Azure AD

Azure AD – Protect your directory better by using Administrative Units (Preview)

Martin Wüthrich Azure AD, Office365

The Azure AD administrative units are in Preview since a while, but lastly they got an update and I decided to check the opportunities that it might gives. Right from the bat, this feature has still a lot of possible improvement, I list those which would affect me the most at the end of the blog. But beside this, there are some neat use cases where I would configure Administrative Units.

Protect service accounts
Since the user administrator role can reset nearly every users password within the Azure AD (exceptions are Global Admin role members and more, see Azure AD User Administrator; thanks to nicola for the correction), it is very unlikely that you want to have a lot of administrators having that role. With Azure AD administrative units, you can add add regular users to a administrative unit. On this administrative unit you then can safely assign the User Administrator role to a technician, without giving the opportunity to gain access to an account with higher permissions. The following roles can be assigned within an administrative unit:

You can add a user to multiple administrative units, which allows to create a well designed delegation model for users and groups in Azure Active Directory.

Continue reading →

Intune – Deploy required user settings to Windows 10 with powershell

Martin Wüthrich Application Management, Azure AD, Client Settings, EMM, General, Intune, MDM, Operating System Deployment, Powershell, Remote Workplace, Windows 10

In this blog I would like to describe, how I managed to set required user settings to Windows 10.
Since I still do have an On-Premises environment, in which also File Servers reside and a DFS Namespace is still up and running, I wanted to make sure to get the advantages of using the local network.
So here are my two use-cases to solve:
1. Add a Network location for the DFS Path if the user is logged on On-Premises
2. Modify the local “host” file, to redirect the workfolder clients to the file server internally
Continue reading →

Intune – Configure “Fast startup” (HiberBoot) for Windows 10

Martin Wüthrich Azure AD, homelab, MDM, Remote Workplace, Windows 10

Since I changed my clients from GPO managed to Intune controlled, not all settings from GPO, but some of them needs to be set through Intune as well. As outlined in my previous blog, I tried to disable the Fast Startup Option on Windows 10 through a CSP. And I did not even found a CSP supporting this setting. Within this blog, I would like to show, how you can configure the fast startup (“Turn on fast startup (recommended)”) setting in Windows 10 through Microsoft Intune:

You may ask, why I want to disable this? My reason: I don’t want to reuse a desktop session which was hibernated. And only a reboot will force the client to create a new desktop session, if fast startup is enabled.
Continue reading →

Windows 10 settings management with Intune

Martin Wüthrich Azure AD, Client Settings, Endpoint Protection, homelab, MDM, Office365, Remote Workplace, Windows 10

When a journey ends, a new journey will begin. My journey with the old school domain joined and GPO managed devices within my LAB ended, and I finally conquer new areas with Azure AD join and Intune controlled devices. Due to the lack of opportunities, I still waited so long, because a lot of settings were not possible to set. And some of them are still not that simple to set through Intune, but there is a solution for, I would like to say, most of the requirements.

So within this blog post, I would like to document my current knowledge of Windows 10 settings management through Intune. As today, we have the following options to configure GPO alike settings through Microsoft Intune:

  • Intune Windows Enrollment settings
  • Intune Portal blade settings
  • Intune Portal Custom CSP settings
  • Intune ADMX-backed administrative template settings (Preview)
  • PowerShell Script

    • Let’s have a closer look to the different options.
    Continue reading →

    Azure AD Connect – Configure the “Enable-ADSyncExportDeletionThreshold” wisely

    Martin Wüthrich Active Directory, Azure AD, Office365

    Today would shed some light on the cmdlet “Enable-ADSyncExportDeletionThreshold” which comes with the Azure AD Connect. If you are using Azure AD Connect to synchronize your On-Premise Active Directory to Azure Active Directory, Azure AD Connect will never execute a batch of more than 500 objects to delete. You can check the current value by using “Get-ADSyncExportDeletionThreshold”:

    Continue reading →

    Azure AD – Change from ADFS to pass-through Authentication

    Martin Wüthrich Active Directory, ADFS, Azure AD, Office365

    Since pass-through Authentication is GA and the major limitations are gone, I decided to change my Azure AD authentication against my local AD from ADFS to pass-through provided with Azure AD Connect.
    For those who are not that familiar with the concept of pass-through authentication, on this Microsoft Article “How it works”, you will find all the information. The picture below is from this article as well.

    Continue reading →

    ADFS – Single Sign On with automatic Login on Edge Browser

    Martin Wüthrich ADFS, Azure AD, Office365, Windows 10

    Today I would like to share my experience when it comes to add a User Agent (e.g. Browser) to the list of Single Sign On capable applications. There is quite a good Article from Microsoft that describes how to add a User agent to the ADFS Configuration, you will find this Article here:
    https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-intranet-forms-based-authentication-for-devices-that-do-not-support-wia
    Continue reading →