From the field: Three gotchas when migrating applications from AD FS to Entra

Reading Time: 3 minutes

From the field

As a professional, I like to prepare my projects to avoid any hick-ups during stressful moments. From reading up on the relevant Microsoft Docs, implementing a staging environment to define run and rollback changes to triple-checking my assumptions.

Recently, I have been involved in several projects for decommissioning Active Directory Federation Services (AD FS). Staged roll-out is a feature that helps migrating the user population from AD FS to managed authentication granularly. Other federated applications, services and platforms don't offer this kind of functionality and require the entire population be changed from authenticating to AD FS to authenticating to Entra. This cutover moment can be stressful. A lot of things can go wrong. Therefore, I'm sharing three gotchas when migrating applications from AD FS to Entra.

 

1. Applications may use a federated protocol that is not available in Entra

Some AD FS implementations have a lot of applications, and sometimes these applications use legacy protocols. It's not a problem when an application uses WS-Fed, SAML 1.0, or SAML 1.1 anymore, as these legacy protocols and versions are all supported by Entra. However, one particular federation protocol was never implemented in Entra: Shibboleth. This protocol was – and still is – primarily used for multilateral federation between universities and research facilities.

Microsoft offers three solutions for organizations:

  1. Microsoft Entra ID with Cirrus Bridge
  2. Microsoft Entra ID with Shibboleth as a SAML proxy
  3. Microsoft Entra ID with AD FS and Shibboleth

All these solutions respect Shibboleth as the federation protocol in use, but also all result in the AD FS implementation or other on-premises functionality is maintained. Mostly, the purpose of an AD FS migration project is to decommission on-premises functionality… Therefore, migrating to Entra External ID may be the best long-term solution, but this is going to take some time to architect, implement and perfect… while AD FS keeps running all the while…

 

2. Applications may use an outdated attribute for Name ID

When you've been working with Entra, you've become very familiar with the userPrincipalName attribute as the sign-in account towards most Entra-connected applications, services and platforms. When the primary user email address and userPrincipalName attributes match, people in your organization only need to remember one sign-in name.

However, in the early days of AD FS, the userPrincipalName wasn't as widely used as the globally unique user name it is considered to be today. In older Active Directory environments, it's even possible to spot accounts with empty userPrincipalName attributes. These environments rely on other attributes. The sAMAccountName attribute is typically used in these environments. Yes, in the Active Directory tooling, this attribute is referred to as the pre-Windows 2000 user name…

These outdated configurations in AD FS may prove cumbersome during the migration from AD FS to Entra, as the default application settings for multi-tenant applications configure the userPrincipalName as the sign-in attribute.

From a user perspective, nothing seems wrong, as AD FS performs its single sign-on magic with Active Directory in the same way. However, in the back-end of the AD FS-integrated application, service or platform, records for user accounts would have settings, profiles, permissions and history linked to a user table with sAMAccountName values. Oftentimes, the sAMAccountName attribute is then appended with the organization's public DNS domain name.

When not addressing this issue, switching the Name ID attribute from sAMAccountName (in Entra user.onpremisessamaccountname) to userPrincipalName (in Entra: user.userprincipalname) through these default settings would create all new users in the back-end, typically without the right settings, permissions, etc.

To avoid this, the back-end of the AD FS-integrated application should be converted from using the sAMAccountName attribute as the Name ID to using the userPrincipalName attribute. Depending on the vendor and contracts, this could easily add months to your AD FS migration project…

Avoid this situation by going through the claims issuance rules of AD FS-integrated applications, services and platforms and make sure these don't issue the sAMAccountName as the Name ID.

 

3. User assignment does not support group nesting

In Entra, it is a recommended practice to toggle the User assignment required setting for enterprise applications to Yes. This ensures that only people with user accounts that are members of a specific group have access to the functionality by configuring specific groups to have access.

However, the User assignment required setting and the groups that are added cannot be nested groups. In AD FS, group nesting was never a problem in claims issuance rules, so group nesting may suddenly become an issue when migrating an application, service and/or platform from AD FS to Entra.

The only thing that can be done is flattening the group memberships by adding the specific members of a sub group to the primary group. This takes time, so it's inconvenient to be confronted with during the actual application migration. Address this issue before migrating the application, service or platform from AD FS to Entra.

Posted on March 17, 2025 by Sander Berkouwer in Active Directory Federation Services, Entra ID

0  

What’s New in Entra ID in February 2025

Reading Time: 3 minutes

Microsoft Entra

Microsoft Entra ID, previously known as Azure AD is Microsoft's Identity Management-as-a-Service solution, offering seamless access, easy collaboration, efficiency in IT processes and improved security and compliance. In its Release Notes for Entra ID and in the Message Center, Microsoft communicated the following planned, new and changed functionality for Entra ID for February 2025:

 

Whats New

Authentication methods migration wizard Generally Available

Service category: MFA
Product capability: User Authentication

The authentication methods migration guide in the Microsoft Entra Admin Center lets admins automatically migrate method management from the legacy MFA and SSPR policies to the converged authentication methods policy. In 2023, Microsoft announced that the ability to manage authentication methods in the legacy MFA and SSPR policies would be retired in September 2025. Until now, organizations had to manually migrate methods themselves by using the migration toggle in the converged policy.

Now, admins can migrate in just a few selections by using the migration guide. The guide evaluates what the organization currently has enabled in both legacy policies, and generates a recommended converged policy configuration for you to review and edit as needed. From there, admins confirm the configuration, and the platform sets it up and marks the migration as complete.

 

Granular Microsoft Graph permissions for Lifecycle workflows Generally Available

Service category: Lifecycle Workflows
Product capability: Identity Governance

Now new, lesser privileged permissions can be used for managing specific read and write actions in Lifecycle workflows scenarios. The following granular permissions were introduced in Microsoft Graph:

  • LifecycleWorkflows-Workflow.ReadBasic.All
  • LifecycleWorkflows-Workflow.Read.All
  • LifecycleWorkflows-Workflow.ReadWrite.All
  • LifecycleWorkflows-Workflow.Activate
  • LifecycleWorkflows-Reports.Read.All
  • LifecycleWorkflows-CustomExt.Read.All
  • LifecycleWorkflows-CustomExt.ReadWrite.All

 

Enhanced user management in Admin Center Public Preview

Service category: User Management
Product capability: User Management

Admins are now able to multi-select and edit user accounts at once through the Microsoft Entra admin center. With this new capability, admins can bulk edit user account properties, add user accounts to groups, edit account status, and more. This user experience enhancement significantly improves efficiency for user account management tasks in the Microsoft Entra admin center.

 

QR code authentication, a simple and fast authentication method for Frontline Workers Public Preview

Service category: Authentications (Logins)
Product capability: User Authentication

Microsoft is thrilled to announce public preview of QR code authentication in Microsoft Entra ID, providing an efficient and simple authentication method for frontline workers.

You'll see a new authentication method QR code in Microsoft Entra ID Authentication method Policies. Admins can enable and add QR code for frontline workers via Microsoft Entra ID, My Staff, or Microsoft Graph APIs. All user accounts in the tenant see a new link Sign in with QR code on navigating to https://login.microsoftonline.com > Sign-in options > Sign in to an organization page. This new link is visible only on mobile devices running Androi, iOS or iPadOS. Users can use this authentication method only if admins add and provide a QR code to them. QR code authentication is also available in BlueFletch and Jamf. MHS QR code auth support will be generally available by early March.

 

External Authentication Methods support for system preferred MFA Public Preview

Support for external authentication methods as a supported method begins rolling out at the beginning of March 2025. When this is live in a tenant where system preferred is enabled and user accounts are in scope of an external authentication methods policy, these people will be prompted for their external authentication method if their most secure registered method is Microsoft Authenticator notification. External Authentication Method will appear as third in the list of most secure methods. If the person has a Temporary Access Pass (TAP) or Passkey (FIDO2) device registered, they'll be prompted for those. In addition, people in the scope of an external authentication methods policy will have the ability to delete all registered second factor methods from their account, even if the method being deleted is specified as the default sign in method or is system preferred.

 

Custom SAML/WS-Fed External Identity Provider Support in Microsoft Entra External ID Public Preview

Service category: B2C – Consumer Identity Management
Product capability: B2B/B2C

By setting up federation with a custom-configured identity provider that supports the SAML 2.0 or WS-Fed protocol, admins enable people to sign up and sign in to applications, systems and services using existing accounts from the federated external provider.

This feature also includes domain-based federation, so a person who enters an email address on the sign-in page that matches a predefined domain in any of the external identity providers will be redirected to authenticate with that identity provider.

 

 

Posted on March 7, 2025 by Sander Berkouwer in Entra ID, What's New

0  

Happy 25th Birthday, Active Directory!

Reading Time: < 1 minute

25 year birthday cake

Today, The DirTeam.com / ActiveDir.org Weblogs are celebrating the 25-year anniversary of Active Directory Domain Services as a released product.

 

Windows 2000 Server

The introduction of Active Directory to the world was part of the release of Windows 2000 Server on February 17, 2000.

Posted on February 17, 2025 by Sander Berkouwer in Active Directory, Community

0  

How to get the redirected URI for a go.microsoft.com/fwlink address

Reading Time: 2 minutes

Will you look at that!

In today’s Zero Trust networking scenarios, many organizations opt to only allow specific web locations to be accessible to their systems. This is problematic with addresses that act as redirect locations to actual web locations, because the actual web location needs to be allowlisted in the firewall to be accessible.

 

Common scenarios

A common scenario is an isolated networking environment with highly sensitive resources, whose systems need to be able to access specific web resources. This can be:

  • Updating and upgrading vendor-specific appliances
  • Downloading vendor-specific ISO files to an internal VMware datastore
  • (regularly) validating licenses in use with vendors

 

My scenario

The scenario I recently encountered was having to download a Windows Server 2025 trial ISO file to use in Azure VMware Solution from a Windows 365 device located on a dedicated network. The network and its systems process sensitive data. The organization has a Microsoft-first, cloud-first approach.

Of course, I knew how to navigate a browser to Windows Server 2025’s download page on Microsoft’s Evaluation Center website, but the links here are all https://go.microsoft.com/fwlink?linkid=… redirect URIs…

Obviously, adding go.microsoft.com for HTTPS in the Azure Firewall does not provide the ability to download the ISO. The actual URI where the *.iso file is located would still not be accessible, because that wouldn’t be allow-listed. We need to allow-list the actual URI to this purpose.

 

Locating the redirect URI

Here’s how to locate the actual URI. I’m using PowerShell to do this, as it is available on every device within this organization.

This is the line of PowerShell I used for the Windows Server 2025 ISO EN-US:

(Invoke-WebRequest -uri "https://go.microsoft.com/fwlink/?linkid=2293312&clcid=0x409&culture=en-us&country=us" -MaximumRedirection 0 -ErrorAction SilentlyContinue).RawContent

The output of this line of PowerShell provides the redirected URI for Location.

The *iso file was located on software-static.download.prss.microsoft.com.

I added go.microsoft.com and this URI to the allow-list for HTTPS for the Azure Firewall, after which I could download the *.iso file and upload it to the datastore of the Azure VMware Solution.

 

Concluding

Sometimes, one Windows built-in tool doesn’t provide the information we need (Microsoft Edge), but another one does (Microsoft PowerShell). 👍

Posted on February 14, 2025 by Sander Berkouwer in Enterprise Security, PowerShell, Recommended Practices

1  

From the field: You receive error ‘AADSTS9090561 The endpoint only accepts POST requests. Received a GET request’ when signing in

Reading Time: 2 minutes

From the field

Sometimes, you hit error messages that are just too vague to troubleshoot. I like these kinds of situations. I’ve hit errors before and their origins were always interesting.

Let’s see what’s happening today causing the error ‘AADSTS9090561 The endpoint only accepts POST requests. Received a GET request’ when signing in.

 

The situation

An organization is actively decommissioning Active Directory Federation Services (AD FS). Today, all employees sign in using the organization’s AD FS implementation but are scheduled to sign in using a managed solution, based on Microsoft Entra ID and password hash synchronization (PHS).

In Entra Connect Sync, Password Hash Synchronization was enabled quite a while ago. During regular checks throughout the project, no errors were detected in Entra Connect Sync Health or in Entra Connect Sync’s Synchronization Manager interface.

The Staged Rollout feature in Entra was enabled. A specific group was added to the feature. During the project, accounts would be added to the group to switch their sign-in method from AD FS to PHS.

 

The issue

After the first account is added to the group for Staged Rollout, the person can no longer sign in with the account. The error message is:

AADSTS9090561 The endpoint only accepts POST requests. Received a GET request

 

The cause

When troubleshooting, we checked Entra Connect Sync’s Synchronization Manager interface. Here, we found that all accounts in scope for synchronization were facing permissions issues.

When troubleshooting these issues, it appeared that Entra Connect Sync’s Active Directory connector account had been stripped of all permissions in Active Directory. Its permissions were reduced to the default membership of Domain users.

This resulted in the inability of Entra Connect Sync to perform Password Hash Sync, as the Active Directory connector account requires the Replicate Directory Changes and Replicate Directory Changes All permissions for that purpose.

 

The solution

On the Windows Server installation with Entra Connect Sync, we used the cmdlets in the ADSyncConfig PowerShell module to provide the appropriate permissions and secure the account:

$useraccount = 'CN=AD Connector account,CN=users,DC=domain,DC=tld'

Import-Module 'C:\Program Files\Microsoft Azure Active Directory Connect\AdSyncConfig\AdSyncConfig.psm1'

Set-ADSyncBasicReadPermissions -ADConnectorAccountDN $useraccount

Set-ADSyncExchangeHybridPermissions -ADConnectorAccountDN $useraccount

Set-ADSyncMsDsConsistencyGuidPermissions -ADConnectorAccountDN $useraccount

Set-ADSyncPasswordHashSyncPermissions -ADConnectorAccountDN $useraccount

Set-ADSyncPasswordWritebackPermissions -ADConnectorAccountDN $useraccount

Set-ADSyncRestrictedPermissions -ADConnectorAccountDN $useraccount

Set-ADSyncRestrictedPermissions -ADConnectorAccountDN $useraccount

 

Alternatively, you can use the fine-grained approach to delegate permissions laid out here, or use Michael Waterman's PowerShell alternative to it.

 

Concluding

Apparently, someone has been helping the project by cleaning up the permissions for Entra Connect Sync’s Active Directory connector account. Unfortunately, this change was too early and we had to reverse it…

Posted on February 13, 2025 by Sander Berkouwer in Active Directory, Entra Connect, Entra ID, KnowledgeBase Articles

0  

What’s New in Entra ID in January 2025

Reading Time: 4 minutes

Microsoft Entra

Microsoft Entra ID, previously known as Azure AD is Microsoft's Identity Management-as-a-Service solution, offering seamless access, easy collaboration, efficiency in IT processes and improved security and compliance. In its Release Notes for Entra ID and in the Message Center, Microsoft communicated the following planned, new and changed functionality for Entra ID for January 2025:

 

What's Deprecated

Azure AD Graph February 1, 2025

Service category: Azure AD Graph
Product capability: Developer Experience

The Azure AD Graph API service was deprecated in 2020. Retirement of the Azure AD Graph API service began in September 2024, and the next phase of this retirement starts February 1, 2025. This phase will impact new and existing applications unless action is taken.

Starting from February 1, 2025, both new and existing applications will be prevented from calling Azure AD Graph APIs, unless they're configured for an extension. You might not see impact right away, as Microsoft is rolling out this change in stages across tenants. We anticipate full deployment of this change around the end of February, and by the end of March for national cloud deployments.

If you haven't already, it's now urgent to review the applications on your tenant to see which ones depend on Azure AD Graph API access, and mitigate or migrate these before the February 1, 2025, cutoff date. For applications that haven't migrated to Microsoft Graph APIs, an extension can be set to allow the application access to Azure AD Graph through June 30, 2025.

 

MSOnline PowerShell module April 2025

Service category: Legacy MSOnline and AzureAD PowerShell modules
Product capability: Developer Experience

As announced in Microsoft Entra change announcements and in the Microsoft Entra Blog, the MSOnline and AzureAD PowerShell modules retired on March 30, 2024.

The retirement for MSOnline PowerShell module starts in early April 2025, and ends in late May 2025. If you're using MSOnline PowerShell, you must take action by March 30, 2025 to avoid impact after the retirement by migrating any use of MSOnline to Microsoft Graph PowerShell SDK or Microsoft Entra PowerShell.

  • The MSOnline PowerShell will retire, and stop working, between early April 2025 and late May 2025
  • The AzureAD PowerShell will no longer be supported after March 30, 2025, but its retirement will happen in early July 2025. This postponement is to allow you time to finish the MSOnline PowerShell migration
  • To ensure customer readiness for MSOnline PowerShell retirement, a series of temporary outage tests will occur for all tenants between January 2025 and March 2025.

 

What's New

Microsoft Entra PowerShell Generally Available

Service category: MS Graph
Product capability: Developer Experience

Manage and automate Microsoft Entra resources programmatically with the scenario-focused Microsoft Entra PowerShell module.

 

Improving visibility into downstream tenant sign-ins Generally Available

Service category: Reporting
Product capability: Monitoring & Reporting

Microsoft Security wants to ensure that all organizations are aware of how to notice when a partner is accessing a downstream tenant's resources. Interactive sign-in logs currently provide a list of sign in events, but there's no clear indication of which logins are from partners accessing downstream tenant resources. For example, when reviewing the logs, admins might see a series of events, but without any additional context, it’s difficult to tell whether these logins are from a partner accessing another tenant’s data.

Here's a list of steps that one can take to clarify which logins are associated with partner tenants:

  1. Take note of the ServiceProvider value in the CrossTenantAccessType column. This filter can be applied to refine the log data. When activated, it immediately isolates events related to partner logins.
  2. Utilize the Home Tenant ID and Resource Tenant ID columns. These two columns identify logins coming from the partner’s tenant to a downstream tenant.

After seeing a partner logging into a downstream tenant’s resources, an important follow-up activity to perform is to validate the activities that might have occurred in the downstream environment. Some examples of logs to look at are Microsoft Entra Audit logs for Microsoft Entra ID events, Microsoft 365 Unified Audit Log (UAL) for Microsoft 365 and Microsoft Entra ID events, and/or the Azure Monitor activity log for Azure events. By following these steps, admins are able to clearly identify when a partner is logging into a downstream tenant’s resources and subsequent activity in the environment, enhancing their ability to manage and monitor cross-tenant access efficiently.

To increase visibility into the aforementioned columns, Microsoft Entra will begin enabling these columns to display by default when loading the sign-in logs UX starting on March 7, 2025.

 

Real-time Password Spray Detection in Microsoft Entra ID Protection Generally Available

Service category: Identity Protection
Product capability: Identity Security & Protection

Traditionally, password spray attacks are detected post breach or as part of hunting activity. Now, Microsoft has enhanced Microsoft Entra ID Protection to detect password spray attacks in real-time before the threat actor ever obtains a token. This reduces remediation from hours to seconds by interrupting attacks during the sign-in flow.

Risk-based Conditional Access can automatically respond to this new signal by raising session risk, immediately challenging the sign-in attempt, and stopping password spray attempts in their tracks. This cutting-edge detection works alongside existing detections for advanced attacks such as Adversary-in-the-Middle (AitM) phishing and token theft, to ensure comprehensive coverage against modern attacks.

 

Protected actions for hard deletions Generally Available

Service category: Other
Product capability: Identity Security & Protection

Organizations can now configure Conditional Access policies to protect against early hard deletions. Protected action for hard deletion protects hard deletion of users, Microsoft 365 groups, and applications.

 

Flexible Federated Identity Credentials Public Preview

Service category: Authentications (Logins)
Product capability: Developer Experience

Flexible Federated Identity Credentials extend the existing Federated Identity Credential model by providing the ability to use wildcard matching against certain claims. Currently available for GitHub, GitLab, and Terraform Cloud scenarios, this functionality can be used to lower the total number of FICs required to managed similar scenarios.

 

Elevate Access events are now exportable via Microsoft Entra Audit Logs Public Preview

Service category: RBAC
Product capability: Monitoring & Reporting

This feature enables admins to export and stream Elevate Access events to both first-party and third-party SIEM solutions via Microsoft Entra Audit logs. It enhances detection and improves logging capabilities, allowing visibility into who in their tenant has utilized Elevate Access.

 

Manage Lifecycle Workflows with Microsoft Security CoPilot in Microsoft Entra Public Preview

Service category: Lifecycle Workflows
Product capability: Identity Governance

Organizations can now manage, and customize, Lifecycle Workflows using natural language with Microsoft Security CoPilot. The Lifecycle Workflows (LCW) Copilot solution provides step-by-step guidance to perform key workflow configuration and execution tasks using natural language. It allows organizations to quickly get rich insights to help monitor, and troubleshoot, workflows for compliance.

 

Posted on February 7, 2025 by Sander Berkouwer in Entra ID, What's New

0  

Entra Connect Sync v2.4.27.0 introduces Administrator Auditing

Reading Time: 2 minutes

Microsoft Entra

Microsoft Entra Connect Sync version 2.4.27.0 introduces the Pubic Preview of Administrator Auditing in Connect Sync.

 

What's New

Entra Connect Sync v2.4.129.0 offers one update and four bug fixes:

Auditing administrator events Public Preview

Starting with Entra Connect Sync v2.4.129.0, Entra Connect Sync enables for logging any admin changes made on Entra Connect Sync. This includes changes made using the UI and the PowerShell scripts.

SSPR Configuration bug addressed

Microsoft addressed the removal of the Self-service Password Reset (SSPR) configuration, when changes are made on the Azure AD Connector and saved in the Sync Service manager UI.

Privileged Identity Management improvements

Microsoft addressed the validation for the Global Administrator/Hybrid Identity Administrator role done during Entra Connect Sync installation and users with Global Administrator/Hybrid Identity Administrator through Privileged Identity Management (PIM).

AD FS improvements (2)

Microsoft addressed two Active Directory Federation Services (AD FS) issues:

  1. Microsoft addressed the no registered protocol handlers error.
  2. Microsoft addressed the Relying party must be unique (conflict error) error.

 

Version information

Version 2.4.129.0 of Entra Connect Sync (previously known as Azure AD Connect Sync) was made available for download and automatic upgrades on January 15th, 2025.

Admins can download the latest version of Entra Connect Sync here.

Superseded versions

Past versions of Microsoft Entra Connect Sync 2.x are retired 12 months from the date they are superseded by a newer version. With Entra Connect Sync v2.4.129.0, Entra Connect Sync version 2.2.8.0 and versions before are retired (superseded by Entra Connect Sync v2.3.2.0 on November 12th, 2023).

If you run a retired version of Microsoft Entra Connect, it might unexpectedly stop working.

Posted on January 20, 2025 by Sander Berkouwer in Entra Connect, What's New

0  

What’s New in Entra ID in December 2024

Reading Time: 4 minutes

Microsoft Entra

Microsoft Entra ID, previously known as Azure AD is Microsoft's Identity Management-as-a-Service solution, offering seamless access, easy collaboration, efficiency in IT processes and improved security and compliance. In its Release Notes for Entra ID and in the Message Center, Microsoft communicated the following planned, new and changed functionality for Entra ID for December 2024:

 

What's New

What's new in Microsoft Entra Generally Available

Service category: Reporting
Product capability: Monitoring & Reporting

What's new in Microsoft Entra offers a comprehensive view of Microsoft Entra product updates including product roadmap (like Public Previews and recent GAs), and change announcements (like deprecations, breaking changes, feature changes and Microsoft-managed policies). It's a one stop shop for Microsoft Entra admins to discover the product updates.

 

Update Profile Photo in MyAccount Generally Available

Service category: My Profile/Account
Product capability: End User Experiences

People can now update their profile photo directly from their MyAccount portal. This change exposes a new edit button on the profile photo section of the persons account.

 

Temporary Access Pass (TAP) support for internal guest users Generally Available

Service category: MFA
Product capability: Identity Security & Protection

Microsoft Entra ID now supports issuing Temporary Access Passes (TAP) to internal guest users. TAPs can be issued to internal guests just like normal members, through the Microsoft Entra ID Admin Center, or natively through Microsoft Graph. With this enhancement, internal guests can now seamlessly onboard, and recover, their accounts with time-bound temporary credentials.

 

Expansion of SSPR Policy Audit Logging Generally Available

Service category: Self Service Password Reset
Product capability: Monitoring & Reporting

Starting Mid-January, Microsoft ise improving the audit logs for changes made to the SSPR Policy.

With this improvement, any change to the SSPR policy configuration, including enablement or disablement, will result in an audit log entry that includes details about the change made. Additionally, both the previous values and current values from the change will be recorded within the audit log. This additional information can be found by selecting an audit log entry and selecting the Modified Properties tab within the entry.

These changes are rolled out in phases:

  • Phase 1 includes logging for the Authentication Methods, Registration, Notifications, and Customization configuration settings.
  • Phase 2 includes logging for the On-premises integration configuration settings.

This change occurs automatically, so admins take no action.

 

Dedicated new 1st party resource application to enable Active Directory to Microsoft Entra ID sync using Microsoft Entra Connect Sync or Cloud Sync Generally Available

Service category: Provisioning
Product capability: Directory

As part of ongoing security hardening, Microsoft deployed Microsoft Entra AD Synchronization Service, a dedicated first-party application to enable the synchronization between Active Directory and Microsoft Entra ID. This new application, with Application Id 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016, was provisioned in customer tenants that use Microsoft Entra Connect Sync and/or the Microsoft Entra Cloud Sync service.

 

Privileged Identity Management integration in Azure Role Based Access Control Generally Available

Service category: RBAC
Product capability: Access Control

Privileged Identity Management (PIM) capabilities are now integrated into the Azure Role Based Access Control (Azure RBAC) UI. Before this integration, RBAC admins could only manage standing access (active permanent role assignments) from the Azure RBAC UI. With this integration, just-in-time access and timebound access, which are functionalities supported by PIM, are now brought into the Azure RBAC UI for customers with either a P2, or Identity Governance, license.

RBAC admins can create assignments of type eligible and timebound duration from the Azure RBAC add role assignment flow, see the list of different states of role assignment in a single view, as well as convert the type and duration of their role assignments from the Azure RBAC UI. In addition, end users now see all their role assignments of different state straight from the Azure RBAC UI landing page, from where they can also activate their eligible role assignments.

 

Microsoft Entra External ID Custom URL Domains Generally Available

Service category: Authentications (Logins)
Product capability: Identity Lifecycle Management

This feature allows organizations to customize their Microsoft default sign in authentication endpoint with their own brand names. Custom URL Domains help organizations to change Ext ID endpoint < tenant-name >.ciamlogin.com to login.contoso.com.

 

Sign in with Apple Public Preview

Service category: B2C – Consumer Identity Management
Product capability: Extensibility

This new feature adds Apple to Microsoft's list of preconfigured social identity providers. As the first social identity provider implemented on the eSTS platform, it introduces a Sign in with Apple button to the sign-in options, allowing people to access applications with their Apple accounts.

 

Provision custom security attributes from HR sources Public Preview

Service category: Provisioning
Product capability: Inbound to Entra ID

With this feature, organizations can automatically provision custom security attributes in Microsoft Entra ID from authoritative Human Resources (HR) sources. Supported authoritative sources include: Workday, SAP SuccessFactors, and any HR system integrated using API-driven provisioning.

 

Microsoft Entra ID Governance: access package request suggestions Public Preview Opt-In

Service category: Entitlement Management
Product capability: Entitlement Management

Microsoft is excited to introduce a new feature in My Access: a curated list of suggested access packages. This capability allows people to quickly view the most relevant access packages (based off their peers' access packages and previous requests) without scrolling through a long list. In December 2024, admins can enable the preview in the Opt-in Preview Features for Identity Governance. From January 2025, this setting is enabled by default.

 

Microsoft Entra ID Governance: Approvers can revoke access in MyAccess Public Preview

Service category: Entitlement Management
Product capability: Entitlement Management

For Microsoft Entra ID Governance users, approvers of access package requests can now revoke their decision in MyAccess. Only the person who took the approve action is able to revoke access. To opt into this feature, admins can go to the Identity Governance settings page, and enable the feature.

 

Security Copilot embedded in Microsoft Entra Public Preview

Service category: Other
Product capability: Identity Security & Protection

Microsoft has announced the public preview of Microsoft Security Copilot embedded in the Microsoft Entra admin Center. This integration brings all identity skills previously made generally available for the Security Copilot standalone experience in April 2024, along with new identity capabilities for admins and security analysts to use directly within the Microsoft Entra admin center. Microsoft has also added brand new skills to help improve identity-related risk investigation. In December 2024, Microsoft broadens the scope even further to include a set of skills specifically for App Risk Management in both standalone and embedded experiences of Security Copilot and Microsoft Entra. These capabilities allow identity admins and security analysts to better identify, understand, and remediate the risks impacting applications and workload identities registered in Microsoft Entra.

With Security Copilot now embedded in Microsoft Entra, identity admins get AI-driven, natural-language summaries of identity context and insights tailored for handling security incidents, equipping them to better protect against identity compromise. The embedded experience also accelerates troubleshooting tasks like resolving identity-related risks and sign-in issues, without ever leaving the admin center.

Posted on January 6, 2025 by Sander Berkouwer in Entra ID, What's New

0  

Entra Connect Sync v2.4.27.0 addresses a remote code execution vulnerability (CVE-2024-37334)

Reading Time: 2 minutes

Microsoft Entra

Microsoft Entra Connect Sync version 2.4.27.0 uses OLE DB version 18.7.4 that further hardens the service. Upgrade to this latest version of connect sync to improve your security.

 

What’s New

Entra Connect Sync v2.4.27.0 offers one update and two bug fixes:

SQL-related drivers updated to OLE DB v18.7.4

Starting with Entra Connect Sync v2.4.27.0, Entra Connect Sync's SQL-related drived have been updated to OLE DB version 18.7.4.

OLE DB v18.7.4 is a security update that addresses a remote code execution vulnerability (CVE-2024-37334) with a CVSS v3.1 score of 8.8/7.7 hat can be abused by a threat actor over the network.

Privileged Identity Management improvements

Microsoft addressed an issue with Privileged Identity Management (PIM), Microsoft Entra roles, and PIM for Groups to verify that PIM is enabled and that the user has the Hybrid Identity Administrator role enabled.

AD FS commands fixed

Microsoft fixed an issue where Active Directory Federation Services (AD FS) commands were failing when Connect Sync is installed on a non-ADFS server.

 

Version information

Version 2.4.27.0 of Entra Connect Sync (previously known as Azure AD Connect Sync) was made available for download only on November 14th, 2024.

Admins can download the latest version of Entra Connect Sync here.

Superseded versions

Past versions of Microsoft Entra Connect Sync 2.x are retired 12 months from the date they are superseded by a newer version. With Entra Connect Sync v2.4.27.0, Entra Connect Sync version 2.2.1.0 and versions before are retired (superseded by Entra Connect Sync v2.2.8.0 on October 11th, 2023).

If you run a retired version of Microsoft Entra Connect, it might unexpectedly stop working.

Posted on November 16, 2024 by Sander Berkouwer in Entra Connect, Security Updates, What's New

0  

What’s New in Entra ID in November 2024

Reading Time: 4 minutes

Microsoft Entra

Microsoft Entra ID, previously known as Azure AD is Microsoft's Identity Management-as-a-Service solution, offering seamless access, easy collaboration, efficiency in IT processes and improved security and compliance. In its Release Notes for Entra ID and in the Message Center, Microsoft communicated the following planned, new and changed functionality for Entra ID for November 2024:

 

What's Deprecated

MFA Fraud Alert will be retired on March 1st 2025

Service category: MFA
Product capability: Identity Security & Protection

Microsoft Entra multi-factor authentication (MFA) fraud alert allows people to report MFA voice calls, and Microsoft Authenticator push requests, they didn't initiate as fraudulent. Beginning March 1, 2025, MFA Fraud Alert will be retired in favor of the replacement Report Suspicious Activity feature which allows people to report fraudulent requests, and is also integrated with Identity Protection for more comprehensive coverage and remediation.

 

MIM hybrid reporting agent

Service category: Microsoft Identity Manager (MIM)
Product capability: Monitoring & Reporting

The hybrid reporting agent, used to send a Microsoft Identity Manager service event log to Microsoft Entra to surface in password reset and self-service group management reports, is deprecated. The recommended replacement is to use Azure ARC to send the event logs to Azure Monitor.

 

What’s New

Microsoft Entra Health Monitoring, Health Metrics Feature Generally Available

Service category: Reporting
Product capability: Monitoring & Reporting

Microsoft Entra health monitoring, available from the Health pane, includes a set of low-latency pre-computed health metrics that can be used to monitor the health of critical user scenarios in an Entra tenant. The first set of health scenarios includes MFA, CA-compliant devices, CA-managed devices, and SAML authentications. This set of monitor scenarios will grow over time. These health metrics are now released as general availability data streams, in conjunction with the public preview of an intelligent alerting capability.

 

Log analytics sign-in logs schema is in parity with MSGraph schema Generally Available

Service category: Authentications (Logins)
Product capability: Monitoring & Reporting

To maintain consistency in its core logging principles, Microsoft has addressed a legacy parity issue where the Azure Log Analytics sign-in logs schema did not align with the MS Graph sign-in logs schema. The updates include fields such as ClientCredentialType, CreatedDateTime, ManagedServiceIdentity, NetworkLocationDetails, tokenProtectionStatus, SessionID, among others. These changes will take effect in the first week of December 2024.

 

Updating profile photo in MyAccount Pubic Preview

Service category: My Profile/Account
Product capability: End User Experiences

On November 13, 2024, people received the ability to update their profile photo directly from their MyAccount portal. This change exposes a new edit button on the profile photo section of the persons account.

 

Microsoft Entra new store for certificate-based authentication Public Preview

Service category: Authentications (Logins)
Product capability: User Authentication

Microsoft Entra ID has a new scalable PKI (Public Key Infrastructure) based CA (Certification Authority) store with higher limits for the number of CAs and the size of each CA file. The new PKI-based CA store allows CAs within each different PKI to be in its own container object allowing admins to move away from one flat list of CAs to more efficient PKI container-based CAs. The new PKI-based CA store now supports up to 250 CAs, 8KB size for each CA and also supports issuers hints attribute for each CA. Admins can also upload the entire PKI and all the CAs using the Upload CBA PKI feature or create a PKI container and upload CAs individually.

 

Universal Continuous Access Evaluation Pubic Preview

Service category: Provisioning
Product capability: Network Access

Continuous Access Evaluation (CAE) revokes, and revalidates, network access in near real-time whenever Microsoft Entra ID detects changes to the identity.

 

What's Changed

Microsoft Entra Health Monitoring, Alerts Feature

Service category: Other
Product capability: Monitoring & Reporting

Intelligent alerts in Microsoft Entra health monitoring notify tenant admins, and security engineers, whenever a monitored scenario breaks from its typical pattern. Microsoft Entra's alerting capability watches the low-latency health signals of each scenario, and fires a notification in the event of an anomaly. The set of alert-ready health signals and scenarios will grow over time. This alerts feature is now available in Microsoft Entra Health as an API-only public preview release (UX release is scheduled for February 2025).

 

Expansion of WhatsApp as an MFA one-time passcode delivery channel

Service category: MFA
Product capability: User Authentication

In late 2023, Entra ID started leveraging WhatsApp as an alternate channel to deliver multi-factor authentication (MFA) one-time passcodes to people in India and Indonesia. Microsoft saw improved deliverability, completion rates, and satisfaction when leveraging the channel in both countries. The channel was temporarily disabled in India in early 2024. Starting early December 2024, Microsoft will be re-enabling the channel in India, and expanding its use to additional countries.

Starting December 2024, people in India, and other countries can start receiving MFA text messages via WhatsApp. Only people that are enabled to receive MFA text messages as an authentication method, and already have WhatsApp on their phone, will get this experience. If a person with WhatsApp on their device is unreachable or doesn’t have internet connectivity, Microsoft will quickly fall back to the regular SMS channel. In addition, people receiving one-time passcodes (OTPs) via WhatsApp for the first time will be notified of the change in behavior via SMS text message.

If organizations don’t want their people to receive MFA text messages through WhatsApp, admins can disable text messages as an authentication method or scope it down to only be enabled for a subset of people. Please note that Microsoft highly encourages organizations move to using more modern, secure methods like Microsoft Authenticator and passkeys in favor of telecom and messaging app methods.

Posted on November 8, 2024 by Sander Berkouwer in Entra ID, What's New

0