|
|
|
|
@ -5,7 +5,7 @@ ms.date: 08/19/2018
|
|
|
|
|
ms.topic: how-to
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Using Certificates for AADJ On-premises Single-sign On
|
|
|
|
|
# Using Certificates for Microsoft Entra joined on-premises single-sign on
|
|
|
|
|
|
|
|
|
|
[!INCLUDE [apply-to-hybrid-cert-trust-entra](deploy/includes/apply-to-hybrid-cert-trust-entra.md)]
|
|
|
|
|
|
|
|
|
|
@ -16,24 +16,25 @@ If you plan to use certificates for on-premises single-sign on, then follow thes
|
|
|
|
|
|
|
|
|
|
Steps you'll perform include:
|
|
|
|
|
|
|
|
|
|
- [Prepare Microsoft Entra Connect](#prepare-microsoft-entra-connect)
|
|
|
|
|
- [Prepare the Network Device Enrollment Services Service Account](#prepare-the-network-device-enrollment-services-ndes-service-account)
|
|
|
|
|
- [Prepare Active Directory Certificate Services](#prepare-active-directory-certificate-authority)
|
|
|
|
|
- [Install the Network Device Enrollment Services Role](#install-and-configure-the-ndes-role)
|
|
|
|
|
- [Configure Network Device Enrollment Services to work with Microsoft Intune](#configure-network-device-enrollment-services-to-work-with-microsoft-intune)
|
|
|
|
|
- [Download, Install and Configure the Intune Certificate Connector](#download-install-and-configure-the-intune-certificate-connector)
|
|
|
|
|
- [Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile](#create-and-assign-a-simple-certificate-enrollment-protocol-scep-certificate-profile)
|
|
|
|
|
> [!div class="checklist"]
|
|
|
|
|
> - [Prepare Microsoft Entra Connect](#prepare-microsoft-entra-connect)
|
|
|
|
|
> - [Prepare the Network Device Enrollment Services Service Account](#prepare-the-network-device-enrollment-services-ndes-service-account)
|
|
|
|
|
> - [Prepare Active Directory Certificate Services](#prepare-active-directory-certificate-authority)
|
|
|
|
|
> - [Install the Network Device Enrollment Services Role](#install-and-configure-the-ndes-role)
|
|
|
|
|
> - [Configure Network Device Enrollment Services to work with Microsoft Intune](#configure-network-device-enrollment-services-to-work-with-microsoft-intune)
|
|
|
|
|
> - [Download, Install and Configure the Intune Certificate Connector](#download-install-and-configure-the-intune-certificate-connector)
|
|
|
|
|
> - [Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile](#create-and-assign-a-simple-certificate-enrollment-protocol-scep-certificate-profile)
|
|
|
|
|
|
|
|
|
|
## Requirements
|
|
|
|
|
|
|
|
|
|
You need to install and configure additional infrastructure to provide Microsoft Entra joined devices with on-premises single-sign on.
|
|
|
|
|
You must install and configure additional infrastructure to provide Microsoft Entra joined devices with on-premises single-sign on.
|
|
|
|
|
|
|
|
|
|
- An existing Windows Server 2012 R2 or later Enterprise Certificate Authority
|
|
|
|
|
- A Windows Server 2012 R2 domain joined server that hosts the Network Device Enrollment Services role
|
|
|
|
|
- An existing Windows Server Enterprise Certificate Authority
|
|
|
|
|
- A domain joined Windows Server that hosts the Network Device Enrollment Services (NDES) role
|
|
|
|
|
|
|
|
|
|
### High Availability
|
|
|
|
|
|
|
|
|
|
The Network Device Enrollment Services (NDES) server role acts as a certificate registration authority. Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority.
|
|
|
|
|
The NDES server role acts as a certificate registration authority (CRA). Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority.
|
|
|
|
|
|
|
|
|
|
The architecture of the NDES server prevents it from being clustered or load balanced for high availability. To provide high availability, you need to install more than one identically configured NDES servers, and use Microsoft Intune to load balance then (in round-robin fashion).
|
|
|
|
|
|
|
|
|
|
@ -59,28 +60,23 @@ To include the on-premises distinguished name in the certificate's subject, Micr
|
|
|
|
|
|
|
|
|
|
### Verify Microsoft Entra Connect version
|
|
|
|
|
|
|
|
|
|
Sign-in to computer running Microsoft Entra Connect with access equivalent to _local administrator_.
|
|
|
|
|
Sign-in to computer running Microsoft Entra Connect with access equivalent to *local administrator*.
|
|
|
|
|
|
|
|
|
|
1. Open **Synchronization Services** from the **Microsoft Entra Connect** folder.
|
|
|
|
|
|
|
|
|
|
2. In the **Synchronization Service Manager**, select **Help** and then select **About**.
|
|
|
|
|
|
|
|
|
|
3. If the version number isn't **1.1.819** or later, then upgrade Microsoft Entra Connect to the latest version.
|
|
|
|
|
1. Open **Synchronization Services** from the **Microsoft Entra Connect** folder
|
|
|
|
|
1. In the **Synchronization Service Manager**, select **Help** and then select **About**
|
|
|
|
|
1. If the version number isn't **1.1.819** or later, then upgrade Microsoft Entra Connect to the latest version.
|
|
|
|
|
|
|
|
|
|
### Verify the onPremisesDistinguishedName attribute is synchronized
|
|
|
|
|
|
|
|
|
|
The easiest way to verify that the onPremisesDistingushedNamne attribute is synchronized is to use the Graph Explorer for Microsoft Graph.
|
|
|
|
|
|
|
|
|
|
1. Open a web browser and navigate to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer).
|
|
|
|
|
|
|
|
|
|
2. Select **Sign in to Graph Explorer** and provide Azure credentials.
|
|
|
|
|
1. Open a web browser and navigate to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer)
|
|
|
|
|
1. Select **Sign in to Graph Explorer** and provide Azure credentials.
|
|
|
|
|
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> To successfully query the Graph API, adequate [permissions](/graph/api/user-get?) must be granted.
|
|
|
|
|
|
|
|
|
|
3. Select **Modify permissions (Preview)**. Scroll down and locate **User.Read.All** (or any other required permission) and select **Consent**. You'll now be prompted for delegated permissions consent.
|
|
|
|
|
|
|
|
|
|
4. In the Graph Explorer URL, enter `https://graph.microsoft.com/v1.0/users/[userid]?$select=displayName,userPrincipalName,onPremisesDistinguishedName`, where **[userid]** is the user principal name of a user in Microsoft Entra ID. Select **Run query**.
|
|
|
|
|
> To successfully query the Graph API, adequate [permissions](/graph/api/user-get?) must be granted
|
|
|
|
|
1. Select **Modify permissions (Preview)**. Scroll down and locate **User.Read.All** (or any other required permission) and select **Consent**. You'll now be prompted for delegated permissions consent
|
|
|
|
|
1. In the Graph Explorer URL, enter `https://graph.microsoft.com/v1.0/users/[userid]?$select=displayName,userPrincipalName,onPremisesDistinguishedName`, where **[userid]** is the user principal name of a user in Microsoft Entra ID. Select **Run query**.
|
|
|
|
|
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> Because the v1.0 endpoint of the Graph API only provides a limited set of parameters, we will use the $select [Optional OData query parameter](/graph/api/user-get?). For convenience, it is possible to switch the API version selector from **v1.0** to **beta** before performing the query. This will provide all available user information, but remember, **beta** endpoint queries should not be used in production scenarios.
|
|
|
|
|
@ -121,29 +117,22 @@ The easiest way to verify that the onPremisesDistingushedNamne attribute is sync
|
|
|
|
|
|
|
|
|
|
The deployment uses the **NDES Servers** security group to assign the NDES service the proper user right assignments.
|
|
|
|
|
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_.
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to *domain administrator*.
|
|
|
|
|
|
|
|
|
|
1. Open **Active Directory Users and Computers**.
|
|
|
|
|
|
|
|
|
|
2. Expand the domain node from the navigation pane.
|
|
|
|
|
|
|
|
|
|
3. Right-click the **Users** container. Hover over **New** and select **Group**.
|
|
|
|
|
|
|
|
|
|
4. Type **NDES Servers** in the **Group Name** text box.
|
|
|
|
|
|
|
|
|
|
5. Select **OK**.
|
|
|
|
|
1. Open **Active Directory Users and Computers**
|
|
|
|
|
1. Expand the domain node from the navigation pane
|
|
|
|
|
1. Right-click the **Users** container. Hover over **New** and select **Group**
|
|
|
|
|
1. Type **NDES Servers** in the **Group Name** text box
|
|
|
|
|
1. Select **OK**.
|
|
|
|
|
|
|
|
|
|
### Add the NDES server to the NDES Servers global security group
|
|
|
|
|
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_.
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to *domain administrator*.
|
|
|
|
|
|
|
|
|
|
1. Open **Active Directory Users and Computers**.
|
|
|
|
|
|
|
|
|
|
2. Expand the domain node from the navigation pane.
|
|
|
|
|
|
|
|
|
|
3. Select **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Select **Add to a group**.
|
|
|
|
|
|
|
|
|
|
4. Type **NDES Servers** in **Enter the object names to select**. Select **OK**. Select **OK** on the **Active Directory Domain Services** success dialog.
|
|
|
|
|
1. Open **Active Directory Users and Computers**
|
|
|
|
|
1. Expand the domain node from the navigation pane
|
|
|
|
|
1. Select **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Select **Add to a group**
|
|
|
|
|
1. Type **NDES Servers** in **Enter the object names to select**. Select **OK**. Select **OK** on the **Active Directory Domain Services** success dialog.
|
|
|
|
|
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> For high-availability, you should have more than one NDES server to service Windows Hello for Business certificate requests. You should add additional Windows Hello for Business NDES servers to this group to ensure they receive the proper configuration.
|
|
|
|
|
@ -152,15 +141,12 @@ Sign-in to a domain controller or management workstation with access equivalent
|
|
|
|
|
|
|
|
|
|
The Network Device Enrollment Services (NDES) role runs under a service account. Typically, it's preferential to run services using a Group Managed Service Account (GMSA). While the NDES role can be configured to run using a GMSA, the Intune Certificate Connector wasn't designed nor tested using a GMSA and is considered an unsupported configuration. The deployment uses a normal services account.
|
|
|
|
|
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_.
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to *domain administrator*.
|
|
|
|
|
|
|
|
|
|
1. In the navigation pane, expand the node that has your domain name. Select **Users**.
|
|
|
|
|
|
|
|
|
|
2. Right-click the **Users** container. Hover over **New** and then select **User**. Type **NDESSvc** in **Full Name** and **User logon name**. Select **Next**.
|
|
|
|
|
|
|
|
|
|
3. Type a secure password in **Password**. Confirm the secure password in **Confirm Password**. Clear **User must change password at next logon**. Select **Next**.
|
|
|
|
|
|
|
|
|
|
4. Select **Finish**.
|
|
|
|
|
1. In the navigation pane, expand the node that has your domain name. Select **Users**
|
|
|
|
|
1. Right-click the **Users** container. Hover over **New** and then select **User**. Type **NDESSvc** in **Full Name** and **User logon name**. Select **Next**
|
|
|
|
|
1. Type a secure password in **Password**. Confirm the secure password in **Confirm Password**. Clear **User must change password at next logon**. Select **Next**
|
|
|
|
|
1. Select **Finish**.
|
|
|
|
|
|
|
|
|
|
> [!IMPORTANT]
|
|
|
|
|
> Configuring the service's account password to **Password never expires** may be more convenient, but it presents a security risk. Normal service account passwords should expire in accordance with the organizations user password expiration policy. Create a reminder to change the service account's password two weeks before it will expire. Share the reminder with others that are allowed to change the password to ensure the password is changed before it expires.
|
|
|
|
|
@ -169,57 +155,44 @@ Sign-in to a domain controller or management workstation with access equivalent
|
|
|
|
|
|
|
|
|
|
The Group Policy object ensures the NDES Service account has the proper user right to assign all the NDES servers in the **NDES Servers** group. As you add new NDES servers to your environment and this group, the service account automatically receives the proper user rights through the Group Policy.
|
|
|
|
|
|
|
|
|
|
Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials.
|
|
|
|
|
Sign-in a domain controller or management workstations with *Domain Admin* equivalent credentials.
|
|
|
|
|
|
|
|
|
|
1. Start the **Group Policy Management Console** (gpmc.msc)
|
|
|
|
|
|
|
|
|
|
2. Expand the domain and select the **Group Policy Object** node in the navigation pane.
|
|
|
|
|
|
|
|
|
|
3. Right-click **Group Policy object** and select **New**.
|
|
|
|
|
|
|
|
|
|
4. Type **NDES Service Rights** in the name box and select **OK**.
|
|
|
|
|
|
|
|
|
|
5. In the content pane, right-click the **NDES Service Rights** Group Policy object and select **Edit**.
|
|
|
|
|
|
|
|
|
|
6. In the navigation pane, expand **Policies** under **Computer Configuration**.
|
|
|
|
|
|
|
|
|
|
7. Expand **Windows Settings > Security Settings > Local Policies**. Select **User Rights Assignments**.
|
|
|
|
|
|
|
|
|
|
8. In the content pane, double-click **Allow log on locally**. Select **Define these policy settings** and select **OK**. Select **Add User or Group...**. In the **Add User or Group** dialog box, select **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Select **OK** twice.
|
|
|
|
|
|
|
|
|
|
9. In the content pane, double-click **Log on as a batch job**. Select **Define these policy settings** and select **OK**. Select **Add User or Group...**. In the **Add User or Group** dialog box, select **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Performance Log Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Select **OK** twice.
|
|
|
|
|
|
|
|
|
|
10. In the content pane, double-click **Log on as a service**. Select **Define these policy settings** and select **OK**. Select **Add User or Group...**. In the **Add User or Group** dialog box, select **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **NT SERVICE\ALL SERVICES;DOMAINNAME\NDESSvc** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Select **OK** three times.
|
|
|
|
|
|
|
|
|
|
11. Close the **Group Policy Management Editor**.
|
|
|
|
|
1. Expand the domain and select the **Group Policy Object** node in the navigation pane
|
|
|
|
|
1. Right-click **Group Policy object** and select **New**
|
|
|
|
|
1. Type **NDES Service Rights** in the name box and select **OK**
|
|
|
|
|
1. In the content pane, right-click the **NDES Service Rights** Group Policy object and select **Edit**
|
|
|
|
|
1. In the navigation pane, expand **Policies** under **Computer Configuration**
|
|
|
|
|
1. Expand **Windows Settings > Security Settings > Local Policies**. Select **User Rights Assignments**
|
|
|
|
|
1. In the content pane, double-click **Allow log on locally**. Select **Define these policy settings** and select **OK**. Select **Add User or Group...**. In the **Add User or Group** dialog box, select **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Select **OK** twice
|
|
|
|
|
1. In the content pane, double-click **Log on as a batch job**. Select **Define these policy settings** and select **OK**. Select **Add User or Group...**. In the **Add User or Group** dialog box, select **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Performance Log Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Select **OK** twice
|
|
|
|
|
1. In the content pane, double-click **Log on as a service**. Select **Define these policy settings** and select **OK**. Select **Add User or Group...**. In the **Add User or Group** dialog box, select **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **NT SERVICE\ALL SERVICES;DOMAINNAME\NDESSvc** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Select **OK** three times
|
|
|
|
|
1. Close the **Group Policy Management Editor**.
|
|
|
|
|
|
|
|
|
|
### Configure security for the NDES Service User Rights Group Policy object
|
|
|
|
|
|
|
|
|
|
The best way to deploy the **NDES Service User Rights** Group Policy object is to use security group filtering. This enables you to easily manage the computers that receive the Group Policy settings by adding them to a group.
|
|
|
|
|
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_.
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to *domain administrator*.
|
|
|
|
|
|
|
|
|
|
1. Start the **Group Policy Management Console** (gpmc.msc)
|
|
|
|
|
|
|
|
|
|
2. Expand the domain and select the **Group Policy Object** node in the navigation pane.
|
|
|
|
|
|
|
|
|
|
3. Double-click the **NDES Service User Rights** Group Policy object.
|
|
|
|
|
|
|
|
|
|
4. In the **Security Filtering** section of the content pane, select **Add**. Type **NDES Servers** or the name of the security group you previously created and select **OK**.
|
|
|
|
|
|
|
|
|
|
5. Select the **Delegation** tab. Select **Authenticated Users** and select **Advanced**.
|
|
|
|
|
|
|
|
|
|
6. In the **Group or User names** list, select **Authenticated Users**. In the **Permissions for Authenticated Users** list, clear the **Allow** check box for the **Apply Group Policy** permission. Select **OK**.
|
|
|
|
|
1. Expand the domain and select the **Group Policy Object** node in the navigation pane
|
|
|
|
|
1. Double-click the **NDES Service User Rights** Group Policy object
|
|
|
|
|
1. In the **Security Filtering** section of the content pane, select **Add**. Type **NDES Servers** or the name of the security group you previously created and select **OK**
|
|
|
|
|
1. Select the **Delegation** tab. Select **Authenticated Users** and select **Advanced**
|
|
|
|
|
1. In the **Group or User names** list, select **Authenticated Users**. In the **Permissions for Authenticated Users** list, clear the **Allow** check box for the **Apply Group Policy** permission. Select **OK**.
|
|
|
|
|
|
|
|
|
|
### Deploy the NDES Service User Rights Group Policy object
|
|
|
|
|
|
|
|
|
|
The application of the **NDES Service User Rights** Group Policy object uses security group filtering. This enables you to link the Group Policy object at the domain, ensuring the Group Policy object is within scope to all computers. However, the security group filtering ensures only computers included in the **NDES Servers** global security group receive and apply the Group Policy object, which results in providing the **NDESSvc** service account with the proper user rights.
|
|
|
|
|
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_.
|
|
|
|
|
Sign-in to a domain controller or management workstation with access equivalent to *domain administrator*.
|
|
|
|
|
|
|
|
|
|
1. Start the **Group Policy Management Console** (gpmc.msc)
|
|
|
|
|
|
|
|
|
|
2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and select **Link an existing GPO**
|
|
|
|
|
1. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and select **Link an existing GPO**
|
|
|
|
|
|
|
|
|
|
3. In the **Select GPO** dialog box, select **NDES Service User Rights** or the name of the Group Policy object you previously created and select **OK**.
|
|
|
|
|
|
|
|
|
|
@ -242,7 +215,7 @@ When deploying certificates using Microsoft Intune, you have the option of provi
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> Skip this step if you do not want to enable Microsoft Intune to specify the validity period of the certificate. Without this configuration, the certificate request uses the validity period configured in the certificate template.
|
|
|
|
|
|
|
|
|
|
Sign-in to the issuing certificate authority with access equivalent to _local administrator_.
|
|
|
|
|
Sign-in to the issuing certificate authority with access equivalent to *local administrator*.
|
|
|
|
|
|
|
|
|
|
1. Open an elevated command prompt and type the following command:
|
|
|
|
|
|
|
|
|
|
@ -256,86 +229,60 @@ Sign-in to the issuing certificate authority with access equivalent to _local ad
|
|
|
|
|
|
|
|
|
|
NDES uses a server authentication certificate to authenticate the server endpoint, which encrypts the communication between it and the connecting client. The Intune Certificate Connector uses a client authentication certificate template to authenticate to the certificate registration point.
|
|
|
|
|
|
|
|
|
|
Sign-in to the issuing certificate authority or management workstations with _Domain Admin_ equivalent credentials.
|
|
|
|
|
Sign-in to the issuing certificate authority or management workstations with *Domain Admin* equivalent credentials.
|
|
|
|
|
|
|
|
|
|
1. Open the **Certificate Authority** management console.
|
|
|
|
|
|
|
|
|
|
2. Right-click **Certificate Templates** and select **Manage**.
|
|
|
|
|
|
|
|
|
|
3. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and select **Duplicate Template**.
|
|
|
|
|
|
|
|
|
|
4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs.
|
|
|
|
|
1. Open the **Certificate Authority** management console
|
|
|
|
|
1. Right-click **Certificate Templates** and select **Manage**
|
|
|
|
|
1. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and select **Duplicate Template**
|
|
|
|
|
1. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs.
|
|
|
|
|
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> If you use different template names, you'll need to remember and substitute these names in different portions of the lab.
|
|
|
|
|
|
|
|
|
|
5. On the **Subject** tab, select **Supply in the request**.
|
|
|
|
|
|
|
|
|
|
6. On the **Cryptography** tab, validate the **Minimum key size** is **2048**.
|
|
|
|
|
|
|
|
|
|
7. On the **Security** tab, select **Add**.
|
|
|
|
|
|
|
|
|
|
8. Select **Object Types**, then in the window that appears, choose **Computers** and select **OK**.
|
|
|
|
|
|
|
|
|
|
9. Type **NDES server** in the **Enter the object names to select** text box and select **OK**.
|
|
|
|
|
|
|
|
|
|
10. Select **NDES server** from the **Group or users names** list. In the **Permissions for** section, select the **Allow** check box for the **Enroll** permission. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes aren't already cleared. Select **OK**.
|
|
|
|
|
|
|
|
|
|
11. Select on the **Apply** to save changes and close the console.
|
|
|
|
|
> If you use different template names, you'll need to remember and substitute these names in different portions of the lab
|
|
|
|
|
1. On the **Subject** tab, select **Supply in the request**
|
|
|
|
|
1. On the **Cryptography** tab, validate the **Minimum key size** is **2048**
|
|
|
|
|
1. On the **Security** tab, select **Add**
|
|
|
|
|
1. Select **Object Types**, then in the window that appears, choose **Computers** and select **OK**
|
|
|
|
|
1. Type **NDES server** in the **Enter the object names to select** text box and select **OK**
|
|
|
|
|
1. Select **NDES server** from the **Group or users names** list. In the **Permissions for** section, select the **Allow** check box for the **Enroll** permission. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes aren't already cleared. Select **OK**
|
|
|
|
|
1. Select on the **Apply** to save changes and close the console.
|
|
|
|
|
|
|
|
|
|
### Create a Microsoft Entra joined Windows Hello for Business authentication certificate template
|
|
|
|
|
|
|
|
|
|
During Windows Hello for Business provisioning, Windows requests an authentication certificate from Microsoft Intune, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring the NDES Server.
|
|
|
|
|
|
|
|
|
|
Sign in a certificate authority or management workstations with _Domain Admin equivalent_ credentials.
|
|
|
|
|
Sign in a certificate authority or management workstations with *Domain Admin equivalent* credentials.
|
|
|
|
|
|
|
|
|
|
1. Open the **Certificate Authority** management console.
|
|
|
|
|
|
|
|
|
|
2. Right-click **Certificate Templates** and select **Manage**.
|
|
|
|
|
|
|
|
|
|
3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**.
|
|
|
|
|
|
|
|
|
|
4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certificate Recipient** list.
|
|
|
|
|
|
|
|
|
|
5. On the **General** tab, type **AADJ WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs.
|
|
|
|
|
1. Open the **Certificate Authority** management console
|
|
|
|
|
1. Right-click **Certificate Templates** and select **Manage**
|
|
|
|
|
1. Right-click the **Smartcard Logon** template and choose **Duplicate Template**
|
|
|
|
|
1. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certificate Recipient** list
|
|
|
|
|
1. On the **General** tab, type **ENTRA JOINED WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs.
|
|
|
|
|
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> If you use different template names, you'll need to remember and substitute these names in different portions of the deployment.
|
|
|
|
|
|
|
|
|
|
6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list.
|
|
|
|
|
|
|
|
|
|
7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**.
|
|
|
|
|
|
|
|
|
|
8. On the **Subject** tab, select **Supply in the request**.
|
|
|
|
|
|
|
|
|
|
9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**.
|
|
|
|
|
|
|
|
|
|
10. On the **Security** tab, select **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and select **OK**.
|
|
|
|
|
|
|
|
|
|
11. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for **Read** and **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes aren't already cleared. Select **OK**.
|
|
|
|
|
|
|
|
|
|
12. Close the console.
|
|
|
|
|
> If you use different template names, you'll need to remember and substitute these names in different portions of the deployment
|
|
|
|
|
1. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list
|
|
|
|
|
1. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**
|
|
|
|
|
1. On the **Subject** tab, select **Supply in the request**
|
|
|
|
|
1. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**
|
|
|
|
|
1. On the **Security** tab, select **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and select **OK**
|
|
|
|
|
1. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for **Read** and **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes aren't already cleared. Select **OK**
|
|
|
|
|
1. Close the console.
|
|
|
|
|
|
|
|
|
|
### Publish certificate templates
|
|
|
|
|
|
|
|
|
|
The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
|
|
|
|
|
|
|
|
|
|
> [!Important]
|
|
|
|
|
> Ensure you publish the **AADJ WHFB Authentication** certificate templates to the certificate authority that Microsoft Intune uses by way of the NDES servers. The NDES configuration asks you to choose a certificate authority from which it requests certificates. You need to publish that certificate templates to that issuing certificate authority. The **NDES-Intune Authentication** certificate is directly enrolled and can be published to any certificate authority.
|
|
|
|
|
> Ensure you publish the **ENTRA JOINED WHFB Authentication** certificate templates to the certificate authority that Microsoft Intune uses by way of the NDES servers. The NDES configuration asks you to choose a certificate authority from which it requests certificates. You need to publish that certificate templates to that issuing certificate authority. The **NDES-Intune Authentication** certificate is directly enrolled and can be published to any certificate authority.
|
|
|
|
|
|
|
|
|
|
Sign in to the certificate authority or management workstations with an _enterprise admin_ -equivalent credential.
|
|
|
|
|
Sign in to the certificate authority or management workstations with an *enterprise admin* -equivalent credential.
|
|
|
|
|
|
|
|
|
|
1. Open the **Certificate Authority** management console.
|
|
|
|
|
|
|
|
|
|
2. Expand the parent node from the navigation pane.
|
|
|
|
|
|
|
|
|
|
3. Select **Certificate Templates** in the navigation pane.
|
|
|
|
|
|
|
|
|
|
4. Right-click the **Certificate Templates** node. Select **New**, and select **Certificate Template** to issue.
|
|
|
|
|
|
|
|
|
|
5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certificate authority.
|
|
|
|
|
|
|
|
|
|
6. Close the console.
|
|
|
|
|
1. Open the **Certificate Authority** management console
|
|
|
|
|
1. Expand the parent node from the navigation pane
|
|
|
|
|
1. Select **Certificate Templates** in the navigation pane
|
|
|
|
|
1. Right-click the **Certificate Templates** node. Select **New**, and select **Certificate Template** to issue
|
|
|
|
|
1. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **ENTRA JOINED WHFB Authentication** templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certificate authority
|
|
|
|
|
1. Close the console.
|
|
|
|
|
|
|
|
|
|
## Install and Configure the NDES Role
|
|
|
|
|
|
|
|
|
|
@ -353,13 +300,11 @@ This section includes the following articles:
|
|
|
|
|
|
|
|
|
|
Install the Network Device Enrollment Service role on a computer other than the issuing certificate authority.
|
|
|
|
|
|
|
|
|
|
Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credential.
|
|
|
|
|
Sign-in to the certificate authority or management workstations with an *Enterprise Admin* equivalent credential.
|
|
|
|
|
|
|
|
|
|
1. Open **Server Manager** on the NDES server.
|
|
|
|
|
|
|
|
|
|
2. Select **Manage**. Select **Add Roles and Features**.
|
|
|
|
|
|
|
|
|
|
3. In the **Add Roles and Features Wizard**, on the **Before you begin** page, select **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Select **Next**. Select **Select a server from the server pool**. Select the local server from the **Server Pool** list. Select **Next**.
|
|
|
|
|
1. Open **Server Manager** on the NDES server
|
|
|
|
|
1. Select **Manage**. Select **Add Roles and Features**
|
|
|
|
|
1. In the **Add Roles and Features Wizard**, on the **Before you begin** page, select **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Select **Next**. Select **Select a server from the server pool**. Select the local server from the **Server Pool** list. Select **Next**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -379,9 +324,8 @@ Sign-in to the certificate authority or management workstations with an _Enterpr
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
7. Select **Next** on the **Web Server Role (IIS)** page.
|
|
|
|
|
|
|
|
|
|
8. On the **Select role services** page for the Web Serve role, Select the following additional services if they aren't already selected and then select **Next**.
|
|
|
|
|
7. Select **Next** on the **Web Server Role (IIS)** page
|
|
|
|
|
1. On the **Select role services** page for the Web Serve role, Select the following additional services if they aren't already selected and then select **Next**.
|
|
|
|
|
|
|
|
|
|
- **Web Server > Security > Request Filtering**
|
|
|
|
|
- **Web Server > Application Development > ASP.NET 3.5**.
|
|
|
|
|
@ -404,23 +348,19 @@ This task adds the NDES service account to the local IIS_USRS group. The task a
|
|
|
|
|
|
|
|
|
|
#### Add the NDES service account to the IIS_USRS group
|
|
|
|
|
|
|
|
|
|
Sign-in the NDES server with access equivalent to _local administrator_.
|
|
|
|
|
Sign-in the NDES server with access equivalent to *local administrator*.
|
|
|
|
|
|
|
|
|
|
1. Start the **Local Users and Groups** management console (`lusrmgr.msc`).
|
|
|
|
|
|
|
|
|
|
2. Select **Groups** from the navigation pane. Double-click the IIS_IUSRS group.
|
|
|
|
|
|
|
|
|
|
3. In the **IIS_IUSRS Properties** dialog box, select **Add**. Type **NDESSvc** or the name of your NDES service account. Select **Check Names** to verify the name and then select **OK**. Select **OK** to close the properties dialog box.
|
|
|
|
|
|
|
|
|
|
4. Close the management console.
|
|
|
|
|
1. Start the **Local Users and Groups** management console (`lusrmgr.msc`)
|
|
|
|
|
1. Select **Groups** from the navigation pane. Double-click the IIS_IUSRS group
|
|
|
|
|
1. In the **IIS_IUSRS Properties** dialog box, select **Add**. Type **NDESSvc** or the name of your NDES service account. Select **Check Names** to verify the name and then select **OK**. Select **OK** to close the properties dialog box
|
|
|
|
|
1. Close the management console.
|
|
|
|
|
|
|
|
|
|
#### Register a Service Principal Name on the NDES Service account
|
|
|
|
|
|
|
|
|
|
Sign-in the NDES server with access equivalent to _Domain Admins_.
|
|
|
|
|
Sign-in the NDES server with access equivalent to *Domain Admins*.
|
|
|
|
|
|
|
|
|
|
1. Open an elevated command prompt.
|
|
|
|
|
|
|
|
|
|
2. Type the following command to register the service principal name
|
|
|
|
|
1. Open an elevated command prompt
|
|
|
|
|
1. Type the following command to register the service principal name
|
|
|
|
|
|
|
|
|
|
```cmd
|
|
|
|
|
setspn -s http/[FqdnOfNdesServer] [DomainName\\NdesServiceAccount]
|
|
|
|
|
@ -441,33 +381,28 @@ Sign-in the NDES server with access equivalent to _Domain Admins_.
|
|
|
|
|
|
|
|
|
|
The NDES service enrolls certificates on behalf of users. Therefore, you want to limit the actions it can perform on behalf of the user. You do this through delegation.
|
|
|
|
|
|
|
|
|
|
Sign-in a domain controller with a minimum access equivalent to _Domain Admins_.
|
|
|
|
|
Sign-in a domain controller with a minimum access equivalent to *Domain Admins*.
|
|
|
|
|
|
|
|
|
|
1. Open **Active Directory Users and Computers**
|
|
|
|
|
|
|
|
|
|
2. Locate the NDES Service account (NDESSvc). Right-click and select **Properties**. Select the **Delegation** tab.
|
|
|
|
|
1. Locate the NDES Service account (NDESSvc). Right-click and select **Properties**. Select the **Delegation** tab.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
3. Select **Trust this user for delegation to specified services only**.
|
|
|
|
|
|
|
|
|
|
4. Select **Use any authentication protocol**.
|
|
|
|
|
|
|
|
|
|
5. Select **Add**.
|
|
|
|
|
|
|
|
|
|
6. Select **Users or Computers...** Type the name of the _NDES Server_ you use to issue Windows Hello for Business authentication certificates to Microsoft Entra joined devices. From the **Available services** list, select **HOST**. Select **OK**.
|
|
|
|
|
1. Select **Trust this user for delegation to specified services only**
|
|
|
|
|
1. Select **Use any authentication protocol**
|
|
|
|
|
1. Select **Add**
|
|
|
|
|
1. Select **Users or Computers...** Type the name of the *NDES Server* you use to issue Windows Hello for Business authentication certificates to Microsoft Entra joined devices. From the **Available services** list, select **HOST**. Select **OK**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
7. Repeat steps 5 and 6 for each NDES server using this service account. Select **Add**.
|
|
|
|
|
|
|
|
|
|
8. Select **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Microsoft Entra joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Select **OK**.
|
|
|
|
|
|
|
|
|
|
9. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates.
|
|
|
|
|
1. Repeat steps 5 and 6 for each NDES server using this service account. Select **Add**
|
|
|
|
|
1. Select **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Microsoft Entra joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Select **OK**
|
|
|
|
|
1. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
10. Select **OK**. Close **Active Directory Users and Computers**.
|
|
|
|
|
1. Select **OK**. Close **Active Directory Users and Computers**.
|
|
|
|
|
|
|
|
|
|
### Configure the NDES Role and Certificate Templates
|
|
|
|
|
|
|
|
|
|
@ -475,40 +410,37 @@ This task configures the NDES role and the certificate templates the NDES server
|
|
|
|
|
|
|
|
|
|
#### Configure the NDES Role
|
|
|
|
|
|
|
|
|
|
Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credential.
|
|
|
|
|
Sign-in to the certificate authority or management workstations with an *Enterprise Admin* equivalent credential.
|
|
|
|
|
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point.
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="Server Manager Post-Install Yellow flag." source="images/aadjcert/servermanager-post-ndes-yellowactionflag.png" lightbox="images/aadjcert/servermanager-post-ndes-yellowactionflag.png":::
|
|
|
|
|
|
|
|
|
|
1. Select the **Configure Active Directory Certificate Services on the destination server** link.
|
|
|
|
|
|
|
|
|
|
2. On the **Credentials** page, select **Next**.
|
|
|
|
|
1. Select the **Configure Active Directory Certificate Services on the destination server** link
|
|
|
|
|
1. On the **Credentials** page, select **Next**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
3. On the **Role Services** page, select **Network Device Enrollment Service** and then select **Next**
|
|
|
|
|
1. On the **Role Services** page, select **Network Device Enrollment Service** and then select **Next**
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Select **Select...**. Type the user name and password for the NDES service account in the **Windows Security** dialog box. Select **Next**.
|
|
|
|
|
1. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Select **Select...**. Type the user name and password for the NDES service account in the **Windows Security** dialog box. Select **Next**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
5. On the **CA for NDES** page, select **CA name**. Select **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Select **Next**.
|
|
|
|
|
1. On the **CA for NDES** page, select **CA name**. Select **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Select **Next**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
6. On the **RA Information**, select **Next**.
|
|
|
|
|
|
|
|
|
|
7. On the **Cryptography for NDES** page, select **Next**.
|
|
|
|
|
|
|
|
|
|
8. Review the **Confirmation** page. Select **Configure**.
|
|
|
|
|
1. On the **RA Information**, select **Next**
|
|
|
|
|
1. On the **Cryptography for NDES** page, select **Next**
|
|
|
|
|
1. Review the **Confirmation** page. Select **Configure**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
9. Select **Close** after the configuration completes.
|
|
|
|
|
1. Select **Close** after the configuration completes.
|
|
|
|
|
|
|
|
|
|
#### Configure Certificate Templates on NDES
|
|
|
|
|
|
|
|
|
|
@ -530,13 +462,11 @@ Ideally, you should match the certificate request with the registry value name t
|
|
|
|
|
|
|
|
|
|
If the need arises, you can configure a signature certificate in the encryption registry value name or an encryption certificate in the signature registry value to maximize the use of your NDES infrastructure. This unintuitive design requires current and accurate documentation of the configuration to ensure the SCEP certificate profile is configured to enroll the correct certificate, regardless of the actual purpose. Each organization needs to balance ease of configuration and administration with additional NDES infrastructure and the management overhead that comes with it.
|
|
|
|
|
|
|
|
|
|
Sign-in to the NDES Server with _local administrator_ equivalent credentials.
|
|
|
|
|
Sign-in to the NDES Server with *local administrator* equivalent credentials.
|
|
|
|
|
|
|
|
|
|
1. Open an elevated command prompt.
|
|
|
|
|
|
|
|
|
|
2. Using the table above, decide which registry value name you'll use to request Windows Hello for Business authentication certificates for Microsoft Entra joined devices.
|
|
|
|
|
|
|
|
|
|
3. Type the following command:
|
|
|
|
|
1. Open an elevated command prompt
|
|
|
|
|
1. Using the table above, decide which registry value name you'll use to request Windows Hello for Business authentication certificates for Microsoft Entra joined devices
|
|
|
|
|
1. Type the following command:
|
|
|
|
|
|
|
|
|
|
```cmd
|
|
|
|
|
reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v [registryValueName] /t REG_SZ /d [certificateTemplateName]
|
|
|
|
|
@ -545,12 +475,11 @@ Sign-in to the NDES Server with _local administrator_ equivalent credentials.
|
|
|
|
|
where **registryValueName** is one of the three value names from the above table and where **certificateTemplateName** is the name of the certificate template you created for Windows Hello for Business Microsoft Entra joined devices. Example:
|
|
|
|
|
|
|
|
|
|
```cmd
|
|
|
|
|
reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v SignatureTemplate /t REG_SZ /d AADJWHFBAuthentication
|
|
|
|
|
reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v SignatureTemplate /t REG_SZ /d ENTRAJOINEDWHFBAuthentication
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
4. Type **Y** when the command asks for permission to overwrite the existing value.
|
|
|
|
|
|
|
|
|
|
5. Close the command prompt.
|
|
|
|
|
1. Type **Y** when the command asks for permission to overwrite the existing value
|
|
|
|
|
1. Close the command prompt.
|
|
|
|
|
|
|
|
|
|
> [!IMPORTANT]
|
|
|
|
|
> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certificates Templates** management console (`certtmpl.msc`).
|
|
|
|
|
@ -567,88 +496,70 @@ Connector group automatically round-robin, load balance the Microsoft Entra appl
|
|
|
|
|
|
|
|
|
|
#### Download and Install the Application Proxy Connector Agent
|
|
|
|
|
|
|
|
|
|
Sign-in a workstation with access equivalent to a _domain user_.
|
|
|
|
|
Sign-in a workstation with access equivalent to a *domain user*.
|
|
|
|
|
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**.
|
|
|
|
|
|
|
|
|
|
2. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**.
|
|
|
|
|
|
|
|
|
|
3. Under **MANAGE**, select **Application proxy**.
|
|
|
|
|
|
|
|
|
|
4. Select **Download connector service**. Select **Accept terms & Download**. Save the file (AADApplicationProxyConnectorInstaller.exe) in a location accessible by others on the domain.
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**
|
|
|
|
|
1. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**
|
|
|
|
|
1. Under **MANAGE**, select **Application proxy**
|
|
|
|
|
1. Select **Download connector service**. Select **Accept terms & Download**. Save the file (AADApplicationProxyConnectorInstaller.exe) in a location accessible by others on the domain.
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="Azure Application Proxy Connectors." source="images/aadjcert/azureconsole-applicationproxy-connectors-empty.png" lightbox="images/aadjcert/azureconsole-applicationproxy-connectors-empty.png":::
|
|
|
|
|
|
|
|
|
|
5. Sign-in the computer that will run the connector with access equivalent to a _domain user_.
|
|
|
|
|
1. Sign-in the computer that will run the connector with access equivalent to a *domain user*.
|
|
|
|
|
|
|
|
|
|
> [!IMPORTANT]
|
|
|
|
|
> Install a minimum of two Microsoft Entra ID Proxy connectors for each NDES Application Proxy. Strategically locate Microsoft Entra application proxy connectors throughout your organization to ensure maximum availability. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers.
|
|
|
|
|
|
|
|
|
|
6. Start **AADApplicationProxyConnectorInstaller.exe**.
|
|
|
|
|
|
|
|
|
|
7. Read the license terms and then select **I agree to the license terms and conditions**. Select **Install**.
|
|
|
|
|
> Install a minimum of two Microsoft Entra ID Proxy connectors for each NDES Application Proxy. Strategically locate Microsoft Entra application proxy connectors throughout your organization to ensure maximum availability. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers
|
|
|
|
|
1. Start **AADApplicationProxyConnectorInstaller.exe**
|
|
|
|
|
1. Read the license terms and then select **I agree to the license terms and conditions**. Select **Install**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
8. Sign-in to Microsoft Azure with access equivalent to **Global Administrator**.
|
|
|
|
|
1. Sign-in to Microsoft Azure with access equivalent to **Global Administrator**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
9. When the installation completes. Read the information regarding outbound proxy servers. Select **Close**.
|
|
|
|
|
1. When the installation completes. Read the information regarding outbound proxy servers. Select **Close**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
10. Repeat steps 5 - 10 for each device that will run the Microsoft Entra application proxy connector for Windows Hello for Business certificate deployments.
|
|
|
|
|
1. Repeat steps 5 - 10 for each device that will run the Microsoft Entra application proxy connector for Windows Hello for Business certificate deployments.
|
|
|
|
|
|
|
|
|
|
#### Create a Connector Group
|
|
|
|
|
|
|
|
|
|
Sign-in a workstation with access equivalent to a _domain user_.
|
|
|
|
|
Sign-in a workstation with access equivalent to a *domain user*.
|
|
|
|
|
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**.
|
|
|
|
|
|
|
|
|
|
2. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**.
|
|
|
|
|
|
|
|
|
|
3. Under **MANAGE**, select **Application proxy**.
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**
|
|
|
|
|
1. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**
|
|
|
|
|
1. Under **MANAGE**, select **Application proxy**.
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="Azure Application Proxy Connector groups." source="images/aadjcert/azureconsole-applicationproxy-connectors-default.png" lightbox="images/aadjcert/azureconsole-applicationproxy-connectors-default.png":::
|
|
|
|
|
|
|
|
|
|
4. Select **New Connector Group**. Under **Name**, type **NDES WHFB Connectors**.
|
|
|
|
|
1. Select **New Connector Group**. Under **Name**, type **NDES WHFB Connectors**.
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="Azure Application New Connector Group." source="images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png" lightbox="images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png":::
|
|
|
|
|
|
|
|
|
|
5. Select each connector agent in the **Connectors** list that will service Windows Hello for Business certificate enrollment requests.
|
|
|
|
|
|
|
|
|
|
6. Select **Save**.
|
|
|
|
|
1. Select each connector agent in the **Connectors** list that will service Windows Hello for Business certificate enrollment requests
|
|
|
|
|
1. Select **Save**.
|
|
|
|
|
|
|
|
|
|
#### Create the Azure Application Proxy
|
|
|
|
|
|
|
|
|
|
Sign-in a workstation with access equivalent to a _domain user_.
|
|
|
|
|
Sign-in a workstation with access equivalent to a *domain user*.
|
|
|
|
|
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**.
|
|
|
|
|
|
|
|
|
|
2. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**.
|
|
|
|
|
|
|
|
|
|
3. Under **MANAGE**, select **Application proxy**.
|
|
|
|
|
|
|
|
|
|
4. Select **Configure an app**.
|
|
|
|
|
|
|
|
|
|
5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Microsoft Entra application proxy setting with the on-premises NDES server. Each NDES server must have its own Microsoft Entra application proxy as two NDES servers can't share the same internal URL.
|
|
|
|
|
|
|
|
|
|
6. Next to **Internal URL**, type the internal, fully qualified DNS name of the NDES server associated with this Microsoft Entra application proxy. For example, ```https://ndes.corp.mstepdemo.net```. You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**.
|
|
|
|
|
|
|
|
|
|
7. Under **Internal URL**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Microsoft Entra application proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Microsoft Entra application proxy. It's recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Microsoft Entra tenant name (-mstephendemo.msappproxy.net).
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**
|
|
|
|
|
1. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**
|
|
|
|
|
1. Under **MANAGE**, select **Application proxy**
|
|
|
|
|
1. Select **Configure an app**
|
|
|
|
|
1. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Microsoft Entra application proxy setting with the on-premises NDES server. Each NDES server must have its own Microsoft Entra application proxy as two NDES servers can't share the same internal URL
|
|
|
|
|
1. Next to **Internal URL**, type the internal, fully qualified DNS name of the NDES server associated with this Microsoft Entra application proxy. For example, ```https://ndes.corp.mstepdemo.net```. You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**
|
|
|
|
|
1. Under **Internal URL**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Microsoft Entra application proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Microsoft Entra application proxy. It's recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Microsoft Entra tenant name (-mstephendemo.msappproxy.net).
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="Azure NDES Application Proxy Configuration." source="images/aadjcert/azureconsole-appproxyconfig.png" lightbox="images/aadjcert/azureconsole-appproxyconfig.png":::
|
|
|
|
|
|
|
|
|
|
8. Select **Passthrough** from the **Pre Authentication** list.
|
|
|
|
|
|
|
|
|
|
9. Select **NDES WHFB Connectors** from the **Connector Group** list.
|
|
|
|
|
|
|
|
|
|
10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**.
|
|
|
|
|
|
|
|
|
|
11. Select **Add**.
|
|
|
|
|
|
|
|
|
|
12. Sign-out of the Azure portal.
|
|
|
|
|
1. Select **Passthrough** from the **Pre Authentication** list
|
|
|
|
|
1. Select **NDES WHFB Connectors** from the **Connector Group** list
|
|
|
|
|
1. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**
|
|
|
|
|
1. Select **Add**
|
|
|
|
|
1. Sign-out of the Azure portal.
|
|
|
|
|
|
|
|
|
|
> [!IMPORTANT]
|
|
|
|
|
> Write down the internal and external URLs. You will need this information when you enroll the NDES-Intune Authentication certificate.
|
|
|
|
|
@ -657,29 +568,21 @@ Sign-in a workstation with access equivalent to a _domain user_.
|
|
|
|
|
|
|
|
|
|
This task enrolls a client and server authentication certificate used by the Intune connector and the NDES server.
|
|
|
|
|
|
|
|
|
|
Sign-in the NDES server with access equivalent to _local administrators_.
|
|
|
|
|
Sign-in the NDES server with access equivalent to *local administrators*.
|
|
|
|
|
|
|
|
|
|
1. Start the Local Computer **Certificate Manager** (certlm.msc).
|
|
|
|
|
|
|
|
|
|
2. Expand the **Personal** node in the navigation pane.
|
|
|
|
|
|
|
|
|
|
3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**.
|
|
|
|
|
|
|
|
|
|
4. Select **Next** on the **Before You Begin** page.
|
|
|
|
|
|
|
|
|
|
5. Select **Next** on the **Select Certificate Enrollment Policy** page.
|
|
|
|
|
|
|
|
|
|
6. On the **Request Certificates** page, Select the **NDES-Intune Authentication** check box.
|
|
|
|
|
|
|
|
|
|
7. Select the **More information is required to enroll for this certificate. Click here to configure settings** link
|
|
|
|
|
1. Start the Local Computer **Certificate Manager** (certlm.msc)
|
|
|
|
|
1. Expand the **Personal** node in the navigation pane
|
|
|
|
|
1. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**
|
|
|
|
|
1. Select **Next** on the **Before You Begin** page
|
|
|
|
|
1. Select **Next** on the **Select Certificate Enrollment Policy** page
|
|
|
|
|
1. On the **Request Certificates** page, Select the **NDES-Intune Authentication** check box
|
|
|
|
|
1. Select the **More information is required to enroll for this certificate. Click here to configure settings** link
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
8. Under **Subject name**, select **Common Name** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**) and then select **Add**.
|
|
|
|
|
|
|
|
|
|
9. Under **Alternative name**, select **DNS** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**). Select **Add**. Type the external URL used in the previous task (without the https://, for example **ndes-mstephendemo.msappproxy.net**). Select **Add**. Select **OK** when finished.
|
|
|
|
|
|
|
|
|
|
10. Select **Enroll**
|
|
|
|
|
1. Under **Subject name**, select **Common Name** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**) and then select **Add**
|
|
|
|
|
1. Under **Alternative name**, select **DNS** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**). Select **Add**. Type the external URL used in the previous task (without the https://, for example **ndes-mstephendemo.msappproxy.net**). Select **Add**. Select **OK** when finished
|
|
|
|
|
1. Select **Enroll**
|
|
|
|
|
|
|
|
|
|
11. Repeat these steps for all NDES Servers used to request Windows Hello for Business authentication certificates for Microsoft Entra joined devices.
|
|
|
|
|
|
|
|
|
|
@ -687,51 +590,43 @@ Sign-in the NDES server with access equivalent to _local administrators_.
|
|
|
|
|
|
|
|
|
|
This task configures the Web Server role on the NDES server to use the server authentication certificate.
|
|
|
|
|
|
|
|
|
|
Sign-in the NDES server with access equivalent to _local administrator_.
|
|
|
|
|
Sign-in the NDES server with access equivalent to *local administrator*.
|
|
|
|
|
|
|
|
|
|
1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**.
|
|
|
|
|
|
|
|
|
|
2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**.
|
|
|
|
|
1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**
|
|
|
|
|
1. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**.
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="NDES IIS Console" source="images/aadjcert/ndes-iis-console.png" lightbox="images/aadjcert/ndes-iis-console.png":::
|
|
|
|
|
|
|
|
|
|
3. Select **Bindings...** under **Actions**. Select **Add**.
|
|
|
|
|
1. Select **Bindings...** under **Actions**. Select **Add**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
4. Select **https** from **Type**. Confirm the value for **Port** is **443**.
|
|
|
|
|
|
|
|
|
|
5. Select the certificate you previously enrolled from the **SSL certificate** list. Select **OK**.
|
|
|
|
|
1. Select **https** from **Type**. Confirm the value for **Port** is **443**
|
|
|
|
|
1. Select the certificate you previously enrolled from the **SSL certificate** list. Select **OK**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
6. Select **http** from the **Site Bindings** list. Select **Remove**.
|
|
|
|
|
|
|
|
|
|
7. Select **Close** on the **Site Bindings** dialog box.
|
|
|
|
|
|
|
|
|
|
8. Close **Internet Information Services (IIS) Manager**.
|
|
|
|
|
1. Select **http** from the **Site Bindings** list. Select **Remove**
|
|
|
|
|
1. Select **Close** on the **Site Bindings** dialog box
|
|
|
|
|
1. Close **Internet Information Services (IIS) Manager**.
|
|
|
|
|
|
|
|
|
|
### Verify the configuration
|
|
|
|
|
|
|
|
|
|
This task confirms the TLS configuration for the NDES server.
|
|
|
|
|
|
|
|
|
|
Sign-in the NDES server with access equivalent to _local administrator_.
|
|
|
|
|
Sign-in the NDES server with access equivalent to *local administrator*.
|
|
|
|
|
|
|
|
|
|
#### Disable Internet Explorer Enhanced Security Configuration
|
|
|
|
|
|
|
|
|
|
1. Open **Server Manager**. Select **Local Server** from the navigation pane.
|
|
|
|
|
|
|
|
|
|
2. Select **On** next to **IE Enhanced Security Configuration** in the **Properties** section.
|
|
|
|
|
|
|
|
|
|
3. In the **Internet Explorer Enhanced Security Configuration** dialog, under **Administrators**, select **Off**. Select **OK**.
|
|
|
|
|
|
|
|
|
|
4. Close **Server Manager**.
|
|
|
|
|
1. Open **Server Manager**. Select **Local Server** from the navigation pane
|
|
|
|
|
1. Select **On** next to **IE Enhanced Security Configuration** in the **Properties** section
|
|
|
|
|
1. In the **Internet Explorer Enhanced Security Configuration** dialog, under **Administrators**, select **Off**. Select **OK**
|
|
|
|
|
1. Close **Server Manager**.
|
|
|
|
|
|
|
|
|
|
#### Test the NDES web server
|
|
|
|
|
|
|
|
|
|
1. Open **Internet Explorer**.
|
|
|
|
|
|
|
|
|
|
2. In the navigation bar, type
|
|
|
|
|
1. Open **Internet Explorer**
|
|
|
|
|
1. In the navigation bar, type
|
|
|
|
|
|
|
|
|
|
```https
|
|
|
|
|
https://[fqdnHostName]/certsrv/mscep/mscep.dll
|
|
|
|
|
@ -755,44 +650,35 @@ You have successfully configured the Network Device Enrollment Services. You mu
|
|
|
|
|
|
|
|
|
|
### Configure NDES and HTTP to support long URLs
|
|
|
|
|
|
|
|
|
|
Sign-in the NDES server with access equivalent to _local administrator_.
|
|
|
|
|
Sign-in the NDES server with access equivalent to *local administrator*.
|
|
|
|
|
|
|
|
|
|
#### Configure the Default Web Site
|
|
|
|
|
|
|
|
|
|
1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**.
|
|
|
|
|
|
|
|
|
|
2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**.
|
|
|
|
|
|
|
|
|
|
3. In the content pane, double-click **Request Filtering**. Select **Edit Feature Settings...** in the action pane.
|
|
|
|
|
1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**
|
|
|
|
|
1. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**
|
|
|
|
|
1. In the content pane, double-click **Request Filtering**. Select **Edit Feature Settings...** in the action pane
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="Intune NDES Request filtering." source="images/aadjcert/NDES-IIS-RequestFiltering.png" lightbox="images/aadjcert/NDES-IIS-RequestFiltering.png":::
|
|
|
|
|
|
|
|
|
|
4. Select **Allow unlisted file name extensions**.
|
|
|
|
|
|
|
|
|
|
5. Select **Allow unlisted verbs**.
|
|
|
|
|
|
|
|
|
|
6. Select **Allow high-bit characters**.
|
|
|
|
|
|
|
|
|
|
7. Type **30000000** in **Maximum allowed content length (Bytes)**.
|
|
|
|
|
|
|
|
|
|
8. Type **65534** in **Maximum URL length (Bytes)**.
|
|
|
|
|
|
|
|
|
|
9. Type **65534** in **Maximum query string (Bytes)**.
|
|
|
|
|
|
|
|
|
|
10. Select **OK**. Close **Internet Information Services (IIS) Manager**.
|
|
|
|
|
1. Select **Allow unlisted file name extensions**
|
|
|
|
|
1. Select **Allow unlisted verbs**
|
|
|
|
|
1. Select **Allow high-bit characters**
|
|
|
|
|
1. Type **30000000** in **Maximum allowed content length (Bytes)**
|
|
|
|
|
1. Type **65534** in **Maximum URL length (Bytes)**
|
|
|
|
|
1. Type **65534** in **Maximum query string (Bytes)**
|
|
|
|
|
1. Select **OK**. Close **Internet Information Services (IIS) Manager**
|
|
|
|
|
|
|
|
|
|
#### Configure Parameters for HTTP.SYS
|
|
|
|
|
|
|
|
|
|
1. Open an elevated command prompt.
|
|
|
|
|
|
|
|
|
|
2. Run the following commands:
|
|
|
|
|
1. Open an elevated command prompt
|
|
|
|
|
1. Run the following commands:
|
|
|
|
|
|
|
|
|
|
```cmd
|
|
|
|
|
reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxFieldLength /t REG_DWORD /d 65534
|
|
|
|
|
reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxRequestBytes /t REG_DWORD /d 65534
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
3. Restart the NDES server.
|
|
|
|
|
1. Restart the NDES server
|
|
|
|
|
|
|
|
|
|
## Download, Install and Configure the Intune Certificate Connector
|
|
|
|
|
|
|
|
|
|
@ -804,119 +690,80 @@ To learn how to download, install, and configure the Intune Certificate Connecto
|
|
|
|
|
|
|
|
|
|
Optionally (not required), you can configure the Intune connector for certificate revocation when a device is wiped, unenrolled, or when the certificate profile falls out of scope for the targeted user (users are removed, deleted, or the profile is deleted). You need to select the **Certificate revocation** option during the connector configuration to enable automatic certificate revocation for certificates issued from a Microsoft Active Directory Certification Authority. Additionally, you need to enable the NDES Service account for revocation.
|
|
|
|
|
|
|
|
|
|
1. Sign in the certificate authority used by the NDES Connector with access equivalent to _domain administrator_.
|
|
|
|
|
|
|
|
|
|
2. Start the **Certification Authority** management console.
|
|
|
|
|
|
|
|
|
|
3. In the navigation pane, right-click the name of the certificate authority and select **Properties**.
|
|
|
|
|
|
|
|
|
|
4. Select the **Security** tab, then select **Add**. In the **Enter the object names to select** box, enter **NDESSvc** (or the name you gave the NDES Service account). Select *Check Names*, then select **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Select **OK**.
|
|
|
|
|
1. Sign in the certificate authority used by the NDES Connector with access equivalent to *domain administrator*
|
|
|
|
|
1. Start the **Certification Authority** management console
|
|
|
|
|
1. In the navigation pane, right-click the name of the certificate authority and select **Properties**
|
|
|
|
|
1. Select the **Security** tab, then select **Add**. In the **Enter the object names to select** box, enter **NDESSvc** (or the name you gave the NDES Service account). Select **Check Names**, then select **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Select **OK**
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
5. Close the **Certification Authority**.
|
|
|
|
|
1. Close the **Certification Authority**
|
|
|
|
|
|
|
|
|
|
## Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile
|
|
|
|
|
|
|
|
|
|
### Create an AADJ WHFB Certificate Users Group
|
|
|
|
|
### Create an ENTRA JOINED WHFB Certificate Users Group
|
|
|
|
|
|
|
|
|
|
Sign-in a workstation with access equivalent to a _domain user_.
|
|
|
|
|
Sign-in a workstation with access equivalent to a *domain user*.
|
|
|
|
|
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**.
|
|
|
|
|
|
|
|
|
|
2. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**.
|
|
|
|
|
|
|
|
|
|
3. Select **Groups**. Select **New group**.
|
|
|
|
|
|
|
|
|
|
4. Select **Security** from the **Group type** list.
|
|
|
|
|
|
|
|
|
|
5. Under **Group Name**, type the name of the group. For example, **AADJ WHFB Certificate Users**.
|
|
|
|
|
|
|
|
|
|
6. Provide a **Group description**, if applicable.
|
|
|
|
|
|
|
|
|
|
7. Select **Assigned** from the **Membership type** list.
|
|
|
|
|
1. Sign-in to the [Azure portal](https://portal.azure.com/) with access equivalent to **Global Administrator**
|
|
|
|
|
1. Select **All Services**. Type **Microsoft Entra ID** to filter the list of services. Under **SERVICES**, select **Microsoft Entra ID**
|
|
|
|
|
1. Select **Groups**. Select **New group**
|
|
|
|
|
1. Select **Security** from the **Group type** list
|
|
|
|
|
1. Under **Group Name**, type the name of the group. For example, **ENTRA JOINED WHFB Certificate Users**
|
|
|
|
|
1. Provide a **Group description**, if applicable
|
|
|
|
|
1. Select **Assigned** from the **Membership type** list.
|
|
|
|
|
|
|
|
|
|
:::image type="content" alt-text="Microsoft Entra new group creation." source="images/aadjcert/azureadcreatewhfbcertgroup.png" lightbox="images/aadjcert/azureadcreatewhfbcertgroup.png":::
|
|
|
|
|
|
|
|
|
|
8. Select **Members**. Use the **Select members** pane to add members to this group. When finished, select **Select**.
|
|
|
|
|
|
|
|
|
|
9. Select **Create**.
|
|
|
|
|
1. Select **Members**. Use the **Select members** pane to add members to this group. When finished, select **Select**
|
|
|
|
|
1. Select **Create**.
|
|
|
|
|
|
|
|
|
|
### Create a SCEP Certificate Profile
|
|
|
|
|
|
|
|
|
|
Sign-in a workstation with access equivalent to a _domain user_.
|
|
|
|
|
|
|
|
|
|
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
|
|
|
|
|
|
|
|
|
2. Select **Devices**, and then select **Configuration Profiles**.
|
|
|
|
|
|
|
|
|
|
3. Select **Create Profile**.
|
|
|
|
|
Sign-in a workstation with access equivalent to a *domain user*.
|
|
|
|
|
|
|
|
|
|
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)
|
|
|
|
|
1. Select **Devices**, and then select **Configuration Profiles**
|
|
|
|
|
1. Select **Create Profile**.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
4. Select **Windows 10 and later** from the **Platform** list.
|
|
|
|
|
|
|
|
|
|
5. Choose **SCEP certificate** from the **Profile** list, and select **Create**.
|
|
|
|
|
|
|
|
|
|
6. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**.
|
|
|
|
|
|
|
|
|
|
7. Next to **Description**, provide a description meaningful for your environment, then select **Next**.
|
|
|
|
|
|
|
|
|
|
8. Select **User** as a certificate type.
|
|
|
|
|
|
|
|
|
|
9. Configure **Certificate validity period** to match your organization.
|
|
|
|
|
|
|
|
|
|
1. Select **Windows 10 and later** from the **Platform** list
|
|
|
|
|
1. Choose **SCEP certificate** from the **Profile** list, and select **Create**
|
|
|
|
|
1. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**
|
|
|
|
|
1. Next to **Description**, provide a description meaningful for your environment, then select **Next**
|
|
|
|
|
1. Select **User** as a certificate type
|
|
|
|
|
1. Configure **Certificate validity period** to match your organization.
|
|
|
|
|
> [!IMPORTANT]
|
|
|
|
|
> Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity.
|
|
|
|
|
|
|
|
|
|
10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list.
|
|
|
|
|
|
|
|
|
|
11. Next to **Subject name format**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate.
|
|
|
|
|
|
|
|
|
|
> Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity
|
|
|
|
|
1. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list
|
|
|
|
|
1. Next to **Subject name format**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> If the distinguished name contains special characters like a plus sign ("+"), comma (","), semicolon (";"), or equal sign ("="), the bracketed name must be enclosed in quotation marks: `CN="{{OnPrem_Distinguished_Name}}"`.
|
|
|
|
|
>
|
|
|
|
|
> If the length of the distinguished name is more than 64 characters, the name length enforcement on the Certification Authority [must be disabled](/previous-versions/windows/it-pro/windows-server-2003/cc784789(v=ws.10)?#disable-dn-length-enforcement).
|
|
|
|
|
|
|
|
|
|
12. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** parameter. Set its value as {{UserPrincipalName}}.
|
|
|
|
|
|
|
|
|
|
13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to the configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**.
|
|
|
|
|
|
|
|
|
|
14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile.
|
|
|
|
|
|
|
|
|
|
15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Select **Add**.
|
|
|
|
|
|
|
|
|
|
16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**.
|
|
|
|
|
|
|
|
|
|
1. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** parameter. Set its value as {{UserPrincipalName}}
|
|
|
|
|
1. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **ENTRA JOINED WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to the configured NDES template in the registry. In this example, the **ENTRA JOINED WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**
|
|
|
|
|
1. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile
|
|
|
|
|
1. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Select **Add**
|
|
|
|
|
1. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**
|
|
|
|
|
:::image type="content" alt-text="WHFB SCEP certificate Profile EKUs." source="images/aadjcert/profile03.png" lightbox="images/aadjcert/profile03.png":::
|
|
|
|
|
|
|
|
|
|
17. Under **SCEP Server URLs**, type the fully qualified external name of the Microsoft Entra application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, ```https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll```. Select **Add**. Repeat this step for each additional NDES Microsoft Entra application proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile.
|
|
|
|
|
|
|
|
|
|
18. Select **Next**.
|
|
|
|
|
|
|
|
|
|
19. Select **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and select **Create**.
|
|
|
|
|
1. Under **SCEP Server URLs**, type the fully qualified external name of the Microsoft Entra application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, ```https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll```. Select **Add**. Repeat this step for each additional NDES Microsoft Entra application proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile
|
|
|
|
|
1. Select **Next**
|
|
|
|
|
1. Select **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and select **Create**
|
|
|
|
|
|
|
|
|
|
### Assign Group to the WHFB Certificate Enrollment Certificate Profile
|
|
|
|
|
|
|
|
|
|
Sign-in a workstation with access equivalent to a _domain user_.
|
|
|
|
|
|
|
|
|
|
1. Sign-in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
|
|
|
|
|
|
|
|
|
2. Select **Devices**, and then select **Configuration Profiles**.
|
|
|
|
|
|
|
|
|
|
3. Select **WHFB Certificate Enrollment**.
|
|
|
|
|
|
|
|
|
|
4. Select **Properties**, and then select **Edit** next to the **Assignments** section.
|
|
|
|
|
|
|
|
|
|
5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Select **Select groups to include**.
|
|
|
|
|
Sign-in a workstation with access equivalent to a *domain user*.
|
|
|
|
|
|
|
|
|
|
1. Sign-in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431)
|
|
|
|
|
1. Select **Devices**, and then select **Configuration Profiles**
|
|
|
|
|
1. Select **WHFB Certificate Enrollment**
|
|
|
|
|
1. Select **Properties**, and then select **Edit** next to the **Assignments** section
|
|
|
|
|
1. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Select **Select groups to include**.
|
|
|
|
|
:::image type="content" alt-text="WHFB SCEP Profile Assignment." source="images/aadjcert/profile04.png" lightbox="images/aadjcert/profile04.png":::
|
|
|
|
|
1. Select the **ENTRA JOINED WHFB Certificate Users** group. Select **Select**
|
|
|
|
|
1. Select **Review + Save**, and then **Save**
|
|
|
|
|
|
|
|
|
|
6. Select the **AADJ WHFB Certificate Users** group. Select **Select**.
|
|
|
|
|
|
|
|
|
|
7. Select **Review + Save**, and then **Save**.
|
|
|
|
|
|
|
|
|
|
You have successfully completed the configuration. Add users that need to enroll a Windows Hello for Business authentication certificate to the **AADJ WHFB Certificate Users** group. This group, combined with the device enrollment Windows Hello for Business configuration prompts the user to enroll for Windows Hello for Business and enroll a certificate that can be used to authentication to on-premises resources.
|
|
|
|
|
You have successfully completed the configuration. Add users that need to enroll a Windows Hello for Business authentication certificate to the **ENTRA JOINED WHFB Certificate Users** group. This group, combined with the device enrollment Windows Hello for Business configuration prompts the user to enroll for Windows Hello for Business and enroll a certificate that can be used to authentication to on-premises resources.
|
|
|
|
|
|
|
|
|
|
> [!NOTE]
|
|
|
|
|
> The Passport for Work configuration service provider (CSP) which is used to manage Windows Hello for Business with Mobile Device Management (MDM) contains a policy called UseCertificateForOnPremAuth. This policy is not needed when deploying certificates to Windows Hello for Business users through the instructions outlined in this document and should not be configured. Devices managed with MDM where UseCertificateForOnPremAuth is enabled will fail a prerequisite check for Windows Hello for Business provisioning. This failure will block users from setting up Windows Hello for Business if they don't already have it configured.
|
|
|
|
|
|
Paolo Matarazzo
