Tag: DirSync

Assign EMS licenses based on Local Active Directory Group Membership

On By Ronny de JongIn Active Directory, Azure, Azure AD, Azure Information Protection, Cloud, Enterprise Mobility, Enterprise Mobility Suite, Infrastructure, Intune, Microsoft Intune4 Comments

 

 

As all roads lead to Rome there are many ways to assign Enterprise Mobility Suite (EMS) licenses to end-users. This can be a manual process or automated by using PowerShell. Both options have in common that you must be a global administrator of your Azure subscription to assign these licenses.

The majority of the available public resources and publications describes the (manual) process bassed on per user- or group assignment through the Azure Management Portal. Downside of assigning EMS licenses through the Azure Management Portal or by PowerShell is that you must be a member of the global administrator user role. A right you want to keep to a limited number of accounts, further these accounts are often not responsible for such tasks as assigning licenses.

Continue reading “Assign EMS licenses based on Local Active Directory Group Membership” →

Making hybrid identity simple with Azure AD Connect

On By Ronny de JongIn Active Directory, Active Directory Federation Services, Azure, Azure AD, Enterprise Mobility, Enterprise Mobility Suite, Infrastructure, Windows Server 2012 R2Leave a comment

As mentioned in my previous post I’m in Redmond (WA) to join the Enterprise Mobility deep dive airlift. During my three-day stay I’ll listen, learn and getting inspired of all cool stuff Enterprise Mobility has to offer. On the first day we covered the hybrid identity part of EMS which means – Azure AD Connect, Azure AD Premium – which provided a lot of new insights and key takeaways.

image

Continue reading “Making hybrid identity simple with Azure AD Connect” →

Use Alternate Login ID implementing Enterprise Mobility Suite in a Multi-Forest scenario

On By Ronny de JongIn Active Directory, Active Directory Federation Services, Azure, Cloud, Infrastructure, Intune, Microsoft Intune, Office 365, Web Application Proxy, Windows Azure Active Directory, Windows Server 2012 R21 Comment

Last week I came across a scenario where Alternate Login ID feature of Active Directory Federation Services (AD FS) came at its best.

Scenario

Part of an Enterprise Mobility Suite (EMS) implementation we were facing a challange to overcome. In this scenario the customer has multi-forest (fictive contoso.local & adatum.local) AD structure with a two-way forest trust relationship. The user resources are currently located in te frabrikam.local (blue) where all server resources are part of the contoso.local (grey) domain including AD FS.

ADFS cross forest Mirosoft Intune Infrastructure

As fabrikam.com is the public domain namespace used, we added a UPN suffix for the fabrikam.local domain to make sure the user objects synced from the on-premise Active Directory – by Azure Active Directory Sync – matches the public User Principal Name (UPN) domain namespace.

Continue reading “Use Alternate Login ID implementing Enterprise Mobility Suite in a Multi-Forest scenario” →

Troubleshooting: Federation for Windows Intune

On By Ronny de JongIn Active Directory, Active Directory Federation Services, Azure, Cloud, Configuration Manager, Enterprise Mobility Management, Infrastructure, Intune, Mobile Device Management, Office 365, System Center, Uncategorized, Windows Intune, Windows Server 2012 R2Leave a comment

During a Windows Intune proof of concept (PoC) I was facing some issues configuring federation in order to enable Signle Sign On (SSO).

Proxy Authentication

When configuring federation we couldn’t convert the the default domain to a federated domain type. By using the –Verbose –Debug parameters of convert –MsolDomainToFederated cmdlet the root cause became clear. Proxy Authentication was required and therefore we couldn’t convert the domain. One down two to go!

clip_image001_thumb[3] Continue reading “Troubleshooting: Federation for Windows Intune” →

Windows Intune User Provisioning: Having a closer look

On By Ronny de JongIn Active Directory, Active Directory Federation Services, Andriod, Azure, Cloud, Configuration Manager, Enterprise Mobility Management, Infrastructure, Intune, iOS, Microsoft Intune, Mobile Device Management, Office 365, System Center, Windows 8, Windows 8.1, Windows 8.1 Update, Windows Intune, Windows Phone 8, Windows RT, Windows Server 2012 R21 Comment

At the moment there’re several scenario’s to manage and provisioning users to Windows Intune in order to enable Enterprise Mobility Management (EMM) or simply said – managing your mobile devices. As the process of provisioning users to Windows Intune in combination with Configuration Manager 2012 R2 is not always clear I’ll provide you some insights and tips where and how to troubleshoot.

clip_image001

As mentioned I’ll will focus in this post on a hybrid scenario using Configuration Manager 2012 R2, Windows Intune and on-premise Active Directory where Azure Active Directory Sync (aka DirSync) is used to syncronize on-premise users to Windows Intune (Azure Active Directory).

Process Overview Windows Intune User provisioning

  1. John Doe is created in (on-premise) Active Directory
  2. John Doe is synchronized by Azure Active Directory Sync to (off-premise) Azure Active Directory
  3. John Doe is discovered by Configuration Manager 2012 R2
  4. John Doe is add to Windows Intune collection in Configuration Manager 2012 R2
  5. John Doe is synchronized by Windows Intune Connector
  6. John Doe is enabled Windows Intune user

Continue reading “Windows Intune User Provisioning: Having a closer look” →