Tag Archives: Azure AD

Comparing Windows AD DS, Azure AD and Azure AD DS

29 Friday May 2020

Posted by in Azure, Azure AD, Azure AD DS, Uncategorized

≈ 2 Comments

Tags

,

Windows AD DS:

Provides authentication and authorization to on-premise applications, resources. Access to various resources can be streamlined through Group Policy some examples of implementing GPO for user’s rights assignment are detailed in the article here.

Authentication Protocol: Kerberos and NTLM

AD Database access: Through LDAP query

Creation of Domain Trusts: Allowed

On-Premise Windows Server AD offers 5 core services:

  • Active Directory Domain Services (ADDS)
  • Active Directory Certificate Services (ADCS)
  • Active Directory Rights Management Services (ADRMS)
  • Active Directory Lightweight Directory Services (ADLDS)
  • Active Directory Federation Services (ADFS)

Windows ADDS provides a hierarchical data storage for various objects in the network users, computers, groups, printers etc. The objects are placed within various Organizational Units (OUs). For example the following screen snap shot demonstrates a way of organizing On-Premises ADDS

capture1

 

Azure Active Directory (Azure AD):

While allowing to create users and groups Azure AD provides a flat structure without Organizational Units (OUs) or Group Policy Objects (GPOs).

  • Azure AD does have a domain name
  • Provides no trusts between domains
  • Supports Web based authentication OAuth 2.0, SAML 2.0 and Open ID Connect
  • Use of HTTP/HTTPS to provide identity services
  • Querying Azure AD done through REST API end point called AD Graph API

Azure Active Directory Domain Services (Azure AD DS):

Cloud based PaaS offering providing managed domain services, group policy, Kerberos / NTLM authentication that is compatible with on-premises Windows AD DS.  The following will additional features of Azure AD DS:

  • Integration with Azure AD
  • Cannot extend the schema
  • No Domain / Forest trust
  • Read-Only LDAP

The following screen snap shots show how identity information is synchronized in cloud-only and hybrid models.

Cloud-Only:

capture2

Hybrid Model:

capture3

 

 

Administering Dynamics 365 CE Subscription

25 Saturday Jan 2020

Posted by in Azure AD, Dynamics 365 CE Online, Power Platform

≈ Leave a comment

Tags

, ,

Microsoft 365 Admin Center will provide the ability to create users requiring access to Dynamics 365 CE.

In the screen snap shot below there are two users one without a Dynamics 365 CE licence

Administer1

Of the two users listed above user “John Smith” has no license assigned and hence cannot access Dynamics 365 CE apps. Logging on to https://portal.office.com using jsmith@idyconsulting.onmicrosoft.com will display the following landing page.

Administer2

 

Product licenses can be allocated/managed from Microsoft 365 admin center

Administer3

Azure AD view for the above two user(s):

Within Azure AD admin portal the users will have the following roles assigned

Administer4

Administer5

From the above we can look up Assigned roles, Groups etc. The Global Administrator role provides capability to manage all aspects of Azure AD, Services that use Azure AD identities. Within Dynamics 365 CE a Azure AD user with Global Administrator role will have the following roles assigned to the instance.

  • Common Data Service User
  • System Administrator

Administer6

Administer7

 

For solution management and other aspects of customization assign “System Customizer” role.

Office 365 admin roles related to Microsoft Dynamics 365

  • Global Admin: Provides administrative features to Office 365 suite of services. By default initial signing account will be global admin and additional administrators can be added.
  • Billing Administrator: To manage all aspects of subscription
  • User Management Administration: For password resets, service health monitoring, user account provisioning.
  • Dynamics 365 Administrator: To manage Dynamics 365 at the tenant level without the need of having a Global Admin role assigned to user.