Getting Started with Azure AD Identity Governance – Part 2: Access Reviews
Posted inAccess Reviews Entra ID (Azure Active Directory) Identity Governance Microsoft 365

Getting Started with Azure AD Identity Governance – Part 2: Access Reviews

This blog is the second in a small series on Azure AD Premium P2's Identity Governance toolkit. Part 1: Entitlement Management Part 2: Access Reviews (this post) Part 3: Privileged Identity Management (PIM) Historically, the apps, groups, and rights a user had were all under central and constant management by IT.  Azure AD and modern management have pushed this towards 'self-service', including guest users, which improves productivity.  The goal of Azure AD access reviews…
Getting Started with Azure AD Identity Governance – Part 1: Entitlement Management
Posted inEntitlement Management Entra ID (Azure Active Directory) Identity Governance Microsoft 365

Getting Started with Azure AD Identity Governance – Part 1: Entitlement Management

This blog is the first in a small series on Azure AD Premium P2's Identity Governance toolkit. Part 1: Entitlement Management (this post) Part 2: Access reviews Part 3: Privileged Identity Management (PIM) Azure AD entitlement management is a bit of an overlooked gem.  It's a feature that automates the processes for giving users access to resources. The typical scenario is a user has just joined a new department or is a new employee. …
Sign In to Azure AD Using Google with Azure AD External Identities
Posted inEntra ID (Azure Active Directory) External Identities Microsoft 365

Sign In to Azure AD Using Google with Azure AD External Identities

External Identities is a new public preview feature of Azure AD which allows external users to authenticate with a non-Microsoft account such as their Google or Facebook identity.  This has been available in Azure AD B2C for some time, but that solution is really targetted at highly customised applications with potentially millions of users.  External Identities opens up that idea to you ordinary Azure AD tenant so that any SAML or WS-Fed IdP can…
Hybrid Azure AD Join + Intune Enrollment – Prerequisites Checklist and Process Flow
Posted inEntra ID (Azure Active Directory) Intune Microsoft 365

Hybrid Azure AD Join + Intune Enrollment – Prerequisites Checklist and Process Flow

I'm a simple person, and sometimes it just helps to have a checklist to refer to when you're troubleshooting rather than navigating the sparse pages of docs.microsoft.com.  In this blog, I  explain the prerequisites for the Hybrid Azure AD Join (HAADJ) + automatic (GPO controlled) Intune MDM enrollment scenario and the process from start to end, as simply and concisely as I can (not easy!)  There are no screenshots and it's not a click-by-click:…
Register Domain-Joined Computers as Devices – The Redundant and Broken Hybrid Azure AD Join GPO
Posted inEntra ID (Azure Active Directory) Group Policy Microsoft 365 Windows Server

Register Domain-Joined Computers as Devices – The Redundant and Broken Hybrid Azure AD Join GPO

The group policy object Register domain-joined computers as devices, or Automatically workplace join client computers in older templates, was previously a requirement for enabling Hybrid Azure AD Join.  After configuring Azure AD Connect and your Seamless SSO GPOs, this had to be enabled. Since Windows 10 1607 ("Anniversary Update"), in Azure AD Connect environments, on-premises Active Directory joined computers become Azure Active Directory registered when a synchronised user signs in to a synchronised computer;…