Mastering and Implementing Azure Active Directory

Explore what Azure Active Directory is, how it compares with native Active Directory, differences between editions, and security features like risk design, multi-factor authentication, auditing, and compliance, on-premises cloud sync.

Explore how Active Directory centralizes users, groups, computers, and organizational units with group policy for centralized control, domain controllers that handle authentication, and concepts like forest, domain, and sites.

Explore how Azure Active Directory provides a cloud-based, multi-tenant directory for identity and access management, offering single sign-on, on-premises synchronization, and reliable multi-datacenter availability across thousands of cloud apps.

Discover how on-premise Active Directory across multiple data centers synchronizes with Azure Active Directory to provide single sign-on to cloud apps like Office, Salesforce, and Dropbox.

Compare Azure Active Directory editions—free, premium one, and premium two—and learn which features like audience synchronization, multi-factor authentication, identity protection, and identity management are included or restricted.

Explore the azure active directory dashboard, identify your domain name, and navigate quick links to create users, groups, or enterprise applications while reviewing recent changes and on-premise synchronization options.

Create a global admin in Azure AD by adding a new user with a domain user principal name, assign global admin rights, and enforce a password change on first login.

Explore Azure AD auditing to track user and group activities, including account changes, login attempts, and password updates, with request IDs, IP, device, and timestamps for forensics and compliance.

Audit azure ad objects by exporting event sets and linking to Power BI for diagnostics and visualizations, with diagnostic exports archived to storage account and governance-aligned retention.

Azure AD Connect synchronizes on-premises users to Azure AD, creating a common identity for cloud-based applications. Features include password hash sync, password writeback, device writeback, and prevention of accidental deletes.

Learn how AD Connect filtering limits synchronization to selected domains and objects with specific attributes, preventing a big-bang sync of all users, groups, and devices to Azure AD.

Azure AD Connect password hash sync synchronizes on-prem password hashes to Azure, enabling sign-in to SaaS apps with a single password and reducing helpdesk costs.

Activate password write back with AD Connect to synchronize password hashes from on-premises to Azure AD and back, enabling cloud password resets while applying on-premises password policies.

Enable device write back to strengthen security by granting application access only to trusted devices. Registered devices write back to Active Directory to optimize authentication and access control.

Learn how the AD Connect feature prevents accidental deletes by defaulting to 500 objects, stopping exports beyond the limit, and notifying admins via email and the Synchronization Service Manager UI.

Automatically upgrades keep the AD Connect binary up to date with the latest release, defaults enabled for install, and let you toggle upgrade behavior as needed.

Learn to download and install Azure AD Connect to synchronize on premise Active Directory users to Azure Active Directory, including handling domain controllers and installation steps in a test environment.

Install the AD Connect tool using express settings, connect to the domain controller with global admin credentials, and synchronize on-premises users to Azure Active Directory.

Verify that on-premise user accounts synchronize to Azure AD by checking the console's user section for on-prem sources and the on-premises data synchronization tool service account.

Identify the on-premises directory synchronization service accounts for azure ad connect, with a special role, tied to the domain controller, a password that never expires, and a 20-account limit.

Describe multi-factor authentication in Azure Active Directory, emphasizing at least two factors from knowledge, possession, biometrics, location, or behavior to protect access.

Enable multi-factor authentication for selected Active Directory users, choose authentication forms, and verify access to enterprise apps while branding the login experience.

Learn how to configure company branding in Azure Active Directory, including banner logos, background images, sign-in page customization, and legal disclaimers for external users.

Publish enterprise applications from the enterprise applications gallery in Azure Active Directory, add new applications to publish to users, and refresh the list to enable access for users.

Publish the Dropbox for business enterprise application to synchronized on-premise users by selecting users or groups in enterprise applications, then grant access based on owners and permissions.

Publish enterprise applications to users in Azure Active Directory and verify access for the Dropbox app, then publish customer web apps to users beyond the marketplace.

Publish custom applications from webapps using Azure Active Directory enterprise applications by registering the app, adding it to application registrations, and publishing to users with branding.

Learn how to add and verify custom domains in Azure Active Directory, enabling users to sign in with company domains by configuring TXT or CNAME DNS records and allowing propagation.

Explore conditional access in Azure Active Directory, balancing security and productivity by enabling automated access control decisions based on sign-in risk, network location, device management, and app types.

Explore conditional access in practice by creating a lab policy that grants or denies Azure AD access based on user, location, device, and MFA requirements.

Explore how conditional access auditing tracks risky sign-ins and assignments, analyzes risk events by user, IP, and location, and enforces actions such as whitelisting and multi-factor authentication failures.