You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-domain-services/powershell-create-instance.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.service: active-directory
10
10
ms.subservice: domain-services
11
11
ms.workload: identity
12
12
ms.topic: sample
13
-
ms.date: 08/17/2022
13
+
ms.date: 09/1/2022
14
14
ms.author: justinha
15
15
ms.custom: devx-track-azurepowershell
16
16
@@ -48,7 +48,7 @@ To complete this article, you need the following resources:
48
48
49
49
Azure AD DS requires a service principal to authenticate and communicate and an Azure AD group to define which users have administrative permissions in the managed domain.
50
50
51
-
First, create an Azure AD service principal by using a specific application ID named *Domain Controller Services*. The ID value is *2565bd9d-da50-47d4-8b85-4c97f669dc36*. Don't change this application ID.
51
+
First, create an Azure AD service principal by using a specific application ID named *Domain Controller Services*. The ID value is *2565bd9d-da50-47d4-8b85-4c97f669dc36* for global Azure and *6ba9a5d4-8456-4118-b521-9c5ca10cdf84* for other Azure clouds. Don't change this application ID.
52
52
53
53
Create an Azure AD service principal using the [New-AzureADServicePrincipal][New-AzureADServicePrincipal] cmdlet:
54
54
@@ -230,7 +230,7 @@ When the Azure portal shows that the managed domain has finished provisioning, t
230
230
231
231
## Complete PowerShell script
232
232
233
-
The following complete PowerShell script combines all of the tasks shown in this article. Copy the script and save it to a file with a `.ps1` extension. Run the script in a local PowerShell console or the [Azure Cloud Shell][cloud-shell].
233
+
The following complete PowerShell script combines all of the tasks shown in this article. Copy the script and save it to a file with a `.ps1` extension. For Azure Global, use AppId value *2565bd9d-da50-47d4-8b85-4c97f669dc36*. For other Azure clouds, use AppId value *6ba9a5d4-8456-4118-b521-9c5ca10cdf84*. Run the script in a local PowerShell console or the [Azure Cloud Shell][cloud-shell].
234
234
235
235
> [!NOTE]
236
236
> To enable Azure AD DS, you must be a global administrator for the Azure AD tenant. You also need at least *Contributor* privileges in the Azure subscription.
@@ -251,7 +251,7 @@ Connect-AzureAD
251
251
Connect-AzAccount
252
252
253
253
# Create the service principal for Azure AD Domain Services.
# How to use number matching in multifactor authentication (MFA) notifications (Preview) - Authentication Methods Policy
15
15
16
-
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security. The schema for the API to enable number match is currently being updated. **While the API is updated over the next two weeks, you should only use the Azure AD portal to enable number match.**
16
+
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security. Number matching can be enabled by using the Azure portal or Microsoft Graph API.
17
17
18
18
>[!NOTE]
19
19
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will be enabled by default for all tenants a few months after general availability (GA).<br>
@@ -25,8 +25,6 @@ Your organization will need to enable Authenticator (traditional second factor)
25
25
26
26
## Number matching
27
27
28
-
<!---check below with Mayur. The bit about the policy came from the number match FAQ at the end.--->
29
-
30
28
Number matching can be targeted to only a single group, which can be dynamic or nested. On-premises synchronized security groups and cloud-only security groups are supported for the Authentication Method Policy.
31
29
32
30
Number matching is available for the following scenarios. When enabled, all scenarios support number matching.
@@ -54,7 +52,7 @@ During self-service password reset, the Authenticator app notification will show
54
52
55
53
### Combined registration
56
54
57
-
When a user is goes through combined registration to set up the Authenticator app, the user is asked to approve a notification as part of adding the account. For users who are enabled for number matching, this notification will show a number that they need to type in their Authenticator app notification.
55
+
When a user goes through combined registration to set up the Authenticator app, the user is asked to approve a notification as part of adding the account. For users who are enabled for number matching, this notification will show a number that they need to type in their Authenticator app notification.
58
56
59
57
### AD FS adapter
60
58
@@ -86,7 +84,256 @@ To create the registry key that overrides push notifications:
86
84
87
85
## Enable number matching
88
86
89
-
To enable number matching, complete the following steps:
87
+
88
+
>[!NOTE]
89
+
>In Graph Explorer, ensure you've consented to the **Policy.Read.All** and **Policy.ReadWrite.AuthenticationMethod** permissions.
90
+
91
+
Identify your single target group for the schema configuration. Then use the following API endpoint to change the numberMatchingRequiredState property under featureSettings to **enabled** and include or exclude groups:
| id | String | The authentication method policy identifier. |
105
+
| state | authenticationMethodState | Possible values are: **enabled**<br>**disabled**|
106
+
107
+
**RELATIONSHIPS**
108
+
109
+
| Relationship | Type | Description |
110
+
|--------------|------|-------------|
111
+
| includeTargets |[microsoftAuthenticatorAuthenticationMethodTarget](/graph/api/resources/passwordlessmicrosoftauthenticatorauthenticationmethodtarget?view=graph-rest-beta&preserve-view=true) collection | A collection of users or groups who are enabled to use the authentication method |
112
+
| featureSettings |[microsoftAuthenticatorFeatureSettings](/graph/api/resources/passwordlessmicrosoftauthenticatorauthenticationmethodtarget) collection | A collection of Microsoft Authenticator features. |
| authenticationMode | String | Possible values are:<br>**any**: Both passwordless phone sign-in and traditional second factor notifications are allowed.<br>**deviceBasedPush**: Only passwordless phone sign-in notifications are allowed.<br>**push**: Only traditional second factor push notifications are allowed. |
121
+
| id | String | Object ID of an Azure AD user or group. |
122
+
| targetType | authenticationMethodTargetType | Possible values are: **user**, **group**.|
| numberMatchingRequiredState | authenticationMethodFeatureConfiguration | Require number matching for MFA notifications. Value is ignored for phone sign-in notifications. |
133
+
| displayAppInformationRequiredState | authenticationMethodFeatureConfiguration | Determines whether the user is shown application name in Microsoft Authenticator notification. |
134
+
| displayLocationInformationRequiredState | authenticationMethodFeatureConfiguration | Determines whether the user is shown geographic location context in Microsoft Authenticator notification. |
| excludeTarget | featureTarget | A single entity that is excluded from this feature. <br> Please note: You will be able to only exclude one group for number matching. |
143
+
| includeTarget | featureTarget | A single entity that is included in this feature. <br> Please note: You will be able to only set one group for number matching. |
144
+
| State | advancedConfigState | Possible values are:<br>**enabled** explicitly enables the feature for the selected group.<br>**disabled** explicitly disables the feature for the selected group.<br>**default** allows Azure AD to manage whether the feature is enabled or not for the selected group. |
145
+
146
+
### Feature Target properties
147
+
148
+
**PROPERTIES**
149
+
150
+
| Property | Type | Description |
151
+
|----------|------|-------------|
152
+
| id | String | ID of the entity targeted. |
153
+
| targetType | featureTargetType | The kind of entity targeted, such as group, role, or administrative unit. The possible values are: ‘group’, 'administrativeUnit’, ‘role’, unknownFutureValue’. |
154
+
155
+
>[!NOTE]
156
+
>Number matching can be enabled only for a single group.
157
+
158
+
### Example of how to enable number matching for all users
159
+
160
+
In **featureSettings**, you will need to change the **numberMatchingRequiredState** from **default** to **enabled**.
161
+
162
+
Note that the value of Authentication Mode can be either **any** or **push**, depending on whether or not you also want to enable passwordless phone sign-in. In these examples, we will use **any**, but if you do not want to allow passwordless, use **push**.
163
+
164
+
>[!NOTE]
165
+
>For passwordless users, enabling or disabling number matching has no impact because it's already part of the passwordless experience.
166
+
167
+
You might need to patch the entire schema to prevent overwriting any previous configuration. In that case, do a GET first, update only the relevant fields, and then PATCH. The following example only shows the update to the **numberMatchingRequiredState** under **featureSettings**.
168
+
169
+
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will see the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
170
+
171
+
```json
172
+
//Retrieve your existing policy via a GET.
173
+
//Leverage the Response body to create the Request body section. Then update the Request body similar to the Request body as shown below.
To confirm this has applied, please run the GET request below using the endpoint below.
208
+
209
+
```http
210
+
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
211
+
```
212
+
213
+
### Example of how to enable number matching for a single group
214
+
215
+
In **featureSettings**, you will need to change the **numberMatchingRequiredState** value from **default** to **enabled.**
216
+
Inside the **includeTarget**, you will need to change the **id** from **all_users** to the ObjectID of the group from the Azure AD portal.
217
+
218
+
You need to PATCH the entire configuration to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the **numberMatchingRequiredState**.
219
+
220
+
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will see the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
257
+
```
258
+
259
+
### Example of removing the excluded group from number matching
260
+
261
+
In **featureSettings**, you will need to change the **numberMatchingRequiredState** value from **default** to **enabled.**
262
+
You need to change the **id** of the **excludeTarget** to `00000000-0000-0000-0000-000000000000`.
263
+
264
+
You need to PATCH the entire configuration to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the **numberMatchingRequiredState**.
265
+
266
+
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will be excluded from the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
0 commit comments