Issues with Office 365 MFA

August 2, 2018, 7:56 am

≫ Next: Domain Joined device is not synced to Azure after enabling device writeback

≪ Previous: Unable to authenticate using Open id connect to Azure ad

I've been testing MFA for a few weeks and constantly run into a few issues.

Setup:

Windows 10 Enterprise

Office 2016

Freshly imaged desktop

Issues:

1. Despite having modern auth. enabled, I still have to enter an App Password for Skype for Business

2. Its my understanding that the App Password would only have to be entered once, yet I am prompted for it maybe twice a week.

3. I don't log out at the end of the day, I simply lock my PC (many of out employees do the same). When I get back the next morning and am prompted by Outlook for the 6-digit code, when I enter it, it will not be accepted. I have to restart the PC before it does. Happens occasionally. I have video of this, and if there is a recommended way to post this, I will.

4. When I open Outlook, it does not prompt me for the code. It will just sit there, not fully loaded. I have to close Skype for business and Outlook and open Skype back up, at which point I am prompted. Then I can open Outlook. Happens regularly.

If there are any questions, please ask.

↧

Domain Joined device is not synced to Azure after enabling device writeback

July 18, 2018, 1:52 am

≫ Next: The app ID is blocked for access of the O365 Discovery Service

≪ Previous: Issues with Office 365 MFA

Hi!

I've just enabled device writeback feature on Azure AD Connect, but devices which joining to On-Premise domain are now not replicated to Azure AD.

I checked Sync Service Manager and it only shows "Projections: 1" and "Connectors with Flow Updates: 1" with a new device. No "Adds" or whatsoever. Containers are checked and it worked before...

Does anyone know what could go wrong?

↧

The app ID is blocked for access of the O365 Discovery Service

August 8, 2018, 1:56 am

≫ Next: Reporting on users group membership from list of users

≪ Previous: Domain Joined device is not synced to Azure after enabling device writeback

Hi,

we have a problem with using OneDrive Business API. Or to be more specific - it was working without problem and suddenly it stopped working and we don't know why. We contacted Azure support on Twitter which send us here with our problem.

We tried to create a new user in Azure AD, with Global Administrator right. Then we logged in as this user and created new application (single-tenant) with these permissions:

Windows Azure Active Directory
- Read and write directory data
- Sign in and read user profile
Office 365 SharePoint Online

Read and write user files
Read user files

We also added key with expiration “Never expires”. After that we requested admin consent via calling https://login.microsoftonline.com/common/oauth2/authorize with prompt=admin_consent in query. We logged in as the global admin user, confirmed requested permissions, everything fine (We also tried to do it via https://login.microsoftonline.com/common/adminconsent, also ok with returned admin_consent=True).

Then we logged in as an "basic" user (also via calling https://login.microsoftonline.com/common/oauth2/authorize with prompt=admin_consent in query), accepted all permissions, which generated our authorization code. When we ask for access token for resource https://api.office.com/discovery/, token is generated without problem, we can even see all scopes which we selected in App and confirmed within login. But when we call discovery service API via calling https://api.office.com/discovery/v2.0/me/services with that access token, we get “The app ID is blocked for access of the O365 Discovery Service”.

We really don’t see what we should do or what we are doing wrong.

Thank you for any advice.

BtW: looks like we are not the only one with this problem - https://stackoverflow.com/questions/51425968/app-blocked-calling-o365-discovery-service

↧

Reporting on users group membership from list of users

July 24, 2018, 2:49 am

≫ Next: Azure Active directory group management with existing AD security group

≪ Previous: The app ID is blocked for access of the O365 Discovery Service

Hi Everyone,

I have a list of users (about 150)that are in a security group, for each of the users I need to list what other security/office 365/mail enabled groups they belong to. I’ve been using msonline powershell v1 and being a complete novice have been looking at various online forums but cannot figure out how to pull the information out, what I've got so far is:

$GroupMembers = Get-MsolGroupMember -GroupObjectId (%Group ID%)

foreach ($GroupMember in $GroupMembers)

{

$Properties = @{"GroupDisplayName"=$Group_DisplayName;

"MemberDisplayName"=$GroupMember.DisplayName;

"MemberEmail"=$GroupMember.EmailAddress;

"MemberType"=$GroupMember.GroupMemberType}

$Obj = New-Object -TypeName PSObject -Property $Properties

Write-Output $Obj | select GroupDisplayName,MemberDisplayName,MemberEmail,MemberType }

I'm not sure what command I would use to pull the users other security group membership out, any advice would be a great help.

Cheers

↧

Azure Active directory group management with existing AD security group

August 6, 2018, 2:01 pm

≫ Next: Unable to join device to Azure AD

≪ Previous: Reporting on users group membership from list of users

Hi,

I am kinda new to Azure AD.

We would like to manage the SSO to different applications which we integrated with Azure AD with our on-premise AD with security groups.

Is it possible to some how import the current security group from our own AD to Azure AD or we have to create everything in AzureAD?

Is there any related documentations can prove it?

Thank you a lot

↧

Unable to join device to Azure AD

August 3, 2018, 11:54 am

≫ Next: Why is my AD Connect Schedule only running Delta Imports?

≪ Previous: Azure Active directory group management with existing AD security group

When adding a computer to Azure AD I receive the error "Something went wrong. Confirm you are using the correct sign-in information and that your organization uses this feature. You can try to do this again or contact your system administrator with the error code 80280036"

The user account trying to join to the domain has a Microsoft 365 Business license. Multiple other users are able to Azure join their computers. The device being joined is a Windows 10 Pro computer on the latest update version.

We have tried: Go to portal.azure.com > Search for Intune > Devices > Azure AD devices and see if there are any devices already connected for the same user. If yes, Please remove the devices and try to connect the device to Azure AD then.

There was an entry for the same device which we have removed now, however still getting the same error.

I have also disabled TPM and see if this resolved the issue:

Open Group Policy Editor: If Group Policy Editor appears to be unavailable, follow instructions for enabling BitLocker first.
Open Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System...
Edit Require additional authentication at startup policy.
Set the policy to Enabled and make sure Allow BitLocker without a compatible TPM is checked.

Getting the same error. Is there anything else I can do to get this working?

↧

Why is my AD Connect Schedule only running Delta Imports?

August 8, 2018, 4:52 am

≫ Next: C# - Pulling a list of all Azure Active Directory Users using Graph API - Stuck/Error/Timeout

≪ Previous: Unable to join device to Azure AD

I recently did an in-place upgrade on our AD Connect server to v1.1.819.0, everything appeared to be functioning properly as a full sync was performed after the upgrade and re-enabling the syncscheduler. The full sync took several hours to complete, but noticed that after completion the connectors are consistently performing Delta Imports. The Policy type is listed as Delta so I would expect to see a Delta Import, Delta Sync, Export. This is no longer the case, however I can manually kick off the run configurations without issue.

I'm sure there is something I'm overlooking but curious if anyone has any insight.

The following is my ADSyncSchedule:

AllowedSyncCycleInterval            : 00:30:00
CurrentlyEffectiveSyncCycleInterval : 00:30:00
CustomizedSyncCycleInterval         :
NextSyncCyclePolicyType             : Delta
NextSyncCycleStartTimeInUTC         : 8/7/2018 7:56:56 PM
PurgeRunHistoryInterval             : 7.00:00:00
SyncCycleEnabled                    : True
MaintenanceEnabled                  : True
StagingModeEnabled                  : False
SchedulerSuspended                  : False
SyncCycleInProgress                 : True

↧

C# - Pulling a list of all Azure Active Directory Users using Graph API - Stuck/Error/Timeout

August 2, 2018, 10:41 am

≫ Next: Need to disable Azure AD Sync after on-premise forest has been removed

≪ Previous: Why is my AD Connect Schedule only running Delta Imports?

I am using

AzureGraphAuthenticationProvider graphAuth = new AzureGraphAuthenticationProvider();        graphAuth.tenantId = tenantId;
        graphAuth.applicationID = applicationID;
        graphAuth.applicationKey = applicationKey;
        GraphServiceClient graphClient = new GraphServiceClient(graphAuth); //sets graph client using previously obtained token
        //graphClient.HttpProvider.OverallTimeout = 0;
        var users = await graphClient.Users.Request().GetAsync();
        string title = "";
        int count = 0;
        while (users != null)
        {
            var usersList = users.CurrentPage.ToList();
            count = count + usersList.Count();
            //users = null;
            users = await users.NextPageRequest.GetAsync();
        }

But I have had no luck in listing the users, I can pull my own info but no one elses.

Though if I use

        User user = await graphClient.Users[currentUser].Request().GetAsync();

I have no problem pulling that specific user's info.

is it possible it is timing out? If so how can I adjust it?

Any thoughts?

Solution:

 try
        {
            while (users != null)
            {
                var usersList = users.CurrentPage.ToList();
                count = count + usersList.Count();
                users = await users.NextPageRequest.GetAsync();
            }
        }
        catch
        {
            //
        }

This works but you have to make sure that you have enough processing power. I was able to run it on my local machine but NOT on my azure instance, I will need to up my resources..

↧

Need to disable Azure AD Sync after on-premise forest has been removed

February 2, 2018, 6:08 am

≫ Next: Differences to SCIM specification

≪ Previous: C# - Pulling a list of all Azure Active Directory Users using Graph API - Stuck/Error/Timeout

I recently set up Azure AD Sync via the Azure AD Connect software, but after realizing this set up did not meet our requirements, i uninstalled Azure AD Connect and removed the forest and domain from the on-premise server. Now I'm receiving "unhealthy sync" errors because the sync is still enabled on Azure under Virtual Active Directory. I realize that the correct way to disable sync was through AD Connect and powershell, but i'm past that point now as the on-premise VM in question has already been deleted. I need help disabling syncing from Azure Virtual Active Directory, as I couldn't figure it out on my own.

↧

Differences to SCIM specification

August 8, 2018, 8:14 am

≫ Next: Azure AD sync preparation?

≪ Previous: Need to disable Azure AD Sync after on-premise forest has been removed

I am trying to integrate SCIM support for Azure AD into an existing web application. At the moment I struggle with several points.

Azure Ad is sending PATCH request for simple attributes with complex attribute as value. E.g.

{"op": "Replace","path": "userName","value": [
        {"$ref": null,"value": "blubb2@mysignavio.onmicrosoft.com"
        }
      ]
}

This is in contrast to the SCIM specification.

Azure AD is upper casing operations in PATCH request, e.g. "Add" instead of "add"

{"op": "Add","path": "name.formatted","value": [
        {"$ref": null,"value": "Blubb Blabb"
        }
      ]
}

The urls for Users and Groups have to have "scim" as a prefix, e.g. https://examplewebapp.com/.../scim/Users. The specification does not mention a "scim" prefix. This can force additional adjustments for existing implementations that don't have such a prefix in the url.
When A AD sends PATCH requests, the add operation sometimes contains filters in the path. This is not part of the SCIM specification and is not supported by many frameworks.
Azure AD is using the schema urn:ietf:params:scim:schemas:extension:enterprise:2.0:User. Is there a way to choose the core User schema of SCIM? Is it enough to support the core schema when only core attributes are mapped?

↧

Azure AD sync preparation?

July 30, 2018, 2:42 pm

≫ Next: Groups have no members

≪ Previous: Differences to SCIM specification

Hello folks,

I am preparing to sync my on premise AD with an Azure AD.

I have an Azure account, but have not setup in custom domains, yet.

I have an internal only local domain called copperfield.net that is not registered publicly (not available).

I use it internally for everything.

I also have an public domain called matlockinc.net, that is registered and I use for my email MX, and then forwards into my copperfield.net servers, successfully.

I can see how to register matlockinc.net in Azure custom domain, must I also create a custom domain for copperfield.net before I can sync? How would it be verified?

↧

Groups have no members

August 2, 2018, 8:32 am

≫ Next: Restore original IP of a Virtual Machine in Azure

≪ Previous: Azure AD sync preparation?

None of my groups on my Azure AD console have members. I have recently had to reinstall Azure AD Connect so maybe I'm missing something.

↧

Restore original IP of a Virtual Machine in Azure

August 8, 2018, 11:24 am

≫ Next: Azure Identity protection - Alerts for impossible travel, but both logins are from the same Hybrid AD domain joned

≪ Previous: Groups have no members

We have a VM in Azure that we have stopped and started again. Once started again, the machine has received a new public IP address. We have our DNS mappings pointing to the old (original) IP address of the machine. Could you please help us on how to get the old, original IP back instead of the new one? We really need help on this and we need to get it done quickly.

↧

Azure Identity protection - Alerts for impossible travel, but both logins are from the same Hybrid AD domain joned

August 6, 2018, 3:15 am

≫ Next: MFA implementation in .NET without using browser

≪ Previous: Restore original IP of a Virtual Machine in Azure

I've got an alert generated by Azure AD Identity protection - 'impossible travel to atypical location' - but when I check the user, both logins are identified as being from a Hybrid Azure AD domain joined machine with the same ID

Is this a known issue?

↧

MFA implementation in .NET without using browser

August 6, 2018, 7:58 am

≫ Next: Set-MsolDomainAuthentication fails when trying to set a domain as federated

≪ Previous: Azure Identity protection - Alerts for impossible travel, but both logins are from the same Hybrid AD domain joned

I want to implement MFA for authenticating an Azure Active Directory account in .NET code without having to use a browser. Is there any library which can be used for this?

↧

Set-MsolDomainAuthentication fails when trying to set a domain as federated

August 6, 2018, 3:08 am

≫ Next: Cannot Sign up Microsoft Account with work email

≪ Previous: MFA implementation in .NET without using browser

I used this command to change authentication type of my domain to federated. Later had to change it back to managed. Now I cannot change it back to federated with the same parameters I used previously successfully. I looked for a solution all over the internet but no help. There were similar error reported in multiple places, yet no straightforward answer was found.

It gives the following error.

PS Azure:\> Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $BrandName -Authentication Federated -ActiveLogOnUri $ecpUrl -SigningCertificate $MySigningCert -LogOffURI $logoutURL -IssuerUri $Issuer -PreferredAuthenticationProtocol $Protocol
Set-MsolDomainAuthentication : Unable to complete this action. Try again later.
At line:1 char:1
+ Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $B ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [Set-MsolDomainAuthentication], MicrosoftOnlineException
+ FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.InternalServiceException,Microsoft.Online.Administration.Automation.SetDomainAuthentication

Any idea what gives the error?

Dinix195

↧

Cannot Sign up Microsoft Account with work email

September 12, 2017, 4:03 am

≫ Next: User name or password is incorrect when performing domain join to Azure VM

≪ Previous: Set-MsolDomainAuthentication fails when trying to set a domain as federated

Hi,

My company is using the Microsoft Azure AD service and the email work is connected to that service. And currently, my company want to utilize Microsoft translation API text and Microsoft Translation HUB. However, when trying to register Microsoft account using our work email, there is an error, It says :
You can't sign up here with a work or school email address. Use a personal email, such as Gmail or Yahoo!, or get a new Outlook email.
I got an answer from Microsoft like this :

Starting today, we’re blocking the ability to create a new personal Microsoft account using a work/school email address, when the email domain is configured in Azure AD.

What does this mean? If your organization uses Office 365 or other business services from Microsoft that rely on Azure AD, and if you’ve added a domain name to your Azure AD tenant, users will no longer be able to create a new personal Microsoft account using an email address in your domain.

This sign-up block has been running in limited Preview for a hand full of organizations and is now active for all domains names that are configured (DNS-verified) in Azure AD. No action is necessary to enable the block.

However, I found this statement:

Short term exceptions
Unfortunately, there’s still a small number of Microsoft business services that don’t support Azure AD. The good news is that we’re making good progress. For example, Windows Dev Center finished their integration last winter and now supports both personal Microsoft accounts and Azure AD accounts. We’re working with other teams such as MSDN and Brand Central to help them add support for Azure AD.
Based on feedback we received during the preview, we will not block the ability to use a work email address to sign up for these business services. This is a short-term compromise that’s consistent with our main goal of preventing accidental use of work/school email address to sign up for personal Microsoft account.

The sentence I bold, does it mean we can still use the same work email address for Azure and Microsoft account?
Please let me know if there is a possibility for this situation? If it can't be done, what is the best practice for this issue?

Regards,
Erwin

↧

User name or password is incorrect when performing domain join to Azure VM

August 8, 2018, 1:27 pm

≫ Next: Azure AD Connect Health Sync Monitor High CPU Usage

≪ Previous: Cannot Sign up Microsoft Account with work email

Installed AAD Domain Services with domain name "mydomain.com"
Added verified custom domain "mydomain.com"
Made "mydomain.com" primary
Created AAD user "admin@mydomain.com"
Converted temp password to permanent password
Logged into Azure with permanent password
Ensured VM can see domain services for "mydomain.com"
When performing domain join, receive "The user name or password is incorrect"

I've tried the following credential combinations when doing the domain join (username : password)

admin : pwd
admin@mydomain.com : pwd
mydomain.com\admin : pwd
mydomain.com\admin@mydomain.com : pwd

None of these work and ultimately give me a lock out indication. I create additional users to continue trying these steps but nothing is working.

Stephen

↧

Azure AD Connect Health Sync Monitor High CPU Usage

June 5, 2018, 4:45 am

≫ Next: Unable to install the Synchronization Service. Please see the event log for additional details.

≪ Previous: User name or password is incorrect when performing domain join to Azure VM

Hello. I have Azure AD Connect installed on my server to sync our on-premise domain with Office 365 and I'm noticing the Azure AD Connect Health Sync Monitoring Service is always running high CPU usage. The actual process is Microsoft.Identity.Health.AadSync.MonitoringAgent.Startup.exe. Is there a reason for this or a way to fix it? Right now, I'm just stopping the Azure AD Connect Health Sync Monitoring Service(AzureADConnectHealthSyncMonitor) and my resources go back to normal. I'm running Azure AD Connect 1.1.819.0 so it is the latest version. If I restart the service, things are normal for a few minutes before this process spikes again. Any help would be appreciated. Thanks!

↧

Unable to install the Synchronization Service. Please see the event log for additional details.

August 8, 2018, 1:43 pm

≫ Next: Azure Active Directory Connect: Service ADSync was not found on computer '.'

≪ Previous: Azure AD Connect Health Sync Monitor High CPU Usage

[13:06:31.879] [ 1] [INFO ]

[13:06:31.879] [ 1] [INFO ] ================================================================================

[13:06:31.879] [ 1] [INFO ] Application starting

[13:06:31.879] [ 1] [INFO ] ================================================================================

[13:06:31.879] [ 1] [INFO ] Start Time (Local): Wed, 08 Aug 2018 13:06:31 GMT

[13:06:31.879] [ 1] [INFO ] Start Time (UTC): Wed, 08 Aug 2018 20:06:31 GMT

[13:06:31.879] [ 1] [INFO ] Application Version: 1.1.880.0

[13:06:31.879] [ 1] [INFO ] Application Build Date: 2018-07-20 22:37:14Z

[13:06:33.191] [ 1] [INFO ] Telemetry session identifier: {5b09e322-00a5-4a9c-a9f7-1b9998fcdb61}

[13:06:33.191] [ 1] [INFO ] Telemetry device identifier: qp13nTfjkj3Zno5GQHVA5uic6t7CdPcTkvuWWcH5H5A=

[13:06:33.191] [ 1] [INFO ] Application Build Identifier: AD-IAM-HybridSync master (3f67a493d)

[13:06:33.270] [ 1] [INFO ] machine.config path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config.

[13:06:33.270] [ 1] [INFO ] Default Proxy [ProxyAddress]: <Unspecified>

[13:06:33.270] [ 1] [INFO ] Default Proxy [UseSystemDefault]: Unspecified

[13:06:33.270] [ 1] [INFO ] Default Proxy [BypassOnLocal]: Unspecified

[13:06:33.270] [ 1] [INFO ] Default Proxy [Enabled]: True

[13:06:33.270] [ 1] [INFO ] Default Proxy [AutoDetect]: Unspecified

[13:06:33.300] [ 1] [VERB ] Scheduler wizard mutex wait timeout: 00:00:05

[13:06:33.300] [ 1] [INFO ] AADConnect changes ALLOWED: Successfully acquired the configuration change mutex.

[13:06:33.363] [ 1] [INFO ] RootPageViewModel.GetInitialPages: Beginning detection for creating initial pages.

[13:06:33.379] [ 1] [INFO ] Checking if machine version is 6.1.7601 or higher

[13:06:33.410] [ 1] [INFO ] The current operating system version is 10.0.14393, the requirement is 6.1.7601.

[13:06:33.410] [ 1] [INFO ] Password Hash Sync supported: 'True'

[13:06:33.441] [ 1] [INFO ] DetectInstalledComponents stage: The installed OS SKU is 7

[13:06:33.441] [ 1] [INFO ] DetectInstalledComponents stage: Checking install context.

[13:06:33.441] [ 1] [INFO ] Performing direct lookup of upgrade codes for: Microsoft Visual C++ 2013 Redistributable Package

[13:06:33.457] [ 1] [VERB ] Getting list of installed packages by upgrade code

[13:06:33.457] [ 1] [INFO ] GetInstalledPackagesByUpgradeCode {20400cf0-de7c-327e-9ae4-f0f38d9085f8}: verified product code {a749d8e6-b613-3be3-8f5f-045c84eba29b}.

[13:06:33.457] [ 1] [VERB ] Package=Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005, Version=12.0.21005, ProductCode=a749d8e6-b613-3be3-8f5f-045c84eba29b, UpgradeCode=20400cf0-de7c-327e-9ae4-f0f38d9085f8

[13:06:33.457] [ 1] [INFO ] Determining installation action for Microsoft Visual C++ 2013 Redistributable Package (20400cf0-de7c-327e-9ae4-f0f38d9085f8)

[13:06:33.457] [ 1] [INFO ] Product Microsoft Visual C++ 2013 Redistributable Package (version 12.0.21005) is installed.

[13:06:33.472] [ 1] [INFO ] Performing direct lookup of upgrade codes for: Microsoft Directory Sync Tool

[13:06:33.472] [ 1] [VERB ] Getting list of installed packages by upgrade code

[13:06:33.472] [ 1] [INFO ] GetInstalledPackagesByUpgradeCode {bef7e7d9-2ac2-44b9-abfc-3335222b92a7}: no registered products found.

[13:06:33.472] [ 1] [INFO ] GetInstalledPackagesByUpgradeCode {dc9e604e-37b0-4efc-b429-21721cf49d0d}: no registered products found.

[13:06:33.472] [ 1] [INFO ] GetInstalledPackagesByUpgradeCode {545334d7-13cd-4bab-8da1-2775fa8cf7c2}: no registered products found.

[13:06:33.472] [ 1] [INFO ] Determining installation action for Microsoft Directory Sync Tool UpgradeCodes {bef7e7d9-2ac2-44b9-abfc-3335222b92a7}, {dc9e604e-37b0-4efc-b429-21721cf49d0d}

[13:06:33.472] [ 1] [INFO ] DirectorySyncComponent: Product Microsoft Directory Sync Tool is not installed.

[13:06:33.472] [ 1] [INFO ] Performing direct lookup of upgrade codes for: Azure AD Sync Engine

[13:06:33.472] [ 1] [VERB ] Getting list of installed packages by upgrade code

[13:06:33.472] [ 1] [INFO ] GetInstalledPackagesByUpgradeCode {545334d7-13cd-4bab-8da1-2775fa8cf7c2}: no registered products found.

[13:06:33.472] [ 1] [INFO ] GetInstalledPackagesByUpgradeCode {dc9e604e-37b0-4efc-b429-21721cf49d0d}: no registered products found.

[13:06:33.472] [ 1] [INFO ] GetInstalledPackagesByUpgradeCode {bef7e7d9-2ac2-44b9-abfc-3335222b92a7}: no registered products found.

[13:06:33.488] [ 1] [INFO ] Determining installation action for Azure AD Sync Engine (545334d7-13cd-4bab-8da1-2775fa8cf7c2)

[13:06:33.863] [ 1] [INFO ] Product Azure AD Sync Engine is not installed.

[13:06:33.863] [ 1] [INFO ] Performing direct lookup of upgrade codes for: Azure AD Connect Synchronization Agent