Does Company ‘X’ have an Azure Active Directory Tenant? • Hacker News Board

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#91

Post by hedora » Sat, Oct 01, 2022, 3:43 PM UTC

MattGaiser wrote: post #85

wsjeffro wrote: post #73

What I can’t understand is why Azure AD doesn’t have a stronger position in the consumer space. Authentication via Google, Apple, and even still Facebook are nearly always supported on customer-facing logins. I rarely see an option for Microsoft. They have a commanding position in the enterprise. What’s keeping them from crossing those enterprise boundaries?

Do enough people still use consumer Microsoft accounts? Except for myself, it has been a long time since I have encountered a hotmail address or live address or outlook address in the wild. I've gotten career advice several times to get a GMail instead, because Microsoft was considered out of date and backward (not so much anymore).

Anyone that uses Minecraft (edit: or Xbox) I'm sure it is only a matter of time until some middle manager stakes their promotion on merging it with github and/or linkedin.

Microsoft is the only company I deal with where I cannot reliably authenticate. I wish they'd just stop trying to run consumer accounts.

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#92

Post by hedora » Sat, Oct 01, 2022, 3:49 PM UTC

ab_testing wrote: post #64

PaulWaldman wrote: post #53

Microsoft is traditionally great at bundling their products. This is reminiscent of bundling Internet Explorer with Windows. Could an Okta have a claim against Microsoft similar to Netscape in the late 90's?

Having Azure AD does not prevent clients from also having Okta or any other 2FA provider for 2 factor authentication. In fact, I have worked with at least 10 clients in the last 2 years that used Azure AD for authentication but then something else for 2-factor depending on the type of apps. Sometimes even within one company, there are multiple 2FA protocols, e.g. using Oracle single sign on for ERP apps but Okta for…

Okta is a single sign on provider though.

Clearly, authenticating via Azure and also Okta would not be single sign on.

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#93

Post by haxxorfreak » Sat, Oct 01, 2022, 3:50 PM UTC

AADInternals[0] is an excellent set of PowerShell modules for pentesting and performing recon against Azure AD as both an outsider[1] and for someone who has been invited to a tenant.

It has similar functionality integrated for discovering if a domain has an associated Azure AD Tenant and enumerating information about users in the tenant, who the "Owner" is and their contact information. As with many Microsoft products there are many configuration options and plenty of them aren't secure by default.

[0] https://o365blog.com/aadinternals/ [1] https://o365blog.com/post/just-looking/

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#94

Post by RajT88 » Sat, Oct 01, 2022, 3:51 PM UTC

ab_testing wrote: post #64

PaulWaldman wrote: post #53

Microsoft is traditionally great at bundling their products. This is reminiscent of bundling Internet Explorer with Windows. Could an Okta have a claim against Microsoft similar to Netscape in the late 90's?

Having Azure AD does not prevent clients from also having Okta or any other 2FA provider for 2 factor authentication. In fact, I have worked with at least 10 clients in the last 2 years that used Azure AD for authentication but then something else for 2-factor depending on the type of apps. Sometimes even within one company, there are multiple 2FA protocols, e.g. using Oracle single sign on for ERP apps but Okta for…

Confirmed. I work with clients who use Ping and Okta for 2FA on top of AAD.

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#95

Post by abruzzi » Sat, Oct 01, 2022, 4:04 PM UTC

hedora wrote: post #92

ab_testing wrote: post #64

Earlier quoted context omitted.

Having Azure AD does not prevent clients from also having Okta or any other 2FA provider for 2 factor authentication. In fact, I have worked with at least 10 clients in the last 2 years that used Azure AD for authentication but then something else for 2-factor depending on the type of apps. Sometimes even within one company, there are multiple 2FA protocols, e.g. using Oracle single sign on for ERP apps but Okta for…

Okta is a single sign on provider though. Clearly, authenticating via Azure and also Okta would not be single sign on.

I don’t know the specific setup, but the app passes you to AAD which passes you to a SAML source (Okta in this instance, but we use Cisco Duo). The SAML provider authenticates you, sets a cookie, then sends you back to AAD, which sets its own cookie, then passes you back to the App. (Or something like that.) if the next app you sign into is an AAD app, you pass through quickly, but if the next app you sign into uses SAML directly you have a cookie set for that as well.

We use AAD for O365 and the few apps that won’t use generic SAML, but everything else uses Duo directly. The reason for this is at our O365 license level we don’t get the ability to restrict access to applications by AD group—everyone or we have to manually manage access account by account.

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#96

Post by daveoc64 » Sat, Oct 01, 2022, 4:06 PM UTC

MattGaiser wrote: post #85

wsjeffro wrote: post #73

What I can’t understand is why Azure AD doesn’t have a stronger position in the consumer space. Authentication via Google, Apple, and even still Facebook are nearly always supported on customer-facing logins. I rarely see an option for Microsoft. They have a commanding position in the enterprise. What’s keeping them from crossing those enterprise boundaries?

Do enough people still use consumer Microsoft accounts? Except for myself, it has been a long time since I have encountered a hotmail address or live address or outlook address in the wild. I've gotten career advice several times to get a GMail instead, because Microsoft was considered out of date and backward (not so much anymore).

There are lots of very popular Microsoft services for consumers including Xbox and Office 365. Combined, these have hundreds of millions of paid subscribers.

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#97

Post by GordonS » Sat, Oct 01, 2022, 4:10 PM UTC

candiddevmike wrote: post #89

wsjeffro wrote: post #73

What I can’t understand is why Azure AD doesn’t have a stronger position in the consumer space. Authentication via Google, Apple, and even still Facebook are nearly always supported on customer-facing logins. I rarely see an option for Microsoft. They have a commanding position in the enterprise. What’s keeping them from crossing those enterprise boundaries?

Microsoft's support for multiple accounts is atrocious. I can easily have 5+ Google accounts that I switch between, moving between MS accounts is awful. Additionally MS's free consumer offerings are not competitive with Gmail/Drive IMO.

It's even worse if you have personal and business accounts tied to the same email address - you never know which one you're using, or which you need.

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#98

Post by ekianjo » Sat, Oct 01, 2022, 4:15 PM UTC

daveoc64 wrote: post #96

MattGaiser wrote: post #85

Earlier quoted context omitted.

Do enough people still use consumer Microsoft accounts? Except for myself, it has been a long time since I have encountered a hotmail address or live address or outlook address in the wild. I've gotten career advice several times to get a GMail instead, because Microsoft was considered out of date and backward (not so much anymore).

There are lots of very popular Microsoft services for consumers including Xbox and Office 365. Combined, these have hundreds of millions of paid subscribers.

minecraft too

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#99

Post by tialaramex » Sat, Oct 01, 2022, 4:18 PM UTC

psanford wrote: post #37

not_enoch_wise wrote: post #27

This is the answer to the question “why can’t we get rid of passwords?”

Nah. Azure AD is one of the few IdPs that already supports FIDO2 Discoverable Credentials. You can use Passkeys with it today. You can go passwordless with it today.

Unfortunately, unless this changed too recently for me to know about it, that feature is default off and labelled "Experimental" or something.

So it's difficult (ask me how I know) for someone who knows way too much about this stuff and has implemented it themselves, to explain to "leadership" why they should change that default.

Re: Does Company ‘X’ have an Azure Active Directory Tenant?

#100

Post by logifail » Sat, Oct 01, 2022, 4:19 PM UTC

GordonS wrote: post #97

candiddevmike wrote: post #89

Earlier quoted context omitted.

Microsoft's support for multiple accounts is atrocious. I can easily have 5+ Google accounts that I switch between, moving between MS accounts is awful. Additionally MS's free consumer offerings are not competitive with Gmail/Drive IMO.

It's even worse if you have personal and business accounts tied to the same email address - you never know which one you're using, or which you need.

> It's even worse if you have personal and business accounts tied to the same email address - you never know which one you're using, or which you need

I have a friend who managed to do get into this mess, and he's still not sure how he did it.

firstname.lastname@companybizname.TLD is apparently linked to two separate identities at Microsoft, one is a business account, one is a "personal" account.

Every time he experiences any kind of login issue, this bites him :/