Azure Active Directory
Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.
Thank you for joining our community and helping improve Azure AD!
Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...
-
banned password message azure ad password protection
Add GPO or client to Windows Client for Azure AD Password protection to display the corporate password policy on login when the user's change password and it's banned. Give users on prem what they can and cannot use as feedback if they put a bad one in.
45 votes -
Show location for Azure AD sign-ins from IPv6 addresses
Please add location information to sign-ins from IPv6 addresses. Currently there is no location information associated with IPv6 so it is circumventing all the Azure AD Identity Protections you have in place.
30 votesThanks for your feedback, folks. We have been working towards resolving the locations for IPv6 logins. Currently, a subset of such logins are getting resolved for location and the % will gradually go up. Are you seeing some of your IPv6 logins with resolved location?
-
Enhance reporting capabilities for Azure AD Identity Protection
The portal reporting for Azure AD Identity Protection could be made much more powerful and usable by:
1. Add ability to sort and filter on column names throughout.
2. Resolving risk events should remove them from the display, or otherwise mark them as resolved so they can be filtered out of future searches.
3. 'Users flagged for risk' should additionally be searchable by IP address, date, type of risk event, etc. (Currently only searchable by user.)
4. Download should provide an option to filter by date, etc.18 votesWe’re working on updates to the Identity Protection UX that have many of these features included. Stay tuned!
-
List users with MFA registration status under Identity Protection
List users with registration status under Identity Protection.
Currently we can only see a pie chart, which doesn't help much when performing enrollment in phases before setting the requirement for users.
15 votes -
"Sign-in Risk" Policy Control Addition?
Add a "Disable account" control to the "Sign-in Risk" policy for the Azure Identity Protection service.
In addition, since Azure supports password write-back to an on-premises AD, it would be great to also disable user's on-premises AD account as well.
Currently, one of the admins has to catch an alert email from Azure Identity Protection and then take action to manually disable an account on-premises if an event happens.
14 votes -
Marking a risky sign in as "Confirmed Safe" in the ID protection blade should factor in to the algorithm for future sign ins
In the risky sign ins report or risky users report in AD Identity Protection you can mark a risky sign in as "confirmed safe." However this does not allow future sign ins from this IP. If an administrator confirms that the sign in is not risky, future sign ins for this user from this location should not be considered risky.
11 votesThank you for your feedback. We are reviewing options for integrating feedback provided by confirm safe/compromised. In the interim, if you want to mark specific IPs as safe for Identity Protection in your tenant, you can do so my marking them as trusted locations. More information is available here (make sure to check the “mark as trusted location” checkbox): https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-configure-named-locations
-
Enhanced Reporting for Azure AD Password Protection
We are running Azure AD Password Protection on-premise mode. The PowerShell summary report is ok, but only works for admins. It would be better to have a report available in the Azure Portal for management to review easily. The report could allow us to see the same summary stats that exist in the PowerShell report.
Also, Individual event data is only available in the Windows Event Viewer where the user attempted to change their password. We have no way to centrally search for an event by user without checking all our DCs. In addition, the helpdesk have no privileges to…
9 votes -
The user flagged for risk receives an email from Identity Protection
When a new risk event is identified, the user flagged for risk receives an email from Identity Protection.
If the user does not recognize this event, the user can change his or her password by following the link provided in the email without going through the administrators.9 votes -
Azure Identity Protection allow alerts to go to any user instead of admins
When you create a new alert in Azure Identity Protection you can only choose an admin as a receiver of the alert, this is a problem when you use PIM without permanent roles.
7 votes -
Azure AD password protection
Add the possibility when using the Azure AD Password Protection feature that if you would ban the word "Contoso" as a password that also varations to this word or sentinces with this word are forbidden. For example "Contoso 2018" or "Contoso is great".
7 votes -
Azure Identity Protection
The emails that are sent when there is a new alert should contain more information than just being notified there is a new alert or risk event. The email can only be sent to global admins so there is no reason to not have detailed info in the email. Also if there is more info in the email a Global Admin can at least call, text, email the user in question as we wont always be able to gain access to the portal so if the event is real. it can be addressed over the phone. Instead of waiting to…
7 votes -
Allow risk reevalueation for guest users
Currently resource tenants with an User Risk Policy in place, will face the problem that guest users with a risk, that doesn't meet the risk policy will get blocked from accessing the resource tenant. As the risk for guest user can neither be seen nor changed, the only way to allow access to resources is to exclude them from the policy. It would be beneficial for admins of resource tenants to be able reevaluate the risk for guest users on their tenant, instead of letting them bypass and ignoring all future risk events for the user.
4 votesThank you for your feedback. We are currently exploring options for how we evaluate risk and enforce policies for guest users. In the interim, we have provided additional details on expected behavior and best practices for Identity Protection with guest users here: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-b2b
-
Risky user email notification is confusing
Risky user email notification is confusing.
When a user click the link on an email, he/she goes to "Risky users (Preview)" page. However this page is confusing. Especially, sometimes it says "No risky sign-ins found" on "Resent risky sign-ins" tab. The link should navigate users to "Azure AD Identity Protection" page, which is intuitive and easier to understand.3 votes -
Notify end-users when an risky sign-in (e.g. sign-in from an anonymous IP address) event is created
Can a feature be added to notify end-users by email when Azure AD detects a risky sign-in event (e.g. sign-in from an anonymous IP address) on their account, so they're able to take immediate action if their account is compromised?
3 votes -
Ability to export Risky Sign in policies programmatically
We need a way to export/consult Risky sign in policies.
In general, a feature should be released with its associated API to allow Microsoft customers to perform automation.
Support case 119070422001895 confirmed this was not possible.
3 votes -
I would also like to use a different email to verify because my phone has been damaged by water and now I am unable to sign in to my email.
I would also like to use a different email to verify because my phone has been damaged by water and now I am unable to sign in to my email. This is ridiculous.
3 votes -
Azure AD Objects LifeCycle Management
We have a certain requirements to create Object like User accounts, Groups etc in Azure AD directly but we don't see an life cycle management like the one available for Office 365 Group.
We need an option to have life cycle management for the objects created in Azure AD. so that we will ensure the life cycle management option available for the objects created in On-Premise AD and Azure AD.
Note: Azure MSI requires a security group for SQL authentication and we don't have a option to use the On-Premise group synced to Azure AD. Only the security group created…
3 votes -
3 votes
-
identity protection
we need to be able to setup different identity protection policies for multiple sets of users. if an identity protection activated user's password is on the Azure Active Directory banned password list, identity protection should force a password change since they are at risk!
3 votes -
Send Azure user risk notifications to the user also.
Currently, Azure allows alert groups to be created in order to receive alerts/risk user alerts, etc. It would be nice if the user could also receive a notification that their AAD account is at risk due to suspicious activity.
2 votes
- Don't see your idea?