How can we improve Azure Active Directory?

← Azure Active Directory

Automate Seamless SSO Kerberos decryption key rollover AZUREADSSOACC

Currently to automate the Kerberos SSO decryption key rollover for AZUREADSSOACC , we would need to store domain admin and tenant global admin credentials in a script or scheduled task.

This is obviously not ideal. We currently having to perform the rollover task manually each month.

Please look at how this process could be improved for automation.

96 votes
Sign in
Check!
(thinking…)
Reset
or sign in with
  • facebook
  • google
    Password icon
    Forgot password?
    Create a password
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    NL shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →
    started  ·  AdminAzure AD Team (Admin, Microsoft Azure) responded  · 

    We are currently working on an approach that will allow Tenant Admins to do key rollover from the Azure AD portal; without the need for PowerShell or scripting. This will be released within the next 4-6 months. Subsequently, we will release an update that will perform key rollover automatically every 30 days

    Swaroop

    12 comments

    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      Forgot password?
      Create a password
      Signed in as (Sign out)
      Close
      Close
      Submitting...
      • Anonymous commented  ·   ·  Flag as inappropriate

        Hi, what's the latest update to this, has the key rollover process has been automated via Azure AD Connect or can this be done now via Azure AD portal?

      • NL commented  ·   ·  Flag as inappropriate

        Hi Azure AD Team, we're at the 3 month mark since your last post on this. Are we likely to see this feature in Azure AD portal soon?

      • Anonymous commented  ·   ·  Flag as inappropriate

        Has this still not been fixed? Having to put Domain Admin credentials into a plain text file in order to automate this is deranged...

      • chris commented  ·   ·  Flag as inappropriate

        It is possible to run this as a scheduled task

        #Connect to Azure and rollover SSO Decryption keys
        Import-Module 'C:\Program Files\Microsoft Azure Active Directory Connect\AzureADSSO.psd1'
        New-AzureADSSOAuthenticationContext -CloudCredentials $CloudCred

        #Report before
        Get-AzureADSSOStatus | Out-String -width 4096 | Out-File "C:\Scripts\AzureADSSOStatus\AzureADSSOStatus_Pre_$Date.txt"
        Get-AzureADSSOComputerAcccountInformation -OnPremCredentials $OnpremCred | Out-File "C:\Scripts\AzureADSSOStatus\AzureADSSOComputerAccountInfo_$Date.txt"

        #Rollover SSO Decryption keys
        Update-AzureADSSOForest -OnPremCredentials $OnpremCred

        #Report After
        Get-AzureADSSOStatus | Out-String -width 4096 | Out-File "C:\Scripts\AzureADSSOStatus\AzureADSSOStatus_Post_$Date.txt"

      • Anonymous commented  ·   ·  Flag as inappropriate

        Please include this process in Azure AD connect so we can avoid using plaintext credentials in scripts.

      • cdubb commented  ·   ·  Flag as inappropriate

        This is very much a needed feature. The scripted approach we have taken as a "work around" is not ideal and exposes highly privileged credentials currently. MS needs to address this.

      • Matt commented  ·   ·  Flag as inappropriate

        Great idea, we've been putting up with this for a while and is easy to forget - until people can't login because they changed their AD password and it hasn't synced.

        MS, please address this.

      Azure Active Directory: Directory Synchronization / AAD Connect

      Feedback and Knowledge Base

      (thinking…)
      Hosted by UserVoice