one of the areas that we constantly have to deal with in the cloud is the area of
cleaning up technical debt technical debt is when we've had practices for a
long time or we've designed applications or security principles or something in
some way that really is no longer applicable but it's the way we've always
done it so we're hesitant to change the reason
why this is a problem in the cloud is because in the cloud we really need a
different mindset a different way of approaching IT and some of this
technical debt stuff just really doesn't fit and in order to improve our
processes and scale and be able to do what we want in the cloud we really have
to do the hard thing and that is change so we're gonna spend the next few
minutes today talking about clearing up some of this technical debt in the area
of security specifically on our virtual machines and we're going to talk about
how we can do that today with Azure Active Directory authentication
I'm Dean Cefola and this is the Azure Academy this video was requested by one
of the members of our community and if you would like to request the video on
something that we haven't covered yet just leave me a comment below saying
what the video topic is and how you think that would help the community and
we'll be happy to create that for you but to start us off today let's look at
the Azure docks now the docks for Windows and Linux in this case are in a
separate location and I'll show you both of those or we're going to start by
going to products and then to Linux virtual machines and in the navigation
here on the left we're gonna go to the how-to guide and then we're going to
manage VMs and then we're gonna scroll down a little bit to sign in with Azure
Active Directory credentials so the basic approach whether you're doing this
for Windows or Linux is to increase security on your systems are removing
one of those things which has been an attack surface for a long time and that
is the local administrator account the local admin is a very powerful account
because its credentials unlock basically anything on the system basically we're
going to have Azure Active Directory use our credentials that already exist in
the cloud which we're gonna control through specific rback policies that
will enable the right people to have the right amount of access on the machine
and function as a local admin without needing separate local admin credentials
that have to be maintained now there are some requirements here so let's go to
the network requirements link on the right and basically these need to have
port 443 open outbound from your virtual networks and you need to be able to hit
all of these URLs so if we're using something like the azure firewall which
we did a couple videos on and you'll find those in the YouTube card up top
you could just use the fqdn filtering on there to make sure that these are
allowed outbound and an important note here for linux systems you cannot use a
network security group at this point with the VMS because we can't do the
fqdn filtering through ns geez now before we go ahead and start building a
linux vm and setting this process up I want to also show you where the windows
side of the docks are and why they are separate so we'll scroll all the way
back up here and go back to our basic documentation link let's go to products
and then we'll come down to identity and then as your Active Directory and we'll
scroll down to the device management section and go in there and over on the
left we'll go to the how-to guides section and then we'll click on the
Windows Azure VMs and AzureAD link now the reason why these are in two separate
places is because the Windows implementation here is going to be quite
a bit different and over on the right if we click the link for requirements we
can see that we've got to have Server 2019 or Windows 10 version 1809 or later
and we have our network requirements again port 443 outbound and we've got to
be able to hit these URLs but there is another note a little further up and
this note tells us that our windows VMs will be as your ad joined so let's jump
over to the azure portal and start getting to work when the azure portal
we're gonna create a new resource so we'll click our plus button at the top
and we'll choose a bun to server version 1804 and the full list of which
distributions are supported under this feature is in the docs
so we'll go through our initial setup here and I'll choose my resource group
as AzureAD Auth and I've gone ahead and set the machine name region and the size
for our VM as well as put in the local username and password and allowed port
22 so we can SSH into this machine now I know I said that we're going to
basically replace that local admin password but we still need it as part of
the build and you'll see what I'm talking about in a second so let's go to
the next page and this is the disk configuration which I'll just leave
alone and hit next for Network and I'll be standing up a new network for this
and so I'll need a public IP to be able to get to the VM but this all looks good
so I'll hit next and here under the management tab is where we're gonna
spend a few moments so we'll scroll down a little bit here and we can see Azure
Active Directory login with AzureAD credentials and this is in preview so
we're gonna turn this on and that's what's going to enable us to take
advantage of AzureAD authentication on our VM see it's really a simple process
and in our auto shutdown section we'll set our V
to turn off at 11 p.m. and I've set that for the Eastern time zone as well and
we'll hit next for the Advanced section and at this point there's no changes
that we need to make here so what is hit next and in our tag section we'll add
the appropriate tags and this is so I know who's gonna be paying for these
resources which kind of deployment it is and what applications were supporting
and that will hit our review and create and you can review everything make sure
that it looks just the way that you want it so before we click the Create button
we'll click the download a template for automation and this is so you can see
what the JSON code is doing so the virtual machine itself is a absolutely
totally and completely standard VM there is nothing special there's no special
settings or configurations that are here what is special is the last item over
here in our resources list and that is the extension or AzureAD authentication
now this extension you could just copy this as is and use this in your arm code
going forward and if you're interested in a Asscher CLI or powershell for how
to do this same kind of deployment that is in the docs let's close this window
and hit create now while this VM is creating let's go over to our resource
groups and we'll go to AzureAD Auth and here I'm going to show you two different
ways to set up these VMs with their permissions so that the right folks can
log in and no one else will so we'll go here to the access control and to role
assignments so we'll click at the top here to add a new role assignment and
for the role type we'll hit the drop down here and scroll down to the bottom
and we're going to use the virtual machine administrator login and then we
can select here the write user to give this permission and I'll give this to my
wvd admin and we'll hit save and if we scroll down now we can see we have a
virtual machine administrator that's set up for this entire resource group so any
VMS that are here this guy will be able to log in and administer them so we'll
go back to the overview screen here and it looks like everything's finished
deploying so we'll click on our VM and then I'll copy our
IP address and I've opened up putty here and put in my IP address and we'll hit
open look at my login prompt and I'll put in my user ID credentials and we'll
hit enter and now we get the device login prompt
so we need to copy this URL and now we need to enter the code provided for us
then we'll hit next and it's prompting us to sign in to this as your VM they'll
put in our credentials again and hit next and then we provide our password
and hit sign in and it says we've successfully signed in so we can close
this window and back in our SSH prompt we are logged in and we can type the
hostname command and there we see we're on linux AzureAD 1 and I'll type sudo -
s and in order to provide our credentials we need to go back to that
device login page and enter the new code and we'll hit next again sign in with
our wbd account and we've been authenticated and now we're in as root
now this process can of course be kind of inconvenient to have to keep bouncing
back and forth to a device login page so we have a way to get around this and we
can do a cat on Etsy sudoers des d as your ad admins and we can see we've got
% as your ad admins all equals all here and if we want we can replace this with
some text that you can find in the azure Doc's section that we were just looking
at so let me show you where that is you can just replace this line of text with
this line of text and then you would not have to enter your password once you
have authenticated for the first time and this is only as an admin regular
users will still need to provide authentication if they try to sue do so
I'll edit this file in nano and the change here will just go to add no
password and then we can control o to write out the file and then we'll just
hit enter and now we can exit and then we can cat the file again and now we'll
exit as a root and we're back in as wvd admin now if I sudo again I'm in without
having to supply credentials so let's exit and logout we'll go back to putty
now and we'll log back in using our ad credentials again and since this is a
new login we'll need our code and we'll put that code in and hit next
select our wvd credentials and we are signed in I'll hit enter a few times on
the console and we're back in so now if I go to sudo - yes we're right in
without having to provide those credentials again so this gets us in as
root but a regular user would require a different process so let's go back to
the azure portal and we can do this directly on the VM we'll go to access
control and role assignments we'll add a new role assignment and we'll scroll
down here at the very bottom and we're gonna want the virtual machine user
login and this time we'll select Batman as our user and then we hit refresh here
we can see Batman is now a user on this VM so this way you can assign Batman or
whatever other users you want to log onto each machine now so you can
delegate their access to login while using the resource group or higher at
the subscription level in order to delegate those administrator rights
so now we'll log back into that VM now this time I'm going to attempt to login
as Superman and we get our same device login prompt so I'll take my code here
now when we tried to login we see that access is denied and that is because we
do not have the login rights that we need I've loaded a fresh putty session
here and we'll login this time as Batman will copy our code again it enter a few
times on the console and we are now logged in as Batman we can see
controlling this now through our back gives us then the ability to manage our
logins from the cloud so let's try to sue do and when we do it is prompting us
to login because we are not part of that administrators group and we don't have
the rights to just login so we've increased security now around our Linux
VMs let's take a look at how to do this on Windows so back in Azure now I've got
a Windows VM built and that was basically done through the same method
that we just did for the Linux systems with one little caveat so we've got to
select a compatible image here so I'll take 2019 data center and then go to the
management time and of course we have to select
here turning on Azure Active Directory credentials when we do watch the managed
system ID see that turns on as well unlike Linux systems this is a
requirement for Windows systems and that's because one of the differences
here is we are doing an AzureAD join and we need that managed system ID to do
some back-end processes let me show you what I mean
ICANN azure active directory under devices I've got my VM registered here
as an azure ad joint machine so when we go back to that VM and now we go to log
on to the VM through our Kinect we'll open up our RDP and we'll open that up
and we should be able to log right in with our azure ad credentials right but
no we cannot and the reason for this is because the machine that I'm trying to
RDP from is not currently as your ad joined now if you're not familiar with
Azure ad joins this is not like a traditional domain join it has some of
the same features some of the same benefits but they don't function exactly
the same way so with an azure AV join you're going to have more of like an in
tune join type experience so when I run this particular command this dsr EG CMD
you can see that i am not as your ad joined on my machine and my machines
hostname is how this machine because it is not joined it's not part of the same
domain so i don't have the trusted relationship to be able to log on to the
vm directly however I can as your ad join my machine here's the
help switch for this particular command and you can see that we can do a slash
join in order to become part of our azure ad environment or you can open
your windows settings screen and go to accounts and under the work or school
you can access a work account this way so you hit the connect button and then
you can provide your email address here or you can click this link
which is what we will do to join this device to Azure Active Directory and
then we provide our credentials and then we hit next and we put in our password
and then we hit the Sign In button and just to verify we're joining the MSS
your Academy and we've got our credentials and so we're gonna create a
user obsession on this local machine with these credentials and we will be
joining as an administrator and we'll hit join and we are all set and when we
show the DES reg command now we are as your ad joined and we are joined to the
Azure Academy but when we scroll down there is this one other feature flag
that's important and that's under our single sign-on state currently single
sign-on is not enabled and that is again because the user that I am logged in as
is currently my local machines user dean so I can't use single sign-on right now
that's why it didn't work when I tried to RDP to the VM in the cloud that has
azure ad credentials enabled so now we've logged in with our massage or
Academy credentials on this in the same machine and when he checked the status
we see that we are joined to Azure Active Directory specifically to the MSS
your Academy and now our SSO state shows a lot more information showing that that
is enabled as well now since we have this login we can now do our single
sign-on pass-through now when I try to log in with my user this user does not
have access from Azure but it will see the basic connection and then it greets
us with a message saying that your account is configured to prevent you
from using this device so that's our security feature from Azure so now if i
change the login to my wvd now I can login so if I pull up the
command prompt we see we are logged in with WBD on to our cloud as your machine
and when we check the status we see the same thing
yes we're joined as your ad to the a massager Academy and then also single
sign-on is enabled so I hope that you've enjoyed looking at this new feature that
is in preview how to use Azure Active Directory to control authentication to
your systems and this should not only help you to increase security across
your systems but also start to alleviate some of that technical debt as you move
into the cloud and so we won't have to manage these local admin accounts
because we can control it all from Azure directly so if you thought that this
video was good please click on the thumbs up icon as well as click the
subscribe button if you haven't already and join us here at the Azure Academy as
we are just trying to help everybody learn all about Asscher while you're
down there go ahead and leave me a comment on this topic or any other that
you'd be interested in again this video is created because of a request from our
community and we'll be happy to make yours
as well and if you want to get an email notifying you when our videos come out
which is roughly once a week you can click on the bell icon as well while
you're down there thanks very much for joining us this week and we will see you
next time happy learning