Azure Active Directory
Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.
Thank you for joining our community and helping improve Azure AD!
Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...
-
Deny Access Control in the RBAC
Please add the options below to RBAC.
Disable inheritance.
Deny.144 votesWe recently added deny capability to Azure’s RBAC system, in the form of deny assignments that can be set by the system only. The first Azure feature to use deny is BluePrint. We intend to add a configurable deny capability in the future, but have not yet announced any details.
Cheers,
/Stuart and Balaji -
AADB2C: How-to on multi-tenant applications based on B2C
As service provider using Azure as the underlying platform, I want to create an application that allows companies to create and manage their tenants and users within my service in order to provide a public service area as well as a privately owned area for the company.
I've read about B2C supporting multi-tenant, but I couldn't find hints within the documentation...
140 votesWe are currently prioritizing Azure AD as and identity provider into B2C. We will review this request after that work is done. Keep the requests coming! /Jose Rojas
-
AADB2C: Add CORS headers to AD B2C token endpoint to allow for implicit flow (XHR POSTS)
We are trying to implement Azure AD B2C authentication with a web app using implict flow. We can login and successfully get redirected to the correct url which includes the correct items on the redirect url (idtoken&code). However, as this article suggests (https://github.com/Azure/azure-content/blob/master/articles/active-directory-b2c/active-directory-b2c-reference-oidc.md#get-a-token) the app then needs to perform a xhr POST request to the token endpoint to retrieve a token for a resource (web api) the app needs to interact with. However, when I try and do an XHR POST to that token endpoint (https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token?p=b2c1_signinpolicy) the browser (quite rightly) performs a preflight check (an…
138 votesCould you elaborate more on the use case for this?
Parakh
-
Password expiry reminder email notification
Most people are having separate accounts for accessing Azure AD. It will be good if there is an email to remind users to change their passwords as the users may not login to their cloud accounts frequently.
137 votes -
Span AADDS domain across multi regions
Span the same AADDS domain to multi regions - currently only possible with vnet pairing and VPN gateways. Would also add redundancy to the domain if say a region were to go down or the AADDS service were to stop within a region.
136 votesUPDATE 01/06/2020
Engineering remains in-progress.Engineering has begun work on this.
-
AADB2C Password history policy
Allow us to set passwords must not be the same as the previous passwords used by a user. The number should be configurable, so not the same as the last 10 passwords used by the individual for example.
135 votes -
Group-based Licensing for Nested Groups
Nested groups have been around for a VERY long time. It is ridiculous that group-based licensing doesn't support nested groups. Please add support for nested groups ASAP!
133 votes -
Powershell Enable PIM Role Assignment
We plan to utilize PIM for Azure Resources (Resource Groups), however it is currently not possible to automate thorugh Powershell. It would be nice if existing Roles could be made eligable and configurated with it's settings thorugh powershell when creating resources/resource groups through powershell.
129 votes -
Find all users with app passwords
We think that it's necessary to have a command for PowerShell to show app passwords per user. It would also need to show what app the password is being used for. MFA is pointless with thousands of app passwords. Not every user we've enforced has set up app passwords. this is what me and many other admins would like to know.
129 votes -
Restricting Access Of Azure Service Principals – Using Conditional Access
If anyone has the below information, can connect to Azure from any network and issue Azure PS commands.
<#
Display Name : MS-PoC-ServicePrincipal
APP ID : XXXXXXXXXXXX
Tenant ID : YYYYYYYYYYY
Object ID : ZZZZZZZZZZZZZ
Key : oooooooooo
MS Link
https://github.com/squillace/staging/blob/master/articles/resource-group-authenticate-service-principal.md>
Best possible scenario is to restrict is using RBAC. Agreed.
An extra layer of conditional access to the Azure Service Principal would be good. This security flaw can compromise the AAD data, since most of the Service Principals have OAuth2 enabled and Read access to AAD.
Can MS look into this please.
I had raised case with MS…127 votesWe’ve started work on this, focused on policy based on IP range.
-
Flutter / Dart Support
We need a native Flutter / Dart plugin. Flutter is the top trending respository on GitHub! https://github.com/trending
It's a very bad decision not to write any plugin's for Flutter / Dart. Once again Microsoft will be left out and will be forced to play catch up at a later date. There are many plugins for AWS, but NONE for Azure!
As of today:
Xamarin Forms has 2k likes
Flutter has over 28k likes!127 votes -
Implement the ability to join Mac OS X to Azure AD
It would great to have the ability to allow Mac OS X users with the ability to join Azure AD.
126 votes -
Azure AD Password Policy
Azure AD should provide more parameters to configure as per the users need.
For example as per my organisation's Security policy, the minimum password length required is 12. But there is no way to configure this parameter from 8.
The Azure AD platform should provide the ability for users to configure the below password policy at least.
1. Password history
2. Password complexity of temporary password generated by Azure
3. Password length125 votes -
B2C Roadmap
Deliver a roadmap which shows what functionality is planned and under review.
125 votesHi all, unfortunately we don’t have plans to share out a public roadmap. This is constantly changing as we’re listening to customer requests. We will continue to update feedback.azure items as they come up so feel free to suggest anything you are curious about.
-
Add group as owner on Azure AD Application and Service Principal
When managing Application and Service Principal objects in Azure Active Directory, it's difficult to provide granular access controls.
Azure currently supports adding "Users" as Owners through the Azure Portal, and we can also assign other "Service Principals" as Owners using PowerShell (or by creating the new SPN with an existing SPN), however it's not possible to add a Group.
When you try to do this, you get the following error message:
#
PS C:> Add-AzureADApplicationOwner -ObjectId <removed> -RefObjectId <removed>
Add-AzureADApplicationOwner : Error occurred while executing AddApplicationOwner
Code: RequestBadRequest
Message: The reference target 'Group<removed>' of type 'Group' is invalid…124 votes -
Query Azure AD Devices BitLocker recovery key via PowerShell
Please allow query Azure AD Devices BitLocker recovery key via PowerShell
124 votes -
Fully Support WebSocket protocol in Azure AD Application Proxy
The current Application Proxy does not support rewriting ws:// or wss:// URLS from my testing.
We have an application that has it's content (HTML, JavaScript, images ...) hosted by IIS and a standalone service that provides data through websockets.
I created an app proxy for the IIS component requesting content rewriting and created a second app proxy for the websocket service. However, it seems that the first app proxy doesn't know to rewrite the embedded ws:// URLS to point them to the second app proxy.
Also, running a websocket tester against the second app proxy external URL fails as it…
124 votesWe are planning to fully support WebSockets. We will update when we have more details.
-
Request for registration of OATH token and connection to user:
We would like you to allow end users to register OATH token by themselves as well as other multi-factor authentication notifications (i.e. telephone and SMS)
If our request above is not permitted, please consider the following to reduce the time and effort of the administrator:
- Registering OATH token information prior to registration of associated user information
- Connecting the user and OATH token by GUI operation from Azure portal instead of importing CSV
- No entering authentication code when activating OATH token123 votes -
Backup Azure Active Directory
I would like the ability to backup my Azure Active Directory. This could be a feature provided by Microsoft, or allowing a configuration file to be exported locally.
If my users maliciously deleted application registrations among other things, there is no easy way to restore this currently.
123 votes -
Custom password complexity
Allow the ability to set different password complexities for local accounts in a B2C tenant.
121 votesWe have a private preview of this feature available. If you are interested in joining, please contact aadb2cpreview@microsoft.com with the name of your tenant.
/Sam
- Don't see your idea?