Azure AD Password Protection is now generally available

April 5, 2019 Chris Spanougakis No comments exist

We’ve talked about this Azure AD feature a few months ago, when it was in Public Preview, you can take a look at the article here: https://systemplus.gr/azuread-password-protection-and-smart-lockout-are-now-in-public-preview/

Something that was not so clear and it needs to be, is the fact that it’s not only a cloud solution: it can be used even on on-premises environments, meaning that you can use it on your Domain Controllers. Simply create a banned password list and that’s all! Keep in mind that it’s not only the banned password list that you create the one that is being used: Microsoft has the proper algorithms and their own banned passwords lists that are also used in your password policy.

You should start configuring it by navigating to Azure Active Directory node in the Azure portal and then select Authentication Methods:

image

 

How to protect your on-premises environment

To use Azure AD Password Protection on our Windows Server Active Directory, download the agents from the download center and use the instructions in the Password Protection deployment guide.

Specifically, you need to deploy Azure AD Password Protection in audit mode, just to monitor the impact of your password policy to your users. Later you should change the mode to Enforce.

In a single-forest deployment, the following diagram shows how it works and the various components that you’ll need:

azure-ad-password-protection

 

Read-only domain controllers

Password changes/sets are not processed and persisted on read-only domain controllers (RODCs). They are forwarded to writable domain controllers. So, you don’t have to install the DC Agent software on RODCs.

 

Deployment requirements

  • All domain controllers that get the DC Agent service for Azure AD password protection installed must run Windows Server 2012 or later. This requirement does not imply that the Active Directory domain or forest must also be at Windows Server 2012 domain or forest functional level. There is no minimum DFL or FFL required for either the DC agent or proxy software to run.

  • All machines that get the DC agent service installed must have .NET 4.5 installed.

  • All machines that get the proxy service for Azure AD password protection installed must run Windows Server 2012 R2 or later.

  • All machines where the Azure AD Password Protection Proxy service will be installed must have .NET 4.7 installed. .NET 4.7 should already be installed on a fully updated Windows Server.

  • All machines, including domain controllers, that get Azure AD password protection components installed must have the Universal C Runtime installed. You can get the runtime by making sure you have all updates from Windows Update, see Update for Universal C Runtime in Windows.

  • Network connectivity must exist between at least one domain controller in each domain and at least one server that hosts the proxy service for password protection. This connectivity must allow the domain controller to access RPC endpoint mapper port 135 and the RPC server port on the proxy service. By default, the RPC server port is a dynamic RPC port, but it can be configured to use a static port.

  • All machines that host the proxy service must have network access to the following endpoints:

    Endpoints
    https://login.microsoftonline.com
    https://enterpriseregistration.windows.net

  • All machines that host the proxy service for password protection must be configured to allow outbound TLS 1.2 HTTP traffic.

  • A Global Administrator account to register the proxy service for password protection and forest with Azure AD.

  • An account that has Active Directory domain administrator privileges in the forest root domain to register the Windows Server Active Directory forest with Azure AD.

  • Any Active Directory domain that runs the DC Agent service software must use Distributed File System Replication (DFSR) for SysVol replication.

  • The Key Distribution Service must be enabled on all domain controllers in the domain that run Windows Server 2012. By default, this service is enabled via manual trigger start.

 

(The deployment requirements are just a copy of the official deployment document by Microsoft, just to give you a general idea of the components that you’ll need. There are a lot of additional steps that you need to perform, so I strongly recommend to check the documentation here: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy)

 

Thanks for your time!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.