Azure Active Directory Connect (AD Connect) with Password Sync

Azure AD Connect is "new" because it is now one integrated tool that includes all the advances of AAD Sync and Dirsync.

The Azure AD Connect wizard Public Preview 1 provides a guided experience for integrating one or multiple Active Directory forests with Microsoft Azure AD.  Optionally you can configure Exchange Hybrid deployment, password change write-back, AD FS and Web Application Proxy.

NOTE:- Azure AD Connect Public Preview 1 is recommended to be run in a lab environment and not in a production AD or AAD environment. To get the installer, click here.

If you plan to run on production environment, please download

Azure Active Directiory Dir Sync from here.

AAD Sync capabilities include the following;

• Active Directory and Exchange multi-forest environments can be extended now to the cloud.
• Control over which attributes are synchronized based on desired cloud services.
• Selection of accounts to be synchronized through domains, OUs, etc.
• Ability to set up the connection to AD with minimal Windows Server AD privileges.
• Setup synchronization rules by mapping attributes and controlling how the values flow to the cloud.
• Preview AAD Premium password change and reset to AD on-premises.

Let begin the AD Connect configuration

After installation , double click AD connect icon on your desktop

Accept the license agreement and click Continue

Note:- Before install this tool, remember to add .Net Framework 3.5 features first.

The AD Connect tool will download and install

• MS Online Services Sign in Assistant
• Windows Azure Active Directory Module for Windows Powershell
• Azure AD Sync Engine

Enter Azure AD Credential

Next page will asking about Express setting (default using password sign on) or Customize (allow to select password or Single Sign On)

Below screen is how it look when select “Customize”

Let select “Password Sync” ..

Enter your Active Directory credential

Select optional features

• Exchange hybrid deployment

- Allow for co-existence of exchange mailboxes both on-premise and in Azure by synchronizing a specific set of attributes from Azure AD back into your on-premise directory.

• Password write back

- this option allow password changes that originates with Azure AD will be written back to your on-premise directory

• Specify identify user in on-premise directories and Azure

Final step

[Verification in Microsoft Azure AD]

You will notice on-premise user account has sync to Azure AD

Evaluate 5Nine Cloud Security 5.0 For Hyper-V With Kaspersky Antivirus Built-in and 98 Viruses

Recently 5Nine has released a new version for 5Nine Cloud Security. But we are busy with a lot of new product/features available in the market that require us to test it. Just hope that we have more than 24 hours a day.

[ Overview ]

5nine Cloud Security for Hyper-V is the first and only agentless complete security and compliance solution built specifically for Microsoft Cloud OS and Hyper-V, utilizing the extensibility of Hyper-V switch. It allows users to:

• Secure  multi-tenant Hyper-V environment and provide VM isolation
• Protect Hyper-V with fast, agentless antivirus
• Enforce PCI-DSS, HIPAA and Sarbanes-Oxley compliance
• And more.

If you’re interested to know more, please feel free to visit our test result from parent site :- http://www.ms4u.info/2014/12/evaluate-5nine-cloud-security-50-for.html

Walkthrough Azure Right Management

 

Azure Right Management help protect organizational sensitive information from unauthorized access and control how information is used. Right Management uses encryption, identity and authorization policies to help secure files and email.

How RMS is different compare with NTFS permission?

Well, protection that is applied by using RMS stays with the files and email, independently of the location. You remain in control of your data even it is shared to other people.

[ RMS Template Configuration – Azure ]

Click Active Directory | Right Management | Directory | Templates | Create Right Policy Template

Modify policy by adding users/ group and permission.

Finally publish the policy.

[ Assign RMS License– Office365]

Login to Office365 Portal :- https://portal.office.com

Go to Admin | Office365 | Users | Active User | Select a user and assign RMS license

[RMS Sharing Application]

RMS sharing app enabled you to securely collaborate with others. You can view protected files that others have shared with you. You can also take pictures or choose from your camera roll, protect with RMS template policy and share them. This app also allow you to open RMS protected PDF files, pictures, text files and any other file format protected as a .pfile. Sign in to this app must use business email address (Gmail / Hotmail) is not allowed.

Download RMS Sharing application from https://portal.aadrm.com and install on your devices.

Currently the following was the supported RMS Application during our testing:-

• FoxIT PDF - http://www.foxitsoftware.com/landingpage/2012/07/Reader-Ads-RMS/
• MS Outlook
• MS Word
• MS Excel
• MS Power Point
• Nitrodesk - http://www.nitrodesk.com/Security.html
• NitroPDF - https://www.nitropdf.com/?utm_source=m-soft-rms&utm_medium=web&utm_campaign=microsoft-rms-icon
• Titus -http://www.titus.com/software/classification-for-mobile.php
• Watchful Software -https://www.watchfulsoftware.com/en/products/rw-for-individuals/get-it-here

 

[ RMS Apps on devices ]

Depend on your Mobile device platform, download “RMS Sharing” from

• Android – Google Play
• Apple – ITunes
• Windows Phone – Windows Store

[ Screenshot RMS Sharing on Android Devices ]

Take picture or select photo from Library

Apply RMS Policy Template

Send the photo by email

 

[ Testing – MS Office Document ]

Open an existing word document and configure restrict access by select policy that you’ve configure in Microsoft Azure. Go to File | Info | Click Protect Document | Set Restrict Access | Select RMS Policy

View Permission. By default owner has full control

To further secure it, we can configure additional setting such as content expire and notify owner when unauthorized user open the document. Click on Share Protection

[ Testing – Email ]

You can configure policy to prevent recipient from forward the email, send to internal email account, etc (Click on Options | Permission)

[ Error ]

Open an attachment without permission

[ Updated on 16 Dec 2014]

Added Support for RMS protected PDF and PPDSs in Adobe Reader – Check out http://blogs.technet.com/b/rms/archive/2014/12/16/rms-in-adobe-reader.aspx

Comparison Between Azure Virtual Machine–13 Dec 2014

 

[ Basic Tier ]

• For Development & Testing
• No Auto scaling and Load Balancing

[ Standard Tier ]

• For Production Use
• Allow to perform auto scaling and load balancing
• RDMA network (A8 and A9)

• SSD local cache – used as temporary storage

[ Premium Tier ]

• Under Public Preview. Only available in West US, East US2 and West Europe
• High Performance Storage
• Low latency
• Store data on SSD
• Up to 32TB per VM
• Up to 50000 IOPS per VM
• Less than 1ms read latency
• To sign up, go to http://azure.microsoft.com/en-us/services/preview/
• Suitable for large workload and high I/O intensive workload such as SQL Server, Oracle Database, IBM DB2, SAP, Exchange Server, MySQL, etc

2nd Book Reviewed : Hyper-V Network Virtualization Cookbook

Couple month has passed and finally glad to see 2nd book reviewed by us has finally released to the market. The title was “Hyper-V Network Virtualization Cookbook”.

[Book cover ]

[ Credit Page ]

[ Reviewer Biography ]

Frankly speaking, I was quite enjoying to review the book and author has did a splendid job to make sure the book was properly written.

[ Table of Content ]

Hyper-V Network Virtualization provides the concept of a Virtual Network that is independent of the underlying physical network. Using software-defined networking, you can manage the network address space, isolation, and routing without having to make changes to the physical underlying architecture.

You will start your journey by understanding the fundamentals of Hyper-V Network Virtualization and how to configure System Center 2012 R2 Virtual Machine Manager to support it. You will learn about the Windows Server Gateway role for Hyper-V Virtual Networks and the different implementation options.

Finally, you will see how the Hyper-V Extensible Switch can help protect Virtual Machines by using Hyper-V Extensible Port ACLs.

• Installing Virtual Machine Manger
• Configuring Network for Hyper-V Network Virtualization
• Creating the Gateway for Virtual Machine Communication
• IP Address Management Integration with VMM for Hyper-V Network Virtualization
• Windows Server Gateway Configuration
• Implementing Network Isolation in Hyper-V
• Network Access Control List

[Buy a book]

Please go to https://www.packtpub.com/virtualization-and-cloud/hyper-v-network-virtualization-cookbook

Enroll IOS Devices To Manage By Microsoft Intune

Last week we have covered on how to enroll 

• Surface RT – Click here
• Android Devices –Click here

to manage by Microsoft Intune. Next device will be the dark side Apple product running IOS firmware. Here we would like to thanks Mr Jacky Chua (Infront Consultant) to borrow us his Apple 4S for this test.

[Pre-configuration]

1. Get APN Certificate Request from Microsoft Intune. Click on Admin | Mobile Device Management | IOS | Upload an APN Certificate.

Click on download and save on your pc

2. Get an Apple Push Notification service certificate by clicking on this link:- http://go.microsoft.com/fwlink/?LinkId=269844

Note:- You must create an Apple ID before login in. To create an Apple ID, please download Apple Itunes and create an Apple ID.

Login using Apple ID

Click Create Certificate

Click Choose File and select the csr file that you have save from Microsoft Intune.

Click Download and Upload the APN certificate in Microsoft Intune. Select the pem file and enter your Apple ID.

[Apple Phone / Tablet]

Open Apple Store, download and install Company Portal

Open Microsoft Intune Company Portal

Login using Microsoft Intune credential and enter Multi Factor Authentication. We have change Company Branding page and enabled MFA.

Click Enroll to start the device enrollment

Click to install Profile. This will download the profile configured on Microsoft Intune to your apple devices.

[End Result]

Access to Intune Portal and able to view app and devices which has enroll previously.

That’s concluded our testing on Apple IOS device enrollment.

Now, should we test by wiping Jacky handphone from Microsoft Intune Portal ????