when thinking about Windows virtual desktops security there are several
areas to keep in mind and that's because WVD spans technologies from Azure
infrastructure to the platform services and our user identities and since wvd is
accessible from any device anywhere in the world and anyone can claim to be one
of your users we need to be able to prove that they are who they say they
are and that those identities have not been compromised also you may want to
have different conditions in place that enable you to treat users differently if
they're on your corporate network or VPN versus sitting at the local coffee shop
so join us for the next few minutes as we dig into identity security as part
two of this micro series on securing Windows virtual desktop I'm Dean Cefola
and this is the Azure Academy the modern security perimeter extends beyond your
network to include user identities and so we need to secure them so that when
someone tries to log in to WVD they are appropriately challenged to prove they
are who they're claiming to be and they should be granted access so let's go
over to the azure docs and in the azure docs we're gonna scroll down a little
bit and then the table of contents will go to identity then go to Azure Active
Directory we're in this top link to secure your remote workforce so the two
things that we're gonna be highlighting today is multi-factor authentication and
conditional access let's start with MFA we'll click this link for how does MFA
work and basically MFA is that two-factor authentication it is where we
tie our user identity of username and password together with some other kind
of authentication it's just some other way to prove that you are who you say
you are when you go to login so multi-factor has been around for quite a
long time and today for Azure the most common ways of viewing multi-factor off
is with your smartphone having an Authenticator app on it or receiving a
text message and there's a couple different ways that you can implement
MFA and we're gonna talk through those today but where MFA really starts to
shine is when we combine it with conditional access now conditional
access is where we set rule and policies in our organization that
say when you go to login do we require you to put in MFA so if you're signing
in from a computer that is in your office so you may not require MFA or
other rules during those conditions but if you're logging in from somewhere just
off the internet then we need to have some better proof that you are you so we
might challenge you then with MFA now of course you can go much deeper on each of
these topics we're just gonna cover them in relation to virtual desktop today but
if you're interested in a deeper dive on conditional access or other Azure Active
Directory security give me some comments below on what you're interested in and
we'll be happy to make a video for you back to the main page of the azure Docs
we'll go down to the virtual desktop documentation and in the search filter
on the left will type in multi-factor and click the link for the multi-factor
off doc and this is gonna walk us through the our process for today's
video so we'll scroll down just a little bit to this prerequisites section
because in order to use something like conditional access we do have to have an
azure active directory t1 or p2 license now MFA is slightly different because
MFA is free but you only get some of the advanced MFA features with conditional
access when you have p1 p2 licenses so over in the azure portal will go to
Azure Active Directory and then we'll go to our users and at the top here there's
a quick link to go to multi-factor authentication and enabling multi-factor
off checking the box and then clicking
enable for anyone or multiple of our users and of course it's suggested to
read the deployment guide before you go ahead and do this and certainly before
you do this for every single user there are other things to consider first so
we'll come right back to here in a minute back in the azure portal let's
assume for a second what if you set up MFA and conditional access on all of
these users and now let's ask the question for argument's sake what if
something went wrong with the MFA service what if you couldn't
multi-factor that would lock everybody out of using WVD and probably lock
everyone out of altogether that would be an absolutely
terrible thing so to avoid that it is a good best practice to create a a sure
cloud account that will not have MFA conditional access privileged Identity
Management or any other features enabled it will be considered a backdoor account
so that way in case something goes wrong you have a way to get back into the
system and unlock users and keep them going
now with setting up something like this it is also a best practice that no one
person have the password the password should be divided amongst multiple
people so no one person can log in on their own or it should be stored in a
password vault that people have to go through a unlock process to be able to
get to those credentials kind of like break the glass in case of emergency so
to set up an account like this we can just go up to the top and click add new
user and this would be a create user operation and I'll call this user
backdoor fill out the name first name and last name then I've set a password
for the groups we do not want any groups selected but for the roles we're gonna
change from being the user through the global administrator role and we'll hit
select for that and the block sign in here of course should be no and then you
can lock it down to the specific country of origin where this account should be
used from so in my case I'll select United States and then we go ahead and
hit create and there we can see our new backdoor administrator account with that
out of the way we can now return to MFA and know that if something goes wrong we
still have a way to get back in and re-enable our users
I'll select several of our users here and then click enable and then click
enable multi-factor off and we see that those users are now enabled now if we
use our search filter up here we change from any to those who are enabled then
there are all of those currently enabled users but if we switch to enforced we
see that we do not have any yet enforced means that we are requiring MFA enabled
means that you have turned on MFA for these users but it's not yet configured
and then when I go to sign in to something like the web portal or the wvd
client I give my user name as normal provide my password and I click sign in
now they're presented with this screen that more
information is required but we'll click Next now each individual user can choose
their authentication method so you can choose here a phone which will send them
a text or a mobile app in which case they'll be needing the Microsoft
Authenticator I'll just choose a phone number in this case and hit next and
then it's going to send a text to my phone number and I supply the
verification code and click verify and we are done additionally you can set up
an application password through this link over here so that for things like
signing in to Outlook or your other office products you don't have to
provide this challenge authentication because the app itself is responsive to
that challenge in this case I'll just click done and we are signed into the
app because our MFA challenge was accepted and since I've now enabled MFA
when I opened my client application and I go to login I'm now asked to represent
my credentials and there's my MFA challenge we put in your code and hit
verify and the rest of our sign-in process completes as normal so now let's
kick things up a notch and add some conditional access now as we talked
about in the beginning conditional access is one of those advanced features
in Azure EDS we need a license for this so we see licenses over here on the left
and the first thing we have is getting started with license management I'll go
over here on the right to get a free trial and we have two different services
to pick from the premium p2 licenses will give us every feature possible and
then the enterprise mobility section above that will be p2 but also give you
some office 365 functionality pull up up the free trial here for the EMS licenses
because why not and click activate now that that's enabled we can go to license
features and see everything that we have now enabled along with a learn more link
in the center or each one of those features so that you can always figure
out what these features do and over on the left we'll go to all products and
there you can see is our EMS license for 250 users so we'll check the box here to
go to a sign it and we'll click the users link here it will add several of
our users and hit select and then we have to pick their assignment option and
at this point there's no reason why we shouldn't select everything
and we'll hit okay for that and then when we go to a sign you might have a
problem so in this case my licenses are not assigned and the reason why is it
says that we cannot assign licenses without usage locations specified so if
you haven't had to set some of the information around your users if they
were just synced over from your Active Directory and you had never setup these
fields then your users are also going to have this problem so inside the user
Hulk if we scroll down we see our usage location is blank so we'll hit edit up
here at the top select our usage location and this is going to become
important for conditional access in particular and we'll hit save now that
we've done that over here on the left under licenses we can do an assignment
now or re5 selecting all of our services and hitting save and now that license
has been assigned successfully now obviously we don't want to have to do
this for every single user by hand what if you have hundreds or thousands of
them so we can make this easier with PowerShell and there's two basic ways
that we could script this out this way is going to be using a sync rule through
a sure ad connect and you can certainly do this if you like but if that looks
too complicated don't worry there's an easier way to do it first thing we have
to do is connect to as your edie so I'll run that and we'll login and with that
out of the way the command is very simple it's set - as your ad user
passing the object ID of our UPN in this case Thor and then setting the usage
location as us and run that and then we can run the get - as your ad user and
then select all the properties and at the bottom here you can see our user's
location is now us we're gonna run this through a for each loop so I'll run this
next command which is going to give me every user in my environment that does
not have Microsoft in the name and that's because there are some accounts
that are on microsoft.com accounts and we don't want those though here are all
of the UPN's and they look good to me so when I will run the next part which is
the for each loop and that is done and of course we can verify that back in the
azure portal and open up gomorrah and scroll down just a little bit and there
is our usage location as united states so now we can successfully add an
assignment or the e5 license to Cumorah and hits
save and that's done we're back in the overview will now scroll down in the
blade to security and then first we'll go to named locations so if I go into
Azure here you'll notice that these are the IP address ranges for my Azure
private virtual networks and they're also marked as a trusted location and we
can do that by ip's or we could do it by countries but it will allow us to add
certain other global rules I've selected the five countries for our global
offices and we'll hit create but notice that this is not trusted because we
cannot possibly trust every IP address in a single country and I've also added
untrusted locations as well and at the top here we can start by creating a new
policy they'll call this policy wvd and then select our users I'll choose to
select users and groups so in this case I'll just select these four users and
hit select then we can also add excludes here and I'll choose the same users and
groups and I'll select my admin here we'll hit done for that and then we have
to select our cloud app I'll choose select apps and I'll just type in
Windows virtual desktop and you can see we've got a few options and here is why
because we have the non arm and the arm versions available now we have these
multiple choices so the one that's related to the new arm portal or the
spring update would be this second one it's the one that starts with 9 CD and
ends in D 0 7 and that's covered in our documentation we'll come back and do the
other one in just a moment we can keep these rules separate so hit select for
that then hit done now you can select some conditions if you want to and the
conditions can be tied to many different factors one would be a sign-in risk how
risky does this sign-in attempt appear what is the specific type of device a
user is coming from what are the locations that they're coming from then
we have two new features here around client apps and device States so under
locations I'll choose YES for this and I'll select my locations and we can see
the ones from our named locations and for this rule I'll just select a sure as
well as my on-prem and we'll hit select for that and
done there and that's all I'm gonna configure here under access controls
we'll click on that here we want to grant access and require multi-factor
authentication and we'll hit select for that and under session we'll select sign
in frequency and then we have to select the units here and that is hours or days
the shortest time span that we can set this policy for is one hour so you will
get prompted right now through conditional access to submit your MFA
token then if you sign out 20 minutes later and you go to sign back in you
would not be reach allenge for MFA now of course you can then expand this out
to days as well and so depending on your location and policy where these users
are coming from you may want this to be extremely restrictive or not have them
prompt for MFA at all which is another rule set that we can get into in a
minute I'll have this go for one hour and I'll hit select for that and then we
have the policy and naval feature and this is where we can choose to have this
just be a learning tool at the moment just have it report only or we can
enable this policy which will enforce these settings or we could just turn
this policy off if something is not working correctly or we want to retire
the policy all set the policy to on and we'll hit create and we can do this from
a different place as well so back in the overview if we go to our enterprise
applications when we scroll down we've got Windows virtual desktop here this is
the non-armed registration that we had done we can click on our client and then
over here on the left go to conditional access and we're basically in the same
place set our policy go to select our specific users or groups in this case
I'll choose an azure ad group we've already got our applications selected
and then you can set your conditions and four locations I'll just choose all
trusted locations this time under grant we'll set it for a multi-factor
authentication and for our session frequency this time I'll make this for
one day and this policy I'm going to set just as report only so now back to the
main page of azure ad we'll go back to security back to conditional access and
we can see both policies are here and what their current status is so now that
we've configured the policy I'm going to go to my app here and I'm going to
unsubscribe myself that way I should be asked to login again we'll go to
subscribe and it wants to know our user identity
I'll put in my credentials and hit next and provide my password and we'll hit
sign in and we're prompted for our MFA and we'll click verify and we are signed
in and now right away I'm going to unsubscribe again and then go right back
in and it Reis obscure ibed me without having to provide my MFA credentials at
all because I have already signed in and I've got one hour for that expires and
I'll open the web browser version and without having to provide my challenge
to MFA at all I am instantly able to sign in however if I go to an in private
browser and I drew the same thing now I have to provide my credentials and now
I'm being challenged again for MFA because even though I've provided those
credentials within the last hour this is a different device essentially because
it is a private browser and so it is not yet trusted I can go ahead and verify
and now I'm in let's go back to our conditional access policy now let's go
and create a new policy and for this one we'll click to enable the new preview
experience we'll give it the name of untrusted location for wvd and we'll set
our users to be all users we will add one exclusion for our WVD admin just in
case for our client app will do the same select we did before and in this case
we'll just select all of the virtual desktop apps and hit select and the
conditions let's choose a selected location of untrusted locations and hit
select for that and under the grant rules we're going to block access and we
don't need to select a sign in frequency since we're blocking things here I don't
choose to enable this policy and hit create so now any user coming from an
untrusted location will now be blocked and for my IP location details I'm
appearing as though I'm in Singapore which is not one of my trusted locations
and we'll go to sign in again provide our password and we do not get the MFA
challenge but we do get a message saying that we can't sign in because we don't
meet the criteria necessary to be able to do that and there is a more details
link and we can see at the bottom here our troubleshooting details in case you
reach this message in error you can give that to your IT folks you should be able
to help sort that out back in the azure portal we can also
scroll down here to the monitoring section and if you haven't done this
already for your azure ad you definitely should go to your diagnostic settings
and make sure that you're sending your ads or ad logs to log analytics or
somewhere else so that you can track and monitor what's going on what do you do
you can go in to sign in we can see all of the different logins that have
happened what their status was success or failure what their locations were and
you can click on any of the users if you want to grab more details we can see
from the location that same public IP address and under the conditional access
rules we have the report only rule for the non armed wvd as well as the
conditional access rules for wvd and untrusted locations and these are just
showing you all the rules applied to this user as a whole to see the
particular details around this login you go to authentication details we can see
access has been blocked due to conditional access policies so hopefully
you've enjoyed looking at how we could secure our users in our WVD environments
through multi-factor authentication as well as conditional access this was not
an exhaustive look at either one of these features there's a lot more to be
told and if you're interested in that give me some comments down below and we
can dive deeper on this subject so if you like this video or learn something
new today go ahead and hit the thumbs up icon and join us here at the Azure
Academy if you haven't done so already by clicking that subscribe button and
while you're down there leave me a question or a comment on what you
thought about this video or any questions that you have on Azure in
general if I don't know the answer I probably know someone who does and you
can also leave us a comment on some videos that you'd like us to create for
you and maybe you'd like to receive an email notifying you when our new videos
come out which is about once a week you can click the email notification bell
there as well and check out our latest video over here
on the top right as well as another one at the bottom we picked out just for you
to help you keep learning about Azure thanks for joining us for this second
video in this micro series on securing WVD and we will catch you in the next
one happy learning