You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<LocalizedStringElementType="ClaimType"ElementId="emailVerificationCode"StringId="UserHelpText">Verification code received in the email.</LocalizedString>
568
554
<LocalizedStringElementType="ClaimType"ElementId="emailVerificationCode"StringId="AdminHelpText">Verification code received in the email.</LocalizedString>
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfSessionDoesNotExist">You have exceeded the maximum time allowed.</LocalizedString>
572
558
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfMaxRetryAttempted">You have exceeded the number of retries allowed.</LocalizedString>
559
+
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfMaxNumberOfCodeGenerated">You have exceeded the number of code generation attempts allowed.</LocalizedString>
573
560
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfInvalidCode">You have entered the wrong code.</LocalizedString>
574
561
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfSessionConflict">Cannot verify the code, please try again later.</LocalizedString>
575
562
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfVerificationFailedRetryAllowed">The verification has failed, please try again.</LocalizedString>
576
563
</LocalizedStrings>
577
564
</LocalizedResources>
578
565
```
579
566
580
-
After you add the localized strings, remove the OTP validation error messages metadata from the LocalAccountSignUpWithLogonEmail and LocalAccountDiscoveryUsingEmailAddress technical profiles.
<LocalizedStringElementType="ClaimType"ElementId="emailVerificationCode"StringId="UserHelpText">Verification code received in the email.</LocalizedString>
552
538
<LocalizedStringElementType="ClaimType"ElementId="emailVerificationCode"StringId="AdminHelpText">Verification code received in the email.</LocalizedString>
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfSessionDoesNotExist">You have exceeded the maximum time allowed.</LocalizedString>
556
542
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfMaxRetryAttempted">You have exceeded the number of retries allowed.</LocalizedString>
543
+
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfMaxNumberOfCodeGenerated">You have exceeded the number of code generation attempts allowed.</LocalizedString>
557
544
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfInvalidCode">You have entered the wrong code.</LocalizedString>
558
545
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfSessionConflict">Cannot verify the code, please try again later.</LocalizedString>
559
546
<LocalizedStringElementType="ErrorMessage"StringId="UserMessageIfVerificationFailedRetryAllowed">The verification has failed, please try again.</LocalizedString>
560
547
</LocalizedStrings>
561
548
</LocalizedResources>
562
549
```
563
550
564
-
After you add the localized strings, remove the OTP validation error messages metadata from the LocalAccountSignUpWithLogonEmail and LocalAccountDiscoveryUsingEmailAddress technical profiles.
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/overview.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Azure Active Directory B2C provides business-to-customer identity as a service.
21
21
22
22
Azure AD B2C is a customer identity access management (CIAM) solution capable of supporting millions of users and billions of authentications per day. It takes care of the scaling and safety of the authentication platform, monitoring, and automatically handling threats like denial-of-service, password spray, or brute force attacks.
23
23
24
-
Azure AD B2C is a separate service from [Azure Active Directory (Azure AD)](../active-directory/fundamentals/active-directory-whatis.md). It is built on the same technology as Azure AD but for a different purpose. It allows businesses to build customer facing application, and then allow anyone to sign up into those applications with no restrictions on user account.
24
+
Azure AD B2C is a separate service from [Azure Active Directory (Azure AD)](../active-directory/fundamentals/active-directory-whatis.md). It is built on the same technology as Azure AD but for a different purpose. It allows businesses to build customer facing applications, and then allow anyone to sign up into those applications with no restrictions on user account.
25
25
26
26
## Who uses Azure AD B2C?
27
27
Any business or individual who wishes to authenticate end users to their web/mobile applications using a white-label authentication solution. Apart from authentication, Azure AD B2C service is used for authorization such as access to API resources by authenticated users. Azure AD B2C is meant to be used by **IT administrators** and **developers**.
@@ -132,4 +132,4 @@ Now that you have an idea of what Azure AD B2C is and some of the scenarios it c
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises.md
+63-30Lines changed: 63 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -70,23 +70,42 @@ The following scenarios aren't supported:
70
70
-*Run as* by using a security key.
71
71
- Log in to a server by using a security key.
72
72
73
+
## Install the Azure AD Kerberos PowerShell module
74
+
75
+
The [Azure AD Kerberos PowerShell module](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement) provides FIDO2 management features for administrators.
76
+
77
+
1. Open a PowerShell prompt using the Run as administrator option.
78
+
1. Install the Azure AD Kerberos PowerShell module:
79
+
80
+
```powershell
81
+
# First, ensure TLS 1.2 for PowerShell gallery access.
> - The Azure AD Kerberos PowerShell module uses the [AzureADPreview PowerShell module](https://www.powershellgallery.com/packages/AzureADPreview) to provide advanced Azure Active Directory management features. If the [AzureAD PowerShell module](https://www.powershellgallery.com/packages/AzureAD) is already installed on your local computer, the installation described here might fail because of conflict. To prevent any conflicts during installation, be sure to include the "-AllowClobber" option flag.
90
+
> - You can install the Azure AD Kerberos PowerShell module on any computer from which you can access your on-premises Active Directory Domain Controller, without dependency on the Azure AD Connect solution.
91
+
> - The Azure AD Kerberos PowerShell module is distributed through the [PowerShell Gallery](https://www.powershellgallery.com/). The PowerShell Gallery is the central repository for PowerShell content. In it, you can find useful PowerShell modules that contain PowerShell commands and Desired State Configuration (DSC) resources.
92
+
73
93
## Create a Kerberos Server object
74
94
75
-
Administrators use PowerShell tools from their Azure AD Connect server to create an Azure AD Kerberos Server object in their on-premises directory. Run the following steps in each domain and forest in your organization that contains Azure AD users:
95
+
Administrators use the Azure AD Kerberos PowerShell module to create an Azure AD Kerberos Server object in their on-premises directory.
76
96
77
-
1. Upgrade to the latest version of Azure AD Connect. The instructions assume that you've already configured Azure AD Connect to support your hybrid environment.
78
-
1. On the Azure AD Connect server, open an elevated PowerShell prompt, and then go to *C:\Program Files\Microsoft Azure Active Directory Connect\AzureADKerberos\\*.
79
-
1. Run the following PowerShell commands to create a new Azure AD Kerberos Server object in both your on-premises Active Directory domain and Azure AD tenant.
97
+
Run the following steps in each domain and forest in your organization that contain Azure AD users:
80
98
81
-
> [!NOTE]
82
-
> Replace `contoso.corp.com` in the following example with your on-premises Active Directory domain name.
99
+
1. Open a PowerShell prompt using the Run as administrator option.
100
+
1. Run the following PowerShell commands to create a new Azure AD Kerberos Server object both in your on-premises Active Directory domain and in your Azure Active Directory tenant.
83
101
84
-
```powerShell
85
-
Import-Module ".\AzureAdKerberos.psd1"
102
+
> [!NOTE]
103
+
> Replace `contoso.corp.com` in the following example with your on-premises Active Directory domain name.
86
104
87
-
# Specify the on-premises Active Directory domain. A new Azure AD
88
-
# Kerberos Server object will be created in this Active Directory domain.
89
-
$domain = "contoso.corp.com"
105
+
```powershell
106
+
# Specify the on-premises Active Directory domain. A new Azure AD
107
+
# Kerberos Server object will be created in this Active Directory domain.
108
+
$domain = "contoso.corp.com"
90
109
91
110
# Enter an Azure Active Directory global administrator username and password.
92
111
$cloudCred = Get-Credential
@@ -99,43 +118,57 @@ Administrators use PowerShell tools from their Azure AD Connect server to create
> If your organization protects password-based sign-in and enforces modern authentication methods such as multifactor authentication, FIDO2, or smart card technology, you must use the `-UserPrincipalName` parameter with the User Principal Name (UPN) of a global administrator.
104
-
> - Replace `contoso.corp.com` in the following example with your on-premises Active Directory domain name.
105
-
> - Replace `[email protected]` in the following example with the UPN of a global administrator.
121
+
> [!NOTE]
122
+
> If you're working on a domain-joined machine with an account that has domain administrator privileges, you can skip the "-DomainCredential" parameter. If the "-DomainCredential" parameter isn't provided, the current Windows login credential is used to access your on-premises Active Directory Domain Controller.
106
123
107
-
```powerShell
108
-
Import-Module ".\AzureAdKerberos.psd1"
124
+
```powershell
125
+
# Specify the on-premises Active Directory domain. A new Azure AD
126
+
# Kerberos Server object will be created in this Active Directory domain.
127
+
$domain = "contoso.corp.com"
109
128
110
-
# Specify the on-premises Active Directory domain. A new Azure AD
111
-
# Kerberos Server object will be created in this Active Directory domain.
112
-
$domain = "contoso.corp.com"
129
+
# Enter an Azure Active Directory global administrator username and password.
130
+
$cloudCred = Get-Credential
131
+
132
+
# Create the new Azure AD Kerberos Server object in Active Directory
133
+
# and then publish it to Azure Active Directory.
134
+
# Use the current windows login credential to access the on-prem AD.
> If your organization protects password-based sign-in and enforces modern authentication methods such as MFA, FIDO2, or Smart Card, you must use the "-UserPrincipalName" parameter with the User Principal Name of a Global administrator.
140
+
> - Replace `contoso.corp.com` in the following example with your on-premises Active Directory domain name.
141
+
> - Replace `[email protected]` in the following example with the User Principal Name of a Global administrator.
142
+
143
+
```powershell
144
+
# Specify the on-premises Active Directory domain. A new Azure AD
145
+
# Kerberos Server object will be created in this Active Directory domain.
146
+
$domain = "contoso.corp.com"
113
147
114
148
# Enter a UPN of an Azure Active Directory global administrator
This command outputs the properties of the Azure AD Kerberos Server. You can review the properties to verify that everything is in good order.
134
169
135
170
> [!NOTE]
136
-
> Running against another domain by supplying the credential would connect over NTLM but would then fail if the users are part of the Protected Users security group in Azure AD.
137
-
>
138
-
> As a workaround, log in with another domain user to the Azure AD Connect box and don’t supply a -domainCredential, because doing so would consume the Kerebros ticket of the currently logged in user. You can confirm by executing `whoami /groups` to validate whether the user has the required permissions in Azure AD to execute the preceding command.
171
+
> Running against another domain by supplying the credential will connect over NTLM, and then it fails. If the users are in the Protected Users security group in Active Directory, complete these steps to resolve the issue: Sign in as another domain user in **ADConnect** and don’t supply "-domainCredential". The Kereberos ticket of the user that's currently signed in is used. You can confirm by executing `whoami /groups` to validate whether the user has the required permissions in Active Directory to execute the preceding command.
139
172
140
173
| Property | Description |
141
174
| --- | --- |
@@ -159,15 +192,15 @@ The Azure AD Kerberos Server encryption *krbtgt* keys should be rotated on a reg
159
192
> [!WARNING]
160
193
> There are other tools that could rotate the *krbtgt* keys. However, you must use the tools mentioned in this document to rotate the *krbtgt* keys of your Azure AD Kerberos Server. This ensures that the keys are updated in both on-premises Active Directory and Azure AD.
If you want to revert the scenario and remove the Azure AD Kerberos Server from both the on-premises Active Directory and Azure AD, run the following command:
0 commit comments