You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/active-directory-application-proxy-troubleshoot.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.workload: identity
12
12
ms.tgt_pltfrm: na
13
13
ms.devlang: na
14
14
ms.topic: article
15
-
ms.date: 01/31/2018
15
+
ms.date: 02/14/2018
16
16
ms.author: markvi
17
17
ms.reviewer: harshja
18
18
ms.custom: H1Hack27Feb2017; it-pro
@@ -67,7 +67,7 @@ This table covers the more common errors that come from Kerberos setup and confi
67
67
| 13016 - Azure AD cannot retrieve a Kerberos ticket on behalf of the user because there is no UPN in the edge token or in the access cookie. | There is a problem with the STS configuration. Fix the UPN claim configuration in the STS. |
68
68
| 13019 - Azure AD cannot retrieve a Kerberos ticket on behalf of the user because of the following general API error. | This event may indicate incorrect configuration between Azure AD and the domain controller server, or a problem in time and date configuration on both machines. The domain controller declined the Kerberos ticket created by Azure AD. Verify that Azure AD and the backend application server are configured correctly, especially the SPN configuration. Make sure the Azure AD is domain joined to the same domain as the domain controller to ensure that the domain controller establishes trust with Azure AD. Make sure that the time and date configuration on the Azure AD and the domain controller are synchronized. |
69
69
| 13020 - Azure AD cannot retrieve a Kerberos ticket on behalf of the user because the backend server SPN is not defined. | This event may indicate incorrect configuration between Azure AD and the domain controller server, or a problem in time and date configuration on both machines. The domain controller declined the Kerberos ticket created by Azure AD. Verify that Azure AD and the backend application server are configured correctly, especially the SPN configuration. Make sure the Azure AD is domain joined to the same domain as the domain controller to ensure that the domain controller establishes trust with Azure AD. Make sure that the time and date configuration on the Azure AD and the domain controller are synchronized. |
70
-
| 13022 - Azure AD cannot authenticate the user because the backend server responds to Kerberos authentication attempts with an HTTP 401 error. | This event may indicate incorrect configuration between Azure AD and the backend application server, or a problem in time and date configuration on both machines. The backend server declined the Kerberos ticket created by Azure AD. Verify that Azure AD and the backend application server are configured correctly. Make sure that the time and date configuration on the Azure AD and the backend application server are synchronized. |
70
+
| 13022 - Azure AD cannot authenticate the user because the backend server responds to Kerberos authentication attempts with an HTTP 401 error. | This event may indicate incorrect configuration between Azure AD and the backend application server, or a problem in time and date configuration on both machines. The backend server declined the Kerberos ticket created by Azure AD. Verify that Azure AD and the backend application server are configured correctly. Make sure that the time and date configuration on the Azure AD and the backend application server are synchronized. For more information, see [Troubleshoot Kerberos Constrained Delegation Configurations for Application Proxy](application-proxy-back-end-kerberos-constrained-delegation-how-to.md). |
Copy file name to clipboardExpand all lines: articles/active-directory/active-directory-conditional-access-azure-portal.md
+29-7Lines changed: 29 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,14 +14,15 @@ ms.devlang: na
14
14
ms.topic: article
15
15
ms.tgt_pltfrm: na
16
16
ms.workload: identity
17
-
ms.date: 02/07/2018
17
+
ms.date: 02/13/2018
18
18
ms.author: markvi
19
19
ms.reviewer: calebb
20
20
21
21
---
22
+
22
23
# Conditional access in Azure Active Directory
23
24
24
-
Security is a top concern for organizations using the cloud. A key aspect of cloud security is identity and access when it comes to managing your cloud resources. In a mobile-first, cloud-first world, users can access your organization's resources using a variety of devices and apps from anywhere. As a result of this, just focusing on who can access a resource is not sufficient anymore. In order to master the balance between security and productivity, IT professionals also need to factor how a resources is being accessed into an access control decision. With Azure AD conditional access, you can address this requirement. Conditional access is a capability of Azure Active Directory that enables you to enforce controls on the access to apps in your environment based on specific conditions from a central location.
25
+
Security is a top concern for organizations using the cloud. A key aspect of cloud security is identity and access when it comes to managing your cloud resources. In a mobile-first, cloud-first world, users can access your organization's resources using a variety of devices and apps from anywhere. As a result of this, just focusing on who can access a resource is not sufficient anymore. In order to master the balance between security and productivity, IT professionals also need to factor how a resource is being accessed into an access control decision. With Azure AD conditional access, you can address this requirement. Conditional access is a capability of Azure Active Directory that enables you to enforce controls on the access to apps in your environment based on specific conditions from a central location.
@@ -31,24 +32,24 @@ This article provides you with a conceptual overview of conditional access in Az
31
32
32
33
## Common scenarios
33
34
34
-
In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, apps, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS apps, IT professionals are faced with two opposing goals:
35
+
In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, apps, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and third party SaaS apps, IT professionals are faced with two opposing goals:
35
36
36
37
- Empower users to be productive wherever and whenever
37
38
- Protect the corporate assets at any time
38
39
39
40
By using conditional access policies, you can apply the right access controls under the required conditions. Azure AD conditional access provides you with added security when needed and stays out of your user’s way when it isn’t.
40
41
41
-
Below are some common access concerns that conditional access can help you with:
42
+
Following are some common access concerns that conditional access can help you with:
42
43
43
44
44
45
45
-
-**[Sign-in risk](active-directory-conditional-access-conditions.md#sign-in-risk)**: Azure AD Identity Protection detects sign-in risks. How do you restrict access if a detected sign-in risk indicates a bad actor? What if you would like to get a stronger evidence that a sign-in was really performed by the legitimate user or your doubts are strong enough to even block specific users from accessing an app?
46
+
-**[Sign-in risk](active-directory-conditional-access-conditions.md#sign-in-risk)**: Azure AD Identity Protection detects sign-in risks. How do you restrict access if a detected sign-in risk indicates a bad actor? What if you would like to get a stronger evidence that a sign-in was performed by the legitimate user or your doubts are strong enough to even block specific users from accessing an app?
46
47
47
48
-**[Network location](active-directory-conditional-access-locations.md)**: Azure AD is accessible from anywhere. What if an access attempt is performed from a network location that is not under the control of your IT department? Using a username and password combination might be good enough as proof of identity for access attempts to your resources from your corporate network. What if you demand a stronger proof of identity for access attempts that are initiated from other unexpected countries or regions of the world? What if you even want to block access attempts from certain locations?
48
49
49
50
-**[Device management](active-directory-conditional-access-conditions.md#device-platforms)**: In Azure AD, users can access cloud apps from a broad range of devices including mobile and also personal devices. What if you demand that access attempt should only be performed user using devices that are managed by your IT department? What if you even want to block certain device types form access in cloud apps in your environment?
50
51
51
-
-**[Client application](active-directory-conditional-access-conditions.md#client-apps)**: Today, you can access many cloud apps using different app types such as web-based apps, mobile apps or desktop apps. What if an access attempt is performed using a client app type that causes known issues? What if you require a device that is managed by your IT department for certain app types?
52
+
-**[Client application](active-directory-conditional-access-conditions.md#client-apps)**: Today, you can access many cloud apps using different app types such as web-based apps, mobile apps, or desktop apps. What if an access attempt is performed using a client app type that causes known issues? What if you require a device that is managed by your IT department for certain app types?
52
53
53
54
These questions and the related answers represent common access scenarios for Azure AD conditional access.
54
55
Conditional access is a capability of Azure Active Directory that enables you to handle access scenarios using a policy-based approach.
@@ -60,7 +61,7 @@ A conditional access policy is definition of an access scenario using the follow
**Then do this** defines the response of your policy. It is important to note that the objective of a conditional access policy is not to grant access to a cloud app. In Azure AD, granting access to cloud apps is subject of user assignments. With a conditional access policy, you control how authorized users (users that have been granted access to a cloud app) can access cloud apps under specific conditions. In your response, you enforce additional requirements such as multi-factor authentication, a managed device and others. In the context of Azure AD conditional access, the requirements your policy enforces are called access controls. In the most restrictive form, your policy can block access. For more information, see [Access controls in Azure Active Directory conditional access](active-directory-conditional-access-controls.md).
64
+
**Then do this** defines the response of your policy. It is important to note that the objective of a conditional access policy is not to grant access to a cloud app. In Azure AD, granting access to cloud apps is subject of user assignments. With a conditional access policy, you control how authorized users (users that have been granted access to a cloud app) can access cloud apps under specific conditions. In your response, you enforce additional requirements such as multi-factor authentication, a managed device, and others. In the context of Azure AD conditional access, the requirements your policy enforces are called access controls. In the most restrictive form, your policy can block access. For more information, see [Access controls in Azure Active Directory conditional access](active-directory-conditional-access-controls.md).
64
65
65
66
66
67
**When this happens** defines the reason for triggering your policy. This reason is characterized by a group of conditions that have been satisfied. In Azure AD conditional access, the two assignment conditions play a special role:
@@ -79,6 +80,27 @@ With Azure AD conditional access, you can control how authorized users can acces
79
80
80
81
One benefit of using a policy-based approach to protect access to your cloud apps is that you can start drafting the policy requirements for your environment using the structure outlined in this article without worrying about the technical implementation.
81
82
83
+
## What you need to know
84
+
85
+
You can use Azure AD conditional access to protect cloud apps when an authentication attempt comes from:
86
+
87
+
- A web browser
88
+
89
+
- A client app that uses modern authentication
90
+
91
+
- Exchange ActiveSync
92
+
93
+
For more information, see [client apps](active-directory-conditional-access-conditions.md#client-apps).
94
+
95
+
Some [cloud apps](active-directory-conditional-access-conditions.md#cloud-apps) also support legacy authentication protocols. This applies, for example, to SharePoint Online and Exchange Online. When a client app can use a legacy authentication protocol to access a cloud app, Azure AD cannot enforce a conditional access policy on this access attempt. To prevent a client app from bypassing the enforcement of policies, you should check whether it is possible to only enable modern authentication on the affected cloud apps.
96
+
97
+
Examples for client apps conditional access does not apply to are:
98
+
99
+
- Office 2010 and earlier
100
+
101
+
- Office 2013 when modern authentication is not enabled
102
+
103
+
For more information, see [Set up SharePoint Online and Exchange Online for Azure Active Directory conditional access](active-directory-conditional-access-no-modern-authentication.md).
Copy file name to clipboardExpand all lines: articles/active-directory/active-directory-coreapps-remove-assignment-azure-portal.md
+40-13Lines changed: 40 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Remove a user or group assignment from an enterprise app in Azure Active
3
3
description: How to remove the access assignment of a user or group from an enterprise app in Azure Active Directory
4
4
services: active-directory
5
5
documentationcenter: ''
6
-
author: curtand
6
+
author: MarkusVi
7
7
manager: mtillman
8
8
editor: ''
9
9
@@ -13,32 +13,59 @@ ms.workload: identity
13
13
ms.tgt_pltfrm: na
14
14
ms.devlang: na
15
15
ms.topic: article
16
-
ms.date: 08/28/2017
17
-
ms.author: curtand
16
+
ms.date: 02/14/2018
17
+
ms.author: markvi
18
18
ms.reviewer: asteen
19
19
ms.custom: it-pro
20
20
21
21
---
22
22
# Remove a user or group assignment from an enterprise app in Azure Active Directory
23
23
It's easy to remove a user or a group from being assigned access to one of your enterprise applications in Azure Active Directory (Azure AD). You must have the appropriate permissions to manage the enterprise app, and you must be global admin for the directory.
24
24
25
-
## How do I remove a user or group assignment?
25
+
> [!NOTE]
26
+
> For Microsoft Applications (such as Office 365 apps), use PowerShell to remove users to an enterprise app.
27
+
28
+
## How do I remove a user or group assignment to an enterprise app in the Azure portal?
26
29
1. Sign in to the [Azure portal](https://portal.azure.com) with an account that's a global admin for the directory.
27
30
2. Select **More services**, enter **Azure Active Directory** in the text box, and then select **Enter**.
28
-
3. On the **Azure Active Directory - *directoryname***blade (that is, the Azure AD blade for the directory you are managing), select **Enterprise applications**.
31
+
3. On the **Azure Active Directory - *directoryname***page (that is, the Azure AD page for the directory you are managing), select **Enterprise applications**.
4. On the **Enterprise applications**blade, select **All applications**. You'll see a list of the apps you can manage.
32
-
5. On the **Enterprise applications - All applications**blade, select an app.
33
-
6. On the ***appname***blade (that is, the blade with the name of the selected app in the title), select **Users & Groups**.
34
+
4. On the **Enterprise applications**page, select **All applications**. You'll see a list of the apps you can manage.
35
+
5. On the **Enterprise applications - All applications**page, select an app.
36
+
6. On the ***appname***page (that is, the page with the name of the selected app in the title), select **Users & Groups**.
34
37
35
38
36
-
7. On the ***appname*****- User & Group Assignment**blade, select one of more users or groups and then select the **Remove** command. Confirm your decision at the prompt.
39
+
7. On the ***appname*****- User & Group Assignment**page, select one of more users or groups and then select the **Remove** command. Confirm your decision at the prompt.
37
40
38
41
39
42
43
+
## How do I remove a user or group assignment to an enterprise app using PowerShell?
44
+
1. Open an elevated Windows PowerShell command prompt.
45
+
46
+
>[!NOTE]
47
+
> You need to install the AzureAD module (use the command `Install-Module -Name AzureAD`). If prompted to install a NuGet module or the new Azure Active Directory V2 PowerShell module, type Y and press ENTER.
48
+
49
+
2. Run `Connect-AzureAD` and sign in with a Global Admin user account.
50
+
3. Use the following script to assign a user and role to an application:
0 commit comments