Conditional Access Makes MFA Migration Easier

Microsoft Azure’s Conditional Access is a really great way to get a company using Multi-Factor Authentication. The old argument of not wanting MFA to get in the way of logins constantly goes away with this solution, because it lets you set the rules and scenarios where MFA will and won’t trigger.

To be more accurate, the access controls that Conditional Access can use lets you use more than just MFA to log in (username/password/token style). You can set the rules so a trusted device negates the need for MFA.

This isn’t new anymore either. Here’s a video from Microsoft back in March 2017 talking about how all this works:

What this means is that someone with a username and password on a device that is either InTune enrolled, or set up for Azure AD Hybrid is trustworthy enough. Of course this is less secure than asking for MFA every time, but do you really need to do that when someone is using their work laptop?

Another condition to choose from is ‘Locations’. You can decide that MFA won’t kick in if the login is coming from inside your corporate network. You can also target different applications with different rules that stack – so maybe the payroll system will always ask for MFA, but a less sensitive one will only ask when not on a managed device.

Security wise, there’s also a ‘Sign-in Risk‘ option where each authentication attempt is evaluated and given a risk ranking, and access can be granted or blocked based on the results. Note that this one needs Azure AD Premium P2 which isn’t part of the Microsoft 365 E3 subscription – E5 or separate licensing is required.

Because Conditional Access works like a bunch of Outlook rules, you can slowly build up and adjust what kicks in when. It’s really easy to do, and there’s really no excuse (once you have licensing!) to stop you setting it up ready to demo to staff. 

Combine Conditional Access with Azure AD App Proxy where you can externalise any internal web based app, while forcing auth on it and you’ve got an easy way of enabling workers to do their jobs remotely, while being happy about the security around it – and NOT just poking a hole in a firewall, exposing your IIS box to the world.

Lenovo 500 Multimedia Controller Review

Thanks to Lenovo, I’ve been given an interesting new gadget to review – the Lenovo 500 Multimedia Controller. It’s a compact sized wireless keyboard, designed for usage from a couch.

For a long time, I’ve used a computer plugged into the main loungeroom TV for a variety of things – watching TV shows and movies via local copies of content on Kodi, streaming services like Netflix and YouTube, as well as general web browsing.

The sticking point on doing all of this from a couch rather than a desk, is how to drive it all. I’ve tried a fairly vast array of devices:

  • A standard wireless keyboard and mouse, an ‘air mouse’ – too clunky and no nice flat surface to use the mouse on.
  • An ‘air mouse’ which is what happens when you breed a keyboard and Nintendo Wiimote together – inaccurate and slow to type on.
  • A dedicated remote control for ‘media’ content – too limiting in what you can do with it, no keyboard for typing.
  • Smartphone as keyboard/mouse – keyboard too slow to type on, mouse too tricky to use, always need smartphone around.
  • All in one keyboard and trackpad – the current winner for me (Logitech K400

The all in one keyboard and trackpad gives me what I want – a full keyboard experience so I can type fast, a multi-touch trackpad so I can move the cursor around fairly well, and use gestures like scrolling through pages. However, it’s still rather large, and doesn’t really like being dropped (the batteries generally go flying).

That’s why I was looking forward to trying Lenovo’s solution to this, and compare it to my currently winning solution.

The box turned up which looks simple enough, and shows what you’re getting :

Opening the box, all that’s inside beyond plastic and manuals are the keyboard itself, a tiny dongle, and a USB extension cable.

The keyboard itself looks and feels very well made. I was expecting something of average quality, but this feels premium. It has a reasonable amount of weight to it and the keys feel very solid – there is no cheap plastic to be found:

Getting the back cover off was a bit tricky – I needed to apply a lot more force than I was comfortable with, but that’s probably good for a device that’ll probably get thrown around and dropped. It takes two AAA batteries (included in the box in some countries) which will last up to 8 months – about normal for a wireless keyboard.

After clicking the back cover back on, I had one more look at the device. It has a decent amount of weight to it which helps with the premium feel, and a curved back sort of like an old iPhone 3GS, but a more emphasised curve – again, a really nice design that feels good to hold:

After plugging it in to my Intel NUC running Windows 10, the device was ready to use. When I first looked at the device (I decided to approach it with no research until after I’d finished playing), I assumed the bottom section was a trackpad. It turns out, the entire keyboard area is a trackpad! Everywhere from the top left Escape key, to the bottom right arrow key is one giant trackpad – despite the keys actually being individual buttons that press down. It even supports gestures, such as scrolling.

https://www.youtube.com/watch?v=Gc19UCAuGYU&feature=youtu.be
Quick demo of using the device as a trackpad

The bottom section are dedicated left and right click mouse buttons, with no touch abilities. The keyboard itself can be used to click also, just like a trackpad and using a tap motion rather than actually pressing down on it.

It’s also worth noting that the cursor sensitivity can be adjusted via the keyboard itself, with the Fn + F9 and Fn+F10 key combos – personally I upped the sensitivity a bit.

After using it for a while, here’s the pros and cons I formed about this device:

Pros:

  • High quality device – good materials, good weight, not flimsy in any way
  • Compact – it’s about the size of a large smartphone
  • Touchpad accuracy – fairly accurate with a very large surface to work with
  • Keyboard keys – they press down seperately and actually click. Typing can be done similar to the old full keyboard Nokias.
  • Battery – ~ 8 months means you won’t go flat easily, or have to remember about charging the device. It can be treated like any other standard remote control

Cons:

  • Small keys – no small device will let me type as fast as I can on a full sized keyboard, but this is probably the best to expect for a device this size
  • Touchpad sensitivity – because the keys are so close to the edge, I found my hands would accidently rest againt a key and affect my ability to move the cursor.

Overall, this is the best keyboard I’ve seen for couch usage for it’s size. The more important consideration is how you expect to use it; if you do a lot of typing and are used to typing fast, you’re going to need a full sized keyboard – no mini keyboard is going to be as good to use. However, for light typing and a trackpad experience, in a form factor that’s around smart-phone size, this ticks all the boxes.

Because the Lenovo 500 Multimedia Controller is a different style of device than what you’d be used to, there is a little adaptation required to put your hands in the right spot, get used to tapping the trackpad instead of clicking and use a small keyboard – but these to me were just minor adjustments I had to learn, rather than being too difficult to change what I do.

A note for Australians – at the time of writing, I can’t see anywhere to buy this locally, but for US residents the device costs around $40US.

OneDrive for Business – Turn Off ‘Allow Editing’ By Default

Update 21st March 2019

You can now find these settings in the OneDrive Admin Center (Preview) at https://admin.onedrive.com and that’s a clearer experience.

Update 16th April 2020

As the SharePoint Admin Center has been updated, here’s the area to find the view/edit choice:

Original Post

Every organisation has their own requirements and standards. For mine, I see a risk when the default action of sharing a document via OneDrive for Business is the ability to ‘Allow editing’ of any document sent out. It’s worse because that option is hidden behind the main popup when sharing a file, and you don’t actually see that you’re giving ‘modify’ access rather than ‘read only’:

OneDrive for Business default sharing popup
OneDrive for Business ‘Allow editing’ on by default

There is a way to change this default behavior though, and it’s not in the OneDrive admin center.

Instead, you’ll need to head to the SharePoint admin center (since the backend of OneDrive is SharePoint Online, this makes some sense). From here, go into ‘sharing’ and there’s an option around ‘Default link permissions’. You can change this to ‘View’ rather than ‘Edit’:

SharePoint admin center

The change was immediate from my testing, as soon as I went to share another file via OneDrive for Business, the ‘Allow editing’ option was unticked. This is only changing the default too, someone can still decide they want to allow editing and tick the box.

It’s worth considering what you should have as your default. The new versioning in OneDrive/SharePoint Online is really good, and will let a user easily roll back to a previous version of a document if something accidentally gets changed – but will your users be aware if something does change? It’s possible to set up an alert, but it’s a bit tedious: http://itgroove.net/brainlitter/2016/05/16/creating-alerts-documents-new-onedrive-business/

Hope this helps anyone considering rolling out OneDrive, or wants to start allowing external sharing.

Azure AD Hybrid Joined Devices Overview

Thought I’d make some notes around Azure AD Hybrid while the details are all bouncing around in my head.

What is Azure AD Hybrid?

A Windows device can be Domain joined, where you change it from a WorkGroup to a domain and authenticate against a domain controller, then the computer gets created in Active Directory. It can also be Azure AD joined, where you use your work account to join the device straight to Azure Active Directory. The later is the modern method, can only be done in Windows 10 as far as I know and really is only designed for someone who’s on the Microsoft 365 suite of products (think of InTune as a part of that ), and you either don’t need legacy on-prem connections, or can do some trickery around giving access to things where you’d historically use on-prem Active Directory authentication.

There is a third option though, that came out of the need for users to have connections to both worlds = Azure AD Hybrid. This lets you add a domain joined device to Azure AD at the same time, but needs to be done in that order. This is supported in Windows 10 (called Windows Current Devices) as well as Windows 7/8/8.1 (called down-level devices), but I’ve only tested this in Windows 10. There’s more work and steps to support down-level devices.

Why would I want Azure AD Hybrid?

There’s a bunch of reasons! A lot of the cool new features you can leverage for identity and devices coming out of Azure AD won’t work at or, or as nicely, on a pure domain joined device:

Windows Hello for Business
Seamless Single Sign-On (SSO) with Passthru Authentication (PTA)
Conditional Access
Windows Store for Business
Enterprise compliant roaming

Multi-factor Authentication

Conditional Access gives options for a better user experience rather than just forcing MFA in all scenarios. One of the options I like, is allowing an Azure AD Hybrid joined device to access a resource without anything beyond a password. This means that combined with Seamless SSO and PTA, a user can take their laptop anywhere, log onto Windows, and access resources without any other requirements. However, if they try to access a resource from another device, they’ll be challenged for another authentication method. Even better with Windows Hello for Business fingerprint or camera login, but that’s a whole other topic.

How To Set Up Azure AD Hybrid

I won’t go into too many details on this, as there’s excellent documentation already that covers both ADFS and non-ADFS users. Unless you already have ADFS, you most likely don’t need it, and it’s not the recommended method, as ADFS itself is much more complex (but fully works and is supported).

Very high level, the two steps are:

  1. Configure Azure AD Connect for Azure AD Hybrid Join using the setup/configuration wizard
  2. Enable “Register domain-joined computers as devices” via Group Policy under Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration.

That’s really it. Read the documentation though, there’s a lot to consider – but the end result should have no impact on users. They won’t know or see that their device is Azure AD Hybrid joined, and you can’t even see it (at the time of writing) via GUI settings.

How to see if a device is Azure AD Hybrid Joined

On a PC itself, you can run the command ‘dsregcmd /status‘ from a command prompt.  The very first line of the results will show ‘AzureAdJoined : YES’ or ‘AzureAdJoined : NO’. Pretty straight forward! You’ll see a lot more information in the other results when it is joined.

You can also test if a device is Azure AD Joined with the PowerShell command ‘get-msoldevice -deviceId <deviceId>’ using the computer name as the deviceid. You’ll either get a result back or you won’t, again it’s pretty clear.

If it’s not joined and you want to work out why, it gets a bit tougher. There’s a great blog post here on troubleshooting, but you can always log a case with Microsoft to get some assistance.

I’m haven’t come across or read any reason to not set up Azure AD Hybrid, as long as you’re in a position where you’ve already got all users and devices syncing already. Seamless Single Sign-On and Passthru Authentication is a great reason in itself to head down this path, as the user experience is a lot nicer without the constant re-entering of passwords.

Secrets To IT Success And Happiness

You won’t be shocked to hear that many IT people are unhappy. There’s so many reasons this could be the case – they don’t enjoy the work they do, the environment they work in, they have to deal with people they’d rather not deal with, there’s too much expected of themselves (either from them or someone else), they work too many hours…. You’re probably thinking of another several I haven’t mentioned.

It’s also not a singular black or white state, being unhappy. There might be aspects you are happy with, and others you aren’t. I don’t have all the answers to make you happy, but I’ve made a list (and will update as I remember more points, as many I naturally do) on points of consideration that for me personally, have helped. If nothing else, I hope this makes you think about what you do and why you do it which leads to improvements.

This could possibly be better to describe this as contentedness rather than happiness, as a lot of this should reduce unhappy situations. That may or may not leave you with happiness as a result. Talk to peers, friends, family, bosses, HR – anyone, if you’re unhappy. Sometimes just saying it out loud can help. I am not a mental health specialist or qualified in any way, so please do your own research and speak to professionals!

Also, as my background and experience is more on the operational side of IT, there’ll be a slant towards that – but with DevOps and all that, isn’t everyone Ops somehow? :)

At the first time of posting, I’ve made a list of 24 (ok, 27). I expect this to grow – feel free to add your own as a comment too!

 

With all that out the way, here’s my growing list of ‘secrets’ to IT Happiness:

1. Discuss and question, but don’t argue.

Arguing means you’re talking over someone, and probably in a less than perfect manner. If you’re at the stage of arguing, it’s unlikely you’re going to change the other parties’ opinion. If someone isn’t listening to your reasoning, then look to understand their view and work backwards from that. Arguing will waste everyone’s time, and you won’t walk away happy. Arguing on the internet is a complete waste of time :) However, you should still engage in healthy discussions and differences of opinion – often you’re trying to achieve similar results with different methods, and hopefully some acceptable common ground can be found.

2. Use every challenge (almost) as a chance to learn.

This is a way of approaching problems that you don’t already know how to fix. It doesn’t necessarily have to be technical either; people challenges can be even more draining, but it gives you more methods of how to work with people and get to a resolution you’re happy with. A technical problem you’re stuck on means you probably have already learnt and refreshed some things to get stuck; they just weren’t the things you needed this time.

3. Don’t be afraid to ask for help, and say “I don’t know”.

… but, say you’ll also find out.  You can’t know everything about everything and having that expectation of yourself is setting yourself up for disappointment. Finding out who to speak to on a problem, internally or externally is still valuable. You can use that opportunity to learn something too.

4. Never trust the user.

This is what I call ‘Rule 101’ of the helpdesk. Just because someone says something happened doesn’t mean it’s true. It might be true, or it might be very close to true… but it also might be completely wrong. Going down rabbit holes when a few clarification questions at the start of a conversation could save you hours of fruitless work. Prove the problem before fixing it. Of course, you need to be careful to maintain trust and rapport with the user while taking this approach.

5. Find out what someone is trying to achieve, before giving them a solution.

This is another time saver. Something as simple as “I need some AA batteries” can turn into time spent getting batteries and delivering them to someone, to find out they wanted them for their mouse which is dead, but plugs in to charge. Tying in with Rule 101, don’t assume the person asking for something actually knows that something will get them what they want.

6. Show pride in your work, but don’t brag.

If you do something good and noteworthy, share it and be proud. That doesn’t mean you bring it up at any opportunity to point out how awesome you think you are. Encourage others who have awesome ideas to see them through too – we’re not in this alone. If you’ve been on the receiving end of someone you’ve perceived as bragging, it’s not pleasant. Avoid others thinking that of you and it’ll be a general help to getting on with everyone. Bragging is a bit difficult to define as it’s contextual and people may have different opinions, but my general take between showing pride and bragging is more around the message it sends – are you doing it in a positive ‘this is awesome!’ way, or are you doing it in a ‘I’m better than you, you suck and you’re wrong’ way.

7. Have people you can learn from, as well as teach.

There are rewards in both teaching and learning. Having people to learn from is the obvious part (and if you can’t find them where you work, find them elsewhere – online, user groups etc), but teaching has it’s own rewards. Having others that can do some of the things you know means that hopefully others can cover for your job. If you’re higher up in the chain, then it will hopefully lead to less escalations which gives you more time to do more challenging tasks.

8. Don’t waste time being a jerk.

An extension of ‘Don’t be a jerk’. Being a jerk is easy, and it won’t benefit anyone, including yourself. You can provide constructive criticism, disagree with others and pick up on other people’s mistakes – but do it with the right approach. Also, just like online arguing, don’t go online and just be a jerk to others. If you feel the need to do this, then have a think about why you spend your valuable, finite time on doing that? In turn, you should stand up for yourself and what you believe is right – and choose when you decide to call someone else out on being a jerk. Personally, I find it demotivating to engage in a lot of it, but that’s me. Do what you think is right and inspires yourself and others.

9. Understand the environment you’re in before trying to change it.

‘It depends’ is an answer often given tongue-in-cheek to any IT related question, but it’s still generally correct. If something breaks in an IT environment, it’s because something changed. If you can’t fully understand the environment before making a change, make sure you can roll back that change as easily and quickly as possible.

10. If you’re stuck, do something else for a bit, have a break or go ask for help (and often realise the fix while asking)

I’m sure most of us experience this regularly. If you’re hitting a mental wall then you need to change your approach. I’ve done all these things many times – realised a solution to a problem while explaining the problem to someone else because I’m all out of ideas, or given up on a problem for the day only to go into work the next morning, look at it again for 5 minutes and have a ‘brain-wave’ on what the issue is. Trial and error should help you see the way you work best, and don’t beat yourself up about it.

11. If you don’t know how to undo what you’re about to do if it goes wrong, don’t do it.

“What does this big red button do?” Don’t press it. When you see someone who’s really struggling with computer basics, it’s often because they don’t know what impact anything they try to do, actually does. They are scared of breaking something due to their lack of understanding. You should be too! Of course this means you should read up on it, ask someone else or test it in a lab environment. Getting yourself out of trouble is just as important (if not more important) than believing you know the right thing to do in the first place. Undoing can be just renaming a file before making a config change so you can switch it back quickly, or restoring from last night’s backup – any way you can get out of trouble.

12. Adapt to your dealings with someone. Visit vs remote, email vs phone, explain vs just do.

When two people are working with each other, ideally they both change a bit to work the best way possible. Often, that doesn’t happen. For your own benefit, learn to adapt to the situation in front of you. If you’re dealing with an issue, it’s an important skill to quickly decide how you’re going to deal with a problem. Some people will want to understand what broke and how you fixed it, and others will want to go get a coffee while you sort it out. Don’t expect to change people that don’t want to listen. Sure, give it a shot and you might get lucky, but going in expecting someone to pay attention to you will just lead to frustration when they more than often, don’t.

13. What someone is asking for may not be what they are trying to achieve.

“I need Adobe Creative Cloud Suite, can you install it please?” might be the question, but the goal of what they’re trying to achieve might be a one time edit of a PDF. Maybe they already have different PDF editing software, or maybe someone else has it and can do it for them which is a lot quicker and cheaper than installing and licensing a product. Or maybe, they also had the original Word document and could just make a change there and reprint the PDF. I’ve seen a lot of time wasted when someone assumes the requester knows what they’re asking for and why. This does tie into #1, but it’s worth pointing out.

14. Respect all roles and people

I don’t care if you’re a receptionist or CEO, I’m going to start by giving you the time of day and try to help you. Sometimes, that receptionist (and I’m sorry to pick on this role, it’s just a good example of what people may consider ‘entry level’ and exists across most companies) is doing work for the CEO. You also might need help from that receptionist in the future, and the response you get may not be great if you didn’t respect them in the first place. More importantly, you’ll just get on with everyone around you better and in turn, should get that respect back. To reword a quote on this: “The true measure of a person is how they treats someone who they believe will do them absolutely no good.”. I’d also suggest not assuming that of anyone, everyone can do you some sort of good.

15. Ask for what you want instead of waiting and hoping.

Promotions, payrises, working on an interesting project or ‘no more apples in the vending machine’ – you should ask for something to greatly increase the chance of it happening. Maybe your boss doesn’t know you want to do certain work – telling them means they can hopefully make it happen in the future. Maybe not of course, but the wait and hope approach rarely works on it’s own.

16. Communicate lots.

Talk about what you’re going to do. Talk about what you just did. Choose whatever format works for you and who you deal with, verbal, email, wiki, instant message. There is a balance here to not be flooding people with information, but having it recorded and shared in any format is much better than no record at all. Even sending the “OK, thank you” email can have value to the sender to acknowledge what they’ve sent. Most issues occur from poor communication – almost every point I’ve listed here has some sort of relationship to good communication. Encourage others to communicate too, so you find out before something changes rather than after.

17. Keep it simple (and don’t call people stupid).

‘Short and sweet, to the point’ is a generalist statement on how I’d normally approach communication, especially when it’s a broadcast message. KIS also applies to technical solutions – don’t over complicate anything you do – the more moving parts, the more possible points of failure. Calling someone stupid… is stupid :) Sure, think it but work out how to work with the person, regardless of their ability level.

18. Critique vendors or services you pay for constructively.

Help vendors help you. Work with an account manager or whomever will listen and help provide solutions at the key vendors you work with. It’ll help in several ways – it will give a sense of how the company works and what they do. This helps you make decisions in how you use them, and even if you do want to use them in the future. You’ll make contacts and hopefully get better access when you really need it; say a critical event occurs and the fires are burning, being able to ping someone at the company who can quickly help is a huge benefit. You might also get access to new features earlier, as well as help shape how the product continues to develop.

19. Give positive feedback where it’s deserved.

Praise happens a lot less than critiquing sadly, but it should be done. I make a conscious effort to make sure positive feedback is given – especially if a bad situation has been turned around. It should mean a lot to whomever gets the praise, and make sure their manager knows too.

20. When you do things right, people won’t be sure you’ve done anything at all

Thanks Futurama for that one. Keeping things running will rarely bring any thanks or credit, but don’t let that discourage you. Take the pride in having services running (not servers, I don’t care about a server uptime! Service uptime which relates to user impact is what matters), and if you do want to show that off, produce reports showing that service uptime along with being fully patched – worth showing when the next major problem hits the news and you know you’re safe.

21. You’ll never know everything even on a single subject.

This can be a tough realisation – and it’s magnified with the new world of cloud and hyper super-accelerated rates of change.  Knowing how to find answers, understanding new things quickly along with how it fits into everything else is a much more important skill than having a photographic memory of what every TCP port is used for.

22. Admit when you’ve made a mistake, own it.

It sucks when you do something wrong and then others have to find out about it, but it’s better than the alternative – others finding out you made a mistake and tried to cover it up. If it’s system impacting, fess up to what you did and either fix it or get the right person to fix it. Think of it as a learning experience, and hopefully you’ll never make that same mistake again.

23. Don’t ‘Automate all the things’

Complexity takes more time and has more room for error. Automation is great, where logic can be applied and the automation doesn’t take more time and resources than doing it manually – or at least a hybrid of manual and automation, such as a form that needs to be manually filled in with validation checks on the data, but then does something based on the data entered.

24. Appreciate that a lot of your job is to help others

A lot of IT (and particularly the non-dev side) at it’s core, is helping others. You’re doing IT work for someone else’s benefit, which in turn should be helping the business to make more money. There’s a whole essay I could write on this, but the main take away is to avoid getting frustrated at interruptions and instead teach that person what they don’t know… which might include telling them to speak to helpdesk first.

25. People yelling at you isn’t normal or healthy.

If a situation has gotten to the state where someone is actually yelling – do not engage. Definitely don’t yell back, and ideally remove yourself from the situation. This might be something more collective around ‘We’re getting worked up about this, let’s take a break and come back with clear heads’, or something much more direct like “There’s no need to yell at me. I’m happy to talk but not like that” – or however you feel is appropriate in the situation. If you’re too flustered to actually respond clearly, a simple “I need some air” or “We’ll talk later about this” can get you out of it to collect your thoughts.

If it’s an ongoing problem, speak to colleagues for advice, or HR. Nobody deserves to be yelled at. This of course gets much trickier if it’s your boss.

26. Don’t stick around under a ‘bad boss’.

This gets tricky. What makes a good or bad boss is more of a universal thing, but what parts of that bother you is going to be a personal thing. It might be fine for some if you have a boss that’s never around because you have plenty of work to do and get direction/feedback in other ways, but for others this can turn a good job into a bad one. You need to give your boss a chance and provide feedback on what you’d like out of them. If this doesn’t work though, you need to draw the line someone start looking for a way out if you really aren’t happy with the situation. Moving departments or companies is usually the go; change is scary but often good – and even if it’s not good, then just move on again!

27. People won’t change without help, guidance and feedback.

… and then sometimes they still won’t change. However, you need to give people a chance to grow and learn. Expecting someone to change what they do, how they communicate, what tiny process they seem to keep getting wrong will rarely change without someone giving them the hint. If someone’s decent at their job and takes pride in what they do, they’ll probably improve. Don’t just wait and hope for change though (#15), as you’ll probably be disappointed when nothing happens.