DOCSEARCHbyAlgolia
Submit Docs

Azure AD Deployment Plans

repository·master·Indexed 41 days ago

https://github.com/azuread/deployment-plans

Open-source deployment plans for Azure AD, featuring the ADFS to Azure AD App Migration Tool for assessing relying party application readiness via PowerShell and Excel reporting, as well as Log Analytics views for monitoring account provisioning and sign-in events.

Tokens
4K
Snippets
3
Records
10
Agent score
2%

What's inside Azure AD Deployment Plans

  1. How the ADFS to Azure AD App Migration Tool works

    master

    The migration tool follows a three-step workflow to assess the readiness of your ADFS relying party applications for Azure AD:

    1. Collect: A PowerShell module runs on an ADFS server to collect relying party application configurations and writes them as individual .XML files to the file system.
    2. Analyze: The PowerShell module enumerates the .XML files and checks various configuration settings for compatibility. This can be done on the primary ADFS server or a different server where ADFS is installed.
    3. Report: An Excel report is generated, indicating which applications are eligible for migration and providing explanations for those that are not.

  2. Install the Log Analytics views

    master

    To import the Azure AD views into your workspace, follow these steps:

    1. In the Azure portal, navigate to Log Analytics and select the workspace where your activity logs are routed.
    2. In the workspace menu, select View Designer.
    3. Select Import, then select Choose File.
    4. Select the downloaded view files from your local computer.
    5. You must repeat this process for both the Azure AD Account Provisioning Events view and the Sign-ins Events view, selecting Save after each import.

  3. Use the Azure AD Log Analytics views

    master

    Once installed, you can access the views via the Workspace Summary section in your Log Analytics workspace. The package includes two primary views:

    • Azure AD Account Provisioning Events: Provides reports on provisioning activity, including counts and failures for new users, user updates, and de-provisioning.
    • Sign-ins Events: Provides reports for monitoring sign-in activity, such as sign-ins filtered by application, user, or device, and summary views of sign-in trends over time.

    To explore specific data, select a view to jump into individual reports.

  4. Collect and analyze ADFS configurations directly on the ADFS server

    master

    Use these steps to perform the full collection and analysis process on your primary ADFS server.

    1. Download the PowerShell module from http://aka.ms/migrateapps/adfsscript and save it as a .psm1 file.
    2. Copy the module to your ADFS server.
    3. Open PowerShell as Administrator on the ADFS server.
    4. Navigate to the directory containing the module.
    5. Execute the following commands:
      ipmo .\ADFSAADMigrationUtils.psm1
Export-ADFS2AADOnPremConfiguration
Test-ADFS2AADOnPremRPTrustSet -RPXMLFileDirectory "C:\adfs\apps"
    6. Collect the following .csv files from the module directory:
      • ADFSRPConfiguration.csv
      • Attributes.csv
      • AttributeStores.csv
      • ClaimTypes.csv
      • RuleDetails.csv
    7. On a workstation with Excel installed, create a folder at C:\adfs and place these .csv files there.
    8. Open ADFS to AAD App Migration Report Template.xlsm in Excel, navigate to the Dashboard tab, and click the Refresh Data button.
    ipmo .\ADFSAADMigrationUtils.psm1
Export-ADFS2AADOnPremConfiguration
Test-ADFS2AADOnPremRPTrustSet -RPXMLFileDirectory "C:\adfs\apps"

  5. Run ADFS analysis from a secondary server

    master

    If you prefer not to run the analysis on your primary ADFS server, follow this two-stage process.

    Stage 1: On the ADFS Server

    1. Download the PowerShell module from http://aka.ms/migrateapps/adfsscript and save it as a .psm1 file.
    2. Open PowerShell as Administrator on the ADFS server.
    3. Navigate to the module directory and run:
      ipmo .\ADFSAADMigrationUtils.psm1
Export-ADFS2AADOnPremConfiguration
    4. Locate the C:\ADFS\ADFSApps.zip file created by the export.

    Stage 2: On the Analysis Server (must have ADFS installed)

    1. Copy C:\ADFS\ADFSApps.zip from the ADFS server to the analysis server.
    2. Unzip the .XML files to a local folder.
    3. Download the PowerShell module to this server and save as .psm1.
    4. Open PowerShell as Administrator and navigate to the module directory.
    5. Run the following commands:
      ipmo .\ADFSAADMigrationUtils.psm1
Test-ADFS2AADOnPremRPTrustSet -RPXMLFileDirectory "<Full Path to XML Folder>"
    6. Collect the resulting .csv files (ADFSRPConfiguration.csv, Attributes.csv, AttributeStores.csv, ClaimTypes.csv, RuleDetails.csv) from the module directory.
    7. On a workstation with Excel, place these files in C:\adfs.
    8. Open ADFS to AAD App Migration Report Template.xlsm, go to the Dashboard tab, and click Refresh Data.
    # On ADFS Server
ipmo .\ADFSAADMigrationUtils.psm1
Export-ADFS2AADOnPremConfiguration

# On Analysis Server
ipmo .\ADFSAADMigrationUtils.psm1
Test-ADFS2AADOnPremRPTrustSet -RPXMLFileDirectory "<Full Path to XML Folder>"

  6. Use the ADFS to AAD App Migration Excel Report

    master

    The Excel report provides detailed insights into your application migration readiness.

    Key Tabs and Data

    • Dashboard: Provides an all-up view of total applications and migration eligibility percentage. You can model changes by typing Yes next to issues you are willing to resolve to see the impact on your migration percentage.
    • AAD App Migration Report: Shows individual application status. It flags:
      • Claim Rules to Review: Count of custom claim rules incompatible with Azure AD.
      • Attributes Not Synced to AAD by Default: Count of AD attributes used in rules that aren't synced via Azure AD Connect by default.
      • Authorization Rules Present: Indicates if rules need to be moved to Azure AD Conditional Access.
      • Restricted Claim Types: Identifies claim type URIs that cannot be modified in Azure AD.
      • Custom Attribute Stores: Identifies use of attribute stores other than Active Directory.
    • Claim Rules Details: Detailed view of every rule, including the Ruleset (issuance, authorization, etc.) and IsRuleKnownMigrateablePattern status.
    • AD Attributes: Lists ADAttribute usage and whether they are Synced to Azure AD by Default.
    • Claim Types: Lists Claim Type URIs and identifies if they are Restricted Claim Types.
    • Attribute Stores: Lists AttributeStoreName and highlights those that are not 'Active Directory'.

    Refreshing Data

    To update the report with new analysis results, ensure the latest .csv files are in C:\adfs, then click the Refresh Data button on the Dashboard tab.

  7. Prerequisites for Log Analytics views for Azure AD

    master

    Before installing the views, ensure you have completed the following setup:

    1. Log Analytics Workspace: You must have a Log Analytics workspace created in your Azure subscription.
    2. Log Routing: You must have already routed your Azure AD activity logs (Audit logs and Sign-in logs) to that specific Log Analytics workspace.
    3. Download Views: Download the view files from the official GitHub repository to your local machine.

  8. Set alerts on Log Analytics reports

    master

    You can create automated alerts based on report parameters (e.g., alerting on sign-in errors).

    Steps to configure an alert:

    1. Navigate to your Log Analytics workspace and select the desired view (e.g., Sign-ins Events).
    2. Select a specific report (e.g., Sign-in errors over time).
    3. Select Analytics to open the details page containing the underlying query.
    4. Select Set Alert.
    5. Under Alert criteria, select Whenever the Custom log search is <logic undefined>.
    6. Set the Threshold (e.g., set to 1 to alert on every occurrence).
    7. Provide a name, description, and set the Severity (e.g., Warning).
    8. Select an Action group (this can be an email/text notification team or an automated task like a webhook, runbook, function, or logic app).
    9. Select Create alert rule to finalize.

  9. Get support for ADFS to Azure AD migration

    master

    If you encounter issues during your migration, you can access support through several channels:

    • Azure Support: Open a ticket via the Azure support portal (availability depends on your Enterprise Agreement).
    • FastTrack: If you have Enterprise Mobility and Security (EMS) or Azure AD Premium licenses, you may be eligible for deployment assistance via the FastTrack Center.
    • Product Engineering: For major deployments involving millions of users, consult your Microsoft account team or Cloud Solutions Architect to request direct engagement with the Azure Identity Product Engineering team.
    • Public Forums:

  10. Interpret application test results in the 'All Apps Details' tab

    master

    When reviewing the migration analysis in the Excel spreadsheet, navigate to the 'All Apps Details' tab to see the status of specific tests run against your applications.

    Results are categorized as:

    • Pass: The configuration is compatible with Azure AD.
    • Warning: The configuration may require attention or migration to a different mechanism (e.g., moving custom issuance rules to Azure AD Conditional Access).
    • Fail: The configuration is not supported by Azure AD and must be addressed before migration.

    Note: The 'Result' column provides an aggregate status. If an application has any Fail results, the aggregate result is Fail. If it only has Warning results, the aggregate result is Warning.

    | Property | Status | Description |
|-------------------------------------------------|-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| RP Name | N/A | Friendly name of application |
| Result | Pass/Warning/Fail | All-up result for specific application. If application has any fails, result will default to fail. If application only has warning, result will default to warning. |
| Test-ADFSRPAdditionalAuthenticationRules | Pass/Warning | Testing for any on-premises MFA providers. Will need to be moved to Azure MFA or Custom Controls integration with 3rd party MFA provider. |
| Test-ADFSRPAdditionalWSFedEndpoint | Pass/Fail | Testing for multiple WS-Fed assertion endpoints since Azure AD only supports (1) one of these today. |
| Test-ADFSRPAllowedAuthenticationClassReferences | Pass/Fail | Whether the application is configured to only allow certain authentication types |
| Test-ADFSRPAlwaysRequireAuthentication | Pass/Fail | Whether the application is configured to ignore SSO cookies and ‘Always Prompt for Authentication’. Not supported by Azure AD today. |
| Test-ADFSRPAutoUpdateEnabled | Pass/Warning | Whether ADFS is configured to auto update the application based on changes within the federation metadata |
| Test-ADFSRPClaimsProviderName | Pass/Fail | Whether the application is hardcoded to another claim provider. Not supported by Azure AD today. |
| Test-ADFSRPDelegationAuthorizationRules | Pass/Fail | Whether the application has any custom delegation authorization rules defined. Azure AD does not support this today. |
| Test-ADFSRPEncryptClaims | Pass/Fail | Whether the application is configured for SAML Token Encryption. Azure AD does not support this today. |
| Test-ADFSRPImpersonationAuthorizationRules | Pass/Warning | Whether the application has any custom impersonation authorization rules defined. Azure AD does not support this today. |
| Test-ADFSRPIssuanceAuthorizationRules | Pass/Warning | Whether the application has any custom issuance authorization rules defined. Move to AAD CA |
| Test-ADFSRPIssuanceTransformRules | Pass/Warning | Whether the application has any custom issuance transform rules defined |
| Test-ADFSRPMonitoringEnabled | Pass/Warning | Whether ADFS is configured to monitor a federation metadata for this application. |
| Test-ADFSRPNotBeforeSkew | Pass/Warning | Whether ADFS allows a time skew based on the NotBefore and NotOnOrAfter times within SAML token. |
| Test-ADFSRPRequestMFAFromClaimsProviders | Pass/Warning | Whether the application is hardcoded to another claim provider and requires MFA. Not supported by Azure AD today. |
| Test-ADFSRPSignedSamlRequestsRequired | Pass/Fail | Whether the application is configured for SAML Request Signing. Azure AD does not support this today. |
| Test-ADFSRPTokenLifetime | Pass/Fail | Whether the application is configured for a custom token lifetime. ADFS default is 1 hour. |