AZ-102 Study notes - Part 4

-

Manage identities (15-20%)

Manage Azure Active Directory (AD)

Add custom domains 

Add a purchased domain and add the MX or Text records. (ms=msXXXXXX)
The person who creates the tenant is automatically the global administrator.
TTL must be 60 minutes.
Make suire you don't have any unmanaged PowerBI tenants.

Configure Azure AD Identity Protection

Azure AD identity protection is P2 level and above.
You can force people to register for MFA - once everyone is register you can add everyone.

User / sign on risk prevents or forces MFA sign in from compromised users.

Azure AD Join, and Enterprise State Roaming

With Azure AD settings you can enable local admin rights for Azure AD members.
The local admins are set as device admins.
ESR allows Windows 10 user data to be synced between devices. Data is encrypted. Requires "EMS".

Configure self-service password reset

Password reset - selected groups or all. One or two methods. Email / Office Phone / Mobile Phone / Security questions (and how many 3-5).
Users can be forced to register and can be force to re-register after a period. 
You can be notified on Admin passwords or user password resets.

Implement conditional access policies

Conditional (- platforms, locations, apps, device state, etc.) / Control statements - (Block / grant, MFA, limited experiences, etc)

Manage multiple directories

Each tenant is independent and a domain name can only be used by a single tenant.

Perform an access review

Access reviews allow you to schedule reports when you approve or deny access to a group or application. If a viewer does not response, we can remove automatically or email.

Recommendations suggest best action. Users can advise on reasons.

Implement and manage hybrid identities

Install and configure Azure AD Connect

Requirements:
Azure AD premium
Global Admin of Azure AD
Azure AD connection health agent installed.
Connectivity (outbound - no ssl inspection.)

Configure federation and single sign-on

Use the Azure AD Connect tool to add an AD FS server, add an AD FS WAP server, and configure a federated domain.

Deploy seamless single sign on via the Azure AD Connect tool.
Deploy group policies to enable SSO.

Manage Azure AD Connect

You can configure health alerts from Azure AD connect health in the portal.

Manage password sync and writeback

Premium feature.
Account used must have elevated rights.
Configured through the Azure AD connect utility.

Comments

Post a Comment

Popular posts from this blog

Azure - Check Invitation Status to guest user

-
Image
Often times you will need to invite a 3rd party to your Azure AD tenant to support your environment. When you add them to a resource, they will automatically be invited as a guest user in your Azure AD tenant, however they won't be able to access this until they accept the invitation email. If you send an invite to a guest user you can see if they have accepted the invitation or not. You also have the option to resend the invitation. From Azure AD you can search for guest users and drill down into an individual one. Here is what the email looks like - the key here is the email comes from " [email protected] " because it can be sent on behalf of this may end up in the junk or spam email folder, so be sure to have them check there.
Read more

Advice for breaking into the DevOps field

-
 A former co-worker reached out a few weeks ago and was looking for advice to give to his son who was about to Graduate and looking to break into the DevOps field. Here is the advise I gave, specifically around the Chicago market: A few years ago I read "The Phoenix Project" and that really got me to focus on changing my career trajectory. I think it's a great explanation of some of the fundamentals of the DevOps philosophy without being too dry. I can't recommend it enough. Skills wise - automation is going to the be the key thing to focus on and it's not going away anytime soon. Tools like Ansible & Terraform are really great to spend time with. Depending on what his dream job is, I would look up and start to focus on the skills required to get there. For example, if he's interested in working for Google, he'd probably want to put some time in to learn Golang, Kubernetes, etc. I think the most important thing is to network, if he plans on staying in ...
Read more

Blogs for Azure Information

-
Here are some of the blogs that I follow for information around new features in Azure, OMS, Log Analytics, Azure Monitor, etc. Azure Monitoring Services Health Status https://blogs.msdn.microsoft.com/servicemap-status/ Microsoft Azure Roadmap https://azure.microsoft.com/en-us/roadmap/ System Center Me http://systemcenterme.com/ Quae Nocent Docent (Great weekly OMS, SCOM, and Azure Info) https://nocentdocent.wordpress.com/ Operations Management Suite Blog https://blogs.technet.microsoft.com/msoms/
Read more