In a specific user's section of Azure AD, there are two menu items that seem to mean the same thing to me even though the data is different. Can someone explain the difference between
Assigned Roles and Azure Role Assignments?
Assigned roles are Azure AD administrator roles, for accessing Azure AD and other Microsoft 365 platforms such as Exchange and SharePoint.
Azure AD built-in roles
Azure role assignments (may also be referred to as Azure RBAC roles) are for accessing Azure resources such as virtual machines, storage accounts, subscriptions, etc.
Azure built-in roles
Azure and Azure AD are different terms for 2 distinct platforms
Related
Now that I can let users sign up for a regular Azure AD tenant with Google, Facebook, etc accounts, what advantages does Azure AD B2C still offer? I know one big disadvantage they have is not offering application roles.
To understand why we need to use Azure B2C, I think you need to learn the differences between AAD and AAD B2C.
We can say AAD is mainly for employee and B2C is mainly for customer.
Although we can add guests into regular Azure AD, we can't use an AAD tenant for millions of customers.
Separating the management of customers and employees is an important role of B2C.
There are several other reasons why we use B2C. For details, you can refer to this good answer.
Is it possible to manage users and groups using Terraform?
Operations such as MFA, user-types, Authentication methods, Registration, notification, User settings, group settings, and Device settings.
Is it possible to manage users and groups using Terraform?
Yes, you can use Terraform to integrate with Azure AD and manage users and groups in Azure AD. At the same time, Terraform supports a number of different methods for authenticating to Azure AD.
Please see:here.
In single-tenant scenarios, why does Azure AD sign in require that the user provide the domain?
Because you can have multiple domains registered in AAD,
and most organizations have users with more than one domain name.
When you log in, you must specify your user principal name.
Same as when logging in to on-prem AD, you'd use e.g. CONTOSO\username or username#contoso.com.
Setting a default is not possible, and is usually not desired.
It looks like what I should be looking at is Azure AD B2C.
From this MSFT FAQ:
What are local accounts in Azure AD B2C? How are they different from
work or school accounts in Azure AD? In an Azure AD tenant, users that
belong to the tenant sign-in with an email address of the form
#. The is one of the verified
domains in the tenant or the initial <...>.onmicrosoft.com domain.
This type of account is a work or school account.
In an Azure AD B2C tenant, most apps want the user to sign-in with any
arbitrary email address (for example, joe#comcast.net, bob#gmail.com,
sarah#contoso.com, or jim#live.com). This type of account is a local
account. We also support arbitrary user names as local accounts (for
example, joe, bob, sarah, or jim). You can choose one of these two
local account types when configuring identity providers for Azure AD
B2C in the Azure portal. In your Azure AD B2C tenant, click Identity
providers and then select Username under Local accounts.
According to the Azure AD B2C FAQ:
Can I use Azure AD Connect to migrate consumer identities that are stored on my on-premises Active Directory to Azure AD B2C?
Azure AD Connect is not designed to work with Azure AD B2C...
Then why is it displayed here? And what can you do with Azure AD Connect and B2C then?
The displaying of that link implies there's a relationship between the two of them (to me at least).
The FAQ is correct in stating that Azure AD Connect is not supported with Azure AD B2C along with several other features of regular Azure AD.
These features show up in the Users and Groups blade because that blade was built primarily for regular Azure AD. There is work underway so that this blade understands it's running in the Azure AD B2C context and only shows applicable features.
Then why is it displayed here?
This is because that when you want to manager users and groups in Azure AD B2C, you must use Azure AD to manage it. Azure AD B2C cannot leave Azure AD. When you are using Azure AD B2C, you would have used Azure AD to authenticate Identity. As #Saca said, that blade was for Azure AD.
And what can you do with Azure ADConnect and B2C then?
That FAQ is right, but you can still use Azure Connect to sync on-premise users to Azure AD. You can also use the synced users accounts to login Azure AD B2C. But after syncing , the user name would changed to .onmicrosoft.com.
If you still want use your local account email address for the synced username, you can refer to this document and this official support article.
How do I migrate an existing OU-structure from the old AD to the new Azure AD?
I have been trying to configure the Azure AD Connector Synchronization Tool for this but without success. Not sure what configuration it is supposed to have.
Anyone know? Thanks.
Do you mean the “old AD” is on-premise AD? In some ways, Windows Azure AD is an extension of the on-premise Active Directory, but not all features available in Azure AD. Azure AD does have a domain name, it does contain users and groups. It contains Service Principals, like on-premise AD, that represent applications. But there is no tree of domains, no trusts between domains or forests. Indeed there are no forests, no Group Policy, no OUs.
If you want to create OU, please try Azure AD Domain Services which supports to create custom Organizational Units and group policy in some limited way.
https://azure.microsoft.com/en-us/documentation/articles/active-directory-ds-features/