Clarification: This is about joining to Azure Active Directory - but not the Directory Services under the AAD.
I have a Server 2019 Azure VM - not joined to any AAD. The subscription is tied to Tenant X. I would like to "Azure AD join" this VM to a different AAD, belonging to Tenant Y. The scenario is to enable a user from tenant Y be able to use his/her credentials to login to this VM.
If you have ideas on how to do this in a scripted way - in the same tenant. That is welcome too.
Related
My organisation use Active Directory on-premise (windows server 2012). We also use Office 365 E1.
Logins are different. We add accounts independly.
Now we are however are thinking about using Ad Connect, but we have some concerns.
Will we lose any data on Teams after integration?
Will our users be able to access data previously attached to theirs Azure Active Directory account?
How can we match AAD users with on-premise AD. It uses aliases?
Following MS documents should give a head start for your requirement.
How objects and credentials are synchronized in an Azure Active Directory Domain Services managed domain
Integrate on-premises AD with Azure
Integrate on-premises AD domains with Azure AD
Azure AD Connect: When you have an existing tenant
Microsoft 365 integration with on-premises environments
Scenario: AADDS deployed, Azure hosted Windows servers are domain joined. Using Azure Bastion to RDP into the domain joined servers. However, it seems the only user accounts who are part of the AAD DC Administrators group can successfully RDP to the servers.
Question: Is it possible to add security groups other than AAD DC Administrators to the local administrators group on domain joined joined servers as to allow RDP access for remote administration?
TIA,
Matt
Remote access to virtual machines (VMs) that run in an Azure Active Directory Domain Services (Azure AD DS) managed domain requires a user account that's a member of the Azure AD DC administrators group in your Azure AD tenant. This is one of the prerequisites.
Once you join a machine to the AADDS domain, you can treat it like a standalone AD DS domain in regards to GPO's and login, etc..
I tested this scenario yesterday and verified that you can add both individual users and AAD groups to the local Administrators group (or any group that allows login to a server) and those users will be able to login with both RDP and via Bastion.
I have mounted an azure file share on an azure VM using access keys ,the VM is not doman joined with the azure active directory instance.Please let me know if below scenario's will work out:-
If i apply acl's on the folders and sub folders will the acl's be
enforced in the mounted drive on the VM?
Will AZURE RBAC apply if someone tries to upload a file from the VM?
Note:- The Azure VM is on a VNET which has access to azure active directory.
Any information/answer/suggestion on the above questions would be greatly appreciated.
ACLs can exist for domain or non-domain accounts. Having a machine that is not domain joined, can obviously not set domain ACLs. So in that case local-server ACLs is all you can hope to get.
If another server mounts the share, and there is not another local user account + SID mapping, then there is no way these ACLs have any meaning on the second machine. But they will be enforced.
So that one will work albeit questionable in terms of usefulness.
RBAC is really a management plane construct. Meant to govern who can manage which Azure resource --> not access which data planes. Now in the case of AD / AAD DS support for Azure file shares, the team has decided to "stretch" the meaning of RBAC to govern share-level ACLs via Kerberos (where normal RBAC is OAuth only!)
Enough of the backend: What this basically means, is that there can be no support for local server accounts.
THese accounts only exist on a local server, not in AAD and certainly not DIRSYNC'ed from on-prem AD into AAD. So that means RBAC cannot work for local accounts, only for domain accounts.
I'm unclear what your scenario is.
A user coming into the server with some sort of local user credential?
Then creating/copying a file into a mounted Azure file share to that VM? --> That can work because there is no RBAC and since this is all happening through that single server that has that local user account, ACLs for these local accounts work natively.
A user coming into the server with a domain cred? --> will not work as the server isn't domain joined.
A user coming in with a local-server account and then using the Azure file share not via SMB mount but by going to the Azur file share directly: Cannot work because it's not a domain account and non-dimain accounts cannot work against Azure file shares. You'd use the srtorage access key to mount the file share to the VM, then you have access and leave auth. to the server with the set of local accounts.
Before you enable Azure AD over SMB for Azure file shares, make sure you have completed the following prerequisites:
Select or create an Azure AD tenant.
You can use a new or existing tenant for Azure AD authentication over SMB. The tenant and the file share that you want to access must be associated with the same subscription.
To create a new Azure AD tenant, you can Add an Azure AD tenant and an Azure AD subscription. If you have an existing Azure AD tenant but want to create a new tenant for use with Azure file shares, see Create an Azure Active Directory tenant.
Enable Azure AD Domain Services on the Azure AD tenant.
To support authentication with Azure AD credentials, you must enable Azure AD Domain Services for your Azure AD tenant. If you aren't the administrator of the Azure AD tenant, contact the administrator and follow the step-by-step guidance to Enable Azure Active Directory Domain Services using the Azure portal.
It typically takes about 15 minutes for an Azure AD DS deployment to complete. Verify that the health status of Azure AD DS shows Running, with password hash synchronization enabled, before proceeding to the next step.
Domain-join an Azure VM with Azure AD DS.
To access a file share by using Azure AD credentials from a VM, your VM must be domain-joined to Azure AD DS. For more information about how to domain-join a VM, see Join a Windows Server virtual machine to a managed domain.
Note:Azure AD DS authentication over SMB with Azure file shares is supported only on Azure VMs running on OS versions above Windows 7 or Windows Server 2008 R2.
Select or create an Azure file share.
Select a new or existing file share that's associated with the same subscription as your Azure AD tenant. For information about creating a new file share, see Create a file share in Azure Files. For optimal performance, we recommend that your file share be in the same region as the VM from which you plan to access the share.
Verify Azure Files connectivity by mounting Azure file shares using your storage account key.
To verify that your VM and file share are properly configured, try mounting the file share using your storage account key. For more information, see Mount an Azure file share and access the share in Windows.
I have a setup where I have installed the Azure AD on-prem cloud provisioning agent on a Domain joined server. The setup was successful. I followed the documentation here:
https://learn.microsoft.com/en-us/azure/active-directory/cloud-provisioning/how-to-prerequisites
After configuring the agent in Azure AD, Users can only be synced as Member.
Is there a way to sync users as Guest using the provisioning agent?
Also, is there a Microsoft Graph API to validate the agent and do the configuration?
On-prem AD isn't synced to Azure AD as Guest and those synced users cannot be a Guest user and it's as per design.
You can invite guest users to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest user must then redeem their invitation to access resources. Any user sync via AD connect will not be a guest user.
Can one use ADFS/pass-through authentication to authenticate to Azure service (Portal) by on-premise AD without synchronizing user accounts? Can one assign RBAC for an on-premise user with Azure services?
For example, grant a VM contributor role to an on-premise user without sync all user information between on-premise AD and AAD.
You need to sync users to Azure AD. Password hashes do not need to be synced, you can use ADFS for login. But you do need to sync users so Azure AD knows what users exist.