Azure Active Directory (Azure AD) inatumika kama huduma ya msingi ya Microsoft kwa usimamizi wa kitambulisho na ufikiaji wa rasilimali kwenye wingu. Ni muhimu katika kuwezesha wafanyakazi kuingia na kupata rasilimali, ndani na nje ya shirika, ikiwa ni pamoja na Microsoft 365, mlango wa Azure, na programu nyingi za SaaS. Ubunifu wa Azure AD unazingatia kutoa huduma muhimu za kitambulisho, ikiwa ni pamoja na uthibitishaji, idhini, na usimamizi wa mtumiaji.
Sifa muhimu za Azure AD ni pamoja na uthibitishaji wa hatua nyingi na ufikiaji wa hali ya hewa, pamoja na ushirikiano wa moja kwa moja na huduma zingine za usalama za Microsoft. Sifa hizi zinaongeza sana usalama wa vitambulisho vya watumiaji na kuwawezesha mashirika kutekeleza na kusimamia sera zao za ufikiaji kwa ufanisi. Kama sehemu muhimu ya mfumo wa huduma za wingu za Microsoft, Azure AD ni muhimu kwa usimamizi wa vitambulisho vya watumiaji kwenye wingu.
AzureAD ni moduli ya PowerShell kutoka Microsoft kwa kusimamia Azure AD. Haioneshi mali zote za vitu vya Azure AD na haiwezi kutumika kupata habari za rasilimali za Azure.
Az PowerShell ni moduli ya kusimamia rasilimali za Azure kutoka kwenye mstari wa amri wa PowerShell.
Unganisho
azlogin#This will open the browserazlogin-u<username>-p<password>#Specify user and passwordazlogin--identity#Use the current machine managed identity (metadata)az login --identity -u /subscriptions/<subscriptionId>/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID #Login with user managed identity
# Login as service principalaz login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com #With password
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p ~/mycertfile.pem --tenant contoso.onmicrosoft.com #With cert
# Request access token (ARM)azaccountget-access-token# Request access token for different resource. Supported tokens: aad-graph, arm, batch, data-lake, media, ms-graph, oss-rdbms
azaccountget-access-token--resource-typeaad-graph# If you want to configure some defaultsazconfigure# Get user logged-in alreadyazadsigned-in-usershow# Helpazfind"vm"# Find vm commandsazvm-h# Get subdomainsazaduserlist--query-examples# Get examples
Connect-AzureAD#Open browser# Using credentials$passwd =ConvertTo-SecureString"Welcome2022!"-AsPlainText -Force$creds =New-Object System.Management.Automation.PSCredential ("test@corp.onmicrosoft.com", $passwd)Connect-AzureAD-Credential $creds# Using tokens## AzureAD cannot request tokens, but can use AADGraph and MSGraph tokens to connectConnect-AzureAD-AccountId test@corp.onmicrosoft.com -AadAccessToken $token
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Install-Module-Name Az -AllowClobber -Scope CurrentUser
Connect to Azure AD
After installing the Az module, you can connect to Azure AD using the following command:
Connect-AzAccount
This command will prompt you to login using your Azure AD credentials. Once authenticated, you will be connected to your Azure AD tenant.
Connect-AzAccount#Open browser# Using credentials$passwd =ConvertTo-SecureString"Welcome2022!"-AsPlainText -Force$creds =New-Object System.Management.Automation.PSCredential("test@corp.onmicrosoft.com", $passwd)Connect-AzAccount-Credential $creds# Get Access Token(Get-AzAccessToken).Token# Request access token to other endpoints: AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse
Get-AzAccessToken-ResourceTypeName MSGraph(Get-AzAccessToken-Resource "https://graph.microsoft.com").Token# Conenct with access tokenConnect-AzAccount-AccountId test@corp.onmicrosoft.com -AccessToken $tokenConnect-AzAccount-AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId <ACCOUNT-ID>## The -AccessToken is from management.azure.com# Connect with Service principal/enterprise app secret$password =ConvertTo-SecureString'KWEFNOIRFIPMWL.--DWPNVFI._EDWWEF_ADF~SODNFBWRBIF'-AsPlainText -Force$creds =New-ObjectSystem.Management.Automation.PSCredential('2923847f-fca2-a420-df10-a01928bec653', $password)Connect-AzAccount-ServicePrincipal -Credential $creds -Tenant 29sd87e56-a192-a934-bca3-0398471ab4e7d#All the Azure AD cmdlets have the format *-AzAD*Get-Command*azad*#Cmdlets for other Azure resources have the format *Az*Get-Command*az*
# Request tokens to access endpoints# ARMcurl"$IDENTITY_ENDPOINT?resource=https://management.azure.com&api-version=2017-09-01"-Hsecret:$IDENTITY_HEADER# Vaultcurl"$IDENTITY_ENDPOINT?resource=https://vault.azure.net&api-version=2017-09-01"-Hsecret:$IDENTITY_HEADER
Unapojisajili kupitia CLI kwenye Azure na programu yoyote, unatumia Programu ya Azure kutoka kwa mpangaji ambayo inamilikiwa na Microsoft. Programu hizi, kama ile unayoweza kuunda kwenye akaunti yako, ina kitambulisho cha mteja. Hautaweza kuziona zote kwenye orodha ya programu zilizoruhusiwa unazoweza kuona kwenye konsoli, lakini zinaruhusiwa kwa chaguo-msingi.
Kwa mfano, scripti ya powershell inayotumia programu yenye kitambulisho cha mteja 1950a258-227b-4e31-a9cf-717495945fc2. Hata kama programu haionekani kwenye konsoli, msimamizi wa mfumo anaweza kuzuia programu hiyo ili watumiaji wasiweze kupata upatikanaji kwa kutumia zana zinazounganisha kupitia programu hiyo.
Hata hivyo, kuna vitambulisho vingine vya wateja vya programu ambavyo vitakuruhusu kuunganisha kwenye Azure:
# The important part is the ClientId, which identifies the application to login inside Azure$token =Invoke-Authorize-Credential $credential `-ClientId '1dfb5f98-f363-4b0f-b63a-8d20ada1e62d'`-Scope 'Files.Read.All openid profile Sites.Read.All User.Read email'`-Redirect_Uri "https://graphtryit-staging.azurewebsites.net/"`-Verbose -Debug `-InformationAction Continue$token =Invoke-Authorize-Credential $credential `-ClientId '65611c08-af8c-46fc-ad20-1888eb1b70d9'`-Scope 'openid profile Sites.Read.All User.Read email'`-Redirect_Uri "chrome-extension://imjekgehfljppdblckcmjggcoboemlah"`-Verbose -Debug `-InformationAction Continue$token =Invoke-Authorize-Credential $credential `-ClientId 'd3ce4cf8-6810-442d-b42e-375e14710095'`-Scope 'openid'`-Redirect_Uri "https://graphexplorer.azurewebsites.net/"`-Verbose -Debug `-InformationAction Continue
Watumiaji
# Enumerate usersazaduserlist--outputtableazaduserlist--query"[].userPrincipalName"# Get info of 1 userazadusershow--id"test@corp.onmicrosoft.com"# Search "admin" usersazaduserlist--query"[].displayName"|findstr/i"admin"azaduserlist--query"[?contains(displayName,'admin')].displayName"# Search attributes containing the word "password"azaduserlist|findstr/i"password"|findstr/v"null,"# All users from AzureADazaduserlist--query"[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi==null]"azaduserlist--query"[?onPremisesSecurityIdentifier==null].displayName"# All users synced from on-premazaduserlist--query"[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi!=null]"azaduserlist--query"[?onPremisesSecurityIdentifier!=null].displayName"# Get groups where the user is a memberazaduserget-member-groups--id<email># Get roles assigned to the userazroleassignmentlist--include-groups--include-classic-administratorstrue--assignee<email>
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji, idara, udhibiti wa upatikanaji, na zaidi. Kwa hivyo, wakati wa kufanya upimaji wa usalama kwenye Azure, ni muhimu kuzingatia maeneo haya ya Azure AD.
Uthibitishaji wa Multi-Factor (MFA)
Kuangalia ikiwa MFA imezimwa kwa watumiaji wote au kwa watumiaji fulani tu. Kwa kuongezea, jaribu kubaini ikiwa kuna njia za kuzunguka MFA.
Vibali vya Programu
Hakikisha vibali vya programu vinavyotumiwa na programu zinazounganishwa na Azure AD vimebainishwa vizuri na kuna udhibiti sahihi juu ya vibali hivyo.
Ufuatiliaji wa Usalama
Hakikisha ufuatiliaji wa usalama umeamilishwa kwa Azure AD ili kugundua shughuli zisizotarajiwa au za kutiliwa shaka.
Usimamizi wa Kifaa
Angalia jinsi vifaa vinavyoingia kwenye Azure AD vinavyosimamiwa na kuhakikisha sera za usalama zinatekelezwa ipasavyo.
Usimamizi wa Kitambulisho
Hakikisha sera za usimamizi wa kitambulisho zimeboreshwa na kutekelezwa kwa usahihi kuzuia vitisho vya usalama.
Usimamizi wa Upatikanaji
Hakikisha udhibiti wa upatikanaji umewekwa kwa usahihi kuzuia ufikiaji usiohitajika kwenye Azure AD.
Usalama wa Data
Hakikisha data inayohifadhiwa kwenye Azure AD inalindwa ipasavyo na hatua sahihi za usalama zimechukuliwa.
Usalama wa Mtandao
Thibitisha kuwa Azure AD imefungwa kwa usalama wa hali ya juu kuzuia mashambulizi ya kimtandao.
Usalama wa Maombi
Hakikisha programu zinazounganishwa na Azure AD zina hatua sahihi za usalama ili kuzuia ukiukwaji wa usalama.
Usalama wa Barua pepe
Thibitisha kuwa barua pepe zinazotumwa kutoka Azure AD zinalindwa na hatua sahihi za usalama zimechukuliwa.
Usalama wa Nenosiri
Hakikisha sera kali za usalama wa nenosiri zimeanzishwa kwa watumiaji wa Azure AD kuzuia matumizi mabaya ya nenosiri.
Usalama wa Usajili
Hakikisha usajili wa watumiaji kwenye Azure AD unafanywa kwa njia salama na kuna udhibiti sahihi wa mchakato wa usajili.
Usalama wa Usimamizi wa Kitambulisho
Hakikisha usimamizi wa kitambulisho kwenye Azure AD unafanywa kwa usahihi ili kuzuia upatikanaji usiohitajika au wa kutiliwa shaka.
Usalama wa Ufuatiliaji
Hakikisha ufuatiliaji wa shughuli za Azure AD unafanywa kwa ufanisi ili kugundua na kuzuia vitisho vya usalama kwa wakati unaofaa.
Usalama wa Uthibitishaji
Hakikisha mifumo ya uthibitishaji inayotumiwa na Azure AD inalindwa ipasavyo na kuna mbinu za ziada za uthibitishaji zilizowekwa kwa usalama zaidi.
Usalama wa Uthibitishaji wa Multi-Factor (MFA)
Hakikisha MFA imeanzishwa kwa watumiaji wote kwa kuongeza safu ya ulinzi kwa akaunti za Azure AD.
Usalama wa Uthibitishaji wa Wateja
Hakikisha mifumo ya uthibitishaji wa wateja inayotumiwa na Azure AD inalindwa ipasavyo ili kuzuia ufikiaji usiohitajika au wa kutiliwa shaka.
Usalama wa Uthibitishaji wa Wateja wa Multi-Factor (MFA)
Hakikisha MFA imeanzishwa kwa wateja wote kwa kuongeza safu ya ulinzi kwa akaunti zao za Azure AD.
Usalama wa Uthibitishaji wa Wateja wa Uthibitishaji
Hakikisha mifumo ya uthibitishaji wa wateja inayotumiwa na Azure AD inalindwa ipasavyo na kuna mbinu za ziada za uthibitishaji zilizowekwa kwa usalama zaidi.
Usalama wa Uthibitishaji wa Wateja wa Uthibitishaji wa Multi-Factor (MFA)
Hakikisha MFA imeanzishwa kwa wateja wote kwa kuongeza safu ya ulinzi kwa akaunti zao za Azure AD.
# Enumerate UsersGet-AzureADUser-All $trueGet-AzureADUser-All $true| select UserPrincipalName# Get info of 1 userGet-AzureADUser-ObjectId test@corp.onmicrosoft.com | fl# Search "admin" usersGet-AzureADUser-SearchString "admin"#Search admin at the begining of DisplayName or userPrincipalNameGet-AzureADUser-All $true|?{$_.Displayname-match"admin"} #Search "admin" word in DisplayName# Get all attributes of a userGet-AzureADUser-ObjectId test@defcorphq.onmicrosoft.com|%{$_.PSObject.Properties.Name}# Search attributes containing the word "password"Get-AzureADUser -All $true |%{$Properties = $_;$Properties.PSObject.Properties.Name | % {if ($Properties.$_ -match 'password') {"$($Properties.UserPrincipalName) - $_ - $($Properties.$_)"}}}
# All users from AzureAD# All users from AzureADGet-AzureADUser-All $true|?{$_.OnPremisesSecurityIdentifier-eq$null}# All users synced from on-premGet-AzureADUser-All $true|?{$_.OnPremisesSecurityIdentifier-ne$null}# Objects created by a/any userGet-AzureADUser [-ObjectId<email>] |Get-AzureADUserCreatedObject# Devices owned by a userGet-AzureADUserOwnedDevice-ObjectId test@corp.onmicrosoft.com# Objects owned by a specific userGet-AzureADUserOwnedObject-ObjectId test@corp.onmicrosoft.com# Get groups & roles where the user is a memberGet-AzureADUserMembership-ObjectId 'test@corp.onmicrosoft.com'# Get devices owned by a userGet-AzureADUserOwnedDevice-ObjectId test@corp.onmicrosoft.com# Get devices registered by a userGet-AzureADUserRegisteredDevice-ObjectId test@defcorphq.onmicrosoft.com# Apps where a user has a role (role not shown)Get-AzureADUser-ObjectId roygcain@defcorphq.onmicrosoft.com |Get-AzureADUserAppRoleAssignment| fl *# Get Administrative Units of a user$userObj =Get-AzureADUser-Filter "UserPrincipalName eq 'bill@example.com'"Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where { $_.Id -eq $userObj.ObjectId } }
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Replace the values with the user's actual information.
Remove Azure AD User
To remove an Azure AD user, you can use the following command:
Remove-AzADUser-UserPrincipalNameuser@example.com
Replace user@example.com with the user's actual UPN.
# Enumerate usersGet-AzADUser# Get details of a userGet-AzADUser-UserPrincipalName test@defcorphq.onmicrosoft.com# Search user by stringGet-AzADUser-SearchString "admin"#Search at the beginnig of DisplayNameGet-AzADUser|?{$_.Displayname-match"admin"}# Get roles assigned to a userGet-AzRoleAssignment-SignInName test@corp.onmicrosoft.com
Inashauriwa sana kuongeza MFA kwa kila mtumiaji, hata hivyo, baadhi ya makampuni hawataki kuweka au wanaweza kuweka na Sera ya Kufikia ya Kigezo: Mtumiaji atahitaji MFA ikiwa ataingia kutoka eneo maalum, kivinjari au hali fulani. Sera hizi, ikiwa hazijasakinishwa kwa usahihi, zinaweza kuwa rahisi kupitishwa. Angalia:
# Enumerate groupsaz ad group listaz ad group list --query "[].[displayName]"-o table# Get info of 1 groupaz ad group show --group <group># Get "admin" groupsaz ad group list --query "[].displayName"| findstr /i "admin"az ad group list --query "[?contains(displayName,'admin')].displayName"# All groups from AzureADaz ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi==null]"
az ad group list --query "[?onPremisesSecurityIdentifier==null].displayName"# All groups synced from on-premaz ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi!=null]"
az ad group list --query "[?onPremisesSecurityIdentifier!=null].displayName"# Get members of groupaz ad group member list --group <group>--query "[].userPrincipalName"-o table# Check if member of groupaz ad group member check --group "VM Admins"--member-id <id># Get which groups a group is member ofaz ad group get-member-groups -g "VM Admins"# Get Apps where a group has a role (role not shown)Get-AzureADGroup-ObjectId <id>|Get-AzureADGroupAppRoleAssignment| fl *
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji, idara, udhibiti wa upatikanaji, na zaidi. Kwa hivyo, wakati wa kufanya ukaguzi wa usalama wa Azure, ni muhimu kuzingatia vipengele vya Azure AD kuhakikisha kuwa mifumo yote imeimarishwa ipasavyo.
Uthibitishaji wa Multi-Factor (MFA)
Kuwezesha uthibitishaji wa hatua nyingi (MFA) kwa watumiaji wote ni njia moja ya kuongeza usalama wa akaunti za Azure AD. MFA inahitaji watumiaji kuthibitisha utambulisho wao kupitia njia zaidi ya moja, kama vile simu ya rununu au programu ya uthibitishaji.
Udhibiti wa Upatikanaji
Azure AD inaruhusu udhibiti wa upatikanaji kwa kudhibiti ni watumiaji wangapi wanaweza kupata rasilimali fulani. Kwa kuzingatia na kusanidi vizuri udhibiti wa upatikanaji, unaweza kuzuia ufikiaji usiohitajika kwa data nyeti au mifumo muhimu.
Ufuatiliaji wa Usalama
Kufuatilia shughuli za usalama ndani ya Azure AD ni muhimu kugundua shughuli zisizotarajiwa au za kutiliwa shaka. Kwa kuchambua na kufuatilia kumbukumbu za usalama, unaweza kugundua vitisho mapema na kuchukua hatua za haraka kurekebisha masuala ya usalama.
Usimamizi wa Leseni
Kudumisha usimamizi sahihi wa leseni katika Azure AD ni muhimu kuzuia matumizi yasiyoruhusiwa au ya ziada ya huduma za Azure. Kwa kufuatilia na kusasisha leseni kwa usahihi, unaweza kudhibiti gharama na kuhakikisha utumiaji sahihi wa rasilimali za Azure.
# Enumerate GroupsGet-AzureADGroup-All $true# Get info of 1 groupGet-AzADGroup-DisplayName <resource_group_name>| fl# Get "admin" groupsGet-AzureADGroup-SearchString "admin"| fl #Groups starting by "admin"Get-AzureADGroup-All $true|?{$_.Displayname-match"admin"} #Groups with the word "admin"# Get groups allowing dynamic membershipGet-AzureADMSGroup|?{$_.GroupTypes-eq'DynamicMembership'}# All groups that are from Azure ADGet-AzureADGroup-All $true|?{$_.OnPremisesSecurityIdentifier-eq$null}# All groups that are synced from on-prem (note that security groups are not synced)Get-AzureADGroup-All $true|?{$_.OnPremisesSecurityIdentifier-ne$null}# Get members of a groupGet-AzureADGroupMember-ObjectId <group_id># Get roles of groupGet-AzureADMSGroup-SearchString "Contoso_Helpdesk_Administrators"#Get group idGet-AzureADMSRoleAssignment-Filter "principalId eq '69584002-b4d1-4055-9c94-320542efd653'"# Get Administrative Units of a group$groupObj =Get-AzureADGroup-Filter "displayname eq 'TestGroup'"Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where {$_.Id -eq $groupObj.ObjectId} }
Az PowerShell
Azure Active Directory (Azure AD) cmdlets can be used to manage Azure AD users, groups, and licenses. Here are some common tasks you can perform using Az PowerShell:
Create a new user account
Add a user to a group
Assign a license to a user
Reset a user's password
Disable a user account
To use Az PowerShell for Azure AD management, you need to install the AzureAD module and connect to your Azure AD tenant using the Connect-AzureAD cmdlet.
Install-Module-Name Az -AllowClobber -ForceInstall-Module-Name AzureAD -AllowCClobber -ForceConnect-AzureAD
Once connected, you can start running Azure AD cmdlets to manage your Azure AD resources efficiently.
For more information on Az PowerShell cmdlets for Azure AD, refer to the official documentation.
# Get all groupsGet-AzADGroup# Get details of a groupGet-AzADGroup-ObjectId <id># Search group by stringGet-AzADGroup-SearchString "admin"| fl *#Search at the beginnig of DisplayNameGet-AzADGroup|?{$_.Displayname-match"admin"}# Get members of groupGet-AzADGroupMember-GroupDisplayName <resource_group_name># Get roles of groupGet-AzRoleAssignment-ResourceGroupName <resource_group_name>
Ongeza mtumiaji kwa kikundi
Wamiliki wa kikundi wanaweza kuongeza watumiaji wapya kwenye kikundi
Vikundi vinaweza kuwa vya kudumu, ambavyo kimsingi inamaanisha kwamba ikiwa mtumiaji anakidhi hali fulani atapewa kikundi. Bila shaka, ikiwa hali hizo zinategemea vipengele ambavyo mtumiaji anaweza kudhibiti, anaweza kutumia kipengele hiki kuingia katika vikundi vingine.
Angalia jinsi ya kutumia vibaya vikundi vya kudumu kwenye ukurasa ufuatao:
Tafadhali kumbuka kwamba Service Principal katika lugha ya PowerShell inaitwaEnterprise Applications kwenye portal ya Azure (wavuti).
# Get Service Principalsazadsplist--allazadsplist--all--query"[].[displayName]"-otable# Get details of one SPazadspshow--id00000000-0000-0000-0000-000000000000# Search SP by stringazadsplist--all--query"[?contains(displayName,'app')].displayName"# Get owner of service principalazadspownerlist--id<id>--query"[].[displayName]"-otable# Get service principals owned by the current userazadsplist--show-mine# List apps that have password credentialsazadsplist--all--query"[?passwordCredentials != null].displayName"# List apps that have key credentials (use of certificate authentication)azadsplist-all--query"[?keyCredentials != null].displayName"
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji wa watumiaji, usimamizi wa ufikiaji, na udhibiti wa leseni. Kwa kuzingatia hilo, kuchunguza na kufanya upimaji wa usalama kwenye Azure AD ni muhimu sana katika mchakato wa upimaji wa usalama wa mfumo wa Azure.
# Get Service PrincipalsGet-AzureADServicePrincipal-All $true# Get details about a SPGet-AzureADServicePrincipal-ObjectId <id>| fl *# Get SP by string name or IdGet-AzureADServicePrincipal-All $true|?{$_.DisplayName-match"app"} | flGet-AzureADServicePrincipal-All $true|?{$_.AppId-match"103947652-1234-5834-103846517389"}# Get owner of SPGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalOwner|fl *# Get objects owned by a SPGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalOwnedObject# Get objects created by a SPGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalCreatedObject# Get groups where the SP is a memberGet-AzureADServicePrincipal|Get-AzureADServicePrincipalMembershipGet-AzureADServicePrincipal-ObjectId <id>|Get-AzureADServicePrincipalMembership|fl *
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Replace user@example.com with the user's UPN and update the details as needed.
Remove Azure AD User
To remove a user from Azure AD, you can use the following command:
Remove-AzADUser-UserPrincipalNameuser@example.com
Replace user@example.com with the user's UPN.
Summary
In this section, we have covered how to install the Az PowerShell module, connect to Azure AD, list users, get user information, create a new user, update user details, and remove a user using PowerShell commands.
# Get SPsGet-AzADServicePrincipal# Get info of 1 SPGet-AzADServicePrincipal-ObjectId <id># Search SP by stringGet-AzADServicePrincipal|?{$_.DisplayName-match"app"}# Get roles of a SPGet-AzRoleAssignment-ServicePrincipalName <String>
</details>
### Majukumu
<div data-gb-custom-block data-tag="tabs"></div>
<div data-gb-custom-block data-tag="tab" data-title='az cli'>
```bash
# Get roles
az role definition list
# Get assigned roles
az role assignment list --all --query "[].roleDefinitionName"
az role assignment list --all | jq '.[] | .roleDefinitionName,.scope'
# Get info of 1 role
az role definition list --name "AzureML Registry User"
# Get only custom roles
az role definition list --custom-role-only
# Get only roles assigned to the resource group indicated
az role definition list --resource-group <resource_group>
# Get only roles assigned to the indicated scope
az role definition list --scope <scope>
# Get all the principals a role is assigned to
az role assignment list --all --query "[].{principalName:principalName,principalType:principalType,resourceGroup:resourceGroup,roleDefinitionName:roleDefinitionName}[?roleDefinitionName=='<ROLE_NAME>']"
Azure AD Enumeration
User Enumeration
User enumeration can be performed through the Azure AD login interface. By entering a valid username and observing the response, an attacker can determine if the username is valid or not. This can aid in further attacks such as password spraying or targeted phishing.
Group Enumeration
Group enumeration involves identifying Azure AD groups and their members. This information can be useful for understanding the organization's structure and identifying high-value targets for attacks.
Application Enumeration
Enumerating applications registered in Azure AD can provide insights into the organization's use of third-party services and potential points of compromise.
Device Enumeration
Identifying devices registered in Azure AD can help an attacker understand the devices used within the organization and potentially exploit vulnerabilities associated with these devices.
Role Enumeration
Enumerating roles assigned within Azure AD can reveal privileged accounts and roles within the organization, which can be valuable targets for attackers.
Policy Enumeration
Understanding the policies configured in Azure AD can help an attacker identify security controls in place and potential weaknesses that can be exploited.
Certificate Enumeration
Enumerating certificates used in Azure AD can reveal information about encryption mechanisms and potential weak points in the security infrastructure.
Endpoint Enumeration
Identifying endpoints exposed by Azure AD can help an attacker discover additional entry points into the organization's network and services.
OAuth App Enumeration
Enumerating OAuth applications registered in Azure AD can provide insights into potential authorization vulnerabilities and misconfigurations that could be leveraged in attacks.
Tenant Enumeration
Identifying Azure AD tenants associated with an organization can help an attacker understand the scope of the environment and potential interdependencies between different tenants.
Federation Enumeration
Enumerating federated services integrated with Azure AD can reveal external dependencies and potential attack vectors that could be exploited to compromise the organization's resources.
Risk Enumeration
Understanding the risk factors associated with Azure AD configurations can help an attacker prioritize targets based on the level of risk they pose to the organization's security posture.
Security Enumeration
Enumerating security settings and configurations within Azure AD can help identify gaps in security controls and potential misconfigurations that could be exploited by an attacker.
Logging Enumeration
Identifying logging and monitoring configurations in Azure AD can help an attacker understand the visibility of their actions and potential detection mechanisms in place.
API Enumeration
Enumerating APIs exposed by Azure AD can provide insights into the functionalities available to attackers and potential avenues for unauthorized access to sensitive data or resources.
Synchronization Enumeration
Identifying synchronization configurations in Azure AD can help an attacker understand how user accounts and data are synchronized across different systems and potentially identify weaknesses in the synchronization process.
Privilege Enumeration
Enumerating privileges assigned within Azure AD can help identify accounts with elevated permissions and roles that could be targeted for privilege escalation attacks.
Multi-factor Authentication Enumeration
Enumerating multi-factor authentication settings in Azure AD can help identify accounts protected by MFA and potential bypass techniques that could be used to circumvent this additional security measure.
Password Policy Enumeration
Understanding the password policies enforced in Azure AD can help an attacker identify potential weaknesses in password management practices and exploit them to gain unauthorized access to accounts.
Conditional Access Enumeration
Enumerating conditional access policies in Azure AD can help identify restrictions and controls placed on user access based on specific conditions, providing insights into potential bypass techniques or misconfigurations that could be abused by an attacker.
Sign-In Enumeration
Identifying sign-in configurations and settings in Azure AD can help an attacker understand the authentication mechanisms in place and potential vulnerabilities that could be exploited to gain unauthorized access to user accounts.
Risky Sign-Ins Enumeration
Enumerating risky sign-ins detected by Azure AD can help identify potential security incidents and ongoing attacks targeting the organization's resources, allowing for timely response and mitigation efforts.
Identity Protection Enumeration
Enumerating identity protection policies and configurations in Azure AD can help an attacker understand the measures in place to protect user identities and detect suspicious activities, providing insights into potential weaknesses that could be exploited.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses
# Get all available role templatesGet-AzureADDirectoryroleTemplate# Get enabled roles (Assigned roles)Get-AzureADDirectoryRoleGet-AzureADDirectoryRole-ObjectId <roleID>#Get info about the role# Get custom roles - use AzureAdPreviewGet-AzureADMSRoleDefinition|?{$_.IsBuiltin-eq$False} | select DisplayName# Users assigned a role (Global Administrator)Get-AzureADDirectoryRole-Filter "DisplayName eq 'Global Administrator'"|Get-AzureADDirectoryRoleMemberGet-AzureADDirectoryRole-ObjectId <id>| fl# Roles of the Administrative Unit (who has permissions over the administrative unit and its members)Get-AzureADMSScopedRoleMembership-Id <id>| fl *
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Replace user@example.com with the user's actual UPN and update the display name as needed.
Remove Azure AD User
To remove a user from Azure AD, you can use the following command:
Remove-AzADUser-UserPrincipalNameuser@example.com
Replace user@example.com with the user's actual UPN.
# Get role assignments on the subscriptionGet-AzRoleDefinition# Get Role definitionGet-AzRoleDefinition-Name "Virtual Machine Command Executor"# Get roles of a user or resourceGet-AzRoleAssignment-SignInName test@corp.onmicrosoft.comGet-AzRoleAssignment -Scope /subscriptions/<subscription-id>/resourceGroups/<res_group_name>/providers/Microsoft.Compute/virtualMachines/<vm_name>
# Get permissions over a resource using ARM directly$Token = (Get-AzAccessToken).Token$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Research/providers/Microsoft.Compute/virtualMachines/infradminsrv/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'
$RequestParams =@{Method ='GET'Uri = $URIHeaders =@{'Authorization'="Bearer $Token"}}(Invoke-RestMethod @RequestParams).value
Vifaa
# If you know how to do this send a PR!
Azure AD Enumeration
Azure AD enumeration involves gathering information about users, groups, applications, and permissions within an Azure AD environment. This information can be used to identify potential security weaknesses and plan further attacks.
Tools for Azure AD Enumeration
Azure AD PowerShell Module: Allows you to manage Azure AD users, groups, and applications using PowerShell commands.
Azure AD Graph API: Enables programmatic access to Azure AD through a REST API, allowing you to retrieve information about users, groups, and applications.
Azure AD Explorer: A graphical tool that helps you explore and manipulate Azure AD entities, such as users and groups.
Techniques for Azure AD Enumeration
User Enumeration: Gathering information about Azure AD users, such as usernames, email addresses, and assigned roles.
Group Enumeration: Identifying Azure AD groups and their members to understand the group structure and relationships.
Application Enumeration: Discovering registered applications in Azure AD and their permissions to access resources.
Permission Enumeration: Understanding the permissions assigned to users, groups, and applications within Azure AD.
By performing Azure AD enumeration, pentesters can gain valuable insights into the target Azure AD environment and identify potential security risks.
# Enumerate DevicesGet-AzureADDevice-All $true| fl *# List all the active devices (and not the stale devices)Get-AzureADDevice-All $true|?{$_.ApproximateLastLogonTimeStamp-ne$null}# Get owners of all devicesGet-AzureADDevice-All $true|Get-AzureADDeviceRegisteredOwnerGet-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredOwner -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Registred users of all the devicesGet-AzureADDevice-All $true|Get-AzureADDeviceRegisteredUserGet-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredUser -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Get dives managed using IntuneGet-AzureADDevice-All $true|?{$_.IsCompliant-eq"True"}# Get devices owned by a userGet-AzureADUserOwnedDevice-ObjectId test@corp.onmicrosoft.com# Get Administrative Units of a deviceGet-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -ObjectId $_.ObjectId | where {$_.ObjectId -eq $deviceObjId} }
Ikiwa kifaa (VM) kimejiunga na AzureAD, watumiaji kutoka AzureAD wataweza kuingia. Aidha, ikiwa mtumiaji aliyeingia ni Mmiliki wa kifaa, atakuwa msimamizi wa ndani.
Maombi
Programu ni Usajili wa Programu kwenye portal (sio Maombi ya Kampuni). Lakini kila Usajili wa Programu utaunda Maombi ya Kampuni (Mwakilishi wa Huduma) yenye jina sawa. Aidha, ikiwa Programu ni Programu inayoruhusu wapangaji wengi, Maombi mengine ya Kampuni (Mwakilishi wa Huduma) yataundwa kwenye mpangaji huo na jina sawa.
Wakati Programu inapoundwa aina 2 za ruhusa hupewa:
Ruhusa zilizopewa Mwakilishi wa Huduma
Ruhusa ambazo programu inaweza kuwa nazo na kutumia kwa niaba ya mtumiaji.
# List Apps
az ad app list
az ad app list --query "[].[displayName]" -o table
# Get info of 1 App
az ad app show --id 00000000-0000-0000-0000-000000000000
# Search App by string
az ad app list --query "[?contains(displayName,'app')].displayName"
# Get the owner of an application
az ad app owner list --id <id> --query "[].[displayName]" -o table
# List all the apps with an application password
az ad app list --query "[?passwordCredentials != null].displayName"
# List apps that have key credentials (use of certificate authentication)
az ad app list --query "[?keyCredentials != null].displayName"
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji, idara, udhibiti wa upatikanaji, na zaidi. Kwa hivyo, wakati wa kufanya ukaguzi wa usalama wa Azure, ni muhimu kuzingatia maeneo haya kuhakikisha kuwa mifumo yako imehifadhiwa vizuri.
Uthibitishaji wa Multi-Factor (MFA)
Kuwezesha uthibitishaji wa hatua nyingi (MFA) kwa watumiaji wote ni muhimu sana. Hii inasaidia kuzuia ufikiaji usioidhinishwa hata kama nywila zimevuja au zimeibiwa. Hakikisha MFA imeanzishwa kwa watumiaji wote, haswa wale wenye ruhusa za juu au ufikiaji wa data nyeti.
Udhibiti wa Upatikanaji
Tumia sera za udhibiti wa upatikanaji kudhibiti ni nani anayeweza kufanya nini ndani ya Azure AD. Weka viwango vya ufikiaji kulingana na majukumu ya watumiaji ili kupunguza hatari ya ufikiaji usioidhinishwa au matumizi mabaya ya rasilimali.
Ufuatiliaji wa Usalama
Hakikisha kufuatilia shughuli za usalama ndani ya Azure AD. Angalia kwa karibu shughuli za kuingia, mabadiliko ya ruhusa, au shughuli zingine za kutiliwa shaka. Ufuatiliaji wa mara kwa mara utasaidia kugundua haraka vitisho au matumizi mabaya.
Usimamizi wa Kifaa
Tumia zana za usimamizi wa kifaa kudhibiti vifaa vinavyoingia kwenye Azure AD. Weka sera za usalama kama vile kuhitaji vifaa kuthibitishwa kabla ya kupata rasilimali au kuhakikisha vifaa vina programu za usalama zilizosasishwa.
Usimamizi wa Kitambulisho
Hakikisha kusimamia vyeti, funguo, na kitambulisho kingine cha siri kwa uangalifu. Epuka kushiriki sana au kuhifadhi vibadilishaji vya siri kwenye maeneo yasiyofaa. Weka mifumo ya kisasa ya kusimamia kitambulisho ili kuzuia upatikanaji usioidhinishwa.
Hitimisho
Kwa kuzingatia maeneo haya muhimu ya usalama ndani ya Azure AD, unaweza kuboresha sana usalama wa mifumo yako ya Azure na kuzuia vitisho vya usalama. Kumbuka kufanya ukaguzi wa mara kwa mara na kurekebisha mapungufu yoyote haraka iwezekanavyo.
# List all registered applications
Get-AzureADApplication -All $true
# Get details of an application
Get-AzureADApplication -ObjectId <id> | fl *
# List all the apps with an application password
Get-AzureADApplication -All $true | %{if(Get-AzureADApplicationPasswordCredential -ObjectID $_.ObjectID){$_}}
# Get owner of an application
Get-AzureADApplication -ObjectId <id> | Get-AzureADApplicationOwner |fl *
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Install-Module -Name Az -AllowClobber -Scope CurrentUser
Connect to Azure AD
After installing the Az PowerShell module, you can connect to Azure AD using the following command:
Connect-AzAccount
This command will prompt you to enter your Azure credentials to authenticate and establish a connection to Azure AD.
List Azure AD Users
Once connected, you can list all the users in Azure AD by running the following command:
Get-AzADUser
This command will return a list of all the users along with their details such as UserPrincipalName, DisplayName, and ObjectId.
Get Azure AD User by UserPrincipalName
You can retrieve a specific user by their UserPrincipalName using the following command:
Get-AzADUser -UserPrincipalName user@example.com
Replace user@example.com with the actual UserPrincipalName you want to search for.
More Azure AD Operations
The Az PowerShell module provides various cmdlets to perform operations such as creating users, updating user details, resetting passwords, and more in Azure AD. You can explore these cmdlets by referring to the official Az PowerShell documentation.
# Get Apps
Get-AzADApplication
# Get details of one App
Get-AzADApplication -ObjectId <id>
# Get App searching by string
Get-AzADApplication | ?{$_.DisplayName -match "app"}
# Get Apps with password
Get-AzADAppCredential
Programu yenye ruhusa AppRoleAssignment.ReadWrite inaweza kupanda hadhi hadi Msimamizi Mkuu kwa kujipa jukumu hilo.
Kwa maelezo zaidi angalia hii.
Kamba ya siri ambayo programu hutumia kuthibitisha utambulisho wake wakati wa kuomba token ni nenosiri la programu.
Kwa hivyo, ukigundua hili nenosiri unaweza kupata ufikiaji kama mkuu wa hudumandani yampangaji.
Tafadhali kumbuka kuwa nenosiri hili linaweza kuonekana tu wakati wa kuzalishwa (unaweza kulibadilisha lakini huwezi kulipata tena).
Mmiliki wa programu anaweza kuongeza nenosiri kwake (hivyo anaweza kujifanya).
Kuingia kama hawa mkuu wa huduma hawatakuwa na alama ya hatari na hawatakuwa na MFA.
Tofauti kati ya Programu na (Programu za Kampuni au Mkuu wa Huduma)
Tofauti kati ya programu na Mkuu wa Huduma katika Azure:
Programu/Viandikishaji vya Programu: Ni programu zilizopo katika Azure AD yako
Mkuu wa Huduma/Programu za Kampuni: Vitu vya usalama katika Azure AD yako vinavyoweza kuwa na ruhusa katika Dhibiti la Azure na vimeunganishwa na programu yako au programu ya mtu wa tatu
Msimamizi anaweza kuhitaji kupitisha ruhusa zilizotolewa ikiwa ni nyeti sana.
Programu inaweza kuwa ikifanya kazi katika mpangaji wa mtu wa tatu na mara tu unapoanza kutumia na kumpa ufikiaji Programu ya Kampuni/Mkuu wa Huduma inaundwa katika mpangaji wako ili kumpa ufikiaji wa habari anayohitaji:
Vitengo vya Utawala
Inatumika kwa usimamizi bora wa watumiaji.
Vitengo vya utawala vinazuia ruhusa katika jukumu lolote la sehemu yoyote ya shirika lako unayoidhinisha. Unaweza, kwa mfano, kutumia vitengo vya utawala kuweka Msimamizi wa Msaada wa Duka kwa wataalamu wa msaada wa kikanda, ili waweze kusimamia watumiaji tu katika eneo wanalounga mkono.
Kwa hivyo, unaweza kumteua jukumu kwa kitengo cha msimamizi na wanachama wake watapata majukumu haya.
AzureAD
AzureAD is Microsoft's cloud-based identity and access management service. It allows organizations to manage users and provide secure access to resources in the cloud. When conducting security assessments on Azure environments, it is crucial to thoroughly test the configuration of AzureAD to identify any potential vulnerabilities that could be exploited by attackers.
Key areas to focus on when pentesting AzureAD:
User Accounts: Check for weak passwords, unauthorized access, and unusual login activities.
Multi-Factor Authentication (MFA): Test the effectiveness of MFA implementation to prevent unauthorized access.
Privileged Accounts: Review the permissions and activities of privileged accounts to prevent misuse.
Security Policies: Assess the security policies in place and ensure they align with best practices.
Integration: Check for secure integration with other applications and services to prevent data leaks.
By thoroughly examining these key areas, pentesters can help organizations identify and address security issues in their AzureAD configuration.
# Get Administrative Units
Get-AzureADMSAdministrativeUnit
Get-AzureADMSAdministrativeUnit -Id <id>
# Get ID of admin unit by string
$adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'"
# List the users, groups, and devices affected by the administrative unit
Get-AzureADMSAdministrativeUnitMember -Id <id>
# Get the roles users have over the members of the AU
Get-AzureADMSScopedRoleMembership -Id <id> | fl #Get role ID and role members
Azure AD Identity Protection (AIP)
Azure AD Identity Protection (AIP) ni huduma ya usalama inayotumia ugunduzi na urekebishaji wa moja kwa moja kusaidia kulinda utambulisho wa mtumiaji katika Azure Active Directory usidukuliwe. AIP inachunguza na kutathmini hatari za kuingia kwa mtumiaji na mipangilio ya utambulisho, kisha kutumia hatua sahihi za usalama moja kwa moja, kama vile kuhitaji uthibitishaji wa hatua nyingi au kuzuia shughuli hatari. Hii husaidia mashirika kuzuia uvunjaji wa usalama unaotokana na utambulisho.
Mchakato:
Azure AD Identity Protection inachunguza shughuli za mtumiaji na kukusanya data kuhusu kuingia, matukio ya uthibitishaji, na shughuli zingine muhimu.
Huduma hutumia algorithms za machine learning kuchambua data hii na kugundua vitisho vya usalama.
Azure AD Identity Protection inapanga kiwango cha hatari ya tishio (k.m. kuingia) na kutoa tahadhari ikiwa inahitajika kufanya hatua moja kwa moja.
Azure AD Password Protection (APP)
Azure AD Password Protection (APP) ni kipengele cha usalama kinachosaidia kuzuia nywila dhaifu katika Azure Active Directory kwa kutekeleza sera kali za nywila. APP inazuia nywila dhaifu zinazotumiwa mara kwa mara na toleo zake, kupunguza hatari ya uvunjaji unaohusiana na nywila. Inaweza kutumika katika kiwango cha wingu na kwenye Active Directory ya ndani, ikiboresha usalama wa nywila kwa jumla katika shirika.