Search This Blog

Monday, June 7, 2021

Passwordless using FIDO2 security key with HoloLens 2

Introduction

Some time ago I was asked by FEITIAN if I would like to test their FIDO2 key. I said yes, because I am in a project where we will onboard Microsoft HoloLens’s in production, in that journey, we will make use of FIDO2 keys + Windows Hello for Business to meet our password-less journey and to make the usability much better and stay secure.

On our blog we have already written about FIDO2 and the password less journey here and here, but I wanted to put the HoloLens angle to the use case of FIDO2.

The key I am using is the K40

ePass FIDO® -NFC Series Duo-interface Security Keys | FEITIAN (ftsafe.com)

clip_image002

 

Here is some scenarios how to determine your authentication model, where we in this blog post will be focusing on the Frontline worker.

Persona

Scenario

Environment

Passwordless technology

Admin

Management tasks

Windows 10 device

WHfB and / or FIDO2

Admin

Management tasks

Mobile or non-windows

Authenticator app

Information worker

Work

Windows 10 device

WHfB and / or FIDO2

Information worker

Work

Mobile or non-windows

Authenticator app

Frontline worker

Factory, plant, retail

Shared windows 10

FIDO2


Requirements

  • AAD P1
  • Endpoint Manager
  • Microsoft compatible FIDO2 key
  • For AAD only Windows 10 1903 or higher
  • For hybrid Windows 10 20H1 or higher
  • Combined security registration
  • MFA

 

Compatible FIDO’s

Here is a list of compatible FIDO’s. You can also follow the link for more information and with link to the different vendors.

clip_image004

Source: Azure Active Directory passwordless sign-in | Microsoft Docs

Combined registration

Before combined registrations were here, users had to register one place for MFA and again for self-service password reset. Now they are “Combined” and easier to register for the users.

Go to the azure portal https://portal.azure.com/

clip_image006

clip_image008

clip_image010

 

As you can see new tenants have this setting by default. It has been like this since 15th august 2020.

clip_image012

 

Best practice is to also create a Conditional Access rule to only allow access to combined registrations from a trusted location. More about that here:

Enable combined security information registration - Azure Active Directory | Microsoft Docs

 

Enable FIDO2 security key method

Before users will be able to use FIDO as an authentication method, it must be enabled in the tenant. This can be done for all users or only for a specific group.

Sign into the azure portal

https://portal.azure.com/

clip_image013

clip_image015

clip_image017

clip_image019

 

Set settings as specified and Save

clip_image021

clip_image023

 

Seen from the user’s perspective - User registration of FIDO2

Sign into security info

https://aka.ms/mysecurityinfo/

Authenticate with your credentials

Add method

clip_image025

 

Security key and press add

clip_image027

 

You will need to provide MFA

clip_image029

clip_image031

 

Insert the FIDO key into your device

clip_image033

clip_image035

clip_image037

 

Add a pin

clip_image039

 

touch the FIDO and hold your finger on it until it prompts for a name.

clip_image041

Give it a name

clip_image043

clip_image045

Not very hard? I Think it is easy but maybe some non-techie would have trouble doing this. Luckily this is only to be done once and then the user will be good to go just using the FIDO.

 

Configuring Windows Hello for Business for HoloLens

Sign in to https://endpoint.microsoft.com/#home

clip_image047

clip_image049

clip_image051

Create profile

clip_image053

 

Choose this platform that this profile type. Press create.

clip_image055

 

Naming structure – HL2 = Hololens 2

clip_image057

 

Add settings

clip_image059

 

Before searching for your settings make sure you only search on the platform for what you need your policy to support. Add filter choose Holographic for Business

clip_image061

clip_image063

 

I’ve chosen to have a minimum of 6 pin length to level up on security.

Also, I require the device to have a TPM.

I allow the device to use security key for sign in.

Click Next

clip_image065

clip_image067

 

If you do not already have a group for HoloLens’s, you can create one and preferable a dynamic group.

Select and click next

clip_image069

 

Click next

clip_image071

 

Click Create

clip_image073

 

Windows 10 login experience using FIDO

I currently don’t have a HoloLens to do this on, but seen on a regular Windows 10 device, this is the process how to logon.

clip_image075

 

Insert pin to your FIDO key

clip_image077

 

Touch the FIDO key so it knows you are physically at the device.

clip_image079

 

Summary

To raise the security in your company introducing passwordless is a good idea. At the same time, your users might actually love it. Now the FIDO2 scenario and HoloLens 2 are a perfect fit for each other. Go try it out yourself.

Happy testing!

 

Sources:

Azure Active Directory passwordless sign-in | Microsoft Docs

Passwordless security key sign-in - Azure Active Directory | Microsoft Docs

Limiting password use | Microsoft Docs

Thursday, June 3, 2021

Block personally owned devices in Intune with enrollment restrictions

devices

 

Introduction

Today I will be looking at enrollment restrictions in Intune, which is a method to block personally owned devices. Did you know that all users (with an Azure AD P1 and Intune license) in your Azure AD by default is allowed to enroll (Azure AD join) their devices into Intune, they will then get all of your company configuration and local admin permission on the device.

So, with that in mind and looking from a security point of view, I would not recommend that all users can enroll their own devices, and I think that every organizations should consider which devices can be enrolled into their Intune environment.

I will show you how to restrict the enrollment of personally owned Windows devices for all users, but still make it possible for a few trustworthy users (e.g. IT staff)



Requirements



First some important knowledge

Before I show you how to restrict the enrollment of personally owned devices for all users, it is important to know a few things first. Like for instance that there are two types of device ownership in Intune:

Personal devices - These devices are registered in Azure AD (Azure AD registered) and enables the user to access your organizations Azure AD controlled resources - Bring your own devices (BYOD)

Corporate devices - These devices are joined to Azure AD (Azure AD joined) and enables the user to access both cloud and on-premises apps and resources - Corporate-owned devices (COD)

Visit the Microsoft Docs to read more about Azure AD joined devices and Azure AD registered devices

1


There are two locations from where you can restrict device enrollment. The first location is device settings in Azure AD, which is like a main switch it's either on or off. In device settings it is not possible to distinguish between users/type/version etc. Or create multiple groups with different settings - the field “Users may register their devices with Azure AD” will be grayed out and set to “All” when Intune is configured in your tenant.

Note. If you haven't configured Intune in your tenant, this is where you can restrict users from Azure AD join their devices.

0


The other location is enrollment restrictions in Intune, from here you will be able to distinguish between users/type/version etc. And create multiple groups with different settings - which I will demonstrate further down in this blog post.

2


It's also important to know that if you block personally owned Windows devices from enrollment, Intune checks to make sure that each new Windows enrollment request has been authorized as a corporate enrollment. Unauthorized enrollments will be blocked.

The following methods qualify as being authorized as a Windows corporate enrollment:

  • The enrolling user is using a device enrollment manager account
  • The device enrolls through Windows Autopilot
  • The device is registered with Windows Autopilot but isn't an MDM enrollment only option from Windows Settings
  • The device's IMEI number is listed in Device enrollment > Corporate device identifiers
  • The device enrolls through a bulk provisioning package
  • The device enrolls through GPO, or automatic enrollment from Configuration Manager for co-management

The following enrollments are marked as corporate by Intune. But since they don't offer the Intune administrator per-device control, they'll be blocked:

  • Automatic MDM enrollment with Azure Active Directory join during Windows setup*
  • Automatic MDM enrollment with Azure Active Directory join from Windows Settings*

The following personal enrollment methods will also be blocked:

  • Automatic MDM enrollment with Add Work Account from Windows Settings*
  • MDM enrollment only option from Windows Settings

* These won't be blocked if registered with Autopilot.

Source: Microsoft Docs



Block personally owned devices

By default all users can enroll their devices.

3


As you can see in the below picture, Annie (my wife) was able to enroll (Azure AD join) her device.

1 


But since I do not trust her social media infected devices - let's change that possibility.
Go to https://endpoint.microsoft.com/

Click on “Devices” and select “Enrollment restrictions” from the “Policy” section.
Select “All Users” in the name column for the default policy.

4


Click on “Properties” and select “Edit”

5


In this demonstration I have blocked the “Android device administrator” platform because Google is deprecating device administrator support in new Android releases. I will recommend the modern and more secure device management “Android Enterprise (work profile)” and then I've blocked all personally owned devices for all users by default.

Click “Review + save”

6


Click “Save”

7

Now that I have blocked personally owned devices in my default policy, we should only be allowed to Azure AD register our devices. Let's switch back to our two Windows 10 devices and confirm that it actually work.

First I will try to Azure AD register my device (SUNE-PC) which should still work.
Go to “Windows Settings” and click on “Accounts”

8


Click on “Access work or school” and select “Connect”

9


Enter your “email address” and click “Next”

10


Click “OK”

11


Click “Done”

12


Success! - Managed by mddprov account. My device is now Azure AD registered.

13


Let's try to Azure AD join my wife's device (ANNIE-PC) and confirm that it is now being blocked.
Go to “Windows Settings” - “Accounts” - “Access work or school” and select “Connect”

Click on “Join this device to Azure Active Directory” and click “Next”

14


Enter your “email address” and click “Next”

15


She will still be prompted to join the organization.
Click “Join”

16


Oh, something went wrong. Awesome! - bye bye social media infected devices.

17


But she will still be able to Azure AD register her devices, which is OK.

18


Some might then ask - But what will happen if you configure your mail and forget to uncheck “Allow my organization to manage my device”? Well, let's test it… So as you can see in the below GIF it will only Azure AD register your device.
azure_ad_registered_mail


If you are happy with just blocking all personally owned devices in Intune - read no further. But keep on reading if you want to know how to allow personally owned devices for trustworthy users (e.g. IT staff)



Allow personally owned devices for trustworthy users

Okay, so we have now successfully blocked all personally owned devices by default, mine included! But I want to allow myself to Azure AD join my devices (because I'm that trustworthy IT guy…)

18_1


Go to https://endpoint.microsoft.com/
Click on “Groups” and then click “New group”

19


Select “Security” as group type and give it a friendly group name and description (optional).
Select “Assigned” in membership type and select members. Click “Create”

20


Here you can see properties and membership for my security group.

21

21_1 


Now that we have created a security group with my account added to it, we then need to create a new enrollment restriction policy that allow personally owned devices.

Click on “Devices” and select “Enrollment restrictions” from the “Policy” section.  
Click on “Create restriction” and select “Device type restriction”

22


Give the policy a friendly name and description (optional)
Click “Next”

23


Block the “Android device administrator” platform like we did earlier in the default policy and click “Next”

24


Click “Next”

25


Add the newly created security group and click “Next”

26


Click “Create”

27

28


It is also possible to limit the amount of devices which can be enrolled by a user by simply click on “All Users” for the default policy or add a new policy for the newly created security group. By default this limit is set to 5 and the max is 15 devices.

29


Let's switch back to my Windows 10 device (SUNE-PC) and confirm that I'm able join it to Azure AD.
Go to “Windows Settings” - “Accounts” - “Access work or school” and select “Connect”

Click on “Join this device to Azure Active Directory” and click “Next”

14


Enter your “email address” and click “Next”

30


Click “Join”

31


Success! - Managed by OSDSune.Mindcorelab.

32

33


In Azure AD we should see that Annie's device is Azure AD registered and my device is Azure AD joined and managed by Intune.

34


And from Microsoft Endpoint Manager admin center we should see that Annie wasn't able to enroll her device as personal.

Go to https://endpoint.microsoft.com/
Click on “Home” and select “Device enrollment”

38

37


We can also confirm the result by running this command line locally on the devices.
dsregcmd /status

35

36



Summary

That's it folks. Now you know how to block personally owned Windows devices in Intune, but still allow a few trustworthy users to enroll (Azure AD join) their devices. I've explained a few important information's and shown you how to confirm and check the results.

Happy testing!

If you have any questions regarding this topic, feel free to reach out to us.