You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/manage-apps/migrate-okta-sign-on-policies-to-azure-active-directory-conditional-access.md
+73-68Lines changed: 73 additions & 68 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ manager: martinco
7
7
ms.service: active-directory
8
8
ms.workload: identity
9
9
ms.topic: how-to
10
-
ms.date: 01/12/2023
10
+
ms.date: 01/13/2023
11
11
ms.author: gasinh
12
12
ms.subservice: app-mgmt
13
13
---
@@ -98,126 +98,131 @@ To enable hybrid Azure AD join on your Azure AD Connect server, run the configur
98
98
99
99
Hybrid Azure AD join replaces Okta device trust on Windows. Conditional Access policies can include compliance for devices enrolled in Endpoint Manager:
100
100
101
-
***Compliance overview**: Refer to [device compliance policies in Intune](/mem/intune/protect/device-compliance-get-started#:~:text=Reference%20for%20non-compliance%20and%20Conditional%20Access%20on%20the,applicable%20%20...%20%203%20more%20rows)
102
-
***Device compliance**: Create [policies in Intune](/mem/intune/protect/create-compliance-policy)
103
-
***Windows enrollment**: If you've opted to deploy hybrid Azure AD join, you can deploy another group policy to complete the [auto-enrollment process of these devices in Intune](/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy)
104
-
***iOS/iPadOS enrollment**: Before you enroll an iOS device, you must make [more configurations](/mem/intune/enrollment/ios-enroll) in the Endpoint Management console
105
-
***Android enrollment**: Before you enroll an Android device, you must make [more configurations](/mem/intune/enrollment/android-enroll) in the Endpoint Management console.
101
+
#### Device compliance policy
106
102
107
-
## Configure Azure AD Multi-Factor Authentication tenant settings
108
-
109
-
Before you convert to Conditional Access, confirm the base Azure AD Multi-Factor Authentication tenant settings for your organization.
110
-
111
-
1. Go to the [Azure portal](https://portal.azure.com) and sign in with a global administrator account.
103
+
*[Use compliance policies to set rules for devices you manage with Intune](/mem/intune/protect/device-compliance-get-started)
104
+
*[Create a compliance policy in Microsoft Intune](/mem/intune/protect/create-compliance-policy)
112
105
113
-
1. Select **Azure Active Directory** > **Users** > **Multi-Factor Authentication** to go to the legacy Azure AD Multi-Factor Authentication portal.
106
+
#### Windows 10/11, iOS, iPadOS, and Android enrollment
114
107
115
-
108
+
If you deployed hybrid Azure AD join, you can deploy another group policy to complete auto-enrollment of these devices in Intune.
116
109
117
-
You can also use the legacy link to the [Azure AD Multi-Factor Authentication portal](https://aka.ms/mfaportal).
110
+
*[What is device enrollment in Intune?](mem/intune/enrollment/device-enrollment)
111
+
*[Quickstart: Set up automatic enrollment for Windows 10/11 devices](/mem/intune/enrollment/quickstart-setup-auto-enrollment)
*[Enroll iOS/iPadOS devices in Intune](/mem/intune/enrollment/ios-enroll)
118
114
119
-
1. On the legacy **multi-factor authentication** menu, change the status menu through **Enabled** and **Enforced** to confirm you have no users enabled for legacy MFA. If your tenant has users in the following views, you must disable them in the legacy menu. Only then will Conditional Access policies take effect on their account.
115
+
## Configure Azure AD Multi-Factor Authentication tenant settings
120
116
121
-
117
+
Before you convert to Conditional Access, confirm the base MFA tenant settings for your organization.
122
118
123
-
The **Enforced** field should also be empty.
119
+
1. Go to the [Azure portal](https://portal.azure.com).
120
+
2. Sign in as a Global Administrator.
121
+
3. Select **Azure Active Directory** > **Users** > **Multi-Factor Authentication**.
122
+
4. The legacy Azure AD Multi-Factor Authentication portal appears. Or select [Azure AD MFA portal](https://aka.ms/mfaportal).
124
123
125
-
1. Select the **Service settings** option. Change the **App passwords** selection to **Do not allow users to create app passwords to sign in to non-browser apps**.
124
+
126
125
127
-
126
+
5. Confirm there are no users enabled for legacy MFA: On the **multi-factor authentication** menu, on **Multi-Factor Auth status**, select **Enabled** and **Enforced**. If the tenant has users in the following views, disable them in the legacy menu.
128
127
129
-
1. Ensure the **Skip multi-factor authentication for requests from federated users on my intranet** and **Allow users to remember multi-factor authentication on devices they trust (between one to 365 days)** checkboxes are cleared, and then select **Save**.
128
+
130
129
131
-
>[!NOTE]
132
-
>See [best practices for configuring the MFA prompt settings](../authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md).
130
+
6. Esure the **Enforced** field is empty.
131
+
7. Select the **Service settings** option.
132
+
8. Change the **App passwords** selection to **Do not allow users to create app passwords to sign in to non-browser apps**.
133
133
134
-
134
+
135
135
136
-
## Configure Conditional Access policies
136
+
9. Clear the checkboxes for **Skip multi-factor authentication for requests from federated users on my intranet** and **Allow users to remember multi-factor authentication on devices they trust (between one to 365 days)**.
137
+
10. Select **Save**.
137
138
138
-
After you've configured the prerequisites and established the base settings, it's time to build the first Conditional Access policy.
139
+
139
140
140
-
1. To configure Conditional Access policies in Azure AD, go to the [Azure portal](https://portal.azure.com). On **Manage Azure Active Directory**, select **View**.
141
+
>[!NOTE]
142
+
>See [Optimize reauthentication prompts and understand session lifetime for Azure AD MFA](../authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md).
141
143
142
-
Configure Conditional Access policies by following [best
143
-
practices for deploying and designing Conditional Access](../conditional-access/plan-conditional-access.md#understand-conditional-access-policy-components).
144
+
## Build a Conditional Access policy
144
145
145
-
1. To mimic the global sign-on MFA policy from Okta, [create a policy](../conditional-access/howto-conditional-access-policy-all-users-mfa.md).
146
+
After you configure the prerequisites and established base settings, you can build Conditional Access policy. Policy can be targeted to an application, a test group of users, or both.
146
147
147
-
1. Create a [device trust-based Conditional Access rule](../conditional-access/require-managed-devices.md).
148
+
Before you get started:
148
149
149
-
This policy as any other in this tutorial can be targeted to a specific application, a test group of users, or both.
*[Building a Conditional Access policy](/azure/active-directory/conditional-access/concept-conditional-access-policies)
150
152
151
-
153
+
1. Go to the [Azure portal](https://portal.azure.com).
154
+
2. On **Manage Azure Active Directory**, select **View**.
155
+
3. Create a policy. See, [Common Conditional Access policy: Require MFA for all users](/articles/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa.md).
156
+
4. Create a device trust-based Conditional Access rule.
152
157
153
-
158
+
154
159
155
-
1. After you've configured the location-based policy and device trust policy, it's time to configure the equivalent [block legacy authentication](../conditional-access/howto-conditional-access-policy-block-legacy.md) policy.
160
+
156
161
157
-
With these three Conditional Access policies, the original Okta sign-on policies experience has been replicated in Azure AD. Next steps involve enrolling the user via Azure AD Multi-Factor Authentication and testing the policies.
162
+
5. After you configure the location-based policy and device trust policy, [Block legacy authentication with Azure AD with Conditional Access](/azure/active-directory/conditional-access/block-legacy-authentication).
158
163
159
-
## Enroll pilot members in Azure AD Multi-Factor Authentication
164
+
With these three Conditional Access policies, the original Okta sign-on policies experience is replicated in Azure AD.
160
165
161
-
After you configure the Conditional Access policies, users must register for Azure AD Multi-Factor Authentication methods. Users can be required to register through several different methods.
166
+
## Enroll pilot members in MFA
162
167
163
-
1. For individual registration, direct users to the [Microsoft Sign-in pane](https://aka.ms/mfasetup) to manually enter the registration information.
168
+
Users register for MFA methods.
164
169
165
-
1. Users can go to the [Microsoft Security info page](https://aka.ms/mysecurityinfo) to enter information or manage the form of MFA registration.
170
+
For individual registration, users go to [Microsoft Sign-in pane](https://aka.ms/mfasetup).
166
171
167
-
See [this guide](../authentication/howto-registration-mfa-sspr-combined.md)to fully understand the MFA registration process.
172
+
To manage registration, users go to [Microsoft My Sign-Ins | Security Info](https://aka.ms/mysecurityinfo).
168
173
169
-
Go to the [Microsoft Sign-in pane](https://aka.ms/mfasetup). After you sign in with Okta MFA, you're instructed to register for MFA with Azure AD.
174
+
Learn more: [Enable combined security information registration in Azure Active Directory](/articles/active-directory/authentication/howto-registration-mfa-sspr-combined.md).
170
175
171
176
>[!NOTE]
172
-
>If registration already happened in the past for a user, they're taken to the **My Security** information page after they satisfy the MFA prompt.
173
-
See the [user documentation for MFA enrollment](../user-help/security-info-setup-signin.md).
177
+
>If users registered, they're redirected to the **My Security** page, after they satisfy MFA.
174
178
175
179
## Enable Conditional Access policies
176
180
177
-
1. To roll out testing, change the policies created in the earlier examples to **Enabled test user login**.
181
+
1. To test, change the created policies to **Enabled test user login**.
178
182
179
-
183
+
180
184
181
-
1. On the next Office 365 **Sign-In** pane, the test user John Smith is prompted to sign in with Okta MFA and Azure AD Multi-Factor Authentication.
185
+
2. On the Office 365 **Sign-In** pane, the test user John Smith is prompted to sign in with Okta MFA and Azure AD MFA.
182
186
183
-
187
+
184
188
185
-
1. Complete the MFA verification through Okta.
189
+
3. Complete the MFA verification through Okta.
186
190
187
-
191
+
188
192
189
-
1. After the user completes the Okta MFA prompt, the user is prompted for Conditional Access. Ensure that the policies were configured appropriately and are within conditions to be triggered for MFA.
193
+
4. The user is prompted for Conditional Access.
194
+
5. Ensure the policies were configured to be triggered for MFA.
190
195
191
-
196
+
192
197
193
-
## Cut over from sign-on to Conditional Access policies
198
+
## Add organization members to Conditional Access policies
194
199
195
-
After you conduct thorough testing on the pilot members to ensure that Conditional Access is in effect as expected, the remaining organization members can be added to Conditional Access policies after registration has been completed.
200
+
After you conduct testing on pilot members, add the remaining organization members to Conditional Access policies, after registration.
196
201
197
-
To avoid double-prompting between Azure AD Multi-Factor Authentication and Okta MFA, opt out from Okta MFA by modifying sign-on policies.
202
+
To avoid double-prompting between Azure AD MFA and Okta MFA, opt out from Okta MFA: modify sign-on policies.
198
203
199
-
The final migration step to Conditional Access can be done in a staged or cut-over fashion.
200
204
201
-
1. Go to the Okta admin console, select **Security** > **Authentication**, and then go to **Sign-on Policy**.
205
+
1. Go to the Okta admin console
206
+
2. Select **Security** > **Authentication**
207
+
3. Go to **Sign-on Policy**.
202
208
203
209
>[!NOTE]
204
-
> Set global policies to **Inactive** only if all applications from Okta are protected by their own application sign-on policies.
205
-
1. Set the **Enforce MFA** policy to **Inactive**. You can also assign the policy to a new group that doesn't include the Azure AD users.
210
+
> Set global policies to **Inactive** if all applications from Okta are protected by application sign-on policies.
206
211
207
-
212
+
4. Set the **Enforce MFA** policy to **Inactive**. You can assign the policy to a new group that doesn't include the Azure AD users.
208
213
209
-
1. On the application-level sign-on policy pane, update the policies to **Inactive** by selecting the **Disable Rule** option. You can also assign the policy to a new group that doesn't include the Azure AD users.
214
+
210
215
211
-
1. Ensure there's at least one application-level sign-on policy that's enabled for the application that allows access without MFA.
216
+
5. On the application-level sign-on policy pane, select the **Disable Rule** option.
217
+
6. Select **Inactive**. You can assign the policy to a new group that doesn't include the Azure AD users.
218
+
7. Ensure there's at least one application-level sign-on policy enabled for the application that allows access without MFA.
212
219
213
-
220
+
214
221
215
-
1. After you disable the Okta sign-on policies or exclude the migrated Azure AD users from the enforcement groups, users are prompted*only* for Conditional Access the next time they sign in.
222
+
8. Users are prompted for Conditional Access the next time they sign in.
216
223
217
224
## Next steps
218
225
219
-
For more information about migrating from Okta to Azure AD, see:
220
-
221
-
-[Migrate applications from Okta to Azure AD](migrate-applications-from-okta-to-azure-active-directory.md)
222
-
-[Migrate Okta federation to Azure AD](migrate-okta-federation-to-azure-active-directory.md)
223
-
-[Migrate Okta sync provisioning to Azure AD Connect-based synchronization](migrate-okta-sync-provisioning-to-azure-active-directory.md)
226
+
-[Tutorial: Migrate your applications from Okta to Azure Active Directory](migrate-applications-from-okta-to-azure-active-directory.md)
227
+
-[Tutorial: Migrate Okta federation to Azure Active Directory-managed authentication](migrate-okta-federation-to-azure-active-directory.md)
228
+
-[Tutorial: Migrate Okta sync provisioning to Azure AD Connect-based synchronization](migrate-okta-sync-provisioning-to-azure-active-directory.md)
0 commit comments