlocker Check
Description: Checks if bitlocker is enabled
Under device health enable Windows Device Health Attestation.
Deploy the policy to your target users or groups
Check for compliance.

November 24, 2016 0

End-user signup for Azure Self Service Password Reset

If you want to enable a user for Self Service Password Reset the user need to navigate to one of these endpoints and register his/her phone as a second factor.

Endpoints:

This endpoint verifies your phone and enrolls the user in SSPR: http://aka.ms/ssprsetup
It does not change your password!
This endpoint resets your password and enrolls the user if his or her phone number is already stored on the user. http://aka.ms/sspr (which points here: http://passwordreset.microsoftonline.com)

Here is a screen dump of what the user will have to do:

routed-to-account-setup-in-azure-ad — You get routed to or enrollment service

verify-phone-number-in-azure-ad — asks to verify your phone (if it is already there) if not you have to enter your phone number

if-phone-is-not-registered — If your phone is not registered in azure AD you see this

call-to-verify-azure-ad — Call goes fastest

one-factor-is-completed — In Azure AD you select how many factors your users need to setup. I have selected 1

myapps-in-azure-after-registration — This is where you end up

September 9, 2016 0

So, I enabled Self Service Password reset. Who signed up?

If you have enabled Self Service Password reset, all users should be prompted to enroll on login. You could also proactively redirect users to https://passwordreset.microsoftonline.com/ or http://aka.ms/ssprsetup

Look at this blogpost for that user experience: Self Service Password Reset User Registration (Same as for MFA registration).

Here is how you get the report for users who signed up for Self Service Password Reset

azure-active-directory-report-catalog-in-azure-management-portal — Azure AD Report Catalog

azure-active-directory-report-catalog-for-activity-logs-on-self-service-password-reset — Activity Logs in Azure AD

report-of-users-registered-in-azure-ad-for-self-service-password-reset — Latest activity for SSPR

download-azure-ad-sspr-reports — Download reports in CSV

excel-self-service-password-reset-activity — The Report in CSV opened in Excel

September 7, 2016 0

Azure MFA enrollment experience

If you want to enroll for Azure MFA the users need to go through these steps. When you enforce or enable MFA the user will be prompted for MFA enrollment. This is best done in a browser.

First the user need to access any of our endpoint e.g. http://portal.office.com

input mfa method — Office 365 MFA input phone number

contact options — Office 365 mfa methods

sms — You will get a text message with a code to enter

Office 365 app password during enrollment — Use this app-password on your native iOS or Android device or old Outlook 2010 instead of your normal password.

Additional Office 365 MFA options — Press cancel if you feel done. or just navigate to the indended site. e.g. http://portal.office.com

Extended Office 365 MFA options — all your MFA options

Azure AD access panel for MFA — The user access panel

Here are all of the pictures in a Sway:
https://sway.com/2fNqmpbe5O17F5Ev

September 2, 2016 0

Service based Azure Multifactor Authentication

Now you can enable a certain service for Azure MFA.

In this example i enforce MFA for a security group with 3 users when they try to access Yammer only. Everything else is not enforced with MFA.

Prerequisites: Enterprise Mobility + Security (EMS) License assigned to the user.

Go to: http://manage.windowsazure.com

Navigate to your domain and click applications

Use these settings

Note on these settings, I have 3 users in the CA Exchange Online Mobile group. Rest of my users are in the NO CA group and that group is set to Except. I do this to ensure that nothing is enforced globally to all users. The 3 users in the first group have not had Azure MFA Enabled or Enforced but is set to Disabled.