mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 14:57:23 +00:00
Update with link + remove tab for 4 spaces.
This commit is contained in:
Jose Ortega
parent
66b42606d0
commit
c9dc397380
@ -28,6 +28,9 @@ Your environment is federated and you are ready to configure device registration
|
|||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment.
|
> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment.
|
||||||
|
|
||||||
|
>[!IMPORTANT]
|
||||||
|
> The identity team has simpolified the join flow for Azure AD device registration, the tutorial can be found [here](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-federated-domains).
|
||||||
|
|
||||||
Use this three-phased approach for configuring device registration.
|
Use this three-phased approach for configuring device registration.
|
||||||
1. [Configure devices to register in Azure](#configure-azure-for-device-registration)
|
1. [Configure devices to register in Azure](#configure-azure-for-device-registration)
|
||||||
2. [Synchronize devices to on-premises Active Directory](#configure-active-directory-to-support-azure-device-synchronization)
|
2. [Synchronize devices to on-premises Active Directory](#configure-active-directory-to-support-azure-device-synchronization)
|
||||||
@ -121,9 +124,9 @@ If your AD FS farm is not already configured for Device Authentication (you can
|
|||||||
|
|
||||||
|
|
||||||
2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands:
|
2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands:
|
||||||
|
|
||||||
`Import-module activedirectory`
|
`Import-module activedirectory`
|
||||||
`PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "<your service account>" `
|
`PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "<your service account>" `
|
||||||
3. On the pop-up window click **Yes**.
|
3. On the pop-up window click **Yes**.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
@ -147,8 +150,8 @@ The above PSH creates the following objects:
|
|||||||
### Create Service Connection Point (SCP) in Active Directory
|
### Create Service Connection Point (SCP) in Active Directory
|
||||||
If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS
|
If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS
|
||||||
1. Open Windows PowerShell and execute the following:
|
1. Open Windows PowerShell and execute the following:
|
||||||
|
|
||||||
`PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" `
|
`PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" `
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep
|
> If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep
|
||||||
@ -157,13 +160,13 @@ If you plan to use Windows 10 domain join (with automatic registration to Azure
|
|||||||
|
|
||||||
2. Provide your Azure AD global administrator credentials
|
2. Provide your Azure AD global administrator credentials
|
||||||
|
|
||||||
`PS C:>$aadAdminCred = Get-Credential`
|
`PS C:>$aadAdminCred = Get-Credential`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. Run the following PowerShell command
|
3. Run the following PowerShell command
|
||||||
|
|
||||||
`PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred `
|
`PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred `
|
||||||
|
|
||||||
Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory.
|
Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory.
|
||||||
|
|
||||||
@ -174,7 +177,7 @@ To ensure AD DS objects and containers are in the correct state for write back o
|
|||||||
|
|
||||||
1. Open Windows PowerShell and execute the following:
|
1. Open Windows PowerShell and execute the following:
|
||||||
|
|
||||||
`PS C:>Initialize-ADSyncDeviceWriteBack -DomainName <AD DS domain name> -AdConnectorAccount [AD connector account name] `
|
`PS C:>Initialize-ADSyncDeviceWriteBack -DomainName <AD DS domain name> -AdConnectorAccount [AD connector account name] `
|
||||||
|
|
||||||
Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format
|
Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format
|
||||||
|
|
||||||
@ -227,100 +230,100 @@ The definition helps you to verify whether the values are present or if you need
|
|||||||
|
|
||||||
**`http://schemas.microsoft.com/ws/2012/01/accounttype`** - This claim must contain a value of **DJ**, which identifies the device as a domain-joined computer. In AD FS, you can add an issuance transform rule that looks like this:
|
**`http://schemas.microsoft.com/ws/2012/01/accounttype`** - This claim must contain a value of **DJ**, which identifies the device as a domain-joined computer. In AD FS, you can add an issuance transform rule that looks like this:
|
||||||
|
|
||||||
@RuleName = "Issue account type for domain-joined computers"
|
@RuleName = "Issue account type for domain-joined computers"
|
||||||
c:[
|
c:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value = "DJ"
|
Value = "DJ"
|
||||||
);
|
);
|
||||||
|
|
||||||
#### Issue objectGUID of the computer account on-premises
|
#### Issue objectGUID of the computer account on-premises
|
||||||
|
|
||||||
**`http://schemas.microsoft.com/identity/claims/onpremobjectguid`** - This claim must contain the **objectGUID** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this:
|
**`http://schemas.microsoft.com/identity/claims/onpremobjectguid`** - This claim must contain the **objectGUID** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this:
|
||||||
|
|
||||||
@RuleName = "Issue object GUID for domain-joined computers"
|
@RuleName = "Issue object GUID for domain-joined computers"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
store = "Active Directory",
|
store = "Active Directory",
|
||||||
types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
|
types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
|
||||||
query = ";objectguid;{0}",
|
query = ";objectguid;{0}",
|
||||||
param = c2.Value
|
param = c2.Value
|
||||||
);
|
);
|
||||||
|
|
||||||
#### Issue objectSID of the computer account on-premises
|
#### Issue objectSID of the computer account on-premises
|
||||||
|
|
||||||
**`http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid`** - This claim must contain the **objectSid** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this:
|
**`http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid`** - This claim must contain the **objectSid** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this:
|
||||||
|
|
||||||
@RuleName = "Issue objectSID for domain-joined computers"
|
@RuleName = "Issue objectSID for domain-joined computers"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(claim = c2);
|
=> issue(claim = c2);
|
||||||
|
|
||||||
#### Issue issuerID for computer when multiple verified domain names in Azure AD
|
#### Issue issuerID for computer when multiple verified domain names in Azure AD
|
||||||
|
|
||||||
**`http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid`** - This claim must contain the Uniform Resource Identifier (URI) of any of the verified domain names that connect with the on-premises federation service (AD FS or 3rd party) issuing the token. In AD FS, you can add issuance transform rules that look like the ones below in that specific order after the ones above. Please note that one rule to explicitly issue the rule for users is necessary. In the rules below, a first rule identifying user vs. computer authentication is added.
|
**`http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid`** - This claim must contain the Uniform Resource Identifier (URI) of any of the verified domain names that connect with the on-premises federation service (AD FS or 3rd party) issuing the token. In AD FS, you can add issuance transform rules that look like the ones below in that specific order after the ones above. Please note that one rule to explicitly issue the rule for users is necessary. In the rules below, a first rule identifying user vs. computer authentication is added.
|
||||||
|
|
||||||
@RuleName = "Issue account type with the value User when it's not a computer"
|
@RuleName = "Issue account type with the value User when it's not a computer"
|
||||||
NOT EXISTS(
|
NOT EXISTS(
|
||||||
[
|
[
|
||||||
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value == "DJ"
|
Value == "DJ"
|
||||||
]
|
]
|
||||||
)
|
)
|
||||||
=> add(
|
=> add(
|
||||||
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value = "User"
|
Value = "User"
|
||||||
);
|
);
|
||||||
|
|
||||||
@RuleName = "Capture UPN when AccountType is User and issue the IssuerID"
|
@RuleName = "Capture UPN when AccountType is User and issue the IssuerID"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.xmlsoap.org/claims/UPN"
|
Type == "http://schemas.xmlsoap.org/claims/UPN"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value == "User"
|
Value == "User"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
||||||
Value = regexreplace(
|
Value = regexreplace(
|
||||||
c1.Value,
|
c1.Value,
|
||||||
".+@(?<domain>.+)",
|
".+@(?<domain>.+)",
|
||||||
"http://${domain}/adfs/services/trust/"
|
"http://${domain}/adfs/services/trust/"
|
||||||
)
|
)
|
||||||
);
|
);
|
||||||
|
|
||||||
@RuleName = "Issue issuerID for domain-joined computers"
|
@RuleName = "Issue issuerID for domain-joined computers"
|
||||||
c:[
|
c:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
||||||
Value = "http://<verified-domain-name>/adfs/services/trust/"
|
Value = "http://<verified-domain-name>/adfs/services/trust/"
|
||||||
);
|
);
|
||||||
|
|
||||||
|
|
||||||
In the claim above,
|
In the claim above,
|
||||||
@ -335,146 +338,146 @@ To get a list of your verified company domains, you can use the [Get-MsolDomain]
|
|||||||
|
|
||||||
**`http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID`** - This claim must contain a valid value for computers. In AD FS, you can create an issuance transform rule as follows:
|
**`http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID`** - This claim must contain a valid value for computers. In AD FS, you can create an issuance transform rule as follows:
|
||||||
|
|
||||||
@RuleName = "Issue ImmutableID for computers"
|
@RuleName = "Issue ImmutableID for computers"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
store = "Active Directory",
|
store = "Active Directory",
|
||||||
types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
|
types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
|
||||||
query = ";objectguid;{0}",
|
query = ";objectguid;{0}",
|
||||||
param = c2.Value
|
param = c2.Value
|
||||||
);
|
);
|
||||||
|
|
||||||
#### Helper script to create the AD FS issuance transform rules
|
#### Helper script to create the AD FS issuance transform rules
|
||||||
|
|
||||||
The following script helps you with the creation of the issuance transform rules described above.
|
The following script helps you with the creation of the issuance transform rules described above.
|
||||||
|
|
||||||
$multipleVerifiedDomainNames = $false
|
$multipleVerifiedDomainNames = $false
|
||||||
$immutableIDAlreadyIssuedforUsers = $false
|
$immutableIDAlreadyIssuedforUsers = $false
|
||||||
$oneOfVerifiedDomainNames = 'example.com' # Replace example.com with one of your verified domains
|
$oneOfVerifiedDomainNames = 'example.com' # Replace example.com with one of your verified domains
|
||||||
|
|
||||||
$rule1 = '@RuleName = "Issue account type for domain-joined computers"
|
$rule1 = '@RuleName = "Issue account type for domain-joined computers"
|
||||||
c:[
|
c:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value = "DJ"
|
Value = "DJ"
|
||||||
);'
|
);'
|
||||||
|
|
||||||
$rule2 = '@RuleName = "Issue object GUID for domain-joined computers"
|
$rule2 = '@RuleName = "Issue object GUID for domain-joined computers"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
store = "Active Directory",
|
store = "Active Directory",
|
||||||
types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
|
types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
|
||||||
query = ";objectguid;{0}",
|
query = ";objectguid;{0}",
|
||||||
param = c2.Value
|
param = c2.Value
|
||||||
);'
|
);'
|
||||||
|
|
||||||
$rule3 = '@RuleName = "Issue objectSID for domain-joined computers"
|
$rule3 = '@RuleName = "Issue objectSID for domain-joined computers"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(claim = c2);'
|
=> issue(claim = c2);'
|
||||||
|
|
||||||
$rule4 = ''
|
$rule4 = ''
|
||||||
if ($multipleVerifiedDomainNames -eq $true) {
|
if ($multipleVerifiedDomainNames -eq $true) {
|
||||||
$rule4 = '@RuleName = "Issue account type with the value User when it is not a computer"
|
$rule4 = '@RuleName = "Issue account type with the value User when it is not a computer"
|
||||||
NOT EXISTS(
|
NOT EXISTS(
|
||||||
[
|
[
|
||||||
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value == "DJ"
|
Value == "DJ"
|
||||||
]
|
]
|
||||||
)
|
)
|
||||||
=> add(
|
=> add(
|
||||||
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value = "User"
|
Value = "User"
|
||||||
);
|
);
|
||||||
|
|
||||||
@RuleName = "Capture UPN when AccountType is User and issue the IssuerID"
|
@RuleName = "Capture UPN when AccountType is User and issue the IssuerID"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.xmlsoap.org/claims/UPN"
|
Type == "http://schemas.xmlsoap.org/claims/UPN"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
|
||||||
Value == "User"
|
Value == "User"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
||||||
Value = regexreplace(
|
Value = regexreplace(
|
||||||
c1.Value,
|
c1.Value,
|
||||||
".+@(?<domain>.+)",
|
".+@(?<domain>.+)",
|
||||||
"http://${domain}/adfs/services/trust/"
|
"http://${domain}/adfs/services/trust/"
|
||||||
)
|
)
|
||||||
);
|
);
|
||||||
|
|
||||||
@RuleName = "Issue issuerID for domain-joined computers"
|
@RuleName = "Issue issuerID for domain-joined computers"
|
||||||
c:[
|
c:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
|
||||||
Value = "http://' + $oneOfVerifiedDomainNames + '/adfs/services/trust/"
|
Value = "http://' + $oneOfVerifiedDomainNames + '/adfs/services/trust/"
|
||||||
);'
|
);'
|
||||||
}
|
}
|
||||||
|
|
||||||
$rule5 = ''
|
$rule5 = ''
|
||||||
if ($immutableIDAlreadyIssuedforUsers -eq $true) {
|
if ($immutableIDAlreadyIssuedforUsers -eq $true) {
|
||||||
$rule5 = '@RuleName = "Issue ImmutableID for computers"
|
$rule5 = '@RuleName = "Issue ImmutableID for computers"
|
||||||
c1:[
|
c1:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
|
||||||
Value =~ "-515$",
|
Value =~ "-515$",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
&&
|
&&
|
||||||
c2:[
|
c2:[
|
||||||
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
|
||||||
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
|
||||||
]
|
]
|
||||||
=> issue(
|
=> issue(
|
||||||
store = "Active Directory",
|
store = "Active Directory",
|
||||||
types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
|
types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
|
||||||
query = ";objectguid;{0}",
|
query = ";objectguid;{0}",
|
||||||
param = c2.Value
|
param = c2.Value
|
||||||
);'
|
);'
|
||||||
}
|
}
|
||||||
|
|
||||||
$existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules
|
$existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules
|
||||||
|
|
||||||
$updatedRules = $existingRules + $rule1 + $rule2 + $rule3 + $rule4 + $rule5
|
$updatedRules = $existingRules + $rule1 + $rule2 + $rule3 + $rule4 + $rule5
|
||||||
|
|
||||||
$crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules
|
$crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules
|
||||||
|
|
||||||
Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString
|
Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString
|
||||||
|
|
||||||
#### Remarks
|
#### Remarks
|
||||||
|
|
||||||
@ -483,8 +486,8 @@ The following script helps you with the creation of the issuance transform rules
|
|||||||
- If you have multiple verified domain names (as shown in the Azure AD portal or via the Get-MsolDomains cmdlet), set the value of **$multipleVerifiedDomainNames** in the script to **$true**. Also make sure that you remove any existing issuerid claim that might have been created by Azure AD Connect or via other means. Here is an example for this rule:
|
- If you have multiple verified domain names (as shown in the Azure AD portal or via the Get-MsolDomains cmdlet), set the value of **$multipleVerifiedDomainNames** in the script to **$true**. Also make sure that you remove any existing issuerid claim that might have been created by Azure AD Connect or via other means. Here is an example for this rule:
|
||||||
|
|
||||||
|
|
||||||
c:[Type == "http://schemas.xmlsoap.org/claims/UPN"]
|
c:[Type == "http://schemas.xmlsoap.org/claims/UPN"]
|
||||||
=> issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?<domain>.+)", "http://${domain}/adfs/services/trust/"));
|
=> issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?<domain>.+)", "http://${domain}/adfs/services/trust/"));
|
||||||
|
|
||||||
- If you have already issued an **ImmutableID** claim for user accounts, set the value of **$immutableIDAlreadyIssuedforUsers** in the script to **$true**.
|
- If you have already issued an **ImmutableID** claim for user accounts, set the value of **$immutableIDAlreadyIssuedforUsers** in the script to **$true**.
|
||||||
|
|
||||||
@ -497,8 +500,8 @@ Using an elevated PowerShell command window, configure AD FS policy by executing
|
|||||||
For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work
|
For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work
|
||||||
|
|
||||||
- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain>
|
- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain>
|
||||||
- read access to the AD FS service account
|
- read access to the AD FS service account
|
||||||
- read/write access to the Azure AD Connect sync AD connector account
|
- read/write access to the Azure AD Connect sync AD connector account
|
||||||
- Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain>
|
- Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain>
|
||||||
- Container Device Registration Service DKM under the above container
|
- Container Device Registration Service DKM under the above container
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user