Category Configuring Windows Hello

In this chapter, you learned how to evaluate passwordless sign-in options for your organization and deploy the ones that best suit your needs. Some passwordless options, such as Windows Hello or FIDO2 keys, may require specialized hardware such as cameras, USB devices, or fingerprint readers, while the Microsoft Authenticator app method requires only the Microsoft Authenticator app on any supported Android or iOS-based device.

You also learned about deploying features such as self-service password reset and Azure AD password protection to further reduce administrative overhead, helping your organization comply with security policies.

In the next chapter, you’ll learn about implementing secure access in the context of Microsoft 365.

Exam Readiness Drill – Chapter Review Questions Benchmark Score: 75%

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That’s why, working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

Before You Proceed

You need to unlock these resources before you start using them. Unlocking takes less than 10 minutes, can be done from any device, and needs to be done only once. Head over to the start of Chapter 7, Managing Security Reports and Alerts by Using the Microsoft 365 Defender Portal in this book for instructions on how to unlock them.

To open the Chapter Review Questions for this chapter, click the following link:

https://packt.link/MS102E1_Ch05. Or, you can scan the following QR code:

Figure 5.34 – QR code that opens Chapter Review Questions for logged-in users

Once you login, you’ll see a page similar to what is shown in Figure 5.35:

Figure 5.35 – Chapter Review Questions for Chapter 5

Once ready, start the following practice drills, re-attempting the quiz multiple times:

Exam Readiness Drill
For the first 3 attempts, don’t worry about the time limit.

ATTEMPT 1
The first time, aim for at least 40%. Look at the answers you got wrong and read the relevant sections in the chapter again to fix your learning gaps.

ATTEMPT 2
The second time, aim for at least 60%. Look at the answers you got wrong and read the relevant sections in the chapter again to fix any remaining learning gaps.

ATTEMPT 3 The third time, aim for at least 75%. Once you score 75% or more, you start working on your timing.

Tip You may take more than 3 attempts to reach 75%. That’s okay. Just review the relevant sections in the chapter till you get there.

Working On Timing

Target: Your aim is to keep the score the same while trying to answer these questions as quickly as possible. Here’s an example of how your next attempts should look like:

Table 5.4 – Sample timing practice drills on the online platform

Note
The time limits shown in the above table are just examples. Set your own time limits with each attempt based on the time limit of the quiz on the website.

With each new attempt, your score should stay above 75% while your time taken to complete should decrease. Repeat as many attempts as you want till you feel confident dealing with the time pressure.

This settings area allows you to extend the custom banned password list to your on-premises infrastructure. There are two components:

• Azure AD Password Protection DC agent, which must be installed on domain controllers.
• Azure AD Password Protection proxy, which must be installed on at least one domain-joined server in the forest. As a security best practice, Microsoft recommends deploying it on a member server since it requires internet connectivity.

In this configuration, the Azure AD Password Protection proxy servers periodically retrieve the custom banned password list from Azure AD. The DC agents cache the password policy locally and validate password change requests accordingly.

If Enable password protection on Windows Server Active Directory is configured as Yes, then you can choose what mode to process password change requests. They can be processed in Audit mode (where changes or logged) or Enforced mode, where password resets are actively evaluated against the banned password list and rejected if they do not meet the requirements.

Further Reading

To view detailed steps for deploying password protection on-premises, see https://learn. microsoft.com/en-us/azure/active-directory/authentication/ concept-password-ban-bad-on-premises.

Configuring and Managing Multifactor Authentication

Configuring users for multifactor authentication can increase the security posture of your Microsoft 365 environment, in addition to protecting any apps that use Azure AD for identity and authentication. In this section, you’ll look at configuring multifactor authentication for your tenant.

Per-User Multifactor Authentication

If multifactor authentication was configured in your tenant prior to October 2019, it may have been configured using the legacy multifactor authentication scheme. Prior to newer technologies, Legacy
Azure MFA was enabled on a per-user basis by manually updating each user’s account to enforce the use of MFA.

Prior to implementing either Microsoft-managed security defaults or Conditional Access policies, you will need to disable the legacy per-user MFA. Having per-user MFA enabled while configuring a Conditional Access policy that prompts for MFA may cause unintended or unexpected MFA prompts.

Note
You should only configure one mechanism for multifactor authentication to avoid unexpected behaviors, such as users being prompted for MFA in scenarios where they previously satisfied multifactor authentication requirements or were accessing resources from trusted locations. Microsoft recommends discontinuing the use of per-user MFA and using Conditional Access policies instead.

To disable per-user multifactor authentication, follow these steps:

1. Navigate to the Microsoft 365 admin center (https://admin.microsoft.com).
2. Expand Users and select Active users.
3. Select Multi-factor authentication:

Figure 5.26 – Active users page

4. If your tenant already has Conditional Access policies, you may need to select the Legacy per-user MFA link to launch the legacy multi-factor authentication page.
5. On the multi-factor authentication page, as shown in Figure 5.27, configure the per-user MFA status to Disabled for users that have Enforced or Enabled set. You can select multiple users, but can only multi-select users that have the same MFA status type:

Figure 5.27 – Selecting users

Once per-user MFA is disabled, you can configure security defaults or Conditional Access policies.

To enable users to sign in with Microsoft Authenticator, you need to configure the authentication policy. The authentication policy is shared across the tenant, though different authentication methods are scoped for groups of users.

Configuring and managing the policy requires an account with the Global Administrator or Authentication Administrator role:

1. Navigate to the Azure portal (https://portal.azure.com).

Exam Tip

While the current (as of this writing) version of the exam was developed before full parity of the Entra admin center was delivered, it’s important to understand that interim exam updates may include references to the Entra admin center (https://entra.microsoft.com). Things such as menu items or configuration options are located in slightly different locations (from the left-hand menu navigation perspective), though they render the current Azure portal information in the main content window.

2. Select Azure Active Directory | Security | Authentication methods and then select Policies, as shown in Figure 5.10:

Figure 5.10 – Authentication methods

3. Select Microsoft  Authenticator.

4.    On the Enable and Target tab of the Microsoft Authenticator settingspage, slide the Enable toggle to On, as shown in Figure 5.11:

Figure 5.11 – Enabling Microsoft Authenticator

5. Using the Include and Exclude tabs, specify which users the policy settings will apply to. Select the All users radio button to include all users in the policy or choose the Select groups radio button to specify which groups will be included or excluded. Each group can have a separate Authentication mode value selected, including Any (default), Passwordless, or Push. Choosing Push as the option prevents the use of the passwordless phone sign-in credential.

6. Click Save to update the policy configuration.

After configuring the policy, users will need to register any devices to be used for passwordless authentication.

Registering Devices

Before users can log in to the service using Microsoft Authenticator, they will need to register their devices. If they’ve already registered for multifactor authentication, nothing else needs to be done.

If a user who has not registered signs in to the Microsoft 365 portal, they are greeted with aMore information required dialog as part of the sign-in process, as shown in Figure 5.12:

Figure 5.12 – More information required

During the process, they are redirected to download the Microsoft  Authenticator app, as shown in

Figure 5.13:

Figure 5.13 – Keep your account secure page

After they click Next, they are prompted to launch the Microsoft Authenticator app and add an account. Following the directions on the mobile device, they should launch a camera window that allows them to take a picture of a unique QR code, linking their device to their account, as shown in Figure 5.14:

Figure 5.14 – Registering a device

Once the device has been linked, the enrollment process will ask the user to confirm a code between the registration screen and their Microsoft Authenticator app. After completing the challenge, users should be presented with a confirmation screen, similar to the one shown in Figure 5.15:

Figure 5.15 – Authenticator registration screen

The final step for the user for full passwordless sign-in from the Microsoft Authenticator app is to configure the device itself. In Microsoft Authenticator, the user can open the app and select Enable phone sign-in, as shown in Figure 5.16:

Figure 5.16 – Microsoft Authenticator Enable phone sign-in

This will start a process to configure the device for passwordless sign-in. After configuration, the user can choose to log in with an app instead, triggering the phone authentication notification on their device. See Figure 5.17:

Figure 5.17 – Launching passwordless sign-in

The user then completes the logon challenge in the Microsoft Authenticator app to finish logging in to Microsoft 365.

Configuring FIDO2

When setting up FIDO2 -based authentication, you’ll follow a similar process as with Microsoft Authenticator—updating the authentication policy to allow the method and then instructing users to self-register their security keys.

In addition to gathering and reporting information for your on-premises AD and synchronization services, Azure AD Connect Health also supports AD FS.

To get the most out of Azure AD Connect Health for AD FS, you’ll need to enable auditing, which involves three steps:

1.Ensure the AD FS farm service account has been granted the Generate security audits right in the security policy (Local Policies | User Rights Assignment | Generate security audits).

2. From an elevated command prompt, run the following command: auditpol.exe /set / subcategory:{0CCE9222-69AE-11D9-BED3-505054503030} /failure:enable /success:enable.

3. On the AD FS primary farm server, open an elevated PowerShell prompt and run the following command: Set-AdfsProperties -AuditLevel Verbose.

Then, you can deploy the agents to your servers.

After deploying the agents to your federation and proxy servers, you will see information reported in the Azure AD Connect Health portal by selecting AD FS services under the Active Directory Federation Services section, as shown in Figure 4.21:

Figure 4.21 – Azure AD Connect Health for AD FS

In addition to diagnostic information, the health services for AD FS can also provide usage analytics and performance monitoring, as well as failed logins and information regarding risky sign-ins. See Figure 4.22:

Figure 4.22 – Azure AD Connect Health for AD FS overview

Azure AD Connect Health is a valuable premium service that can help you keep on top of the health and performance aspects of your hybrid identity deployment.

Troubleshooting Azure AD Connect Synchronization

While things normally operate smoothly, there may be times when objects become misconfigured, or services go offline unexpectedly. You can troubleshoot common issues with Azure AD Connect’s built-in troubleshooting tool.

To launch the troubleshooting tool, follow these steps:

1.Launch the Azure AD Connect configuration tool on the desktop of the server where Azure AD Connect is installed.

2. Click Configure.

3. On the Additional tasks page, select Troubleshoot and then click Next.

4. On the Welcome to AADConnect Troubleshooting page, select Launch, as shown in Figure 4.23:

Figure 4.23 – Launching the AADConnect Troubleshooting tool

5. Select the appropriate troubleshooting option from the menu shown in Figure 4.24:

Figure 4.24 – AADConnect Troubleshooting menu

The AADConnect Troubleshooting tool provides several specific troubleshooters, such as diagnosing attribute or group membership synchronization, password hash synchronization, as well as service account permissions.

Most object or attribute troubleshooting routines will require the errored object’s distinguished name to continue.

Further Reading

For more information on the tests that can be performed by the AADConnect Troubleshooting tool, see https://learn.microsoft.com/en-us/azure/active-directory/ hybrid/tshoot-connect-objectsync.

Configuring and Managing Directory Synchronization by Using Azure AD Connect Cloud Sync

Azure AD Connect Cloud Sync (rebranded as Microsoft Entra Cloud Sync) is a new synchronization platform that allows you to manage directory synchronization from the Azure portal. Depending on your organization’s goals and environments, Azure AD Connect Cloud Sync can be a lightweight, flexible option that allows you to begin directory synchronization quickly.

Exam Tip

To perform the installation, you’ll need either Domain Admin or Enterprise Admin credentials to the on-premises Active Directory forest so that the installer can create the group Managed Service Account (gMSA). You’ll also need an account that has either the Global Administratoror Hybrid Identity Administrator roles in Azure AD.

Microsoft recommends configuring a unique identity in Azure AD with the Hybrid Identity Administrator role for Azure AD Connect Cloud Sync.

Microsoft’s recommended solution for passwordless authentication is Windows Hello for Business (WHFB). It’s designed for users that have their own dedicated PC. When logging on, the user presents a biometric or PIN code to unlock the device.

WHFB supports a variety of biometric logons, including facial recognition and fingerprint scanners. Devices configured to use Windows Hello (such as the one shown in Figure 5.1) can be recognized because they have the Windows Hello smiley face greeting at the top:

Figure 5.1 – Windows Hello for Business sign-on screen

After configuring Windows Hello, the sign-in flow follows this sequence, as depicted in Figure 5.2:

Figure 5.2 – Windows Hello authentication sequence

1. The user signs in with either a biometric or PIN (if the configured biometric input can’t be accessed), which unlocks the WHFB private key. The key is then passed to the Cloud Authentication security support provider, also known as the Cloud AP, part of the on-device security package.

2. The Cloud AP requests a nonce (single-use random number) from Azure AD.

3. Azure AD sends the nonce to the Cloud AP on the endpoint.

4. The Cloud AP signs the nonce with the user’s private key and returns the signed nonce to Azure AD.

5. Azure AD decrypts and validates the signed nonce with the user’s public key. After it’s validated, Azure AD issues a primary refresh token (PRT) with the session key, encrypts it using the device’s public transport key, and sends that to the Cloud AP.

6. The Cloud AP decrypts the PRT/session key using the device’s transport private key and then uses the Trusted Platform Module (TPM) to store the session key.

7. The Cloud AP returns a success response to Windows, allowing the user to log in to complete.

WHFB is available to be deployed as a cloud-only or hybrid identity solution and can be used for both Windows logon as well as logon to Microsoft 365 services. Windows Hello-based authentication is tied to a unique device, meaning you have to set it up individually for each device that you will be using.

Microsoft Authenticator App

Many administrators and users are already familiar with the Microsoft Authenticator mobile device app, after using it for multifactor authentication. The Authenticator app can also be used as a passwordless sign-in option. When used as a passwordless option, Microsoft Authenticator can use number-matching, where the sign-in screen displays a number that the user enters and confirms with their PIN or biometric data. See Figure 5.3:

Figure 5.3 – Passwordless authentication dialog with Microsoft Authenticator

The data flow using the Authenticator app follows the same general pattern as Windows Hello, as shown in Figure 5.4:

Figure 5.4 – Microsoft Authenticator authentication sequence

1.The user enters their username on the device.

2. Azure AD detects that the user is configured for passwordless authentication.

3. Azure AD sends a notification to the Authenticator app on the user’s configured Apple or Android device.

4. The user launches the Authenticator app.

5. The Authenticator app connects to Azure AD and receives the proof-of-presence challenge and the nonce.

6. The user completes the challenge on their mobile device and then confirms their identity with biometric data or a PIN, unlocking the private key.

7. The private key is used to sign the nonce and the Authenticator app returns the data to Azure AD.

8. Azure AD decrypts the data with the user’s public key, performs validation, and then returns the sign-in token to the original device where the logon was started.

Whereas WHFB has specific hardware requirements (such as a Windows Hello-compatible camera or fingerprint reader), passwordless using Microsoft Authenticator has a very low barrier to entry. The Authenticator app is free for iOS and Android devices and works not only with Microsoft 365 services but also any service that supports a soft-token app or device.

Further Reading

In addition to the traditional Microsoft Authenticator application, Microsoft has also released Authenticator Lite as part of Outlook. For more information, see https://learn. microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-authenticator-lite.

Another customization option available involves mapping attribute values between on-premises and cloud objects. As with Azure AD Connect, you can configure how cloud attributes are populated—whether it’s from a source attribute, a constant value, or some sort of expression.

Azure AD Connect sync comes with a default attribute mapping flow, as shown in Figure 4.33:

Figure 4.33 – Azure AD Connect Cloud Sync attribute mappings

You can select an existing attribute to modify or create a new attribute flow. One of the basic configuration features for most attributes is to configure a Default value (if the on-premises value is blank), allowing you to make certain that cloud attributes are populated with values.

In Figure 4.34, the Country attribute has been selected and updated with the default value US. This ensures that in the event a user’s on-premises country attribute is blank, the corresponding cloud attribute will be populated with a valid entry.

Figure 4.34 – Edit attribute mappings in Azure AD Connect Cloud Sync

Azure AD Connect Cloud Sync also features an expression builder, allowing you to create your own custom attribute flows.

Unlike Azure AD Connect, however, attribute mappings and expressions cannot be used to merge attributes from different domains or forests, nor does Azure AD Connect Cloud Sync support synchronization rules or attribute flow precedence. If you require that level of customization, you should deploy Azure AD Connect instead.

Once you have finished customizing the scoping filters and attribute flows, you can return to the Overview page and enable synchronization by selecting Review and enable.

Troubleshooting Azure AD Connect Cloud Sync Synchronization

Just as Azure AD Connect may experience issues with synchronizing identity, Azure AD Connect Cloud Sync can as well. Successful synchronization depends on several factors:

• Agent functionality: Is the agent installed and functioning normally?

• Network communications: Can the agent reach all of the required endpoints and resolve DNS for Azure AD services?

• Service account issues: Does the service account have the appropriate rights to the on-premises objects?

When troubleshooting the Azure AD Connect Cloud Sync service, you should start with the Windows Event Viewer to determine whether there are any errors related to the service, such as invalid credentials or missing privileges.

While Microsoft generally recommends bypassing proxy and content filtering services for Microsoft 365 endpoints, your organization may still choose to deploy them. In the event that the server for the Azure AD Connect Cloud Sync agent is located behind a proxy server or appliance, it may become necessary to modify the service configuration file with the proxy’s information.

The Azure AD Connect Cloud Sync provisioning agent utilizes a configuration file stored in

C:\Program Files\Microsoft Azure AD Connect Provisioning Agent\ AADConnectProvisioningAgent.exe.config. To add proxy configuration information, edit this file, and before the closing </configuration> tag, enter the following data (replacing

[proxy-server] and [proxy-port]) with the proxy server or appliance address and network port:

<system.net><defaultProxyenabled=”true”useDefaultCredentials=”true”><proxyusesystemdefault=”true”proxyaddress=”http://[proxy-server]:[proxy-port]”bypassonlocal=”true”/></defaultProxy></system.net>

If you need to perform deeper troubleshooting for the agent, you can install the AADCloudSyncTools PowerShell module. The AADCloudSyncTools module has a number of functions in it for configuringand gathering verbose logging data, configuring the sync schedule, and repairing the service account. For more information on the functions supported by the cmdlet, see https://learn.microsoft.com/ en-us/azure/active-directory/hybrid/cloud-sync/reference-powershell.

If you need to exclude objects from Azure AD Connect’s synchronization scope, you can do that through a number of different methods:

• Domain and organizational unit-based filtering

• Group-based filtering

• Attribute-based filtering

Let’s quickly examine these.

Domain and Organizational Unit-Based Filtering

With this method, you can deselect large portions of your directory by modifying the list of domains or organizational units that are selected for synchronization. While there are several ways to do this, the easiest way is through the Azure AD Connect setup and configuration tool:

1.To launch the Azure AD Connect configuration tool, double-click the Azure AD Connect icon on the desktop of the server where Azure AD Connect is installed. After it launches, click Configure.

2. On the Additional tasks page, as shown in Figure 4.8, select Customize synchronization options and then click Next.

Figure 4.8 – Additional tasks page

3. On the Connect to Azure AD page, enter credentials for either the Global Administrator or Hybrid Identity Administrator role and click Next.

4. On the Connect your directories page, click Next.

5. On the Domain and OU filtering page, as shown in Figure 4.9, select the Sync selected domains and OUs radio button and then select or clear objects to include or exclude from synchronization.

Figure 4.9 – Azure AD Connect Domain and OU filtering page

6. Click Next.

7. On the Optional features page, click Next.

8. On the Ready to configure page, click Configure.

After synchronization is completed, verify that only objects from in-scope organizational units or domains are present in Azure Active Directory.

Group-Based Filtering

Azure AD Connect only supports the configuration of group-based filtering if you choose to customize the Azure AD Connect setup. Group-based filtering is not available if you perform an express installation.

If you’ve chosen a custom installation, you can choose to limit the synchronization scope to a single group. On the Filter users and devices page of the configuration wizard, select the default radio button, Synchronize all users and devices, to continue without group filtering. You can also choose the Synchronize selected radio button and then enter the name or distinguishedName (DN) of a group that contains the users and devices to be synchronized.

Figure 4.10 – Filter users and devices page

With group-based filtering, only direct members of the group are synchronized. Users, groups, contacts, or devices nested inside other groups are not resolved or synchronized.

Note

Microsoft recommends group-based filtering for piloting purposes only.

In order to complete the Azure AD Connect Cloud Sync deployment, you’ll need to set up a new configuration in the Azure portal:

1.Navigate to the Azure portal (https://portal.azure.com) and select Active Directory | Azure AD Connect.

2. Select Cloud sync from the navigation menu, and then on the Configurations tab, select New configuration.

3. On the New cloud sync configuration page, select which domains you would like to synchronize to Azure AD. If desired, select the Enable password hash sync checkbox. The password hash sync checkbox on this page only enables the feature—it does not configure password hash sync as a sign-in method. See Figure 4.30.

Exam Tip

Azure AD Connect Cloud Sync does not support using password hash sync for

InetOrgPerson objects.

Figure 4.30 – Creating a new Azure AD Connect Cloud Sync configuration

4. Scroll to the bottom of the page and click Create to complete the basic configuration.

The Azure AD Connect Cloud Sync configuration has been completed but it is not yet enabled and ready to start provisioning users. In the next series of steps, you can customize the service before fully enabling it.

Customizing the Provisioning Service

Like the on-premises Azure AD Connect service, Azure AD Connect Cloud Sync features the ability to perform scoping (including or excluding objects from synchronization) as well as attribute mapping.

After creating a new configuration, you should be redirected to the properties of the configuration, as shown in Figure 4.31:

Figure 4.31 – Provisioning agent overview page

From this page, you can set up the scoping filters and attribute mappings for customizing your environment. By default, Azure AD Connect Cloud Sync will include all objects in the connected forest and domains for synchronization.

Scoping Filters

By selecting Scoping filters under Manage, you can configure which objects should be synchronized to Azure AD. You can specify a list of security groups or select organizational units, but not both. See Figure 4.32:

Figure 4.32 – Azure AD Connect Cloud Sync scoping filters

There are a few important caveats when using scoping filters with Azure AD Connect Cloud Sync:

• When using group-based scoping, nested objects beyond the first level will not be included in the scope

• You can only include 59 separate OUs or security groups as scoping filters

It’s also important to note that using security groups to perform scoping is only recommended for piloting scenarios.

Azure AD Connect has a long history, originally starting as DirSync to support the deployment of Microsoft Business Productivity Online Suite (BPOS) in 2007.

If you are familiar with Microsoft Identity Manager(MIM), you’ll notice a lot of similarities shared with the current Azure AD Connect platform. Azure AD Connect (rebranded as Microsoft Entra Connect) allows you to connect to multiple directory sources and provision those objects to Azure Active Directory.

Planning and Sizing

Depending on your organization’s requirements for onboarding to Microsoft 365, as well as additional features or services that are included with your subscription, you may want (or need) to enable or configure additional Azure AD Connect features.

Table 4.2 illustrates the features that can be enabled through an Azure AD Connect setup:

Feature	Description
Device writeback	Synchronizes Azure AD-joined devices back to on-premises
	Active Directory
Directory extensions	Enables the synchronization of additional on-premises attributes
Federation	Enables authentication federation with Microsoft  AD Federation
	Services (FS) or PingFederate
Hybrid Azure AD join	Enables on-premises domain-joined devices to be synchronized
	and automatically joined to Azure AD
Password hash synchronization	Enables the hash of an on-premises password to be synchronized
	to Azure AD; can be used for authentication, a backup option for
	authentication, or leaked credential detection
Pass-through authentication	Authentication method where passwords are validated on-premises
	through the Azure AD Connect service’s connection to Azure
	Service Bus
Unified group writeback	Enables cloud-based Microsoft 365 groups to be written back to
	on-premises Active Directory

Table 4.2 – Azure AD Connect features

There are several additional features available post-installation for Azure AD Connect, such as managing duplicate attribute resiliency and user principal name soft-matching, both of which are used to manage how Azure AD handles conflicts and connecting cloud accounts to on-premises accounts.

Further Reading

More detailed information about Azure AD Connect’s optional features, such as duplicate attribute resiliency, is available here: https://learn.microsoft.com/en-us/azure/ active-directory/hybrid/how-to-connect-syncservice-features.

Installing the Synchronization Service

The first step to deploying Azure AD Connect is gathering the requirements of your environment. These requirements can impact the prerequisites for deployment (such as additional memory or a standalone SQL Server environment). As part of the planning process, you’ll also want to identify which sign-in method will be employed (password hash synchronization, pass-through authentication, or federation).

Exam Tip

To perform the express installation, you’ll need Enterprise Administrator credentials to the on-premises Active Directory forest so that the installer can create a service account and delegate the correct permissions. You’ll also need an account that has either the Global Administrator or Hybrid Identity Administrator role in Azure AD, which Azure AD Connect will use to create a cloud sync service account.

With that information in hand, it’s time to start deploying Azure AD Connect:

1. On the server where Azure AD Connect will be deployed, download the latest version of the Azure AD Connect setup files (https://aka.ms/aad-connect) and launch the installer.

2. Agree to the installation terms and select Continue. See Figure 4.4:

Figure 4.4 – Azure AD Connect welcome page

3. Review the Express Settings page, as shown in Figure 4.5. You can choose Customize if you want to configure Azure AD Connect to use pass-through or federated authentication methods, group-based filtering, or a custom SQL Server installation. While the sign-in methods and other features can be changed after installation, it is not possible to enable group-based filtering or change the SQL Server location after setup.

Figure 4.5 – Azure AD Connect Express Settings page

Installation Notes

If you have other domains in your Active Directory forest, they must all be reachable from the Azure AD Connect server or installation will fail. You can perform a custom installation to specify which domains to include in synchronization.

4. On the Connect to Azure AD page, enter credentials for either the Global Administrator or Hybrid Identity Administrator role in Azure AD. Click Next.

5. On the Connect to AD DS page, enter Enterprise Administrator credentials and click Next.

6. Verify the configuration settings. By default, the Exchange hybrid scenario is not enabled. If you have an on-premises Exchange environment that you will be migrating to Microsoft 365, select the Exchange hybrid deployment option to include the Exchange-specific attributes. If you want to perform additional configuration tasks prior to synchronizing users, clear the Start the synchronization process when configuration completes. checkbox.

Figure 4.6 – Azure AD Connect Ready to configure page

7. Click Install.

8. Review the Configuration complete page, as shown in Figure 4.7, and click Exit:

Figure 4.7 – Azure AD Connect Configuration complete page

If you selected the Start the synchronization process when configuration completes checkbox, you can review the Azure AD portal to verify that users have been synchronized.

You can configure PIM for a role by following this procedure:

1. Navigate to the Azure portal (https://portal.azure.com). Enter Identity Governance into the search bar and select the Identity Governance option.

2. Under Privileged Identity Management, select Azure AD roles (or Microsoft Entra roles).

3. Under Manage, select Roles. See Figure 3.22:

Figure 3.22 – Role assignments

4. Select the role you wish to configure an assignment for, such as the Exchange Administrator role.

5. Click Add assignments.

6. On the Membership tab of the Add assignments page, under Select member(s), click No member selected to bring up the Select a member flyout.

7. On the Select a member flyout, choose one or more members and click Select, as shown in Figure 3.23:

Figure 3.23 – Selecting members

8. On the Add assignments page, click Next.

9. On the Setting tab of the Add assignments page, select an assignment type, such as Eligible. In this instance, if you want the users to be eligible to request elevation for the duration of the time period their account is enabled, select Permanently eligible.

Figure 3.24 – Configuring assignment type and eligibility duration

10. Click Assign.

From this point, the users that you have selected can activate their role assignment from the Azure portal.

Reviewing Role Assignments

You can review all of the assignments that you’ve created in the Azure portal. To view the role assignments, navigate to the Identity Governance blade and then select Azure AD roles | Azure AD roles | Assignments. See Figure 3.25:

Figure 3.25 – Viewing role assignments

On the Eligible assignments tab, assignments are listed under their respective Azure AD role. The Active assignments tab lists individuals with various role assignments, including their end dates andwhether they’re permanent. Review Figure 3.26 for an example of active assignments.

Figure 3.26 – Viewing active assignments

Notice that the assignments can include both users as well as application security principals.