Skip to content

Commit fac8c1d

Browse files
v-aljev-alje
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into release-mvc-domain-services
2 parents a37e6a8 + eedc76b commit fac8c1d

File tree

112 files changed

+1856
-829
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

112 files changed

+1856
-829
lines changed

‎articles/active-directory/authentication/howto-mfa-userstates.md

+25-26
Original file line numberDiff line numberDiff line change
@@ -136,32 +136,6 @@ which can also be shortened to:
136136
The following PowerShell can assist you in making the conversion to Conditional Access based Azure Multi-Factor Authentication.
137137

138138
```PowerShell
139-
# Disable MFA for all users, keeping their MFA methods intact
140-
Get-MsolUser -All | Disable-MFA -KeepMethods
141-
142-
# Wrapper to disable MFA with the option to keep the MFA methods (to avoid having to proof-up again later)
143-
function Disable-Mfa {
144-
145-
[CmdletBinding()]
146-
param(
147-
[Parameter(ValueFromPipeline=$True)]
148-
$User,
149-
[switch] $KeepMethods
150-
)
151-
152-
Process {
153-
154-
Write-Verbose ("Disabling MFA for user '{0}'" -f $User.UserPrincipalName)
155-
$User | Set-MfaState -State Disabled
156-
157-
if ($KeepMethods) {
158-
# Restore the MFA methods which got cleared when disabling MFA
159-
Set-MsolUser -ObjectId $User.ObjectId `
160-
-StrongAuthenticationMethods $User.StrongAuthenticationMethods
161-
}
162-
}
163-
}
164-
165139
# Sets the MFA requirement state
166140
function Set-MfaState {
167141
@@ -191,6 +165,31 @@ function Set-MfaState {
191165
}
192166
}
193167
168+
# Wrapper to disable MFA with the option to keep the MFA methods (to avoid having to proof-up again later)
169+
function Disable-Mfa {
170+
171+
[CmdletBinding()]
172+
param(
173+
[Parameter(ValueFromPipeline=$True)]
174+
$User,
175+
[switch] $KeepMethods
176+
)
177+
178+
Process {
179+
180+
Write-Verbose ("Disabling MFA for user '{0}'" -f $User.UserPrincipalName)
181+
$User | Set-MfaState -State Disabled
182+
183+
if ($KeepMethods) {
184+
# Restore the MFA methods which got cleared when disabling MFA
185+
Set-MsolUser -ObjectId $User.ObjectId `
186+
-StrongAuthenticationMethods $User.StrongAuthenticationMethods
187+
}
188+
}
189+
}
190+
191+
# Disable MFA for all users, keeping their MFA methods intact
192+
Get-MsolUser -All | Disable-MFA -KeepMethods
194193
```
195194

196195
## Next steps

‎articles/active-directory/conditional-access/TOC.yml

+20
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@
1919
- name: Concepts
2020
expanded: false
2121
items:
22+
- name: Adopting Conditional Access
23+
href: howto-conditional-access-adoption-kit.md
24+
- name: Common Conditional Access policies
25+
href: concept-conditional-access-policy-common.md
2226
- name: Conditions
2327
href: conditions.md
2428
- name: Location conditions
@@ -38,6 +42,22 @@
3842
href: plan-conditional-access.md
3943
- name: Best practices
4044
href: best-practices.md
45+
- name: Common policy templates
46+
items:
47+
- name: Require MFA for administrators
48+
href: howto-conditional-access-policy-admin-mfa.md
49+
- name: Require MFA for Azure management
50+
href: howto-conditional-access-policy-azure-management.md
51+
- name: Block legacy authentication
52+
href: howto-conditional-access-policy-block-legacy.md
53+
- name: Risk-based Conditional Access
54+
href: howto-conditional-access-policy-risk.md
55+
- name: Require trusted location for MFA registration
56+
href: howto-conditional-access-policy-registration.md
57+
- name: Block access by location
58+
href: howto-conditional-access-policy-location.md
59+
- name: Require compliant devices
60+
href: howto-conditional-access-policy-compliant-device.md
4161
- name: Block legacy authentication
4262
href: block-legacy-authentication.md
4363
- name: Conditional Access for MFA registration

‎articles/active-directory/conditional-access/concept-conditional-access-policy-common.md

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
title: Common Conditional Access policies - Azure Active Directory
3+
description: Commonly used Conditional Access policies for organizations
4+
5+
services: active-directory
6+
ms.service: active-directory
7+
ms.subservice: conditional-access
8+
ms.topic: conceptual
9+
ms.date: 08/16/2019
10+
11+
ms.author: joflore
12+
author: MicrosoftGuyJFlo
13+
manager: daveba
14+
ms.reviewer: calebb, rogoya
15+
16+
ms.collection: M365-identity-device-management
17+
---
18+
# Common Conditional Access policies
19+
20+
Baseline protection policies are great but many organizations need more flexibility than they offer. For example, many organizations need the ability to exclude specific accounts like their emergency access or break-glass administration accounts from Conditional Access policies requiring multi-factor authentication. For those organizations, the common policies referenced in this article can be of use.
21+
22+
![Conditional Access policies in the Azure portal](./media/concept-conditional-access-policy-common/conditional-access-policies-azure-ad-listing.png)
23+
24+
## Emergency access accounts
25+
26+
More information about emergency access accounts and why they are important can be found in the following articles:
27+
28+
* [Manage emergency access accounts in Azure AD](../users-groups-roles/directory-emergency-access.md)
29+
* [Create a resilient access control management strategy with Azure Active Directory](../authentication/concept-resilient-controls.md)
30+
31+
## Typical policies deployed by organizations
32+
33+
* [Require MFA for administrators](howto-conditional-access-policy-admin-mfa.md)
34+
* [Require MFA for Azure management](howto-conditional-access-policy-azure-management.md)
35+
* [Block legacy authentication](howto-conditional-access-policy-block-legacy.md)
36+
* [Risk-based Conditional Access (Requires Azure AD Premium P2)](howto-conditional-access-policy-risk.md)
37+
* [Require trusted location for MFA registration](howto-conditional-access-policy-registration.md)
38+
* [Block access by location](howto-conditional-access-policy-location.md)
39+
* [Require compliant device](howto-conditional-access-policy-compliant-device.md)
40+
41+
## Next steps
42+
43+
[Simulate sign in behavior using the Conditional Access What If tool](troubleshoot-conditional-access-what-if.md)

‎articles/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa.md

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
title: Conditional Access - Require MFA for administrators - Azure Active Directory
3+
description: Create a custom Conditional Access policy to require administrators to perform multi-factor authentication
4+
5+
services: active-directory
6+
ms.service: active-directory
7+
ms.subservice: conditional-access
8+
ms.topic: conceptual
9+
ms.date: 08/16/2019
10+
11+
ms.author: joflore
12+
author: MicrosoftGuyJFlo
13+
manager: daveba
14+
ms.reviewer: calebb, rogoya
15+
16+
ms.collection: M365-identity-device-management
17+
---
18+
# Conditional Access: Require MFA for administrators
19+
20+
Accounts that are assigned administrative rights are targeted by attackers. Requiring multi-factor authentication (MFA) on those accounts is an easy way to reduce the risk of those accounts being compromised.
21+
22+
Microsoft recommends you require MFA on the following roles at a minimum:
23+
24+
* Global administrator
25+
* SharePoint administrator
26+
* Exchange administrator
27+
* Conditional Access administrator
28+
* Security administrator
29+
* Helpdesk (Password) administrator
30+
* Password administrator
31+
* Billing administrator
32+
* User administrator
33+
34+
Organizations can choose to include or exclude roles as they see fit.
35+
36+
## User exclusions
37+
38+
Conditional Access policies are powerful tools, we recommend excluding the following accounts from your policy:
39+
40+
* **Emergency access** or **break-glass** accounts to prevent tenant-wide account lockout. In the unlikely scenario all administrators are locked out of your tenant, your emergency-access administrative account can be used to log into the tenant take steps to recover access.
41+
* More information can be found in the article, [Manage emergency access accounts in Azure AD](../users-groups-roles/directory-emergency-access.md).
42+
* **Service accounts** and **service principles**, such as the Azure AD Connect Sync Account. Service accounts are non-interactive accounts that are not tied to any particular user. They are normally used by back-end services and allow programmatic access to applications. Service accounts should be excluded since MFA can’t be completed programmatically.
43+
* If your organization has these accounts in use in scripts or code, consider replacing them with [managed identities](../managed-identities-azure-resources/overview.md). As a temporary workaround, you can exclude these specific accounts from the baseline policy.
44+
45+
## Create a Conditional Access policy
46+
47+
The following steps will help create a Conditional Access policy to require those assigned administrative roles to perform multi-factor authentication.
48+
49+
1. Sign in to the **Azure portal** as a global administrator, security administrator, or Conditional Access administrator.
50+
1. Browse to **Azure Active Directory** > **Conditional Access**.
51+
1. Select **New policy**.
52+
1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
53+
1. Under **Assignments**, select **Users and groups**
54+
1. Under **Include**, select **Directory roles (preview)** and choose the following roles at a minimum:
55+
* Global administrator
56+
* SharePoint administrator
57+
* Exchange administrator
58+
* Conditional Access administrator
59+
* Security administrator
60+
* Helpdesk administrator
61+
* Password administrator
62+
* Billing administrator
63+
* User administrator
64+
1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts.
65+
1. Select **Done**.
66+
1. Under **Cloud apps or actions** > **Include**, select **All cloud apps**, and select **Done**.
67+
1. Under **Access controls** > **Grant**, select **Grant access**, **Require multi-factor authentication**, and select **Select**.
68+
1. Confirm your settings and set **Enable policy** to **On**.
69+
1. Select **Create** to create to enable your policy.
70+
71+
## Next steps
72+
73+
[Conditional Access common policies](concept-conditional-access-policy-common.md)
74+
75+
[Simulate sign in behavior using the Conditional Access What If tool](troubleshoot-conditional-access-what-if.md)

‎articles/active-directory/conditional-access/howto-conditional-access-policy-azure-management.md

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: Conditional Access - Require MFA for Azure management - Azure Active Directory
3+
description: Create a custom Conditional Access policy to require multi-factor authentication for Azure management tasks
4+
5+
services: active-directory
6+
ms.service: active-directory
7+
ms.subservice: conditional-access
8+
ms.topic: conceptual
9+
ms.date: 08/16/2019
10+
11+
ms.author: joflore
12+
author: MicrosoftGuyJFlo
13+
manager: daveba
14+
ms.reviewer: calebb, rogoya
15+
16+
ms.collection: M365-identity-device-management
17+
---
18+
# Conditional Access: Require MFA for Azure management
19+
20+
Organizations use a variety of Azure services and manage them from Azure Resource Manager based tools like:
21+
22+
* Azure portal
23+
* Azure PowerShell
24+
* Azure CLI
25+
26+
These tools can provide highly privileged access to resources, that can alter subscription-wide configurations, service settings, and subscription billing. To protect these privileged resources, Microsoft recommends requiring multi-factor authentication for any user accessing these resources.
27+
28+
## User exclusions
29+
30+
Conditional Access policies are powerful tools, we recommend excluding the following accounts from your policy:
31+
32+
* **Emergency access** or **break-glass** accounts to prevent tenant-wide account lockout. In the unlikely scenario all administrators are locked out of your tenant, your emergency-access administrative account can be used to log into the tenant take steps to recover access.
33+
* More information can be found in the article, [Manage emergency access accounts in Azure AD](../users-groups-roles/directory-emergency-access.md).
34+
* **Service accounts** and **service principles**, such as the Azure AD Connect Sync Account. Service accounts are non-interactive accounts that are not tied to any particular user. They are normally used by back-end services and allow programmatic access to applications. Service accounts should be excluded since MFA can’t be completed programmatically.
35+
* If your organization has these accounts in use in scripts or code, consider replacing them with [managed identities](../managed-identities-azure-resources/overview.md). As a temporary workaround, you can exclude these specific accounts from the baseline policy.
36+
37+
## Create a Conditional Access policy
38+
39+
The following steps will help create a Conditional Access policy to require those assigned administrative roles to perform multi-factor authentication.
40+
41+
1. Sign in to the **Azure portal** as a global administrator, security administrator, or Conditional Access administrator.
42+
1. Browse to **Azure Active Directory** > **Conditional Access**.
43+
1. Select **New policy**.
44+
1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
45+
1. Under **Assignments**, select **Users and groups**
46+
1. Under **Include**, select **All users**.
47+
1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts.
48+
1. Select **Done**.
49+
1. Under **Cloud apps or actions** > **Include**, select **Select apps**, choose **Microsoft Azure Management**, and select **Select** then **Done**.
50+
1. Under **Access controls** > **Grant**, select **Grant access**, **Require multi-factor authentication**, and select **Select**.
51+
1. Confirm your settings and set **Enable policy** to **On**.
52+
1. Select **Create** to create to enable your policy.
53+
54+
## Next steps
55+
56+
[Conditional Access common policies](concept-conditional-access-policy-common.md)
57+
58+
[Simulate sign in behavior using the Conditional Access What If tool](troubleshoot-conditional-access-what-if.md)

‎articles/active-directory/conditional-access/howto-conditional-access-policy-block-legacy.md

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
title: Conditional Access - Block legacy authentication - Azure Active Directory
3+
description: Create a custom Conditional Access policy to block legacy authentication protocols
4+
5+
services: active-directory
6+
ms.service: active-directory
7+
ms.subservice: conditional-access
8+
ms.topic: conceptual
9+
ms.date: 08/16/2019
10+
11+
ms.author: joflore
12+
author: MicrosoftGuyJFlo
13+
manager: daveba
14+
ms.reviewer: calebb, rogoya
15+
16+
ms.collection: M365-identity-device-management
17+
---
18+
# Conditional Access: Block legacy authentication
19+
20+
Due to the increased risk associated with legacy authentication protocols, Microsoft recommends that organizations block authentication requests using these protocols and require modern authentication.
21+
22+
## Create a Conditional Access policy
23+
24+
The following steps will help create a Conditional Access policy to require those assigned administrative roles to perform multi-factor authentication.
25+
26+
1. Sign in to the **Azure portal** as a global administrator, security administrator, or Conditional Access administrator.
27+
1. Browse to **Azure Active Directory** > **Conditional Access**.
28+
1. Select **New policy**.
29+
1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
30+
1. Under **Assignments**, select **Users and groups**
31+
1. Under **Include**, select **All users**.
32+
1. Under **Exclude**, select **Users and groups** and choose any accounts that must maintain the ability to use legacy authentication.
33+
1. Select **Done**.
34+
1. Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
35+
1. If you must exclude specific applications from your policy, you can choose them from the **Exclude** tab under **Select excluded cloud apps** and choose **Select**.
36+
1. Select **Done**.
37+
1. Under **Conditions** > **Client apps (preview)**, set **Configure** to **Yes**.
38+
1. Check only the boxes **Mobile apps and desktop clients** > **Other clients**.
39+
2. Select **Done**.
40+
1. Under **Access controls** > **Grant**, select **Block access**.
41+
1. Select **Select**.
42+
1. Confirm your settings and set **Enable policy** to **On**.
43+
1. Select **Create** to create to enable your policy.
44+
45+
## Next steps
46+
47+
[Conditional Access common policies](concept-conditional-access-policy-common.md)
48+
49+
[Simulate sign in behavior using the Conditional Access What If tool](troubleshoot-conditional-access-what-if.md)

‎articles/active-directory/conditional-access/howto-conditional-access-policy-compliant-device.md

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: Conditional Access - Require compliant devices - Azure Active Directory
3+
description: Create a custom Conditional Access policy to require compliant devices
4+
5+
services: active-directory
6+
ms.service: active-directory
7+
ms.subservice: conditional-access
8+
ms.topic: conceptual
9+
ms.date: 08/16/2019
10+
11+
ms.author: joflore
12+
author: MicrosoftGuyJFlo
13+
manager: daveba
14+
ms.reviewer: calebb, rogoya
15+
16+
ms.collection: M365-identity-device-management
17+
---
18+
# Conditional Access: Require compliant devices
19+
20+
Organizations who have deployed Microsoft Intune can use the information returned from their devices to identify devices that meet compliance requirements such as:
21+
22+
* Requiring a PIN to unlock
23+
* Requiring device encryption
24+
* Requiring a minimum or maximum operating system version
25+
* Requiring a device is not jailbroken or rooted
26+
27+
This policy compliance information is forwarded to Azure AD where Conditional Access can make decisions to grant or block access to resources.
28+
29+
## Create a Conditional Access policy
30+
31+
The following steps will help create a Conditional Access policy to require devices accessing resources be marked as compliant with your organization's Intune compliance policies.
32+
33+
1. Sign in to the **Azure portal** as a global administrator, security administrator, or Conditional Access administrator.
34+
1. Browse to **Azure Active Directory** > **Conditional Access**.
35+
1. Select **New policy**.
36+
1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
37+
1. Under **Assignments**, select **Users and groups**
38+
1. Under **Include**, select **All users**.
39+
1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts.
40+
1. Select **Done**.
41+
1. Under **Cloud apps or actions** > **Include**, select **All cloud apps**.
42+
1. If you must exclude specific applications from your policy, you can choose them from the **Exclude** tab under **Select excluded cloud apps** and choose **Select**.
43+
1. Select **Done**.
44+
1. Under **Access controls** > **Grant**, select **Require device to be marked as compliant**.
45+
1. Select **Select**.
46+
1. Confirm your settings and set **Enable policy** to **On**.
47+
1. Select **Create** to create to enable your policy.
48+
49+
## Next steps
50+
51+
[Conditional Access common policies](concept-conditional-access-policy-common.md)
52+
53+
[Simulate sign in behavior using the Conditional Access What If tool](troubleshoot-conditional-access-what-if.md)
54+
55+
[Device compliance policies work with Azure AD](/intune/device-compliance-get-started.md#device-compliance-policies-work-with-azure-ad)

0 commit comments

Comments
 (0)