Azure AWS Beginners Guide for IT Professionals Azure IT Pros Azure Vs AWS

Azure AWS Beginners Guide for IT Professionals Azure IT Pros Azure Vs AWS. AWS and Azure are the most comprehensive cloud platforms. Recently, I have gone through a video that explains the fundamentals of Azure and AWS cloud platforms.

If you are an AWS professional, your knowledge of the AWS platform makes it easier for you to start your journey with Azure. The learning curve is not very huge. In this post, we will see how you can transfer the fundamental knowledge of the Amazon AWS platform to Microsoft Azure.

This post is based on the 5-minute comparison video by Matt McSpirit. He explains how your knowledge as an AWS Professional easily translates to Microsoft Azure.

Get the critical differences between these two comprehensive cloud platforms in the 5 minutes video. This post is an Azure Beginners Guide for AWS Professionals.

Key Concepts of AWS and Azure

The fundamental differences between AWS and Azure are the concepts of subscriptions and accounts. In Azure, account owners can delegate the task of managing subscriptions to application owners. This delegation is essential when paying the bill, not the person operating the technology.

Also, imagine if you could run AWS services in your private Data Center? With Azure, you can deploy Azure services in your data center with Azure stack. Azure also supports first-party integration between your cloud and on-premises solutions.

  • Common Identity
  • Management and Security
  • Data Platform
  • Artificial Development

Like AWS, Azure Architecture gives you the flexibility to build solutions with Windows and Linux. AWS and Azure have a vibrant marketplace of growing 3rd party echo systems of apps and solutions.

Azure Beginners Guide for AWS Professionals - Azure AWS Beginners Guide for IT Professionals Azure IT Pros Azure Vs AWS
Azure AWS Beginners Guide for IT Professionals Azure IT Pros Azure Vs AWS

Three Pillars of Azure and AWS Cloud Platform 

Azure Beginners Guide for AWS Professionals is based on three main pillars of these cloud offerings. There are three core services in AWS and the Azure cloud platform. I will cover each component in this post, as Matt explained above.

  • Compute
  • Data Storage
  • Management

AWS Vs. Azure Compute Options

Virtual Machine Templates

Compute options are very similar to AWS and Azure. You can find the same range of on-demand virtual machine sizes in Azure and a similar variety of Amazon EC2 instances in AWS. There are some differences in Memory, CPU, and storage options.

You can create AWS instances of virtual machines in the AWS management console. You can create Azure VMs in the Azure portal using APIs or Azure Command-line inter-phase for Windows or Linux. Following are the variety of options I have captured for the Azure Beginners Guide for AWS Professionals.

Azure Virtual Machine Offerings

  • Small Workloads (A, Av2, B, D, Dv2)
  • General-purpose (Dv3, N)
  • Storage workloads (L)
  • Database workload (Ev3)
  • Enterprise applications (M)
  • SAP HANA workloads (SAP)

AWS Virtual Machine Offerings

  • Accelerated Graphics (P2, G3)
  • Storage Optimized (I3, D2)
  • General-purpose (T2, M4)
  • Compute Optimized (C4)
  • Memory Optimized (X1, R3, and R4)

Automatic Scalability Options

In both AWS and Azure, you can use Auto Scaling options to scale your application or service dynamically. This can be done without any downtime for most of the scenarios.

In Azure, you can automatically use virtual machine scale sets to automatically add or remove VMs based on your defined metrics and threshold. Where in AWS, AWS CloudFormation can be used to scale your application or services automatically.

Application Architecture

In Azure, you can use Azure Resource Manager or ARM templates to define the architecture of your application or service for the multi-tiered workload. Again,  AWS CloudFormation templates can be used to architect your application or services.

Containers Options

Amazon has AWS Elastic (EC2) Container Service for containers. Azure has Azure Container Service (AKS) to provide you the container service options. Use a fully-managed Kubernetes container orchestration service or choose other orchestrators.

Azure supports both Linux and Windows containers. Azure also offers a range of orchestration options including Kubernetes, Mesosphere DC/OS, and Docker Swarm.

Serverless Options

AWS Lambda and AWS API Gateway (plus other services) are the solutions to build and deploy applications in AWS. In Azure, Azure Functions and other platform services are the answers for Serverless platforms.

This includes Azure Logic Apps to visually model and automates your process workflows. Other options for serverless in Azure are Azure Database as a Service and Azure Service Fabric Cluster.

Azure Beginners Guide for AWS Professionals
Azure AWS Beginners Guide for IT Professionals Azure IT Pros Azure Vs AWS

AWS Vs. Azure Data Storage Options

Persistent data storage is the heart of many applications. Azure and AWS offer a range of storage options. AWS Simple Storage Service (AWS S3) is the cloud storage solution in AWS.

Where in Azure, you can use Azure Blob Storage as a cloud storage solution for your application and services. Storage speed and performance are important to cover in Azure Beginners Guide for AWS Professionals.

In AWS, there is an option to have cold storage using AWS S3 Standard IA. And Amazon Glacier is archival cold storage in AWS. In Azure, this cold storage maps to Azure storage standard COLD (Access tier) and Azure Archival storage.

Database Options

Relational Database Options

Database options in AWS and Azure are also similar. But there is an essential difference that IT Pros need to understand. Amazon offers a variety of AWS Relational Database (AWS RDS) options. In Azure, Azure Relational Database options are Azure SQL Databases, Azure DB for MySQL, and Azure DB for PostgreSQL.

Non-Relational Database Options

Azure offers Cosmos DB (Azure Cosmos DB) to build a nonrelational Database for your applications and services. Azure Cosmos DB provides additional features like SQL query, unstructured data, low latency, and Geo-replication. AWS offers Amazon DynamoDB to have Fast and flexible nonrelational database service in the cloud.

Traditional Data Warehousing

Traditional Data Warehousing options are available for both AWS and Azure. Amazon AWS offers the AWS Redshift database for traditional data warehousing requirements of your applications and services.

Where Azure offers you an Azure SQL Data Warehouse solution to meet your application requirements, similar to AWS Redshift, Azure SQL Data Warehouse is a fast, fully managed, and petabyte-scale data warehouse.

Big Data Offerings

Amazon and Azure offer Big data analysis offerings as part of their cloud services. AWS offers Amazon Elastic MapReduce (Amazon EMR) for big data analytics, including the Hadoop framework. Whereas Azure offers Azure HDInsights as big data analytics options. 

HDInsight provides a fully managed, full-spectrum open-source analytics service for enterprises. There is an additional offer from Azure for Big Data, and that is Azure Data Lake Store. Azure Data Lake Store allows you to store massive unstructured or structured data sets which enables analysis of all your data from one place.

Azure Beginners Guide for AWS Professionals
Azure AWS Beginners Guide for IT Professionals Azure IT Pros Azure Vs AWS

AWS Vs Azure Management Options

Management is an important topic. Azure and AWS offer a variety of options to manage your cloud resources. In AWS, you can start with the AWS management console.

Azure provides management options through the Azure management portal. Management options for both platforms are essential with Azure Beginners Guide for AWS Professionals.

Troubleshooting

Azure Cloud Shell is an interactive, browser-accessible shell for managing Azure resources. You can also use Azure Cloud Shell for custom troubleshooting. Azure Cloud Shell supports Bash Shell for Linux and PowerShell for Windows workloads. 

There are other varieties of options available including CloudWatch, CloudTrail, and X-Ray. There are a lot of other 3rd party solutions for AWS cloud management.

Monitoring

AWS and Azure offer different monitoring options. In AWS, you can use 3rd party analytics engine like Splunk. Azure’s built-in monitoring options are log analytics, Azure application insights, etc.

Proactive Resource Optimization

Azure and AWS provide proactive resource optimization tools to help you. AWS comes with AWS Trusted Advisor Dashboard. Trusted Advisor allows you to observe best practices for the use of AWS by inspecting your AWS environment and providing proactive resource optimization.

Whereas, Azure provides a complementary tool called Azure Advisor to provide proactive resource optimization for your Azure environment.

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is Blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc……………

Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD

Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD? SCCM admins have to go through the AAD connect setup when they want to build  Intune and SCCM hybrid lab.

AAD Connect is the app used for syncing On-Prem AD with Azure AD. AAD connect app can be installed on any of the server-class machines. AAD  Connect sync operation is very critical for organizations.

If you are planning to sync the hash of your passwords to the cloud, then the configuration of the AAD  connect setup is fairly straightforward. If you have specific and advanced AAD Connect setup requirements, you need to spend loads of time in the initial setup.

Introduction

AAD connect setup and configuration will install SQL Express DB and configure it. For big corporate organizations, we need to select the advanced settings. They may have custom attributes used in their sync process.  These kinds of settings can be configured in advanced settings.

Also, there could be the possibility that the password hash is not synced and ADFS configuration has been used for authentication.

Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD
Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD

Azure AD AAD Connect Setup

But for my lab, I  have selected “Express Settings”  so that installation is very straightforward. During the configuration, you have to provide two credentials, AZURE AD and On-prem AD. To use on-premises credentials for Azure AD sign-in, UPN suffixes should match one of the verified custom domains in Azure AD.

I have changed the UPN suffixes of 4 on Prem AD users so that those On-Prem AD users will get synced with Azure AD. The high-level steps are completed in the AAD Connect setup and configuration wizard. Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD?

  • Install and Configure SQL Express DB
  • Install the synchronization engine
  • Configure Azure AD Connector
  • Configure On-Prem AD Connector
  • Enable Password Synchronization
  • Enable Auto Upgrade
  • Configure Azure AD Connect Health Agent for sync
  • Configure Synchronization services on the computer
  • End Results/Outcome of AAD Connect Sync
Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD
Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD

AAD Connect sync process will start after the AAD Connect setup and configuration. As you can see in the above screen capture, the configuration has been completed successfully on my On-prem AD server. To confirm whether the on-prem users/groups got synced with Azure AD, you can log in to portal.azure.com and confirm the user IDs.

All the users whose  UPNs have been changed to SCCZ.Onmicrosoft.com  have been replicated to Azure AD. They can use them ON Prem AD user ID and password to log in to AZURE AD, Office 365 services. You can check the user profile – Source attribute to confirm whether the user is synced via AAD Connect from the on-prem Active Directory.

Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD
Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD

Azure AD AAD Connect Setup User Password Sync Tool to Sync On-prem AD Domain to Azure AD?

You can sync on-prem user identities/attributes and passwords to Azure AD using Azure AD connect. Azure AD connect installation and configuration is very straightforward if we use (express settings 🙂 ).

I have a video tutorial here that helps you understand the AAD connect configuration, How to enable MFA for Azure AD to join Windows 10 devices and Twitter app integration with Azure AD.

In this post, I will cover two other topics related to Azure AD (AAD) Sync.

  1. Where is the Scheduled Task used to get created for Azure AD?
  2. How to Create a service connection point in on-premises Active Directory?
  3. Video Tutorial – How to Sync On-Prem AD User accounts With Azure AD

Windows 10 MDM devices can write back to on-prem AD. More details are available here. AAD Connect is mandatory for the write-back feature of Windows 10 devices.  

Earlier versions of Azure AD connect used  Windows task scheduler to schedule the Azure AD sync of on-prem objects and attributes. The latest version of Azure AD connect has a sync engine inbuilt. Hence we won’t find a scheduled task for AAD Connect. 

The new default synchronization frequency is 30 minutes. We can change the AD Sync Schedule using the PowerShell command “Get-ADSyncScheduler” and other parameters documented here. Window  

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr

  PS C:\Users\anoop\Desktop> Get-ADSyncSchedulerAllowedSyncCycleInterval            : 00:30:00
CurrentlyEffectiveSyncCycleInterval : 00:30:00
CustomizedSyncCycleInterval         :
NextSyncCyclePolicyType             : Delta
NextSyncCycleStartTimeInUTC         : 26-05-2016 02:06:23
PurgeRunHistoryInterval             : 7.00:00:00
SyncCycleEnabled                    : True
MaintenanceEnabled                  : True
StagingModeEnabled                  : False

I was getting trouble creating a service connection point in on-premises Active Directory. This service connection point is used to “Connect domain-joined devices to Azure AD for Windows 10 experiences”. I followed the documentation here to configure the service connection points in on-prem AD but was getting stuck with PowerShell Commands. I ran the PowerShell commands as per the above documentation, however, with no luck.

After that, I installed the appropriate version of the Windows Azure Active Directory Module for Windows PowerShell. Then I tried to run the following PowerShell commands, which worked like a champ!

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
PS C:\Users\anoop\Desktop> Connect-MsolService

PS C:\Users\anoop\Desktop> Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1"

PS C:\Users\anoop\Desktop> Initialize-ADSyncDomainJoinedComputerSync

cmdlet Initialize-ADSyncDomainJoinedComputerSync at command pipeline position 1
Supply values for the following parameters:
AdConnectorAccount: nair\Anoop
AzureADCredentials
Initializing your Active Directory forest to sync Windows 10 domain joined computers to Azure AD.
Configuration Complete

How to Sync On-Prem AD User accounts With Azure AD

How to Sync On-Prem AD User accounts With Azure AD AADJ MFA Twitter Integration – YouTube

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…

Intune Application Policy Manager RBA Controls In MEM Portal | Endpoint Manager Role-Based Access

Intune Application Policy Manager RBA Controls In MEM Portal | Endpoint Manager Role-Based Access? We will discuss the access rights of the build-in Intune RBA role called Intune Application Manager.

Ideally, this role should have access to administrate Managed apps, Mobile apps and read device information depending upon the scope of users/devices assigned to this role.

Do you know what the scope is? “The users or devices that a specified person (the member) can manage.” If you are an SCCM admin, the SCOPE option is already there in SCCM 2012 and CB console. I’ve another post that talks about Configuration manager RBAC detail here.

Intune Application Policy Manager

In this post, we will see the permissions associated with Intune application manager build-in role. As per the Microsoft documentation, this role is to “Manage and deploy applications and profiles”.

We will do a deep dive into this topic and explain the exact actions an Intune app admin can perform from the MEM portal. Following are the access permissions given to Intune APP Manager RBAC role.

Intune Application Policy Manager RBA Controls In Azure Portal | Endpoint Manager Role-Based Access
Intune Application Policy Manager RBA Controls In Azure Portal | Endpoint Manager Role-Based Access

Managed Apps

Assign managed apps to a security group
Create managed apps
Delete managed apps
Read managed apps
Update managed apps
Wipe Managed apps Managed Devices
No Access to delete devices
Access to read device information
No Access to update device properties Mobile Apps
Assign mobile apps to a security group
Create mobile apps
Delete mobile apps
Read mobile apps
Update mobile apps   Overall Access Rights of Intune tiles

  1. It is allowed to administrate some actions in managing apps and configuring devices tiles.
  2. Access is denied to perform any activities in Conditional Access, Device Enrollment, Access control, and Set device compliance tiles.
  3. Allowed to set up certificate authority in Configure devices tile. However, no access to view profiles.
  4. Allowed to view the device information in the Device and Groups tile.
  5. Access is denied to create/delete new/existing groups or users profiles. It doesn’t matter whether the Intune policy manager is editing the groups in SCOPE or not. In a lot of places, save and add buttons are enabled, but when we try to save, it will give an error.
  6. Access is denied to change device and user settings in the Manage user tile.
  7. Access is denied to access Intune Silverlight console.
  8. Access is denied to Intune App Protection section. Intune mobile application management is not allowed for Intune App Managers. All these app protection options are probably already part of Intune – Manage Apps tab in the Azure portal.

Access rights – Manage Apps (Manage Apps and Mobile apps) – Intune Application Policy Manager RBA Controls

Intune Application Policy Manager RBA Controls In Azure Portal | Endpoint Manager Role-Based Access
Intune Application Policy Manager RBA Controls In Azure Portal | Endpoint Manager Role-Based Access
  1. Allowed to create new mobile apps.
  2. Allowed to edit mobile apps which are uploaded by admins. Access is Denied to edit the managed apps, which are automatically uploaded.
  3. Access is denied to remove assignments/deployments to a group out of scope for Intune application manager.
  4. Access is denied to remove assignments/deployments to a group in scope for Intune application manager. This SHOULD be allowed!
  5. Allowed to add an assignment to mobile/manage app if the user group is in the scope of Intune application manager.
  6. Access Denied adding an assignment to mobile/manage app if the user group is out of scope of Intune application manager.
  7. App Protection Policies are getting hung while trying to edit (or create) existing (or new) app protection policies from Intune App manager account.
  8. Allowed to perform App Selective wipe option from Intune app manager account. Allowed to perform app selective wipe only on “in scope users/devices”.
  9. Access is denied to edit Company portal Branding from Intune app manager account.

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…

How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune

How to Organize Endpoint Manager Portal Neat Clean for Intune Activities? MEM portal is a one-stop-shop for all the services in the Microsoft cloud. When a user logins to a MEM portal for the first time, he/she can see all these services which are already selected as favorite services by default.

The selection of favorite services in the MEM portal for individual users is not based on the user’s profile or access rights of the user. This is not really good for new users in Intune portal. They will struggle to find out their role-related services.

Video

A more detailed explanation is in the above video or you can click here

How to Organize Endpoint Manager Portal Neat Clean for Intune Activities

For example, you are an Intune admin and you have only access to Intune and Azure AD users and groups. But if you log into the MEM portal you will see all loads of services that make no sense to you at all. You will also find it really messy and I’m sure you will get lost in the portal until you find the search button or Intune services.

How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune
How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune

Don’t worry there is a very friendly search option available in the Azure portal. If you are Intune admin then you can just click on more services and type “Intune” in the search menu. You can see 2 Intune services one is for Intune (MDM) and the second one is for Intune App Protection (MAM without enrollment).

How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune
How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune

To keep your Azure portal well organized, you need to spend only 2-3 minutes when you log in to the portal for the first time. What do we need to do to get neatly organized Azure portal? You log in to the Azure portal and click on the more services button, then remove the services which are not relevant to you.

For example, Intune admins don’t have anything to do with “Virtual Machines” hence you can remove Virtual machine service from your favorite menu. So this will help you to get rid of the Virtual machine shortcut from the left side menu of the MEM portal.

How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune
How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune

END Result:- Clean and Tidy Azure portal for Intune Admins. Remove all the services from the Azure portal except Azure Active Directory, Users and Groups, Intune, and Intune protection services.

How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune
How to Organize Endpoint Manager Portal Neat Clean for Intune Activities | Microsoft Intune

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…

How to Reset MFA Contact Details of Azure AD User

Reset MFA Contact Details of Azure AD User? In this post, we will see different types of users in the Azure Active Directory (Azure AD or AAD). Along with this, we will see how we can delete the existing contact details of a user in Azure AD and request the user to fill in the new contact details.

More details to change the Azure MFA Authentication phone from the MyApps portal – https://www.anoopcnair.com/change-azure-mfa-authentication-phone-myapps/(opens in a new tab)

End-User and trying to change MFA Mobile Number – https://aka.ms/MFASetup 

We can easily reset the contact details used for MFA (Multi-Factor Authentication) from the Azure AD portal. This is very useful when the user gets an internal transfer within the organization to another country and wants to change the number.

Also, there are options to “Delete all existing app passwords generated by the selected users” and “Restore multi-factor authentication on all remembered devices”.

MFA Mobile Contact Number reset from Azure Portal with Admin Access?

More details in the video here.

How to Reset MFA Contact Details of Azure AD User
How to Reset MFA Contact Details of Azure AD User
How to Reset MFA Contact Details of Azure AD User

As you can see in the above picture, there are two types of symbols near user accounts. The one with external email ids like Gmail and those kinds of users are guest users in Azure AD.

You can provide access to your organization’s apps to external contractors on a temporary basis using the Guest user option. Another type of user with your organization’s email IDs is internal users.

How to Reset MFA Contact Details of Azure AD User
How to Reset MFA Contact Details of Azure AD User

To get access to resources of the organization, Guest users should go through a secure onboarding process with MFA (Multi-Factor Authentication). Guest users will receive an invitation mail on the external email ID, and the email subject will be “You’re invited to the {Anoop’s} organization”.

The user has to click on the “Get Started” link from the mail, and they will be guided through the onboarding process with MFA. As you can see in the welcome screen (below picture), you will access the MyApps.microsoft.com portal, where guest users can access internal applications allocated to that user.

MFA Mobile Contact Number reset How to Reset MFA Contact Details of Azure AD User
How to Reset MFA Contact Details of Azure AD User

So coming back to the main topic, “How to Reset the MFA Contact Details of an Azure AD User”. This option is there in the Azure portal “Microsoft Azure Active Directory –> Users and groupsAll users“, click on “Multi-Factor Authentication“.  In the new tab, you will get the option to reset the contact details of the AAD User.

This blade will allow you to reset all apps passwords generated by the selected users, and you can ask users to perform MFA on all the existing devices. Select the user ID and click on “Manage user setting” to reset the MFA contacts of the AAD User.

How to Reset MFA Contact Details of Azure AD User
How to Reset MFA Contact Details of Azure AD User

When you click on any user account from the above place (as you can see in the above pic), it will take you to the Office 365 licensing portal. So no need to login into the Office portal separately to assign licenses to users. This is very useful stuff.

MFA Mobile Contact Number reset How to Reset MFA Contact Details of Azure AD User
How to Reset MFA Contact Details of Azure AD User

Once you click on “Manage User Settings“, you will be able to see the following options:-

1. Require selected users to provide contact methods again.

2. Delete all existing app passwords generated by the selected users.

3. Restore Multi-factor authentication on all remembered devices. To reset the MFA contact details of an Azure AD user, you need to select option one, “Require selected users to provide contact methods again,” and click save. Next time a user logs into a device, AAD will prompt the user to provide contact details again.

MFA Mobile Contact Number reset
How to Reset MFA Contact Details of Azure AD User

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…

How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager

How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager? A Clean Intune environment always gives us better deployment results, and one of the important steps to keep your environment clean is explained in this post.

This is not the only way to keep your Intune environment clean. Rather you should have regular sanity checks for your environment to ensure that you don’t have duplicate copies of policies and applications.

Moreover, you should avoid duplicate deployments of policies and applications. Duplicate deployments of policies can cause conflicts and could result in unexpected results.

Introduction

We SCCM Admins are familiar with the process of deletion and removal of a device in SCCM and Microsoft Intune. However, we are always not sure when you remove a device from SCCM, then that device record will automatically get removed from On-prem Active Directory or not.

The removal or deletion of a device or machine from Active Directory is not SCCM’s responsibility, and this should be handled separately by on-prem Active Directory.

So how are these operations handled in the modern device management world in terms of Intune SA (or SCCM Hybrid) and Azure Active Directory? In most cases, I have not seen that when you retire and delete a device from Intune, that device record will automatically get purged from Azure Active Directory (AAD).

To have better results for your Compliance/configuration policy and application deployments in the modern device management world, we should ensure a clean environment with clean Azure AD. You can get a better understanding of this issue from the above video tutorial. How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager?

How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager
How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager

How to Delete Clean Tidy Intune Azure Active Directory?

In the above example, Intune console shows me only one device assigned to my user account. Whereas if you look at my Azure AD user ID and check for the devices assigned against my account, you can see there are a total of 3 devices, and all the 3 devices have been shown as managed by Intune.

This is not accurate data that is getting reflected in Azure Active Directory. I’m not saying every time this scenario will happen. I’ve seen some devices automatically get removed from Intune and AAD. How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager?

I suppose we should have a better accuracy/sync between Intune and Azure AD databases.  I don’t see a scheduled task in Azure AD to purge the deleted records from Microsoft Intune. I’m not sure whether this is coming in the near future or not.

To ensure better results for Intune device management policies, when you delete a device from Intune, you should make sure that the device record is removed from Azure AD. I’m planning to post a video tutorial showing how to delete a device from Azure AD to have a clean and tidy environment.

How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager
How to Delete Clean Tidy Intune Azure Active Directory Environment | Microsoft Endpoint Manager

Resources

Windows 10 Intune Enrollment Manual Process AAD Registration (anoopcnair.com)

Validate Azure AD Dynamic Group Rules | Intune

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr

Using Azure AD Connect, you can sync on-prem AD users identities/attributes and passwords to Azure AD. Azure AD connect installation and configuration is very straightforward if we use (express settings 🙂 ).

I have a video tutorial here that helps you understand the AAD connect configuration, How to enable MFA for Azure AD to join Windows 10 devices and Twitter app integration with Azure AD.

In this post, I will cover two other topics related to Azure AD (AAD) Sync.

  1. Where is the Scheduled Task used to get created for Azure AD?
  2. How to Create a service connection point in on-premises Active Directory?
  3. Video Tutorial – How to Sync On-Prem AD User accounts With Azure AD

Windows 10 MDM devices can write back to on-prem AD more details are available here. AAD Connect is mandatory for the write-back feature of Windows 10 devices.  

Earlier versions of Azure AD connect used  Windows task scheduler to schedule the Azure AD sync of on-prem objects and attributes. The latest version of Azure AD connect has a sync engine inbuilt. Hence we won’t find a scheduled task for AAD Connect. 

The new default synchronization frequency is 30 minutes. We can change the AD Sync Schedule using the PowerShell command “Get-ADSyncScheduler” and other parameters documented here. Window  

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr

  PS C:\Users\anoop\Desktop> Get-ADSyncSchedulerAllowedSyncCycleInterval            : 00:30:00
CurrentlyEffectiveSyncCycleInterval : 00:30:00
CustomizedSyncCycleInterval         :
NextSyncCyclePolicyType             : Delta
NextSyncCycleStartTimeInUTC         : 26-05-2016 02:06:23
PurgeRunHistoryInterval             : 7.00:00:00
SyncCycleEnabled                    : True
MaintenanceEnabled                  : True
StagingModeEnabled                  : False

I was getting trouble creating a service connection point in on-premises Active Directory. This service connection point is used to “Connect domain-joined devices to Azure AD for Windows 10 experiences”. I followed the documentation to configure the service connection points in on-prem AD but was getting stuck with PowerShell Commands. I ran the PowerShell commands as per the above documentation. However, with no luck.

After that, I installed the appropriate version of the Windows Azure Active Directory Module for Windows PowerShell. Then I tried to run the following PowerShell commands, which worked like a champ!

How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
How to Sync On-Prem AD Users with Azure AD Intune ConfigMgr
PS C:\Users\anoop\Desktop> Connect-MsolService

PS C:\Users\anoop\Desktop> Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1"

PS C:\Users\anoop\Desktop> Initialize-ADSyncDomainJoinedComputerSync

cmdlet Initialize-ADSyncDomainJoinedComputerSync at command pipeline position 1
Supply values for the following parameters:
AdConnectorAccount: nair\Anoop
AzureADCredentials
Initializing your Active Directory forest to sync Windows 10 domain joined computers to Azure AD.
Configuration Complete

How to Sync On-Prem AD Users accounts With Azure AD

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 20 years of experience (calculation done in 2021) in IT. He is a blogger, Speaker, and Local User Group HTMD Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. E writes about ConfigMgr, Windows 11, Windows 10, Azure AD, Microsoft Intune, Windows 365, AVD, etc…