Part 1 – What is a FIDO2 key and How to Set One Up for Emergency Access in Entra ID

Posted on December 3, 2024 by Imran Rashid

Reading Time: 8 minutes

In this 2 post blog series, I’ll explore emergency “break glass” account best practices, the importance of phishing resistant MFA (Multi Factor Authentication), how phishing resistant MFA can prevent token theft by a bad actor, and finally I will go through a step by step demo on configuring a physical FIDO2 (Fast Identity Online) supported passkey, specifically a YubiKey. I purchased a YubiKey for 30 euros from Yubico. Please note that Yubico offers various types of YubiKeys including different types of USB connectors and physical keys which meet different compliant standards, so it’s essential to research your options before making a purchase. Additionally, since FIDO2 is an open standard, several other vendors offer physical keys, giving you multiple options to choose from.

IMPORTANT NOTE
Part 2 will provide a detailed, step by step demo on configuring a YubiKey. I recommend reading this post (Part 1) first to understand best practices and how FIDO2 works to secure your account. However, if you wish to skip to Part 2, click the following link: Part 2 – Configure a YubiKey For An Emergency Access Account In Entra ID | Cloud Build

Image of a Security Key NFC (Near Field Communication) by Yubico. This is the key I purchased.

Explanation of NFC:
Near Field Communication (NFC) is a wireless technology that enables devices to communicate with each other when they are in close proximity, typically within a few centimeters. Think about when you touch your card or Apple Pay on your phone against a card reader to make a payment. If supported, you can utilise the NFC capabilities allowing you to touch they key on a NFC reader built in to your phone or a internal/external NFC reader built in to your laptop.

As mention above, part 2 covers the step by step demo, so before diving into the steps for configuring my YubiKey as a secure phishing resistant MFA method, I’d like to go through some important points, starting off with best practices you should consider when setting up an emergency access account.

Emergency Access “Break Glass” Account Best Practices

Emergency accounts also known as break glass accounts are crucial accounts that provide access to critical systems during a emergencies. Microsoft recommends that organisations have two cloud only emergency access accounts permanently assigned the Global Administrator role. These accounts are highly privileged and should not be assigned to specific individuals. They are limited to emergency scenarios only and where normal accounts can’t be used or all other administrators are accidentally locked out. Here are a few points to note when creating your emergency break glass accounts:

Assign Both Emergency Accounts Permanent Global Administrator:
- Having two break glass accounts ensures that if one account becomes inaccessible, you have a fallback account.
Use Non-Obvious Names:
- Avoid obvious names like emergency@.onmicrosoft.com or breakglass@.onmicrosoft.com. Instead, use random human names to make the accounts obscure, making it more challenging for attackers to target them during attacks like password spraying.
Create Cloud Identities:
- Create your break glass accounts using the *.onmicrosoft.com domain inside Entra ID. Avoid syncing accounts from on-premises to prevent access issues if on-premises systems fail.
Configure Complex Passwords:
- Use strong passwords, ideally with a minimum of 16 characters as recommended by Microsoft at the time of writing this post. Although it is possible to create passwords up to 256 characters long, a minimum of 32 characters is common. Feel free to increase the length of the password as per your requirements. However, be aware that no matter how strong the password, token theft is still a potential risk and the reason why it is recommended to use phishing resistant MFA, such as FIDO2 supported devices. More on this later.
Secure Password Storage:
- If you’re using passwords, follow Microsoft’s recommendation to separate the password into two or three parts, write each part on separate pieces of paper, and store them in secure, fireproof safes in different locations. Ensure only authorised individuals have access.
Use Phishing Resistant MFA:
- For multi-factor authentication (MFA), use a phishing resistant method like a FIDO2 Security Key. Again, ensure you store these physical keys in a safe location and only allow authorised individuals access.
Audit and Monitor Access:
- Configure monitoring to notify you if the emergency break glass accounts are used, allowing for swift action.
Diversify MFA Methods:
- Avoid using the same MFA method as your admins. For instance, if admins use passkeys via their phones or certificate based authentication (CBA), use a physical pass key for the emergency accounts to avoid issues affecting mobile devices such as a wider mobile outage.
Avoid Assigning to Individuals:
- Do not attach break glass accounts to an individual, such as an engineer’s mobile phone, to prevent issues if the person is unavailable. Just imagine if that individual is on holiday, it’s not good practice from both a convenience and security point of view.
Exclude from Conditional Access Policies:
- Ensure at least one emergency access/break glass account is excluded from all Conditional Access policies.
Regular Validation and Documentation:
- Validate your emergency accounts every 90 days or sooner if needed. Document a step by step process IT staff to access the accounts in emergencies. Training and clear documentation are crucial. The last thing you want is to discover an issue during a real emergency.

Now that we have covered best practices for emergency break glass accounts, you may have read or heard that Microsoft announced mandatory multi factor authentication (MFA) will be enforced for Azure sign ins. This will gradually be rolled out to other portals, such as admin.microsoft.com, and more. So, what does this mean? Well, any user account logging into the admin portals will be required to enable MFA before they can log in.

Previously, it was possible to log into the Azure portal using an account without MFA enabled, but this will no longer be possible going forward. Why? Because one of the most effective security measures available to organisations is multifactor authentication (MFA). Research by Microsoft shows that MFA can block more than 99.2% of account compromise attacks. Since emergency accounts are commonly used to log into admin portals, these accounts are not exempt from this new rule. Attackers could exploit emergency break glass accounts to access your environment with Global Administrator privileges and cause significant damage. Previously, a large number of organisations would create emergency break glass accounts without enabling MFA, which was normal. However, this recent announcement from Microsoft means that organisations will no longer be allowed to login to admin portals using any account including emergency break glass accounts with a password alone. MFA must be enabled with phishing resistant MFA being highly recommended, however, other MFA methods are allowed. In my opinion, It makes sense to secure these highly privileged accounts.

Great, we’re nearly there. What’s next? I would like to provide a quick overview of passkeys and a popular attack method known as token theft or token replay. Why am I discussing this, you may ask? Because using phishing resistant MFA, such as a passkey, can prevent token theft. Let’s learn more about passkeys and token theft.

What are passkeys?
Unlike passwords which can be compromised no matter how long or complex you set them, FIDO2 security keys enable phishing resistant passwordless authentication. They can replace weak credentials with strong hardware backed public/private key credentials that can’t be reused or replayed in the event your users are targeted via a phishing attack. This is where the hacker attempts to steal the users password by tricking them to click on a link and enter credentials or deploy malware to the device. When configuring a FIDO2 supported method, such as a physical YubiKey, the process involves the generation of two keys:

A private key, which remains on the physical YubiKey and never leaves the device. This is similar to how other non phishing resistant methods function, such as Windows Hello For Business. This private key never leaves the physical device, so in the case of a YubiKey, the private key is stored securely on the YubiKey. With Windows Hello for Business, the private key remains on the device, such as the laptop, stored in a secure TPM (Trusted Platform Module).
A public key is provided to the relying party. In my case, the relying party is Microsoft, because I’ll be using my FIDO2 supported physical passkey to log in to admin portals such as the Azure portal.

Because passkeys are phishing resistant, they are highly recommended. Apart from physical FIDO2 security keys, there are other phishing resistant MFA methods available, including Certificate Based Authentication (CBA), passkeys via the Microsoft Authenticator app and one I mentioned earlier, Windows Hello for Business.

Why are passkeys secure?
When configuring a passkey, there are a number of security features that prevent a hacker from misusing your credentials. One of the key security features is proximity, which means the user must have proximity between the authenticator and the laptop. In this case, the authenticator could be a physical FIDO security key or a passkey on the Authenticator app. This prevents users from being tricked by a bad actor, for example, If the bad actor attempts to steal a user’s session token, it would be of no use, because the hacker is most likely sitting someplace far away from the laptop device, and therefore the proximity check fails and access is denied. If you’re interesting in knowing how token theft works, I have embedded a video explaining the steps below. We’ll get to that shortly.

Another important security feature is that the FIDO2 supported device is tied to a specific website address. This means that if a hacker tries to fool the user by redirecting them to a different URL, the authentication attempt would fail. This is because the private key stored on the device will only respond to the specific website it was originally registered with. So, even if a hacker tries to mimic the real website by creating a good looking clone pointing the user to login.micr0soft.com (disguising the o for a zero), the FIDO2 supported key won’t complete the authentication process because it was originally registered against login.microsoft.com and not the fake login.micr0soft.com.

Still confused? I demonstrate the flow between the public and private key in a diagram below. Click the image below to enlarge.

How does a hacker steal user login information?

The process is known as token theft or token replay. This involves various methods a hacker will use to steal a user’s session token or a cookie which is created once the user has logged in and authenticated. If the hacker manages to obtain the session token, the session token can be captured and replayed on the hackers device, allowing the hacker direct access to the users data without having to login again. The methods used can include, but are not limited to, installing malware on a user’s device, stealing the session token and sending it over the Internet to the hacker, or using a technique known as adversary in the middle (AiTM) attack. When a user successfully logs in, a session token/cookie is automatically created, granting the user access to email, Teams, OneDrive data, and more. As mentioned above, hackers can use techniques to steal the session token and replay it on their own computer to gain access to the user’s data.

In the video below, Merill Fernando (Principal Product Manager @ Microsoft Entra) demonstrates a couple of controls which can prevent token theft. He provides a demo of how EvilJinx can be used to steal and replay a token to access user data, and then provides a demo showing a number of security measures to help prevent it, including using phishing resistant MFA.

DISCLAIMER:
Evilginx has the potential for malicious use. It’s crucial for defenders to account for such attacks and devise strategies to safeguard their users from these types of phishing threats. Evilginx should only be employed in lawful penetration testing engagements with explicit written consent from the targeted entities or for educational objectives.

Another good video by Alex Weinert (VP Identity Security at Microsoft) in which Alex provides several solutions to help prevent token theft.

Passkeys Available via Phone Using the Authenticator App
In the next post, I demonstrate how to set up a physical FIDO2 support passkey from Yubico. However, passkeys are also available without needing to purchase a physical key. Modern smartphones come equipped with built in FIDO2 authentication capabilities, providing you with phishing resistant protection and allowing you to use biometric features like fingerprint or face recognition as passkeys. With the Microsoft Authenticator app, you can register and use these passkeys on your iphone or android phone to securely log into your accounts. This provides a convenient and cost effective way to enhance your online security without having to purchase physical security keys.

I know what you’re thinking! “If passkeys are available for free using phones via the Authenticator App, why should I purchase a physical key?”

Great question! While passkeys on smartphones offer a great level of convenience and security, there are several reasons why an organisation might still opt for physical security keys. Here are a few benefits:

Device Flexibility: Physical passkeys can be used with any device, including shared workstations, without relying on employees’ personal mobile phones. If you don’t allow the use of personal mobile phones in your organisation, you could purchase physical passkeys.
Enhanced Protection: Physical keys can offer an extra layer of protection against malware and other attacks that might target vulnerabilities in mobile devices.
Compliance Requirements: In some industries, compliance requirements may mandate the use of physical keys. Therefore, while smartphone based passkeys are excellent for many users, physical keys still play a crucial role depending on your organisational requirements.
Emergency Break Glass Accounts: A physical FIDO2 key would be a better option than a mobile phone for an emergency break glass account. It ensures that access is not dependent on the availability or functionality of a specific mobile device. YubiKeys don’t contain moving parts and are designed to be simple and robust, with a solid construction that contributes to their reliability. They don’t require batteries or an external power source, as they draw power directly from the USB or NFC connection when in use, making them ideal for offline storage and offsite locations.

That’s it! I hope you enjoyed and found Part 1 useful. In Part 2, I will go through the steps to configure my newly purchased YubiKey. Click the following link if you’re interested in learning more. Part 2 – Configure a YubiKey For An Emergency Access Account In Entra ID | Cloud Build

Part 2 – Configure a YubiKey For An Emergency Access Account In Entra ID

Posted on December 3, 2024 by Imran Rashid

Reading Time: 8 minutes

In Part 1, I covered emergency account best practices and the benefits of FIDO2 supported passkeys. If you haven’t read the post, I highly recommend doing so to get a understanding of the foundational concepts and best practices that will enhance your overall security. It’s worth the read! You can check out part 1 by clicking the following link Part 1 – What is a FIDO2 key and How to Set One Up for Emergency Access in Entra ID | Cloud Build

In this blog post, I will guide you through the step by step process of configuring a YubiKey purchased from Yubico. As explained in part 1, the open standard technology used under the hood is FIDO2, which is also used by other vendors. It’s not only Yubico that provides these FIDO2 based security keys.

Now that you have had an overview of passkeys and token theft, let’s continue to part 2, enabling my YubiKey (FIDO2) which I purchased from Yubico.

Access entra.microsoft.com
Click protection and authentication from the left pane

3. Click Passkey (FIDO2) which is set to disabled by default

4. Click the toggle to enable, click select groups and then browse and locate your security group in which your emergency break glass account is a member of. In my case, I have created a DemoGroup which includes the emergency break glass account.

5. Next, click Configure

6. There are a several default configuration options. Let’s go through these one at a time.

Allow self-service setup
The default option is set to yes, which means users can register a passkey themselves by logging into the security Info portal accessible via https://mysignins.microsoft.com/security-info. If set to No, users can’t register a passkey by using Security info, even if passkeys (FIDO2) are enabled by the Authentication methods policy, so one to be aware of.

Note:
Currently in preview, administrators can use Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users. At the time of writing, there is no option to provision FIDO2 on behalf of users via the portal, therefore, users have to enable this capability themselves via the MY SignIns url I shared above. Public preview: Microsoft Entra ID FIDO2 provisioning APIs

Enforce attestation
The next option is Enforce attestation.

When this option is set to Yes, Microsoft relies on the FIDO Alliance Metadata Service (MDS) to determine security key compatibility with Windows, Microsoft Edge browser, and online Microsoft accounts. The FIDO Alliance Metadata Service (MDS) is a centralised repository of the Metadata Statement that is used by the relying parties to validate authenticator attestation and prove the genuineness of the device model. Vendors such as Yubico report data to the FIDO MDS. Vendors are responsible to publish all root attestation certificates to the FIDO Alliance MDS; otherwise, attestation verification can fail. In simple terms, attestation involves performing a check against a central verification database to ensure the FIDO2 key being used is listed in a central database.

Administrators can enforce which hardware security key providers are allowed in their environment. For example, an organisation may only allow particular models of YubiKey to be purchased from Yubico and disallow all other providers. YubiKeys are identified by a AAGUID which can be accessed at the following url, YubiKey Hardware FIDO2 AAGUIDs – Yubico

I purchased a Security Key NFC with firmware version 5.7. Accessing the link above, I’ll be able to locate the unique AAGUID for this model of device. If I enter the AAGuid into the configuration within EntraID, only this model of security key will be allowed in my organisation. I could add additional AAGUIDs if needed.

If you wish to use passkeys in Microsoft Authenticator, clicking the check box labelled Microsoft Authenticator automatically adds the two AAGUIDS for Apple and Android to the list, allowing you to use passkeys in the free Microsoft Authenticator app. If you wish to learn more click the following Microsoft Learn link, How to enable passkeys in Microsoft Authenticator for Microsoft Entra ID

The images below show how an AAGUID is added and the check box to enable passkeys in Microsoft Authenticator. I won’t be covering passkeys in the Microsoft Authenticator app but you can learn more at the link I posted above.

ok, we’re done. The option to use PassKeys (FIDO2) shows enabled as per the image below.

The user experience

In the next steps, I will login using my emergency break glass account and enable the option for physical PassKeys.

Access https://mysignins.microsoft.com/security-info
I log in with my emergency break glass account
Click Add sign-in method

4. Click Security key

5. I am required to configure MFA before I can enable a security key. I click next.

6. Click Next again

7. I already have the Microsoft Authenticator App installed on my phone. I click next

8. I open the Authenticator app on my phone and scan the QR code provided

9. A two digit code appears on screen and a prompt on my Microsoft Authenticator App requesting I enter the two digit code. After entering the code, I receive a notification approved message.

10. Click Done

11. We can now attempt to add the security key again at My Sign-Ins | Security Info | Microsoft.com

12. I click add sign-in method and select Security Key again. This time I receive two options. I click USB device.

13. Click Next. If I had selected NFC in the step above, I would receive the message below. By selecting USB, the message would be similar but there would be no mention of “tap your security key on the reader”.

14. I am redirected to Windows Security. I select Security key and click Next

15. I click ok

16. Click ok. Notice the key will be locked down to login.microsoft.com. If a bad actor attempts a phishing attack and redirects the user to a different fake url, the YubiKey will not allow access.

17. I am prompted to insert my YubiKey into my laptop. Plug the physical key into the USB port depending on which USB device you purchased.

18. Once the YubiKey is detected, I am asked to create a new pin. This pin will be stored and locked to my YubiKey.

19. After creating a PIN, I am prompted to place my finger on the YubiKey.

20. Name the Key, for example YubiKey 5 NFC, and click next.

21. We’re all set. Click done

22. The new YubiKey is now visible as one of my sign-in methods.

23. I remove the YubiKey from the USB port in my laptop.

Login to test the YubiKey. I’ll access portal.microsoft.com
Select or type my username
Instead of entering a password, I click the option, Use your face, fingerprint, PIN, or security key instead

24. Select Security key and click next

25. I enter the pin I created as part of the setup earlier and click OK

26. The YubiKey flashes and I am prompted to place my finger on the YubiKey and I’m in.

That’s it.

Enforcing users to use phishing resistant MFA
If you wish to enforce the use of phishing resistance MFA for certain or all users, you can use authentication strengths via conditional access policies in Entra ID.

A few things to note

Conditional Access requires Entra ID P1 licenses. It is not a free feature.
Attestation enforcement governs whether a passkey (FIDO2) is allowed only during registration. Users who register a passkey (FIDO2) without attestation aren’t blocked from sign-in if you were to enable the option enforce attestation later.
Enforce key restrictions should be set to Yes only if your organisation wants to only allow or disallow certain security key models or passkey providers, which are identified by their AAGUID. You can work with your security key vendor to determine the AAGUID of the passkey or check the vendors website. If the passkey is already registered, you can find the AAGUID by viewing the authentication method details of the passkey for the user. Locate and click the user in Entra ID and click authentication methods from the left pane. The AAGUID is also visible from the my-signins portal.
When Enforce key restrictions is set to Yes, you can select Microsoft Authenticator to automatically add the Authenticator app AAGUIDs for you in the key restriction list. If you wish to learn more about enabling passkeys in the Authenticator app, instead of having to purchase physical keys, click the following Microsoft Learn link, How to enable passkeys in Microsoft Authenticator for Microsoft Entra ID
If your organisation doesn’t currently enforce key restrictions and already has active passkey usage, you should collect the AAGUIDs of the keys being used today. Add them to the allow list, along with the Authenticator AAGUIDs, to enable passkeys (FIDO2). This task can be done with an automated script that analyses logs, such as registration details and sign-in logs.
Currently in preview, administrators can use Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users. At the time of writing, it was not possible to automatically provision the rollout of FIDO2 security keys to users from the portal.

I hope you found this two part blog series useful. Thank you for tuning in and catch you at the next post.

Integrate Defender for Endpoint with Defender for Cloud Apps

Posted on May 24, 2024 by Imran Rashid

Reading Time: 6 minutes

In this post I explore how to integrate Defender for Endpoint with Defender for Cloud Apps natively without having to go through much effort.

Why would you want to do this? Once traffic information is collected by Defender for Cloud Apps, you can analyse what Cloud Apps your users are accessing, including details such as website address, IP, user and device name.

Defender for Cloud Apps takes advantage of capabilities to block endpoint device access to Cloud Apps. Cloud Apps can include any application or website accessed over the Internet, for example, Office 365 and websites such as social media sites. For example, you may want to identify commonly used risky cloud storage and collaboration websites your users may be using and unsanction (block access). Defender for Cloud Apps helps you manage over 31,000 apps by assessing risk factors provided by Microsoft to ensure compliance. If a Cloud App does not meet security and compliance requirements, you can unsanction the app. This is basically shadow IT and mitigation, allowing you to block the use of unauthorised Cloud Apps in your organisation with a click of a button.

Pre-requisites

Microsoft Defender for Cloud Apps license
Microsoft Defender for Endpoint with Plan 2 OR Microsoft Defender for Business with a premium or standalone license.
Windows 10 version 1709 (OS Build 16299.1085 with KB4493441), Windows 10 version 1803 (OS Build 17134.704 with KB4493464), Windows 10 version 1809 (OS Build 17763.379 with KB4489899) or later Windows 10 and Windows 11 versions.
Enable Microsoft Defender Antivirus:

There are number of configuration options we must enable before the data we require from our user devices is visible within Defender for Cloud Apps.

Access the Microsoft Defender XDR portal at security.microsoft.com
From the left pane, click settings.

3. Click Endpoints

4. Click Advanced features

5. Scroll down to Microsoft Defender for Cloud Apps and enable this option.

6. From the left pane, click Settings again

7. Click Cloud Apps

8. Under Cloud Discovery, click Microsoft Defender for Endpoint

9. Enable enforce access. Once you discover and unsanction unauthorised Cloud Apps, users will not be able to access them and will receive a warning. You can also set up additional alerting options as required, such as redirecting the users to a custom web page of your choice when a website/cloud app is blocked.

10. Click Settings > Endpoints > Advanced features, and then select Custom network indicators. This allows you to leverage Microsoft Defender Antivirus network protection capabilities to block access to URLs using Defender for Cloud Apps.

11. Click Yes to confirm.

It can take up to 2 hours before information is passed from the endpoints to Defender for Cloud Apps

12. Access Defender for Cloud Apps (security.microsoft.com) and click Cloud Discovery from the left pane as shown in the image below.

13. Once the data is visible in Defender for Cloud Apps, a new report similar to the one below should be visible. The report shown in the image below is named Win10 Endpoint Users.

14. In the Win10 Endpoint Users report, some statistics start to become visible. Click Discovered apps.

15. We can see a list of Cloud Apps being accessed by users. There is not much going on as I only have one Windows 10 machine and one user that I used for this demo.

Each Cloud App/website is assessed against a catalog of built in Cloud Apps. The Microsoft Defender for Cloud Apps catalog page provides a list of over 31,000 discoverable Cloud Apps. Defender for Cloud Apps discovery analyses your traffic logs from your Windows 10 and 11 devices to give you ongoing visibility into Cloud use, shadow IT, and risks posed to your organisation. Defender for Cloud Apps rates each website/cloud app risk based on regulatory certification, industry standards, and best practices.

16. We can dig deeper and check the users and IP addresses tab.

17. All Cloud Apps accessed by my demo users are ok from a risk score point of view, but let’s assume that I wanted to prevent my users from, accessing Dropbox or other websites. I could unsanction, block access to the Cloud App.

Note: unsanctioning a Cloud App blocks access for the whole organisation. However, you can create custom App tags which can be based on include and exclude. You can then select to exclude or include certain devices. For example, block access to social media sites for all devices apart from marketing user devices.

18. Once I click unsanction, a list of drop box url’s are added to a blocked list known as Indicators. These can be viewed by clicking settings from the left menu > Endpoints and then scroll down to Indicators as shown in the image below.

19. You’ll find that as part of unsanctioning Dropbox, a number of urls are added automatically by Defender for Cloud Apps, such as dropbox.com, dropbox.jp, dropboxbusiness.com and more. You could also manually add website addresses you wish to block from user devices.

Note: it can take a few hours, sometimes up to 24 hours before the changes are synced to Defender for Endpoint.

20. We can also unsanction Cloud Apps from the catalog of over 30,000 built in apps. From the left pane click Cloud App catalog.

21. I filter to display all Cloud Apps with a risk score of zero. Change the filter as per your requirements using the risk score option shown in the image below.

A total of 321 apps (at the time of writing) with a risk score of 1 appear from the catalog.

22. Let’s click the first one in the list, torrentz.cl

Clicking the app, provides me with some useful information including app security and compliance details. This could be really useful as I may only want my users accessing apps which meet ISO 27001 and ISO 27018 compliance.

I could also check if my users are using this app and if yes, I could decide to unsanction (block) or even monitor access. If a Cloud App is tagged as monitored, a message will appear notifying the users that this cloud app/website is being monitoring.

23. After the indicators have synced to Defender for Endpoint (This could take a few hours, sometimes up to 24 hours), I launch Edge browser and access dropbox.com, I receive a blocked message. An alert is also logged in the Defender portal to inform administrators that a user attempted to access an unsanctioned (blocked) website/cloud app.

Message: This website is blocked by your organization. Contact your administrator for more information.

and that’s it. I hope you found the post useful.

See you at the next post

Azure Portal Menu Options Auto Collapsed

Posted on May 14, 2024 by Imran Rashid

Reading Time: 2 minutes

You may have noticed that when accessing portal.azure.com, your menu options automatically collapse and are hidden as per the image below.

Whereas previously your menu items looked like the example in the image below, known as expanded, where all menu options were visible.

You can expand the menu items by clicking on the collapse all headers icon as shown in the image below, but this is a temporary setting, as the menu options will auto collapse again when you log out of the portal or whilst browsing around the portal.

The good news is that it is possible to disable this feature.

How to auto expand menu items in the Azure Portal

Click on the settings icon located in the top right of the Azure Portal

2. From the left pane, click Appearance + startup views

3. Click the option Expanded

4. Click the apply button to save changes

That’s it. A short post you may find useful.

See you at the next post

Configure Entra ID Company Branding

Posted on April 26, 2024 by Imran Rashid

Reading Time: 8 minutes

In this post I will explore the process of customising the Microsoft Cloud branding default sign in page experience when we login to the Azure Portal, 365 and other services.

When users authenticate into your corporate intranet or web based applications, Microsoft Entra ID (formerly Azure AD) offers an identity and access management service.

There is a default sign in page which all Microsoft customers experience when logging onto the Admin portals, 365 services, third party apps or your own apps. Below is what the default sign in experience looks like for all customers. However, we can change this default look and that’s what I will be covering in this post.

Why change the custom default page?

You’ll be able to create a custom look and feel for the default sign in page. This ensures that users encounter a familiar and visually appealing interface when logging in.
A customised branded page helps users identify legitimate login prompts. When users encounter a familiar and consistent interface, they are less likely to fall for phishing attempts that mimic the default login page. Attackers often create fake login pages to steal credentials, but a branded page reduces the effectiveness of such attacks.
A well designed branded login page instills trust and confidence in users. When they see your organisation’s logo and branding, they feel more secure during the authentication process.
The default login page might appear generic and impersonal. In contrast, a branded page provides a reassuring and professional experience. Users are less likely to be anxious or suspicious when logging in, which contributes to a positive security posture.

Is Entra ID Company Branding Free?

No, this is a licensed feature and requires one of the following licenses at the time of writing this post. Entra ID P1/P2, Microsoft 365 Business Standard or SharePoint (Plan 1).

Can anyone in my organisation configure company branding?

The Organisational Branding Administrator role is the minimum role required to customise company branding. If you have a team of people in the organisation who look after the Entra branding page, following least privilege, it would make sense to assign them the Organisational Branding Administrator role.

Configure Company Branding step by step

Let’s go through the process and explore what we are able to customise.

1. Login to entra.microsoft.com or portal.azure.com. I’ll be accessing branding via entra.microsoft.com

2. From the left pane, expand Identity > User experiences and click Company branding

3. Click default sign-in experience

4. Click customize

5. It is important to note that we are only able to upload images of a certain size. Let’s go through the options one at a time.

Starting with favicon.

A favicon is the image which appears in the browser tab, to the left as shown in the image below.

We could change this favicon as shown in the image below.

6. Scroll down and we are able to change the page background colour of the login page from blue to a colour of your choice.

Page background color

7. Click next to move to the Layout tab

Visual Templates

Here you can decide the layout of the login experience. By default, the Sign in box appears in the middle of the screen. We can also hide the default footer links as shown in the image below. More on footer links later.

On the same page we have the option of custom CSS

A new feature introduced in July 2023 allows you to upload a CSS (Cascading Style Sheets) file. You can customise self-service password reset (SSPR), footer hyperlinks, browser icon, style sign-in experiences and enable header and footer using one of the pre-defined templates.  Using a custom CSS allows you to change the colour of links, colour of buttons and more. Microsoft offer a free CSS template which you could upload or change as per your requirements. The free template is available at the following Microsoft Learn link, CSS reference guide for customizing company branding. The benefit of uploading a CSS is that you have the capability to change the complete default login experience which was not previously possible.

8. Click next to move to the Header tab. Here you can add a header. A logo is displayed in the header of the Microsoft Entra ID sign-in page when users sign-in. See images below.

9. Click next to move to the Footer tab

If you have decided to hide footer links, you won’t be able to add custom footer links. Enable footer links via the layout tab we visited earlier.

Here we can replace the default footer links by adding custom Privacy & Cookies and Terms of use links.

The links appear in the footer as shown below.

10. Click next to move to the Sign-in form tab

Banner logo

This option replaces the Microsoft logo icon as shown below.

Microsoft logo replaced with a custom Cloud Build logo as shown in the image below.

11. Square logo (Light theme) and Square logo (Dark Theme)

Light theme
The square logo is used to represent user accounts in your organisation, on Microsoft Entra ID web UI and in Windows. An image showing what this experience looks like is available below.

Dark theme
If configured, this image will be used instead of the Square logo (light theme) image in combination with dark backgrounds, such as Windows Microsoft Entra ID Join screens in the out of box experience. If your logo already looks good on white and on dark blue/black backgrounds, there’s no need to configure a separate dark theme logo.

Logo shown below

12. Whilst on the Sign-on forms tab we have two further options, username hint text and sign-in page text.

Username hint text
The text that appears before a user enters their information. Using the username hint text assists users in your organisation who may have forgotten the format of their username. If guest users sign-in to your apps, Microsoft recommend that you do not set this option.

Sign-in page text
Appears at the bottom of the Microsoft Entra ID sign-in page and in the Microsoft Entra ID Join experience on Windows. Use this to convey instructions, tips, etc to your users. Anyone can see your sign-in page, so don’t put sensitive info here.

13. Finally, the remaining option on the sign-in form tab is self-service password reset.

This option enables the Forgot my password link under the password field as shown in the image below,

If we were to disable the option Show self-service password reset, the Forgot my password option will no longer be visible as shown in the screenshot below.

We could also change the Forgot password link text or redirect it to a different url as shown in the images below.

Common url
Customises the destination URL of the ‘self-service password reset’ hyperlinks in the username collection and password collection screens. If configured, a custom destination URL will be used instead of the Microsoft default value. In the example above, I changed the url to https://cloudbuild.co.uk/testlink

Account collection display text
Customises the display text of the ‘self-service password reset’ hyperlink on the account collection screen. If configured, a custom destination URL will be rendered instead of the Microsoft ‘Can’t access your account’ default value.

Password collection display text
Customises the display text of the ‘self-service password reset’ hyperlink on the password collection screen. If configured, a custom destination URL will be displayed instead of the Microsoft ‘forgot password’ default value. In the example above, I changed the text to ‘test forgot password’.

14. Browser language customizations

Browser language customizations will allow you to create a personalised sign in experience for a subset of end users based on their browser language. The browser language customizations option will override the default sign in experience. The process for customising the experience is the same as the default sign in experience process, except you must select a language from the dropdown list in the Basics section.

If browser language customisations are not configured, all your users see the same sign in page. However, if you have users logging in from a different country and using a different language, the sign in page will automatically default to their browser language customisation profile if one exists.

The customised branding sign in page appears only after the user types their email and clicks next, is this by design?

Yes, but as per the instructions below, it is possible to change this behavior.

More info available at the following Microsoft Learn link, Home Realm Discovery policy

And that’s it. Remember that you can customise the colour of the buttons, link colours and more by uploading a CSS file as mentioned in step 7 above.

Thanks for reading. See you at the next post.

Subscribe