MFA, Conditional Access and AAD Identity Protection
Last updated
Last updated
You have been asked to create a proof of concept of features that enhance Azure Active Directory (Azure AD) authentication. Specifically, you want to evaluate:
Azure AD multi-factor authentication
Azure AD conditional access
Azure AD Identity Protection
For all the resources in this lab, we are using the East US region. Verify with your instructor this is the region to use for class.
In this lab, you will complete the following exercises:
Exercise 1: Deploy an Azure VM by using an Azure Resource Manager template
Exercise 2: Implement Azure MFA
Exercise 3: Implement Azure AD Conditional Access Policies
Exercise 4: Implement Azure AD Identity Protection
az-500-04_azuredeploy.json
az-500-04_azuredeploy.parameters.json
In this exercise, you will complete the following tasks:
Task 1: Deploy an Azure VM by using an Azure Resource Manager template.
In this task, you will create a virtual machine by using an ARM template. This virtual machine will be used in the last exercise for this lab.
Sign-in to the Azure portal https://portal.azure.com/.
Note: Sign in to the Azure portal using an account that has the Owner or Contributor role in the Azure subscription you are using for this lab and the Global Administrator role in the Azure AD tenant associated with that subscription.
In the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Deploy a custom template.
Note: You can also select Template Deployment (deploy using custom templates) from the Marketplace list.
On the Custom deployment blade, click the Build your own template in the editor option.
On the Edit template blade, click Load file, locate the \Allfiles\Labs\04\az-500-04_azuredeploy.json file and click Open.
Note: Review the content of the template and note that it deploys an Azure VM hosting Windows Server 2019 Datacenter.
On the Edit template blade, click Save.
Back on the Custom deployment blade, click Edit parameters.
On the Edit parameters blade, click Load file, locate the \Allfiles\Labs\04\az-500-04_azuredeploy.parameters.json file and click Open.
Note: Review the content of the parameters file noting the adminUsername and adminPassword values.
On the Edit parameters blade, click Save.
On the Custom deployment blade, ensure that the following settings are configured (leave any others with their default values):
Note: You will need to create a unique password that will be used for creating VMs (virtual machines) for the rest of the course. The password must be at least 12 characters long and meet the defined complexity requirements (Password must have 3 of the following: 1 lower case character, 1 upper case character, 1 number, and 1 special character). VM password requirements. Please make a note of the password.
Subscription
the name of the Azure subscription you will be using in this lab
Resource group
click Create new and type the name AZ500LAB04
Location
(US) East US
Vm Size
Standard_D2s_v3
Vm Name
az500-04-vm1
Admin Username
Student
Admin Password
Please create your own password and record it for future reference. You will be prompted for this password for the required lab access.
Virtual Network Name
az500-04-vnet1
10. Click Review + create, and then click Create.
Result: You have initiated a template deployment of an Azure VM az500-04-vm1 that you will use in the last exercise of this lab.
In this exercise, you will complete the following tasks
Task 1: Create a new Azure AD tenant.
Task 2: Activate Azure AD Premium P2 trial.
Task 3: Create Azure AD users and groups.
Task 4: Assign Azure AD Premium P2 licenses to Azure AD users.
Task 5: Configure Azure MFA settings.
Task 6: Validate MFA configuration
In this task, you will create a new Azure AD tenant.
In the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Azure Active Directory and press the Enter key.
On the blade displaying Overview of your current Azure AD tenant, click Manage tenants, and then on the next screen, click + Create.
On the Basics tab of the Create a tenant blade, ensure that the option Azure Active Directory is selected and click Next: Configuration >.
On the Configuration tab of the Create a tenant blade, specify the following settings:
Organization name
AdatumLab500-04
Initial domain name
a unique name consisting of a combination of letters and digits
Country or region
United States
Note: Record the initial domain name. You will need it later in this lab.
Click Review + Create and then click Create.
Add Captcha code on Help us prove you're not a robot blade and then click on Submit button.
Note: Wait for the new tenant to be created. Use the Notification icon to monitor the deployment status.
In this task, you will sign up for the Azure AD Premium P2 free trial.
In the Azure portal, in the toolbar, click the Directory + subscription icon, located to the right of the Cloud Shell icon.
In the Directory + subscription blade, click the newly created tenant AdatumLab500-04 and click the Switch button to set it as the current directory.
Note: You may need to refresh the browser window if the AdatumLab500-04 entry does not appear in the Directory + subscription filter list.
In the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Azure Active Directory and press the Enter key. On the AdatumLab500-04 blade, in the Manage section, click Licenses.
On the Licenses | Overview blade, in the Manage section, click All products and then click + Try / Buy.
On the Activate blade, in the Azure AD Premium P2 section, click Free Trial and then click Activate.
In this task, you will create three users: aaduser1 (Global Admin), aaduser2 (user), and aaduser3 (user). You will need each user's principal name and password for later tasks.
Navigate back to the AdatumLab500-04 Azure Active Directory blade and, in the Manage section, click Users.
On the Users | All users blade, click + New User.
On the New user blade, ensure that the Create user option is selected, and specify the following settings (leave all others with their default values) and click Create:
User name
aaduser1
Name
aaduser1
Password
ensure that the option Auto-generate password is selected and click Show Password
Groups
0 groups selected
Roles
click User, then click Global administrator, and click Select
Usage Location
United States
Note: Record the full user name. You can copy its value by clicking the Copy to clipboard button on the right hand side of the drop-down list displaying the domain name.
Note: Record the user's password. You will need this later in this lab.
Back on the Users | All users blade, click + New User.
On the New user blade, ensure that the Create user option is selected, and specify the following settings (leave all others with their default values):
User name
aaduser2
Name
aaduser2
Password
ensure that the option Auto-generate password is selected and click Show Password
Groups
0 groups selected
Roles
User
Usage Location
United States
Note: Record the full user name and the password.
Back on the Users | All users blade, click + New User.
Click New User,complete the new user configuration settings, and then click Create.
User name
aaduser3
Name
aaduser3
Password
ensure that the option Auto-generate password is selected and click Show Password
Groups
0 groups selected
Roles
User
Usage Location
United States
Note: Record the full user name and the password.
Note: At this point, you should have three new users listed on the Users page.
In this task, you will assign each user to the Azure Active Directory Premium P2 license.
On the Users | All users blade, click the entry representing your user account.
On the blade displaying the properties of your user account, click Edit. Verify Usage Location is set to United States if not set the usage location and click Save.
Navigate back to the AdatumLab500-04 Azure Active Directory blade and, in the Manage section, click Licenses.
On the Licenses | Overview blade, click All products, select the Azure Active Directory Premium P2 checkbox, and click + Assign.
On the Assign licenses blade, click + Add users and groups.
On the Users blade, select aaduser1, aaduser2, aaduser3, and your user account and click Select.
Back on the Assign licenses blade, click Assignment options, ensure that all options are enabled, click Review + asssign, click Assign.
Sign out from the Azure portal and sign back in using the same account. This step is necessary in order for the license assignment to take effect.
Note: At this point, you assigned Azure Active Directory Premium P2 licenses to all user accounts you will be using in this lab. Be sure to sign out and then sign back in.
In this task, you will configure MFA and enable MFA for aaduser1.
In the Azure portal, navigate back to the AdatumLab500-04 Azure Active Directory tenant blade.
Note: Make sure you are using the AdatumLab500-04 Azure AD tenant.
On the AdatumLab500-04 Azure Active Directory tenant blade, in the Manage section, click Security.
On the Security | Getting started blade, in the Manage section, click MFA.
On the Multi-Factor Authentication | Getting started blade, click the Additional cloud-based MFA settings link.
Note: This will open a new browser tab, displaying multi-factor authentication page.
On the multi-factor authentication page, click the service settings tab. Review verification options. Note that Text message to phone, Notification through mobile app, and Verification code from mobile app or hardware token are enabled. Click Save and then click close.
Switch to the users tab, click aaduser1 entry, click the Enable link, and, when prompted, click enable multi-factor auth.
Notice the Multi-Factor Auth status column for aaduser1 is now Enabled.
Click aaduser1 and notice that, at this point, you also have the Enforce option.
Note: Changing the user status from Enabled to Enforced impacts only legacy Azure AD integrated apps which do not support Azure MFA and, once the status changes to Enforced, require the use of app passwords.
With the aaduser1 entry selected, click Manage user settings and review the available options:
Require selected users to provide contact methods again.
Delete all existing app passwords generated by the selected users.
Restore multi-factor authentication on all remembered devices.
Click Cancel and switch back to the browser tab displaying the Multi-Factor Authentication | Getting started blade in the Azure portal.
In the Settings section, click Fraud alert.
On the Multi-Factor Authentication | Fraud alert blade, configure the following settings:
Allow users to submit fraud alerts
On
Automatically block users who report fraud
On
Code to report fraud during initial greeting
0
Click Save
Note: At this point, you have enabled MFA for aaduser1 and setup fraud alert settings.
Navigate back to the AdatumLab500-04 Azure Active Directory tenant blade, in the Manage section, click Properties, next click the Manage Security defaults link at the bottom of the blade, on the Enable Security Defaults blade, click No. Select My Organization is using Conditonal Access as the reason and and then click Save.
Note: Ensure that you are signed-in to the AdatumLab500-04 Azure AD tenant. You can use the Directory + subscription filter to switch between Azure AD tenants. Ensure you are signed in as a user with the Global Administrator role in the Azure AD tenant.
In this task, you will validate the MFA configuration by testing sign in of the aaduser1 user account.
Open an InPrivate browser window.
Navigate to the Azure portal and sign in using the aaduser1 user account.
Note: To sign in you will need to provide a fully qualified name of the aaduser1 user account, including the Azure AD tenant DNS domain name, which you recorded earlier in this lab. This user name is in the format aaduser1@
<your_tenant_name>.onmicrosoft.com, where<your_tenant_name>is the placeholder representing your unique Azure AD tenant name.
When prompted, in the More information required dialog box, click Next.
Note: The browser session will be redirected to the Additional security verification page.
On the Keep your account secure page, select the I want to set up a different method link, in the Which method would you like to use? drop-down list, select Phone, and select Confirm.
On the Keep your account secure page, select your country or region, type your mobile phone number in the Enter phone number area, ensure that the Text me a code option is selected, and click Next.
On the Keep your account secure page, type the code you received in the text message on your mobile phone, and click Next.
On the Keep your account secure page, ensure that the verification was successful and click Next.
On the Keep your account secure page, click I want to use a different method, select Email from the drop down list, click Confirm, provide the email address you intend to use, and click Next. Once you receive the corresponding email, identify the code in the email body, provide it, and then click Done.
When prompted, change your password. Make sure to record the new password.
Verify that you successfully signed in to the Azure portal.
Sign out as aaduser1 and close the InPrivate browser window.
Result: You have created a new AD tenant, configured AD users, configured MFA, and tested the MFA experience for a user.
In this exercise, you will complete the following tasks
Task 1: Configure a conditional access policy.
Task 2: Test the conditional access policy.
In this task, you will review conditional access policy settings and create a policy that requires MFA when signing in to the Azure portal.
In the Azure portal, navigate back to the AdatumLab500-04 Azure Active Directory tenant blade.
On the AdatumLab500-04 blade, in the Manage section, click Security.
On the Security | Getting started blade, in the Protect section, click Conditional Access.
On the Conditional Access | Policies blade, click + New policy select the Create new policy from the drop-down list.
On the New blade, configure the following settings:
In the Name text box, type AZ500Policy1
Click Users or workload identities selected. On the right side under the What does this policy apply to >> Users and groups >> Include >> Enable Select users and groups >> select the Users and Groups checkbox, on the Select blade, click aaduser2, and click Select.
Click Cloud apps or actions, click Select apps, on the Select blade, click Microsoft Azure Management, and click Select.
Note: Review the warning that this policy impacts access to the Azure Portal.
Click Conditions, click Sign-in risk, on the Sign-in risk blade, review the risk levels but do not make any changes and close the Sign-in risk blade.
Click Device platforms, review the device platforms that can be included and click Done.
Click Locations and review the location options without making any changes.
Click Grant in the Access controls section, on the Grant blade, select the Require multi-factor authentication checkbox and click Select
Set the Enable policy to On.
On the New blade, click Create.
Note: At this point, you have a conditional access policy that requires MFA to sign in to the Azure portal.
In this task, you will sign in to the Azure portal as aaduser2 and verify MFA is required. You will also delete the policy before continuing on to the next exercise.
Open an InPrivate Microsoft Edge window.
In the new browser window, navigate to the Azure portal and sign in with the aaduser2 user account.
When prompted, in the More information required dialog box, click Next.
Note: The browser seesion will be redirected to the Keep your account secure page.
On the Keep your account secure page, select the I want to set up a different method link, in the Which method would you like to use? drop-down list, select Phone, and select Confirm.
On the Keep your account secure page, select your country or region, type your mobile phone number in the Enter phone number area, ensure that the Text me a code option is selected, and click Next.
On the Keep your account secure page, type the code you received in the text message on your mobile phone, and click Next.
On the Keep your account secure page, ensure that the verification was successful and click Next.
On the Keep your account secure page, click Done.
When prompted, change your password. Make sure to record the new password.
Verify that you successfully signed in to the Azure portal.
Sign out as aaduser2 and close the InPrivate browser window.
Note: You have now verified that the newly created conditional access policy enforces MFA when aaduser2 signs into the Azure portal.
Back in the browser window displaying the Azure portal, navigate back to the AdatumLab500-04 Azure Active Directory tenant blade.
On the AdatumLab500-04 blade, in the Manage section, click Security.
On the Security | Getting started blade, in the Protect section, click Conditional Access.
On the Conditional Access | Policies blade, click the ellipsis next to AZ500Policy1, click Delete, and, when prompted to confirm, click Yes.
Note: Result: In this exercise you implement a conditional access policy to require MFA when a user signs into the Azure portal.
Result: You have configured and tested Azure AD conditional access.
In this exercise, you will complete the following tasks
Task 1: View Azure AD Identity Protection options in the Azure portal
Task 2: Configure a user risk policy
Task 3: Configure a sign-in risk policy
Task 4: Simulate risk events against the Azure AD Identity Protection policies
Task 5: Review the Azure AD Identity Protection reports
In this task, you will view the Azure AD Identity Protection options in the Azure portal.
If needed, sign-in to the Azure portal https://portal.azure.com/.
Note: Ensure that you are signed-in to the AdatumLab500-04 Azure AD tenant. You can use the Directory + subscription filter to switch between Azure AD tenants. Ensure you are signed in as a user with the Global Administrator role in the Azure AD tenant.
On the AdatumLab500-04 blade, in the Manage section, click Security.
On the Security | Getting started blade, in the Protect section, click Identity Protection.
On the Identity Protection | Overview blade, review the New risky users detected and New risky sign-ins detected charts and other information about risky users.
In this task, you will create a user risk policy.
On the Identity Protection | Overview blade, in the Protect section, click user risk policy
Configure the User risk remediation policy with the following settings:
Click Users; on the Include tab of the Users blade, ensure that the All users option is selected.
On the Users blade, switch to the Exclude tab, click Select excluded users, select your user account, and then click Select.
Click User risk; on the User risk blade, select Low and above, and then click Done.
Click Access; on the Access blade, ensure that the Allow access option and the Require password change checkbox are selected and click Done.
Set Enforce policy to On and click Save.
In this task, you will configure a sign-in risk policy.
On the Identity Protection | User risk policy blade, in the Protect section, click Sign-in risk policy
Configure the Sign-in risk remediation policy with the following settings:
Click Users; on the Include tab of the Users blade, ensure that the All users option is selected.
Click Sign-in risk; on the Sign-in risk blade, select Medium and above, and then click Done.
Click Access; on the Access blade, ensure that the Allow access option and the Require multi-factor authentication checkbox are selected and click Done.
Set Enforce Policy to On and click Save.
Before you start this task, ensure that the template deployment you started in Exercise 1 has completed. The deployment includes an Azure VM named az500-04-vm1.
In the Azure portal, set the Directory + subscription filter to the the Azure AD tenant associated with the Azure subscription into which you deployed the az500-04-vm1 Azure VM.
In the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Virtual machines and press the Enter key.
On the Virtual machines blade, click the az500-04-vm1 entry.
On the az500-04-vm1 blade, click Connect and, in the drop down menu, click RDP.
Click Download RDP File and use it to connect to the az500-04-vm1 Azure VM via Remote Desktop. When prompted to authenticate, provide the following credntials:
User name
Student
Password
Please use your personal password created in Lab 04 > Exercise 1 > Task 1 > Step 9.
Note: Wait for the Remote Desktop session and Server Manager to load.
Note: The following steps are performed in the Remote Desktop session to the az500-04-vm1 Azure VM.
In Server Manager, click Local Server and then click IE Enhanced Security Configuration.
In the Internet Explorer Enhanced Security Configuration dialog box, set both options to Off and click OK.
Start Internet Explorer, click the cog wheel icon in the toolbar, in the drop-down menu, click Safety and then click InPrivate Browsing.
In the InPrivate Internet Explorer window, navigate to the ToR Browser Project at https://www.torproject.org/projects/torbrowser.html.en.
Download and install the Windows version of the ToR Browser with the default settings.
Once the installation completes, start the ToR Browser, use the Connect option on the initial page, and browse to the Application Access Panel at https://myapps.microsoft.com.
When prompted, attempt to sign in with the aaduser3 account.
Note: You will be presented with the message Your sign-in was blocked. This is expected, since this account is not configured with multi-factor authentication, which is required due to increased sign-in risk associated with the use of ToR Browser.
Use the Sign out and sign in with a different account option or select the back arrow to sign in as aaduser1 account you created and configured for multi-factor authentication earlier in this lab.
Note: This time, you will be presented with the Suspicious activity detected message. Again, this is expected, since this account is configured with multi-factor authentiation. Considering the increased sign-in risk associated with the use of ToR Browser, you will have to use multi-factor authentication.
Use the Verify option and specify whether you want to verify your identity via text or a call.
Complete the verification and ensure that you successfully signed in to the Application Access Panel.
Close your RDP session.
Note: At this point, you attempted two different sign ins. Next, you will review the Azure Identity Protection reports.
In this task, you will review the Azure AD Identity Protection reports generated from the ToR browser logins.
Back in the Azure portal, use the Directory + subscription filter to switch to the AdatumLab500-04 Azure Active Directory tenant.
On the AdatumLab500-04 blade, in the Manage section, click Security.
On the Security | Getting started blade, in the Report section, click Risky users.
Review the report and identify any entries referencing the aaduser3 user account.
On the Security | Getting started blade, in the Reports section, click Risky sign-ins.
Review the report and identify any entries corresponding to the sign-in with the aaduser3 user account.
Under Reports click Risk detections.
Review the report and identify any entries representing the sign-in from anonymous IP address generated by the ToR browser.
Note: It may take 10-15 minutes to risks to show up in reports.
Result: You have enabled Azure AD Identity Protection, configured user risk policy and sign-in risk policy, as well as validated Azure AD Identity Protection configuration by simulating risk events.
We need to remove identity protection resources that you no longer use.
Use the following steps to disable the identity protection policies in the AdatumLab500-04 Azure AD tenant.
In the Azure portal, navigate back to the AdatumLab500-04 Azure Active Directory tenant blade.
On the AdatumLab500-04 blade, in the Manage section, click Security.
On the Security | Getting started blade, in the Protect section, click Identity Protection.
On the Identity Protection | Overview blade, click User risk policy.
On the Identity Protection | User risk policy blade, set Enforce policy to Off and then click Save.
On the Identity Protection | User risk policy blade, click Sign-in risk policy
On the Identity Protection | Sign-in risk policy blade, set Enforce policy to Off and then click Save.
Use the following steps to stop the Azure VM you provisioned earlier in the lab.
In the Azure portal, set the Directory + subscription filter to the the Azure AD tenant associated with the Azure subscription into which you deployed the az500-04-vm1 Azure VM.
In the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Virtual machines and press the Enter key.
On the Virtual machines blade, click the az500-04-vm1 entry.
On the az500-04-vm1 blade, click Stop and, when prompted to confirm, click OK
Do not remove any resources provisioned in this lab, since the PIM lab has a dependency on them.
