Windows 10: update on Azure AD support for FIDO2 security keys in hybrid environments

grundlichkeit · Oct 15, 2020

this is still a preview thing right? any update on the GA release?

I might have an opportunity where we can deploy yubikeys, but the customer is not yet ready for AAD join.

the customer has nothing yet in azure AD either, using azure ad free should work for yubikeys if they have W10 2004 if i'm correct

but also that means in the free AAD they can only do MFA with phone authentication as MFA is a prereq for the security key signin

anyone did something similar recently?

:)

Brink · Oct 15, 2020

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@user) View on Twiiter

WojtekSzk · Oct 15, 2020

Azure AD Banned Password List without On-Prem Agent

Hi All,

I am considering enabling banned password list for our Azure AD in our hybrid environment and want to ask, how doing that will affect our environment if we do not install the on-prem DC agent, as our on-prem does not meet minimum requirements.

Which password resets and changes will be validated through banned password list and which will not?

Will 'noncompliant' passwords synced from on-prem to Azure AD be causing issues?

TIA,

W

Brink · Oct 15, 2020

Windows Autopilot for existing devices supports Hybrid Azure AD Join

First, a quick refresher on Windows Autopilot for existing devices: For customers looking for a path to migrate from Windows 7 (or 8.1) to Windows 10 using Windows Autopilot, the challenge was always that you had to register the existing machines with Windows Autopilot in advance, but doing so was impossible because you couldn't grab the hardware hash from a device running Windows 7.

So, we added the ability in Windows 10, version 1809 to use a JSON file containing the equivalent of the Windows Autopilot profile so that you didn't have to register the device in advance; you could then tell Microsoft Intune to harvest the hash from the device later and register the device after the fact.

This solution worked great and has been leveraged by a number of organizations to move from Windows 7 and Active Directory to Windows 10 and Azure Active Directory, using Microsoft Intune (often with Configuration Manager for co-management) to deploy and manage the device.

But some organizations weren't yet ready for Azure AD Join (even with the Administrative Templates support in Microsoft Intune, and full support for Kerberos authentication from an Azure AD-joined device to Active Directory-secured resources) and asked us to support this same process, but with Hybrid Azure AD Join.

With this month's Microsoft Intune updates, we can now support this. And no client changes are needed: this works with Windows 10, version 1809 and above. All you need to do is specify a JSON file that specifies to join Active Directory (via Hybrid Azure AD Join) instead of Azure Active Directory - the rest of the process (e.g. the Configuration Manager task sequence that deploys Windows 10 to the device) is unchanged.

Note that you will need to target a Domain Join profile (and any other device-targeted policies) to "All devices" since the device won't be known to Microsoft Intune in advance. (Don't worry, this Domain Join profile has no impact on already-deployed devices, as it's only used by Microsoft Intune to determine what domain and OU should be used when joining a device to Active Directory.) See the updated documentation for more details.
Click to expand...

Source: https://techcommunity.microsoft.com/...re/ba-p/730408

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

Windows 10: update on Azure AD support for FIDO2 security keys in hybrid environments

update on Azure AD support for FIDO2 security keys in hybrid environments

update on Azure AD support for FIDO2 security keys in hybrid environments

update on Azure AD support for FIDO2 security keys in hybrid environments

update on Azure AD support for FIDO2 security keys in hybrid environments - Similar Threads - update Azure support

FIDO2 Windows login on hybrid joined devices not working when no on-prem AD in sight

FIDO2 Windows login on hybrid joined devices not working when no on-prem AD in sight

Do I need Azure premium for cloud hybrid trust / key hybrid trust or not?

Do I need Azure premium for cloud hybrid trust / key hybrid trust or not?

Foreign Security Principals - Azure AD Sync

Azure AD Hybrid environment with on prem

Azure AD Hybrid environment with on prem

Save bitlocker keys to Azure AD?

Windows Autopilot for existing devices supports Hybrid Azure AD Join