How To

Microsoft Entra ID Protected Actions

Microsoft Entra ID Protected Actions

Microsoft Entra ID has a feature called Protected Actions. When you configure Protected Actions, you can use them with Conditional Access policies to add extra layers of security before the protected action executes.

The following actions can be configured with Protected Actions:

  • Conditional Access policy management
  • Named Location management
  • Protected Actions management
  • Cross-tenant Access policy management
  • Hard deletions of soft-deleted items

In this post, I will show you step by step how to configure Microsoft Entra ID Protected Actions with Conditional Access.

The Process

  • Login to the Microsoft Entra admin center.
  • Click on Entra ID > Conditional Access.
  • Click on Authentication contexts.
  • Click on New authentication context.
  • Enter a name for the Protected Action Authentication context.
  • Select Publish to apps.
  • Pick an ID.

In my example, I will create three authentication contexts: one for Conditional Access policy management, one for Cross-tenant Access policy management, and one for Hard Delete.

Once we have created the authentication contexts, we need to build a Conditional Access policy that uses them.

  • Click on Policies.
  • Click on New policy.
  • Next, we need to configure the Conditional Access policy.
  • For Name, enter the name you want to use for your Conditional Access policy.

In my example, I will call it Protected Actions.

  • For Users, select the users that you want to apply the policy to and select any users you want to exclude.

In my example, I will select all users and exclude my break-glass accounts.

  • For Target resources, select Authentication context.
…

Read More Read More

Microsoft Entra ID Governance Access Package Workflow

Microsoft Entra ID Governance Access Package Workflow

An Access Package is a feature of Entitlement Management within Microsoft Entra ID Governance. With an Access Package, users gain self-service access to groups, applications, or SharePoint sites. You can also configure an Access Package to require approval before access is granted.

The post is a follow-up to my blog post, Configure Microsoft Entra ID Governance Entitlement Management Access Packages, and shows you the workflow for an Access Package.

In this post, I will show each stage of an Access Package, including approvals and views from the user, approver, and admin perspectives.

Prerequisites

  • An active Access Package.

If you haven’t set up an Access Package, my blog post Configure Microsoft Entra ID Governance Entitlement Management Access Packages details the entire setup process.

The Process

There are several stages of an Access Package.

User Request

To start the workflow for an Access Package, a user requests access to the Access Package.

  • The user finds the Access Package they want and, under Actions, clicks Request.
  • On the Request details tab, the user clicks Continue.

If the user clicks the Resources tab, they can see what resources they will gain access to.

  • The user fills in the required details, then they click Submit request.

If the Access Package has an expiry configured and the user enters a longer period, they will receive an error when submitting the request.

If a user does not enter specific period dates, the expiry countdown begins once they have access to the Access Package.

Once a user requests access to an Access Package, they cannot request it again until the request is approved or denied.

From the admin side, go to the Access Package, click Requests, and select the user to view the request details.

First Approval

If the Access Package has approvals configured, the user’s request is sent for approval.

  • The first approvers will get an email about the access request.

The email approvers see shows the access start and end times in UTC, and the user’s answers are not visible.

  • The first approver locates the request and clicks Review.
  • The first approver can see some basic information, such as when they are required to make a decision.
…

Read More Read More

Configure Microsoft Entra ID Governance Entitlement Management Access Packages

Configure Microsoft Entra ID Governance Entitlement Management Access Packages

Microsoft Entra ID Governance has many cool features, one of them is Entitlement Management. Within Entitlement Management is the Access Packages feature.

Access Packages allow you to configure user self-service access to groups, applications, or SharePoint sites. You can set an Access Package to use a specific approver or a dynamic one, such as the user’s manager. You can also configure access reviews to help address users having access to things they no longer need.

An example use case for an Access Package is configuring it so a user can request Visio and have their manager approve the request. Once approved, the Access Package adds the user to the Visio licensing group, which allocates them a license. If Intune is configured, the user can then install Visio themselves via Company Portal.

You can delegate the setup of Access Packages for a department to someone in that department, allowing them to self-manage how their department members get the access they need for the projects or tasks they are working on.

In this post, I will show you step by step how to create an Access Package.

Prerequisites

To use the basics of Entitlement Management, including Access Packages, you need the following license.

  • Microsoft Entra ID P2

If you want to unlock all the advanced features of Entitlement Management and Identity Governance, you need to have one of the following licenses.

  • Microsoft Entra ID Governance
  • Microsoft Entra Suite

The Process

  • Login to the Microsoft Entra admin center.
  • Click on ID Governance > Entitlement management.

The rest of the process is divided into the following sections.

Catalogs

Before creating an Access Package, we need to create a Catalog. A Catalog is a collection of resources that Access Packages can use. Catalogs help organize resources and can enable delegated management without excessive permissions.

  • Click on Catalogs.
  • Click on New catalog.
  • Enter a name and description for the catalog.

In my example, I will enter the name as Project Neo and the description as Access to project Neo.

  • For Enabled for users to request, decide if users can request access to the Access Packages within the Catalog.

In my example, I will select Yes.

  • For Enabled for external users to request, decide if external users can request access to Access Packages within the Catalog.

In my example, I will select No.

  • Click Create.
  • Click on the Catalog you just created.

In my example, I will click on the Project Neo catalog I just created.

  • In the Manage section, click on Resources.
…

Read More Read More

Microsoft Entra ID Conditional Access What If

Microsoft Entra ID Conditional Access What If

An underrated feature of Entra ID Conditional Access is the What If tool. The Conditional Access What If tool can help you troubleshoot or design Conditional Access policies.

Typically, when building a Conditional Access policy, you target a test user and then expand testing using report-only mode. Testing can be difficult if the workflow is complex or uncommon. Fortunately, the Conditional Access What If tool lets you simulate logins and policy impacts to test or troubleshoot without logging in multiple times or waiting for changes to propagate and the Entra sign-in logs to populate.

In this post, I will show you step by step how to use the Conditional Access What If tool.

The Process

  • Login to the Microsoft Entra admin center.
  • Click on Entra ID > Conditional Access.
  • Click on Policies.
  • Click on What if.
  • Now we need to configure all the settings for the What If tool.
  • For identity type, select whether to test Users, Guest or external users, Workload identities, or Agent identities.

In my example, I will select Users.

  • Select the identity to simulate a login for.

Depending on which identity type you selected, your options will differ.

In my example, I will select my user account.

…

Read More Read More

Microsoft Entra ID Conditional Access

Microsoft Entra ID Conditional Access

Microsoft Entra ID (formerly Azure AD) has an awesome feature called Conditional Access that can add an extra layer of security to your Microsoft 365 tenant. The power of Conditional Access really shines when you position Entra as your IdP (Identity Provider). Conditional Access is one of my favorite features in Entra.

To use Conditional Access policies, you need an Entra ID P1 or P2 license. Without one, your tenant likely has Security Defaults enabled. Security Defaults is a basic version of Conditional Access that does not allow any customizations. It provides protections, such as requiring all users to register for MFA and prompting for MFA when Microsoft deems it necessary.

The power of Conditional Access is that it lets you use identity signals such as user, location, application, and device, to name a few, and make decisions based on those signals, such as allowing or denying access or requiring additional verification.

Conditional Access processes policies using if-then conditions (not top-to-bottom like a firewall). Conditional Access policies take effect after first-factor authentication is completed (such as entering a valid password).

The best way I’ve found to think about Conditional Access is to compare it to airport security when traveling from Canada to the United States. Before you can board your flight, you need to clear security. If we wrote this as a conditional access policy, it would be: if the user is logging in, then MFA is required.

When traveling to the United States from Canada, you complete customs pre-clearance before boarding your flight. After clearing security, you have to clear U.S. customs. Customs checks whether you have a valid passport and whether you pose a risk to the country. You could technically say that to access customs, you need to clear security and have a valid passport. If we wrote this as a conditional access policy, it would be: if a user wants to log in to the VPN portal, then MFA and a compliant device are required. Since the user just performed MFA, the policy won’t prompt for MFA again, and as long as the device is compliant, it allows the user to log in to the VPN portal. At a high level, that’s how Conditional Access policies work.

Here are a few tips when creating and using Conditional Access policies:

…

Read More Read More

Configure VCF Installer Online Depot

Configure VCF Installer Online Depot

Once you have deployed the VCF Installer, you need to configure a depot connection to access the binaries needed to deploy VCF (VMware Cloud Foundation) or VVF (VMware vSphere Foundation).

In this post, I will show you step by step how to configure an online depot connection for the VCF Installer and download the binaries for VCF or VVF.

Before VCF 9.1, you configured the VCF Installer online depot connection using a download token. In VCF 9.1, the process has changed. You now need to register the VCF Installer in the VCF licensing portal.

Prerequisites

  • VCF Installer deployed.

If you need to learn how, my blog post Deploy VCF Installer details the steps.

  • Internet access on the VCF Installer appliance.

A list of URLs that the VCF Installer needs access to is available from Broadcom here.

The Process

  • Login to the VCF Installer as the admin@local user.
  • In the Get Started section, in the Download Binaries tile, click on Depot Settings and Binary Management.
  • In the Online Depot tile, click on Configure.
  • Copy your Download Service ID.
  • Click on Software Depot Registration.
…

Read More Read More

Deploy VCF Installer

Deploy VCF Installer

When you want to deploy VCF (VMware Cloud Foundation) or VVF (VMware vSphere Foundation), you typically use the VCF installer. Even though the VCF installer has VCF in its name, it can be used to deploy VVF.

In this post, I will show you step by step how to deploy the VCF installer on VMware ESX.

Prerequisites

  • Static IP for the VCF Installer appliance.
  • FQDN for the VCF Installer appliance with forward and reverse DNS records.
  • Enough resources to run the VCF Installer VM.
    • The VCF Installer VM will need:
      • 4 vCPU
      • 16GB RAM
      • 914GB disk space
  • A root password for the VCF Installer appliance.
  • A local user password for the VCF Installer appliance.
  • NTP Servers.

The Process

The entire VCF Installer deployment process is divided into two sections.

Download VCF Installer

Before we can deploy the VCF Installer, we need to download it first.

  • Click on Software > VMware Cloud Foundation > My Downloads.
  • Click on VMware Cloud Foundation or VMware vSphere Foundation.
  • Click VMware Cloud Foundation 9 or VMware vSphere Foundation 9 to expand the releases, then click the release you want.
  • Beside VCF Installer click on View Group.
  • Before you can download anything, you need to read and review the Terms and Conditions and the Compliance Reporting Terms and Conditions.
  • Click on Terms and Conditions to read them.
  • Click on Compliance Reporting Terms and Conditions to read them.
  • After reading, if you agree to the Terms and Conditions and the Compliance Reporting Terms and Conditions, select I agree.
  • Download the VCF SDDC Manager Appliance OVA.

Technically, you are downloading the VCF SDDC (Software Defined Datacenter) Manager.

The SDDC Manager has two purposes:

  1. The VCF Installer for VCF and VVF
  2. The SDDC Manager for VCF.
    • If you deploy the VCF Installer on an ESX host that will be part of your VCF management domain, the VCF Installer will convert into your SDDC Manager.

Deploy VCF Installer

Now that we have the VCF Installer downloaded, we can deploy it.

If you deploy the VCF Installer to an ESX host that will be used for the VCF Management Domain, it will convert to the SDDC Manager and can no longer be used as an installer.

  • To use the VCF Installer, you need to deploy it to something. The following are supported:
    • VMware vCenter
    • VMware ESX
    • VMware Workstation
    • VMware Fusion

In my example, I will deploy the VCF Installer to an ESX host. The process will be similar on other platforms.

  • Login to VMware ESX.
…

Read More Read More

Deploy Horizon Edge Gateway on VMware vSphere

Deploy Horizon Edge Gateway on VMware vSphere

If you have an Omnissa Horizon subscription, you should deploy the Horizon Edge gateway appliance to license your Omnissa Horizon setup.

The Horizon Edge Gateway for vSphere is a VM that you deploy on your VMware vSphere environment. In addition to automatically licensing your Horizon setup, the Horizon Edge gateway also serves as a connector to the Horizon Control Plane hosted by Omnissa, enabling Omnissa and you to monitor your Horizon setup for issues. In older versions of Horizon, the Edge Gateway was called the Cloud Connector.

In this post, I will show you step by step how to deploy the Omnissa Horizon Edge Gateway on VMware vSphere.

Prerequisites

  • Static IP for the Horizon Edge Gateway appliance.
  • FQDN for the Horizon Edge Gateway appliance with forward and reverse DNS records.
  • Enough resources in vSphere for the Edge Gateway VM.
    • The Edge Gateway will need
      • 8 vCPU
      • 16GB RAM
      • 40GB disk
  • A Root password for the Horizon Edge Gateway appliance.
  • An Admin password for the Horizon Edge Gateway appliance.
  • Service Account configured as an admin in Horizon.

If you need to add the service account as an admin to Horizon, my blog post, Add Administrators to Omnissa Horizon covers how to do so.

The Process

  • Under the Launch Services section, click Horizon Cloud.
  • In the Get Started section, in the Horizon 8 tile, click Select.
  • In the Horizon Edge tile, click Start Deployment.
…

Read More Read More

Schedule VMware Exam

Schedule VMware Exam

In this post, I will show you step by step how to schedule a VMware exam.

The Process

The entire process is split into a few stages.

Testing Portal Login

  • In the Additional Resources section, on the Education Portal tile, click Explore.
  • On the new page that opened up under the Addition Resources section, click on Certification.

If you want, you can skip those clicks and go directly to the following URL https://cp.certmetrics.com/vmware/en/home/dashboard

  • Under Features, click on Schedule your exam.
  • Click on SSO to Vue.

Private Access Codes

If you are taking a VMware exam at a conference, you will likely have a private access code to access the on-site exam center.

  • Click Private Access Code, type in the Private Access Code, then click Enter.

Exam Selection

  • Click on View exams.
  • Depending on the exam you are taking, you may need to click on VMware Professional Level Exams or VMware Advanced Level Exams. You can also search for the exam.
…

Read More Read More