Azure AD password protection

Users are prevented from picking commonly used passwords

Azure AD Password Protection is part of Azure Active Directory and helps prevent users from picking poor/easily guessable/compromised passwords. Microsoft maintain a “global banned passwords” list which stores passwords which are “deemed too common”. Obviously this list is not published, but by using Azure AD Password Protection you can have password changes run against it for both cloud and on-premises users. You can also create a custom banned password list, of up to 1000 entries, containing easily guessable things about your organisation, e.g. product names.

When a password change is processed, the service will “normalise” the password (which in essence would be taking it to lower case, swapping out any common substitutions, e.g. Pa$$w0rd -> password), and then checking the resulting string against the banned password lists. If it matches the user will get an error telling them to pick something more difficult to guess.

The only thing I don’t like about this at the moment – and hopefully is something that will be worked on in a future update – is that it’s all or nothing. At work we give staff a much more strict password policy than pupils, so it would be nice to be able to do the same here.

Continue reading “Azure AD password protection”

Backing up my Azure workload to Azure

AzureI’ve looked at using Azure to back up on-premise workloads in a couple of posts now (Azure Backup for smaller loads, and Azure Backup Server for things like a Hyper-V cluster), so I think it’s time I looked at backing up workloads that are already running from Azure. I’m going to look at backing up Virtual Machines and storage accounts – there’s not much more I store in Azure that would need backing up.

I’m going to take a quick look at the options for storage accounts, virtual machines and databases.

Continue reading “Backing up my Azure workload to Azure”

Azure Backup Server – protecting our Hyper-V workload

The Azure Backup Server console showing jobs in progress

We recently migrated our VMWare 3-node plus SAN cluster to a 2-node hyperconverged Hyper-V setup, and after reviewing a few options for backing the thing up I decided on Azure Backup Server.

Our previous setup involved Veeam doing the local backups, then Cloudberry transferring all this into an Azure storage account periodically. I like this setup but want to simplify it (and save money). Best thing here is Azure Backup Server is essentially free – you’re just paying for the data transfer and storage costs in Azure – which I am already paying for – and a fixed fee per item. It will do local backups, i.e. Disk-to-disk, but also allow you to back up to Azure (hence the name), i.e. Disk-to-disk-to-cloud. Perfect.

Continue reading “Azure Backup Server – protecting our Hyper-V workload”

In-place OS upgrade of Azure Virtual Machines

In-place OS upgrade of Azure Virtual Machines is not supported, but still possible.

In-place upgrade of Windows 2016 Azure VMs to Windows 2019 is not officially supported but still something we occasionally need to do. While I’d recommend you spin up a new 2019 VM and migrate your workload if at all possible, it’s a bit long winded but you can do an in-place upgrade.

If you’re lucky it’s as simple as copying the files off the ISO and running through the upgrade wizard, however if it brings up any prompts or messages you need to connect to the console to view you’d not get very far with a service like Azure where you cannot view the console, and this is one of the reasons why it is unsupported directly on Azure.

I’ve done two upgrades so far, one the following way and one just running the ISO. Both methods have worked out fine for me.

First of all you will need access to Azure with permission to manage the Virtual Machine in question, access to a storage account (or permission to create one), a local system running Hyper-V (this can just be a powerful PC running Windows 10), the Server 2019 ISO (or other installation source) and, if you don’t want a very long wait, a decent Internet connection.

Continue reading “In-place OS upgrade of Azure Virtual Machines”

Hybrid Azure AD Domain Join Without an SCP

The standard method to configure hybrid domain join is to open up Azure AD Connector and follow the wizard. However this isn’t suitable for every environment – for a start it needs to write forest-level configuration data, create a Service Connection Point (SCP), and if you want to link multiple tenancies to a single AD forest you’re in for a hard time.

Luckily we can hybrid join with some registry settings on the client devices, and don’t need to set up an SCP. Here’s how I’ve managed it on my network.

Continue reading “Hybrid Azure AD Domain Join Without an SCP”