In short, WIP is a great security feature in the latest builds (Windows 10 Anniversary build and greater) of Windows 10 that allows companies to ‘containerize’ applications to ensure the integrity of corporate data.

Let’s get into the basic setup with Microsoft Intune.

Log into the Intune admin console and proceed to POLICY –> ADD and expand the WINDOWS section to find the WIP policy.

Now, this is an important part and it’s required.  So, not having the certificate will mean that your WIP policy will not work at all.  I highly recommend that you do this first before setting any of the other policy options.

Here’s a bit of documentation on what you need to do to configure this properly:

In the required Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data box, click Browse to add a data recovery certificate for your policy.

After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.

For more info about how to find and export your data recovery certificate, see the Data Recovery and Encrypting File System (EFS) topic. For more info about creating and verifying your EFS DRA certificate, see the Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate.

Next, you’ll want to start creating your app rules, I’ll give you some examples on how to deal with the formatting shortly, but when you are done your setup should look something like this.  Keep in mind you can configure both desktop applications (think products in the Office 2016 suite, notepad.exe, etc…) and Microsoft Store applications.

Here’s how to create a policy.  I’ll share the link here and it will point you to the platform you want to use (we’re just showing Intune in this blog post).  The blog article there is very detailed and shows you the various ways to get the proper ID values for apps so you can tag them for protection.

As an example, the app rule for the Microsoft Word desktop application looks like this:

Finally, you have a few additional options that you can choose from.

Now, how does this look once the policy makes it down to the device?

If you want a live demo of how this looks – you can head over to a YouTube video I recorded to check it out.  This link will take you directly to the part of the video where the demo starts playing.  https://youtu.be/nLcudXxBi_E?t=411

As you can see, the Word and Outlook applications are now ‘managed’. 

IE is also managed – but only when I go to the websites definied in the policy.  When I hit OWA as an example, this is what you’ll see in the browser.

And finally, copy/paste actions per my policy are blocked.  So when I try to copy from Word over to Google Docs as an example, I’m blocked with either a right-click paste or a CTRL-V.

Now, when you save documents to your local disk you’ll see they’ve been encrypted.

Finally, lets try to drag this encrypted doc over to Google Drive and see what happens?

Pretty cool stuff.  Enjoy!

I use a Digicert multi-domain cert for my ADFS server in my EMS lab.  It’s only a 1 year cert so I had to replace it for the first time today and thought I’d document the process.  It’s pretty straightforward…

One thing to be sure of – it may have been awhile since you’ve updated your cert and if you’ve enabled workplace join then you need a multi-domain cert to add an alternative name to your certificate.  I used this guide for ADFS when building out my 2012 R2 lab.  If you haven’t seen it – it might be helpful for you as well.  https://technet.microsoft.com/en-us/library/dn280939.aspx

You need a cert that has a private key that corresponds to the certificate.  If you don’t make sure that you export the PFX and be sure to include the private key.  It’s easy to miss this in the export wizard.

When you walk through the export wizard – make sure you choose the option to include the private key.

After you have the certificate imported into the ADFS Servers “Personal Store” then you need to make sure that you assign the appropriate permissions to the certificate.  Specifically, you need to assign full control to the ADFS service account.  If you are using a managed service account be sure to scope your search for that when assigning permissions.

Now you’ll want to bounce over to the ADFS Console to “Set Service Communications Certificate”

You can do this via PowerShell as well:

Set-AdfsCertificate -CertificateType Service-Communications -Thumbprint thumbprint
Set-AdfsSslCertificate -Thumbprint thumbprint

You’ll see all the certs in the personal store enumerated – be sure to pick the right one (there is an option to view the cert before selecting it).  If you don’t see your cert it means you didn’t import it correctly or there’s no private key that corresponds to the cert.

Now you need to open PowerShell to run a few commands.

Run Get-AdfsSslCertificate.  Make a note of the thumbprint of the new certificate.

WARNING!!!

You might run into what I did which is what was messing me up and prompted me to author this article.  For some reason for me when I issue the Get-AdfsSslCertificate command it still showed my OLD certificate – not the new one that I just updated with the set service communication certificate step above.  You’ll need to confirm this by going into the certificate store and looking at the details of the certificate you set to be the service communication cert to see if the thumbprint there matches what you see with the GET command.  In my case, it didn’t match.

At this point you want to take that hex and paste it out to notepad and then remove all of the spaces and then when you issue the SET command make sure to paste that value for the CORRECT certificate in as the thumbprint.

Next run Set-AdfsSslCertification –thumbprint XXXXXXXXXXXXXXXXXXXXXX

Restart the ADFS Service (restart-service adfssrv)

The Powershell for all of this (including installing the role/feature) is:

Install-WebApplicationProxy -FederationServiceTrustCredential System.Management.Automation.PSCredential -CertificateThumbprint 'thumbprintwiththequotes' -FederationServiceName 'adfs.getmobile.mobi'

OPTIONAL: Using a Web Application Proxy Server

Now if you are using a Web Application Proxy Server in front of your ADFS Server you need to do a few things.

I used the MMC console to see the certificate store on my ADFS server to export the PFX with the private key (make sure you do that!) so that I could import that key over on my WAP server.  Once you have that PFX just copy it over to the WAP and click on it – make sure that you import it into the PERSONAL STORE.  You can then open the MMC console to see the certificates there and make sure that it has been imported properly to the WAP.

Now at this point you should be able to run a PS command to replace the SSL cert and then restart the adfssrv on the WAP and you’re good to go.  For whatever reason that didn’t work for me so I just removed/reinstalled the WAP feature.  If you already have published web applications those won’t go away.  When you reinstall the WAP feature you’ll see your list of published apps show back up.  Basically, just walk through the wizard setup for the WAP again and then select the certificate we’ve been talking about from the list when the setup asks you.  That worked like a charm for me. 

You can try the PowerShell commands here – hopefully they work for you:

Set-WebApplicationProxySslCertificate -Thumbprint thumbprint (the thumbprint is the same as the one we used above so you should be able to just copy and paste.  If you want to get it again you can issue the GET instead of the SET to see the thumbprints for the certs)

You’ll need to restart the service on the WAP:  Restart-Service adfssrv

Good luck – hope that gets you going!

One thing I see missed a lot, especially in PoC’s where the customer may not already have O365 setup and public DNS records configured is a missing CNAME for manage.microsoft.com.  Since Intune is a cloud service we need to redirect the devices trying to communicate with Intune via your custom domain to hit manage.microsoft.com.

Full documentation can be found here but I’ll paste in the relevant part.

Stage 1: Sign Up: https://blogs.technet.microsoft.com/configmgrdogs/2015/03/30/the-ultimate-intune-setup-guide-stage-1-sign-up/

Stage 2: Configure Your Public Domain: https://blogs.technet.microsoft.com/configmgrdogs/2015/03/10/the-ultimate-intune-setup-guide-stage-2-configure-your-public-domain/

Stage 3: Sync Accounts From On-Prem: https://blogs.technet.microsoft.com/configmgrdogs/2015/03/30/the-ultimate-intune-setup-guide-stage-3-sync-accounts-from-on-prem/

Stage 4: Enable ConfigMgr 2012 R2 Management: https://blogs.technet.microsoft.com/configmgrdogs/2015/03/30/the-ultimate-intune-setup-guide-stage-4-enable-configmgr-2012-r2-management/

There are quite a few “Stage 5’s” all covering various device enrollment scenarios: https://blogs.technet.microsoft.com/configmgrdogs/?s=stage

Some other documentation that I find helpful here:

Official Intune Documentation Library

Setting the Management Authority for Intune

Official Microsoft Intune Team Blog (A MUST to bookmark/RSS)

https://www.acloudabove.com/2016/02/17/configure-apple-vpp-intune/

Thanks Rich!

You can check your tenant to see if VPP is available by looking here in the Intune portal:

I switched out from the NVG router that was not working well for me (random reboots, packet loss, etc…) today and just thought I’d document the procedure for setting up devices with static IP’s.  I had a nice tech show up and do some diagnostics on my equipment…but even he didn’t know how to setup the IP addresses.  I’ve even talked to several folks at ATT tier-2 support that weren’t much help.  So, hopefully this helps you if landed here.

So, basically here’s the device we’re working with:

On the back you’ll see the Model Number:

The new router uses 192.168.1.254 to login just like the NVG.  Once they do their testing it should work fine for basic connectivity – internet browsing, etc…

The GUI is a bit different than the NVG in terms of finding the spot to enter your static IP range and then configuring it by ‘allocating’ the IP.

If you go to the SETTINGS –> BROADBAND tab you’ll see the option to add a ‘supplementary network’.  That’s where you’ll enter the router address and mask that ATT provides.  In the NVG you needed to enter starting and ending IP’s – you don’t have to do that here.

After you save that configuration then go over to the SETTINGS –> LAN –> DHCP tab.  About half way down you’ll find this.  Here’s where it gets tricky…

In order to “allocate” the static IP then adapter has to pick it up via DHCP first.  You can’t set it statically on the adapter itself.  If you do, it won’t work.  You have to leave the NIC set for DHCP but it has to get an IP from the public range to for the allocation to work properly.  I tried letting it get one from the private pool and then  mapping it to a public IP but it balked at me and gave me some error.  So, maybe yours will do that – mine didn’t.

Anyway, the tricky part here is that you probably want to have as few devices connecting to your network as possible and certainly nothing else that’s going to pick up an IP via DHCP while you are attempting this.

So, here’s what I did.  In my case I was setting up a NIC in a Windows Server 2012 R2 VM that has RRAS installed and is the endpoint for my Azure S2S VPN.  So, I went into the NIC properties and disabled it (it was set to get its IP via DHCP).  I went over to the web GUI and switched the DHCP from private network to public routed network and then saved the configuration.  Once it was saved, I went back over the to the NIC properties in the VM and enabled the NIC.  It went to pick up a DHCP address and grabbed the first available public IP in my static range.

SUCCESS!

Now you have to ‘allocate’ it.

If you scroll through the list you’ll see your public IP connected device.  It will say connected DHCP and then you’ll probably want to disable the firewall.  You’ll leave the address assignment set to public but then you’ll pull the WAN IP Mapping drown down and select the IP address out of the range you have available.   Hit save at the bottom and then it will tell you if the configuration was saved successfully or not.  Hopefully it saved.

At this point you should be able to go back to the NIC and refresh it – do a /release /renew or reboot the machine/VM or whatever and it should come back up every time with your static IP reservation.

If you go to SETTINGS –> LAN –> STATUS you can see a list of connected devices/IP’s/details.  My public IP shows up there and I can see some detail:

Anyway, good luck.  Hopefully someone else who runs into this will find this blog and get a little help from it.  It’s not rocket science of course – just weird how you have to set this stuff up.  The NVG wasn’t all that different in terms of having to change the router settings to supply DHCP from the public range and allocating, etc… but I think I like this setup a little better.

FWIW, this router is WAYYYYY better than the NVG.  It’s 802.11AC so the wireless speeds are superfast.  I have U-Verse GigaPower so I get around 900’ish Mbps up and down on wired connections and about 250Mbps up and down on devices that I can connect to the 5GHz radio.  This router also does ‘guest’ wireless access as well.  It basically has a ‘DMZ” network (172.x.x.x) that it sticks guests so that they can’t snoop your 192.x.x.x while they are on your wireless.  So, I like that.

Good luck!

First of all, here’s the ‘official’ documentation for ATA.  It’s worth walking through that as I won’t really detail the setup process here since I’ve already done that and don’t have the screenshots.  The setup/install for ATA is very straightforward although I’ll provide a few tidbits here that might help you not run into the same snags I did getting this up and running.

ATA Deployment Guide

ATA Architecture and Capacity Planning

ATA Operations Guide

ATA FAQ

ATA Technical Discussion Forums

If you need the 90 day trial bits – you can grab those here: https://www.microsoft.com/en-us/evalcenter/evaluate-microsoft-advanced-threat-analytics

They are also on MSDN as well if you are a subscriber there (along with a key you can use):

An example ATA Topology might look like what is represented in this diagram.  But, the gist here is that you NEED to have both the ATA Center AND the gateway and they can’t be the same server.

The capacity planning guide (linked above) will give you an idea how to size your servers:

In my lab I’m running everything (DC, ATA Center and ATA Gateway) all in Hyper-V VM’s.  I happen to be using the Windows Server 2016 Tech Preview 4 but most folks will, at least at the time of this writing, use 2012 R2 which will work fine of course.  It is required to run 2012 R2 – 2012 R1 is not supported.  The key here is that you’ll need to enable port mirroring on both your DC and ATA Gateway VM’s so keep that in mind.

NOTE: As of this writing using ATA in Microsoft Azure is not supported.  So, if you have domain controllers in Azure you will not be able to configure the port mirroring (or the gateway servers for that matter) since those virtual switch capabilities are not exposed.  The product teams are working on this so stay tuned…

Tip/Trick: I happen to have DC’s in both Azure and “on-prem” in my environment and have a site-to-site VPN connection pinned up so that they can communicate.  I run my ATA demo Windows 7 VM’s on the same Hyper-V host as my ATA Center and Gateway VM’s and the Windows 7 VM’s are set to talk to the IP address of the DC/DNS server sitting on the same subnet so my ‘attacks’ are always against the local DC.  If you have DC’s in Azure just make sure you configure AD Sites so that clients communicate with local DC’s first.

When you are installing the ATA Center you’ll need a VM configured with either 2 NIC’s or a single NIC with 2 IP addresses.  If you are going with the single NIC configuration you can get more information on how to set that up in the Operations Guide.  Modifying the Console IP Address should help you.  One of them is to connect to the console and the other is for ATA management.  Make sure you notate the IP’s correctly when you get this setup.  Read the deployment guide as well – there’s a Windows Server hotfix that needs to be applied or you’ll have issues.

Now, on the DC go to the network settings on the VM and enable port mirroring and choose ‘source’ from the drop down.

On the Gateway VM you’ll connect to the ATA Center console IP address and then download the gateway installer components.  Follow the instructions per the deployment guide for installing – it’s pretty straightforward.

The thing here is – you’ll need to 2 NIC’s on the Gateway VM.  In this case, you’ll need 2 NIC’s – not a single NIC with one IP address like you can do with the ATA Center.   Configure one for LAN and the other for CAPTURE.  I like to name the NIC’s just to keep track easily.

On the CAPTURE NIC you’ll want some ‘dummy’ information in there.  Pick an  IP/subnet that is not routable and no DNS.  Here’s what I did:

On the gateway server you’ll need to enable port mirroring on that CAPTURE NIC.  Make sure you pick the right one – in the Hyper-V settings I always look for the MAC address and then do an ipconfig in the VM to match up which NIC since it’s not blatantly obvious in the settings which one is which.  Make sure you choose ‘destination’ from the drop down.

In the ATA web console you’ll see the option to check the appropriate capture NIC:

You may need to check to make sure that the ATA Service is running at this point on the gateway.

Now you’ll want to make sure that you configure event forwarding on your DC so that Event ID 4776 (which deals with Pass the Hash) gets forwarded to the ATA Gateway.  These steps are also documented in the installation guide (although with no screen shots or details so it can be a bit confusing to figure out what goes where)

On your DC open the event viewer and create a new subscription.  In the ‘select computers’ make sure you select your ATA Gateway.  Then in the query filter choose the following options:

As the deployment guide states – check the perfmon counters to make sure your gateway is installed correctly.

The one that will tell you whether or not the gateway is the network listener / captures messages per second:

When you add that counter you’ll start to see some activity there:

At this point you should be able to login to the console and over on the right hand side you’ll see that ATA will start picking up some information about your environment:

You should also be able to use the ‘search’ box to look up users/computers, etc…

At this point we can do a few tests to check and make sure our environment is working properly.  ATA will take 21 days to really learn your environment so you won’t see pattern behavior type activity for a period of time because ATA is in learning mode.  However, there are quite a few attacks that will show up immediately.  Here’s a few you can use to do some testing or demos:

Pass the Hash:

I won’t walk through all the steps – it’s pretty well documented on how to do this.  Easiest way to test is with Windows 7 since newer OS’s have features to combat this.  Best way is to watch this video from TechEd with Mark Russinovich and Nathan Ide.

https://www.youtube.com/watch?v=7hmTElGFWA0

DNS Recon:

Open a CMD window and do an NSLOOKUP against your protected DC:

nslookup –dc.domain.com

Now do this:

ls domain.com

You’ll see all your machines enumerated in the window.  Now lets go check out the ATA Console:

We can see here that I ran this a couple times.  Once at 11:33am and again for this demo at 12:28pm:

Let’s try something else…

Remote Execution:

Download the PsExec Tools from TechNet: https://technet.microsoft.com/en-us/sysinternals/bb896649.aspx

From a member server in the domain run the following command:

PsExec.exe \\DC01 Ipconfig

(DC01 of course represents one of your protected DC’s)

You’ll get an ipconfig from the DC.  In your ATA console you’ll see this:

Finally let’s log into a PC with the honey token user account:

If you followed the directions in the ATA install guide you have your honey token account setup. Typically this is the good ol’ DOMAIN\Administrator account.

In my case, I have a user called ‘admin’ and I just logged into one of my Windows 7 VM’s with that identity.  This is what shows up in the ATA console:

So there you go!  ATA is really a pretty easy product to install and get especially when you consider the kind of information and insight it provides.  Hopefully this helps you on your way to getting ATA setup and configured properly and if you are like me and doing demos and such this gives you a few things that you can show off in real time.

On a side note – I found a cool app to populate pictures in AD.  Not really a requirement here – but if like me, you are in lab environment and doing demo’s it’s nice to add some context to the interface.  I don’t have SharePoint or Exchange running in my lab so some of the ways to populate this aren’t available to me.  So, check this site out – free download and you’ll have some fun pictures for your test users.

https://www.codetwo.com/freeware/active-directory-photos/?sts=1687

Have fun!

Log into your Azure subscription and navigate to Azure Active Directory.  From there add an application.  You’ll want to choose the middle option to create one from the gallery.

You have the ability to search through the gallery for applications or if you know it’s not in there – just choose the ‘custom’ option as highlighted and enter the name that you want to appear in the https://myapps.microsoft.com portal for your users.

Once added choose the “configure SSO” option.

In our case the application just requires a username and a password so we’ll choose the “password SSO” option.  In our example we are going to pre-populate the credential so that all users would use the same login to sign in.  You of course have the option to allow the users to self-service that credential as well.

The next step is to provide the URL to the sign-in page.

Now AAD will want to ‘capture’ the login fields for us.  Click the “click to sign-in” link and it will open the web page where you will then place your cursor into the username field and enter a credential.  Your credential is not store here – AAD is just using it to verify the appropriate fields.

Click on the username field and enter a credential.  Same for the password then login.

AAD will ask you to save the login details.

Now you’re back in the Azure portal where you will click the ‘sign-in succeeded’ check box and continue on.

On the next page you have the option to view the fields that were captured.

Now you’ll want to assign users access to the application in Azure AD.  Pretty straightforward here.  As I mentioned in my scenario I’m going to pre-populate a credential that all users will use when the access the application.

Now when my users accesses the MyApps portal (https://myapps.microsoft.com) they’ll see the custom application available to them.  When they click on it, they will be signed in using the credential the Azure administrator defined in the previous step.

Voila!  Success!

A few advanced options that are available…if you go into the ‘configure’ tab…

You can do things like:

• Add a custom logo
• Configure MFA on a per-application basis
• Allow your users to self-service their own access to your custom application

The “Ultimate” EMS lab is going to try to emulate a real-world customer environment in most every way possible .  You obviously want to be able to connect to the various services like Office 365, Intune, Azure Active Directory, enable SSO, mobile device management and such and also have the ability to enable some of the more advanced scenarios like lighting up MFA on premise scenarios and RemoteApp.  The only EMS feature that I really don’t do anything with in my environment is FIM (Forefront Identity Manager).  For the most part, that is really a completely different discussion and I am lucky to work with some really great SI Partners who have a lot of practical experience with FIM and identity management in general.  So, when the conversations go down that path – we bring in the experts here.

Anyway, on the last pass through I took a bunch of notes and screenshots and figured I’d share as much as I can here.  This isn’t really a step-by-step walkthrough guide covering all things EMS, but more of a resource guide pointing to places where you can get the right information and some of my own experiences, gotcha’s and such that hopefully save you a little bit of grief if you embark on this journey.

I’ll also link here the primary deck that I use to drive these conversations.  I don’t like to show a bunch of slides, but I’ve found there are a handful that need to be used.  Keep in mind, this deck is current feature/functionality wise as of the date of this blog post.  I’ll try to remember to keep that link updated but if not, just back out to the main folder of the OneDrive site and search for content by date updated – it should get you the latest/greatest.

I would also point you to a YouTube channel I setup where I have recorded demo/walkthrough videos.

Enterprise Mobility YouTube Channel

12 Minute EMS Demo: I recorded this video showing a very high level 12 minute walkthrough of the most common scenarios that get covered during these demos.  In the following blog post, I’ll give you some ideas of how to build the same demos in your lab environment.

As it sits today (and by tomorrow this will likely be slightly different…adding/changing things as I go…) this is the 10k foot view of what I’m running in my EMS lab.

Run it in Azure – or – Keep it ‘On-Prem’?

The first time around, I ran everything ‘on-prem’.  I have a nice HP Elitebook with an i7 CPU and 16GB of RAM.  It was more than enough to do everything I needed (and I still use it as you can see in the diagram above – and it’s nice to have especially for the RemoteApp, Azure Application Proxy and other scenarios where you want to show what you can do with a site/branch connected to Azure).  I installed Server 2012 R2 on the host, enabled Hyper-V and turned it into a DC.  (I hate having my only DC in a self-contained lab like that as a VM…if the host reboots and the DC VM doesn’t start…you are hosed!)  I ran all the VM’s in Hyper-V, including a RRAS VM that I used to pin up a site-to-site VPN to Azure.  I also have the luxury of a reeeealy nice internet connection.  I use ATT Gigapower at home and have a more than adequate pipe to run all of this as well as pin up a high performance VPN.  I also have a small subnet of static IP’s so I was able to assign an IP to a Server 2012 R2 VM running RRAS to act as a VPN endpoint without having to worry about poking holes in the SOHO firewall.  Also, many of the SOHO firewalls don’t pass GRE or other IP protocols required for VPN connections so many folks trying to get an on-premise setup going through their SOHO firewalls run into a bunch of problems.  For fun, here’s the speed test for my home internet connection. :)

My 2nd iteration I moved a couple things to Azure but had ran into a weird problem trying to run AD and ADFS on the same D2 sized VM.  Pretty much immediately after I had ADFS installed and configured just about every reboot would leave the login stuck at “please wait…” and I’d never actually get in.  I could force a hard restart in the Azure portal but that would take forever and even then there was a percentage of time where the login would stick at “please wait…” or I’d get in but the ADFS service would stick at ‘starting…’.  I thought there was just something weird going on in that setup but when I started the 3rd iteration and I setup that first VM exactly the same (AD and ADFS on the same box) and ran into the exact same issue.  So, lesson learned there.  I separated AD and ADFS and haven’t had any problems since.  I never actually figured out what the technical problem was with this configuration – I just moved on.  AD and ADFS is supported on the same server so it shouldn’t be an issue – there just must have been something with my exact configuration that was causing some problems.  Either way, just an FYI…

The obvious advantage of running the core workloads in Azure (AD/ADFS/WAP) are fairly straightforward and really the same reasons any customer would want to run this stuff in the cloud.  It’s highly available, great internet connectivity that’s not dependent on your home network connection being up, it’s easily accessible and it’s just nice having everything in the same spot when you are doing demos…if you are in the Azure portal  you can get to everything.  The downside I guess is that you have to pay for it on a monthly basis vs just using the internet connectivity you are already paying for at your house/office and using paid for resources like laptops or servers for the virtualization hosts.

I do run into situations from time to time where customers have blocked outbound access to RDP ports.  If that’s the case, you could setup a RD Gateway host either in Azure or on-prem so that you can get RDP access via SSL.  Another cool scenario to enable here would be to integrate the RD Gateway with the on-prem MFA to force a 2nd factor authentication against the RDS login.  It’s a cool scenario to demo and can also be quite practical for the reasons previously mentioned.  Here’s a link to the best guide that’s out there now on how to set this up:

https://www.rdsgurus.com/uncategorized/step-by-step-using-windows-server-2012-r2-rd-gateway-with-azure-multifactor-authentication/

I’ve also published a PPT presentation with screenshots showing what you need to configure to get this up and running as well.

For me, I have access to a couple Azure subscriptions (MSDN and a Microsoft Internal) and I had enough capacity to run 3 smallish sized VM’s just about 24X7 along with a VPN and a few other services without tapping out my capacity.

Here’s what I’m running in Azure:

• Domain Controller / IIS / MFA Server on an A3 sized VM.  In additional to DC/DNS duties this VM runs IIS and hosts the Azure MFA User Portal, SDK and Mobile Site.  I also setup a ADFS sample claims app here to do some testing/verification that I had ADFS setup correctly.
• ADFS/MFA Server on a D2 sized VM.  This VM is really only running those two server services but it’s also the VM that I remote into to drive the demo.  So, I have the consoles installed here, all the remote administration tools for AD, DNS, Hyper-V, etc… RDP shortcuts to all the other VM’s in the lab, Azure and Azure AD Powershell, etc…  I also run Azure AD Connect from this VM as well.
• WAP Server on an A2 sized VM.  This thing pretty much just does WAP.  I had it on a A1 VM the first time around and it worked but it was dreadfully slow remoting into and trying to get anything done on it.  Really though, once you get it setup you won’t do much here so you could get it setup with a bigger sized VM and then downsize it once you are ready to put it in production.
• Non-domain joined Windows 8.1 machine.  I use this to run most of my end-user experience demos.  From here I access the myapps.microsoft.com application portal and show how a user can connect to a “BYO” device and get access to corporate resources using their hybrid identity.  I also show how a user can do a self-service password reset, the RemoteApp client experience, various MFA scenarios, etc…

A few things to note:

• Static IP’s.  You’ll want to at least assing a static IP to the DC’s you have running in Azure.  This is easy to do in the new portal.azure.com preview portal.  Just dig into the VM and set the static IP.  You can also do this via powershell as well.
  • https://azure.microsoft.com/blog/2014/04/22/static-internal-ip-address-for-virtual-machines/
  • Or via the portal.azure.com preview portal:

• Before you get started provisioning VM’s in Azure you need to determine whether or not you are going to get a site to site VPN up and running.  The reason for this is that you’ll need to provision the VM’s that you want to be able to communicate across the VPN into that virtual network.  So, if  you get everything up and running and then decide later that you want to create a VN for a VPN…you can’t just move the VM’s over.  So, take that into consideration before you get started.
• Provision all the VM’s into the same cloud service?  You can, but be aware that only a single VM in the same cloud service can sit on an endpoint.  So, if you want to publish SSL for example on 2 of the 3 VM’s and you set them all up in the same cloud service – you won’t be able to.  I figured I could get away with setting them all up in the same cloud service but just opted to create a unique one for each VM just in case I needed to open other endpoints at some point in the future.

What’s Running “On-Prem”?

• Well, everything else. :)
• Here’s what I setup:
  • 2nd Domain Controller.  If you do this, be sure to follow a guide like this – or something similar – that gets your replication right across multiple sites.  If you don’t then your DC’s will be chattering across the VPN just like they were sitting in the same rack plugged into the same switch.  Might not be a big deal to you, but if it is then you’ll want to get AD configured correctly.  There’s also a helpful GUI tool to make sure your AD replication is working properly.  I run it from time to time just to make sure that my DC’s are healthy and able to communicate across the WAN.
  • SQL Server 2012.  Need this for all kinds of things.  Mainly for me it’s SCCM 2012 R2 that I have setup to drive an Intune hybrid configuration.  But a lot of stuff needs SQL so might as well have it ready.
  • SharePoint 2010:  Nice demo for the Azure Application Proxy (and it needs that SQL Server…)
  • RRAS Server:  Windows Server 2012 R2 server running RRAS to pin up the VPN’s for site to site and the RemoteApp VPN.  I authored a blog recently on how to get this setup in your environment – it’s dead simple with Server 2012 R2.
  • Domain joined Windows 8.1 client machine.  This is helpful to show SSO ‘behind the firewall’ scenarios.  For customers who don’t have ADFS or haven’t used it – it’s nice to be able to show what SSO looks like for someone that’s on a domain joined machine or connecting behind the firewall.
  • SCCM 2012 R2 with CU4.  Not really much else configured here except for the connection to an Intune tenant.  Make sure you have the latest/greatest cumulative update release for SCCM installed – at the time of this writing it’s CU4 for 2012 R2.
  • Android x86 Emulator in Hyper-V. 

The process:

It can be overwhelming trying to figure out where to start here.  Here’s how I approached it.

• Get your O365, Intune, Azure AD Premium tenants all setup.  Ideally, you’ll use the same Azure AD backend for everything.  I started with O365, like most customers do.
  • Provision an O365 E3 trial – take note of your global admin credential.  It will be something like admin@yourcompany.onmicrosoft.com.
  • You really want to setup a custom domain name.  Head over to GoDaddy or similar and get one.  I grabbed getmobile.mobi and set all that up using O365.  It’s nice because O365 has a direct tie-in to GoDaddy – so you just provide your GoDaddy credentials in the O365 admin portal and it goes out and provisions all the DNS records you need to get mail flowing.  If you don’t get a custom domain you’ll probably have trouble getting the mail flow working properly.
  • Now take that same credential and go login to the Intune portal and setup a trial there using the same credential.  Now both will share the same Azure AD backend.
  • Now in your Azure subscription go to the Azure Active Directory section and click on NEW and take all the defaults to create a new Azure AD tenant…EXCEPT…choose the option to add a directory that’s already been created so that you can bring it into the Azure portal for management.                                                                                                                                                                                                                                                                                  

• Now you’ll see the ‘yourcompany.onmicrosoft.com’ tenant in your Azure portal.  You can now go to the license tab in the Azure AD tenant and enable AD Premium.

• It’s worth mentioning that you need to assign an AD Premium license to not only the users but also to the admins that are logging into the portal.  If you don’t, then the admins will not be able to see the premium features available in the ‘configure’ tab for the directory.
• OK, now you have all your tenants setup using the same Azure AD backend.  Now it’s time to build out the main components of the lab.
• Another cool by-product of this arrangement is that you can provision the licenses for all these services for each user in the O365 portal at one time. 

Building out AD/ADFS/WAP

• Certificates: If you have access to a public signed certificate for your lab (say a wildcard or SSL cert) then it will make your life easier.  I use DigiCert and create a handful of SSL certificates for my ADFS server, WAP and SCCM servers so that I don’t have to use self-signed certs or use the AD certificate services.  If you don't then the guides below will help you understand what you need to have from a cert perspective but it’s one of those necessary evils that  you have to have in place for this lab to work (The WAP can ONLY accept HTTPS traffic, for example) so there’s no way to work around it.
• Active Directory:  Not much to say here – this process is pretty well documented and cut and dry.  One thing I did though to make my life a bit easier was use the same internal AD domain as the internet domain name I acquired through GoDaddy.  So, for me I use GETMOBILE.MOBI both inside and outside.
  • SMTP Proxy Address:  If you aren’t running Exchange on-prem or haven't gone through the AD schema prep for Exchange on-prem then you won’t be able to assign your O365 users a primary SMTP address that matches the custom domain you setup in O365/Azure AD.  This causes problems sending email from your demo accounts because their primary SMTP is an xyz.onmicrosoft.com account which typically ends up with NDR’s.  The way around this is to setup a proxy address for your demo users you synch up to Azure:

• UPN’s.  Ugh…these can be a pain.  To get your users to sync to the cloud there needs to be a matching UPN in on-prem AD.  The easiest way most folks solve for this is to create a alternative UPN in the AD Domains and Trusts tool.  This way it gets created automagically for all your users.  For me, I don’t run into this because my local AD name matches my Azure AD custom domain so it just works.

• Azure AD Sync/AD Connect:  Download the latest version of whatever sync tool is up to date at the time you are building your lab.  As I author this – the latest “GA” tool is Azure AD Sync.  However, the Azure AD Connect Public Preview 2 was just released and that’s what I’m using in my lab (I upgraded AAD Sync).   The process here is very straightforward (the new AD Connect tool provides quite a few additional features that you may or may not want to use – including the ability to configure your ADFS/WAP servers.  I’ll let you do the research here to figure out what’s the best tool for you.
  • Once I get the tool installed I throw a few shortcuts on to my desktop.
    • For AD Synch put a shortcut to the Sycn Manager Tool on the desktop for easy access.  "C:\Program Files\Microsoft Azure AD Sync\UIShell"

• They also include a cmd file that allows you to do a full synch when needed vs waiting the 3 hours it takes on it’s own.   This is great if you are adding some new users/changing things and need AAD updated immediately.  I throw a shortcut to this out on my desktop as well.  "C:\Program Files\Microsoft Azure AD Sync\Bin\DirectorySyncClientCmd.exe"
• ADFS:  There’s an exceptional lab guide HERE.  Every time I’ve setup my lab I’ve used this guide and followed it step-by-step and everything works.  One thing to note here – it’s a best practice to NOT name your ADFS server (as in the HOSTNAME) the same as federation service name you choose during the ADFS configuration process.  It causes SPN issues, etc… that I won’t go into here.  But suffice it say if you give your ADFS server a hostname of ADFS.DOMAIN.LOCAL then name the federation service something like STS or FS…not ADFS.

• Rhoderick proves another good ADFS setup guide here as well. 
  • Part 1: Setup of ADFS: https://blogs.technet.com/b/rmilne/archive/2014/04/28/how-to-install-adfs-2012-r2-for-office-365.aspx
  • Part 2: Web Application Proxy Configuration: https://blogs.technet.com/b/rmilne/archive/2014/04/28/how-to-install-adfs-2012-r2-for-office-365_1320_part-2.aspx
  • Part 3: Federating with O365 / SSO: https://blogs.technet.com/b/rmilne/archive/2014/04/30/how-to-install-adfs-2012-r2-for-office-365-part-3.aspx
• WAP: For WAP, I’d use the Part 2 of Rhoderick’s guide linked in the section above this one.  It’s a pretty straightforward setup.

Lab Guides for Additional Scenario’s:

Here are some configuration guides/tips and tricks for some of the additional components that you’ll setup in your EMS lab:

• MFA
  • There are a few options here.  In my lab, I brought the MFA Server down on-prem so that I could leverage the ADFS Adapter and light up additional MFA scenario’s for intranet/extranet, AD security group and device registration.  You can also set this up and demo it from the cloud.  Here’s a good guide detailing that process:  https://blogs.technet.com/b/ad/archive/2013/10/10/getting-started-with-windows-azure-multifactor-authentication.aspx
  • Dave Harris has a nice guide here on how to setup the MFA Server on-prem and get the mobile app working.  https://dave.harris.uno/installing-and-configuring-azure-multi-factor-authentication-mfa/
  • Here is the official Azure MFA Documentation.  https://msdn.microsoft.com/en-us/library/azure/dn249471.aspx
• Azure RMS
  • I show these primary scenarios around Azure RMS.
    • How to enable RMS in O365, how to configure a new template in the Azure Portal along with the various options available, how to publish and then how the client connects to and can use the templates that get published.
    • Securing an O365 SharePoint site using RMS.  I enable RMS for a document library on a SharePoint site and show how anything that gets saved there automatically has a policy applied.  So, if I download that and try to open it on a non-domain joined PC then it prompts for AD credentials to access.
    • RMS Sharing.  I detail the user experience of how someone can share RMS protected information with an external user.  This isn’t possible using the Windows Server RMS services since it’s so tightly integrated with on premise AD.  However, with the RMS Sharing (this service is really called RMS for Individuals) its easy to get setup so that anyone can share protected information.  This is not an EMS feature – but it’s lit up using Azure AD on the backend and it’s a relevant demo – a lot of folks are trying to solve for this these days and to be able to do this for free is pretty compelling.
    • EMS provides for some additional document tracking/management capabilities around RMS.  I show these in the demo.
• Microsoft Intune
  • In my lab I have 2 Intune subscriptions configured.  The first is a “Cloud Only” meaning that I have to connect to the Intune Admin Console online to configure the settings.  The other in what’s referred to as Intune “Hybrid”, meaning I’ve connected SCCM 2012 R2 to the tenant using the Intune Connector in SCCM.
  • I demo the common scenarios:
    • device enrollment
    • application management using the Office Apps with integrated Intune MAM
    • policy configuration
    • conditional access scenarios
    • device management (selective wipe, etc…)
    • UDM with SCCM 2012 R2
  • It’s obviously helpful here to have an iPad / Android device for testing.  I tried using the iPad emulator and didn’t have a great experience with that.  So, I bought an iPad to drive the demos and it works great.
  • I use an app called Reflector that allows me to share the iPad screen when I’m doing remote demos via Skype for Business with customers.
  • I linked it above somewhere – but you can setup an Android device on a Hyper-V VM using bits from android-x86.org.  Android x86 Emulator in Hyper-V
• RemoteApp
  • If you have the ability to pin up a VPN then I’d highly recommend getting RemoteApp up and running.  It’s well documented and pretty easy to get setup.  https://azure.microsoft.com/en-us/documentation/articles/remoteapp-create-hybrid-deployment/
  • The hybrid deployment allows you to publish the clients for LOB apps and the VPN ensures that they can connect to the backend servers on the other end of the VPN.  In my lab, I’ve published things like the SCCM Management Console and SQL Server Management Studio to show how I can connect to those using my AD credentials and an iPad or a Windows 8.1 client.

• There is also an option to create an O365 RemoteApp Collection.  This is nice if you have that O365 tenant already configured.  You can assign O365 users to the collection and now they can connect to the RemoteApp client, use the Office applications and connect to and save content out to OneDrive for Business.  This is a fun demo on an iPad.

• Azure Application Portal / SSO
  • This is one of the most common scenarios and folks like to spend a lot of time here walking through the features in the portal (what do you get with AAD “Free” vs AAD Premium, etc…), how to setup the hybrid identity (Azure AD Connect), how to federate to various applications and make those accessible to the end users.

• I like to emphasize how it easy it is to add Azure AD Premium to those existing O365 customers.  They just need to bring their Azure AD backend for O365 into the Azure portal for management (discussed in this blog post previously) and turn on the AD Premium license.  Once they do that they have all kinds of additional scenario’s available to them.
• This demo changes frequently based on the new features that are showing up in preview in the Azure portal.  I basically walk through the ‘configure’ tab in the AAD Premium tenant to show all the various features and how they work.  So, things like Self-Service Password reset, Azure Application Proxy, etc…
• Salesforce.com – Sign up for the Salesforce.com developer program.  You’ll get access to a tenant that you can then setup for federation using Azure.  https://developer.salesforce.com/
  • Here’s a hard link to the Salesforce.com SSO tutorial to get an idea of what you’ll do here.  It’s a great demo showcasing how a customer can do all the SAML federation/SSO plumbing work in Azure.  https://msdn.microsoft.com/en-us/library/azure/dn308593.aspx
• Azure Application Proxy
  • It’s definitely worth getting this setup – and it’s easy to do.  This is one of those features that not many folks know about and a lot of customers are very interested.  The AAP started out as just a pretty simple reverse proxy with pass-through only capabilities – now it’s quite impressive with new capabilities being added constantly.  You can setup the AAP to connect to whatever you want behind the firewall without the IT Admins having to touch an internet connected endpoint.  I publish a default IIS page and SharePoint 2010 site behind my firewall and make that accessible via the myapps.microsoft.com portal.
• Azure Connect Health Service
  • Awesome new service for Azure AD Premium customers.  Check it out via the blog posting here.  It’s a great demo to show customers running an ADFS/WAP infrastructure the tools available to monitor that environment (have to use the new preview Azure portal to configure this):  https://blogs.technet.com/b/ad/archive/2015/01/29/azure-ad-conditional-access-and-azure-ad-connect-health-now-in-preview.aspx
• Self-Service Password Reset
  • There’s not much to this one to setup – but it’s a great demo and a tool/resource that a lot of customers are very interested in.  I show how you can force your users to setup a profile when they access the myapps.microsoft.com portal.  They’ll need to update their phone number that the MFA service will use to contact them, an alternate email and security questions.  From there, I just go out to the online password reset site and walk through the process of how a user would do a SSPR.  https://passwordreset.microsoftonline.com/
• Cloud Application Discovery Tool
  • Yet another awesome demo.  Most customers are struggling trying to figure out how their end users are connecting to SaaS applications.  The cloud app discovery tool can be quite helpful here.
  • Log into https://appdiscovery.azure.com/ with a global admin account in your AAD tenant.  Download the agent and install it on a computer that you actually use so that you get some relevant data.  If you install the agent on a lab machine that you rarely use to browse the internet you won’t get a good demo experience.  Then connect to the portal and show how the IT admins can see how folks are using SaaS applications and how they can quickly connect those in the Azure Portal.

Well, that’s all I can think of for now.  I’ll promise to try to keep this up date the best that I can.  If you have any questions or comments – please let me know!!  Good luck!

Often times when doing demo’s for customers we’ll come across an app or two that they want to connect to that’s not listed in the 2400+ applications in the gallery that we are currently pre-federated to in one way or another.  You can find that list here.  The process to this point was to submit via the feedback.azure.com portal or funnel it up through your Microsoft account team to the appropriate product group at Microsoft.

Well, now you can add your own.  This is a preview feature so it may not be fully functional or feature complete – so keep that in mind if you are thinking about putting these features in production.

Anyway, here’s how it works:

You are searching the Azure Application Gallery and type in an app that we can’t find (because it’s not in there).  You’ll see a link to “Add an unlisted application…”.  Click that.

I’m going to use Twitter as an example here although we actually do have Twitter in the gallery.  It’s a demo folks… :)

Now let’s configure SSO:

We’re going to choose the password option.  In this example, we’re going to provide a credential that we’ll cache in Azure so that all users that access the application use the same credential.  Alternatively, you can allow the user to enter their own credentials for the application when they login to the myapps.microsoft.com user portal.

We are going to be prompted to enter the sites login URL.  In this case we entered https://www.twitter.com.  Azure goes and checks the site to make sure that it can pass the credentials.  Once it’s verified, it configures the app.

Now I need to assign which users have access to the application when the login to the portal.  I assigned a specific group and now Azure wants me to provide the credential that all users will use when accessing the Twitter application from the user portal:

I can also upload a custom logo for the app as well so there’s a pretty picture associated with the application in the portal vs the default Azure logo:

Now when I login to my application portal, I see the Twitter app available to connect:

I click on it and it signs me right in!!

Well done Azure Engineering Team!

Enjoy!

…I thought I’d show how I set this up in my lab – it’s pretty straightforward.

OK, so what are we trying to do?

I have a IIS Server sitting behind my firewall that I want to publish to users that are connecting to the Azure MyApps Portal.  Furthermore, I want Azure to handle the pre-authentication to the application and I have my IIS Server configured ONLY for Integrated Windows Authentication.  The user is already providing their AD credentials to get access to the MyApps Portal (https://myapps.microsoft.com) so we want to SSO them to the on-prem website that’s sitting behind the firewall.

Here’s how we have the IIS Site configured:

In my case, this is simply the default IIS start page.  If I connect to this on premise as a logged in domain user, I get access to the page:

Next, we need to add a SPN on the IIS server.  Use ADSI Edit to connect to the IIS Server (in my case the server is named SYNCHVM) and add a http/hostname SPN.  In my case it was “http/syncvm”.  We’ll use this SPN in the Azure Admin Portal to configure access to the site in a bit…

Now on the server that is running the Azure WAP connector/agent you need to configure constrained delegation.  To do this, open AD Users and Computers and find the computer running the Azure WAP Connector/agent.  Right click –> Properties and select the ‘delegation’ tab.  You’ll need to configure yours similar to mine adding the IIS server and the http service type.

On the Azure side you’ll walk through the wizard process to add an application via the Azure WAP.  When you click into the application once it’s configured and get advanced properties you will want to set yours up accordingly.  The last 2 fields are not exposed during the wizard setup – you’ll have to get into the ‘configure’ tab of the application to turn on integrated auth and add the SPN you configured in a previous step.

So the final step here is doing some testing…

I open a web browser on a non-domain joined computer or internet connected device.  I enter the URL that Azure assigned me for the application I published.  In my case, I’m using ADFS so I get redirected to my ADFS server on-prem for authentication.  Once I’m authenticated as a domain user, I get signed on to my application behind the firewall.  If you weren’t setup to use ADFS your user would be authenticated out of Azure Active Directory.  Now of course, this assumes that you are using DirSync and those on-prem users have been synchronized out to Azure AD.