Azure Active Directory
Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.
Thank you for joining our community and helping improve Azure AD!
Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...
-
Add Multifactor Authentication (MFA) support for DirectAccess remote technology
One Time Password access to the DirectAccess user tunnel using MFA
107 votesPlease provide more details. DirectAccess is an on-premises technology and as such may not fall into Azure Active Directory.
-
Deny Access Control in the RBAC
Please add the options below to RBAC.
Disable inheritance.
Deny.106 votesWe recently added deny capability to Azure’s RBAC system, in the form of deny assignments that can be set by the system only. The first Azure feature to use deny is BluePrint. We intend to add a configurable deny capability in the future, but have not yet announced any details.
Cheers,
/Stuart and Balaji -
Custom password complexity
Allow the ability to set different password complexities for local accounts in a B2C tenant.
105 votesWe have a private preview of this feature available. If you are interested in joining, please contact aadb2cpreview@microsoft.com with the name of your tenant.
/Sam
-
SSPR - Allow user unlock from the windows 10 logon screen.
You recently implemented the password reset from the Windows 10 logon screen. However, the possibility of unlocking the user when they remembered the password was lacking.
I remember that this functionality already exists through the MIM or Azure reset link.
102 votesHi folks! Thank you for your feedback. We don’t yet have plans to release this feature, but we are still considering it. We will update you if anything changes.
-
Migrating from Azure MFA Server to MFA Cloud
Need a migration method for migrating from Azure MFA Server to Azure MFA Cloud, without all our users having to re-register.
100 votes -
Password expiry notification for Azure AD joined devices?
It would be great if a Password Expiry notification could be implement for full Windows 10 Azure AD-joined clients in the same way as the domain joined clients receive them. A notification that pops up at bottom-right corner of the screen. At the moment I wasn't able to find any way of enabling that.
We use Azure Directory Sync - no ADFS.100 votesThank you for your feedback! Would you like the feature to be controlled by the admin or available for everyone?
Thanks,
Sadie Henry -
Allow administrators to unlock locked-out users in Azure AD Domain Services
If a users gets locked out of their account in Azure AD Domain services there is no way to unlock it. The user has to wait for 30 minutes.
Try telling the CEO you can't unlock her account?98 votes -
Flutter / Dart Support
We need a native Flutter / Dart plugin. Flutter is the top trending respository on GitHub! https://github.com/trending
It's a very bad decision not to write any plugin's for Flutter / Dart. Once again Microsoft will be left out and will be forced to play catch up at a later date. There are many plugins for AWS, but NONE for Azure!
As of today:
Xamarin Forms has 2k likes
Flutter has over 28k likes!96 votes -
Enable synchronized AD groups (or AAD groups) to map to PIM.
Rather than adding single accounts from AAD (which may be synched from AD), it would be great to map AAD (or synched AD) groups to eligibility rules. E.g. AAD group A is eligible for Role Exchange Admin. That way, one could administer AD groups for privileged access like in RBAC and use PIM to activate the privileges. Adding single users may be difficult to handle in large environments.
94 votes -
Microsoft Authenticator support for Tizen Samsung Gear S3 needed
Pls ADD autenticator to Samsung gear s3 (tizen)
93 votes -
Span AADDS domain across multi regions
Span the same AADDS domain to multi regions - currently only possible with vnet pairing and VPN gateways. Would also add redundancy to the domain if say a region were to go down or the AADDS service were to stop within a region.
91 votesUPDATE 01/06/2020
Engineering remains in-progress.Engineering has begun work on this.
-
Introspection endpoint for Azure Active Directory
Hi,
Times, there will be cases when the user logs out but the token associated with the user on the client doesn't expire and so when the Resource Servers/APIs invoked with these tokens gets serviced/honored. It would be great to have an introspection endpoint with AAD to check the validatity of the token (as mentioned in RFC 7662 https://tools.ietf.org/html/rfc7662) so that all APIs/Resources can leverage it and accept or reject the token instead of creating a custom repository at our end to blacklist these tokens.91 votesThanks for the feedback! We will look into this and share an update when we have more information.
-
Add hashed password migration to Azure AD B2C
Currently, I can migrate user accounts from an existing database to Azure AD B2C. However, it only accepts unhashed passwords, which is completely useless for any modern system, which should ONLY be using hashed and salted passwords. What would actually make this feature useful is to include fields for hashed password, hash algorithm (any of several standard ones), salt and salt method (i.e., appended, prepended, etc).
91 votesThis is not planned for the next 6 months. If this is needed for your scenario, please continue voting and we will re-evaluate at a later.
-
Powershell Enable PIM Role Assignment
We plan to utilize PIM for Azure Resources (Resource Groups), however it is currently not possible to automate thorugh Powershell. It would be nice if existing Roles could be made eligable and configurated with it's settings thorugh powershell when creating resources/resource groups through powershell.
90 votes -
Conditional Access blocking Office Activation and signin.
When the Conditional Access Policy is configured with All cloud Apps option, Office activation is also blocked, although there isn´t any cloud app dedicated for Office activation exclusion. Please create one dedicated cloud app for Office activation.
90 votes -
Make SPN (non-interactive) login events logged and available
Currently in Azure AD when using SPN (non-interactive) logins via code (.Net, Powershell, etc.) for automated processes (server to server communication/API) that interact with Azure, there is no event in Azure AD logs to show that this login has occurred. Please make this exposed in the logs in the same fashion that an interactive user login is logged. This is not only beneficial for troubleshooting, but more importantly from a security, compliance, and risk audit trail standpoint.
90 votesWe are working on this but we don’t have a public ETA to share at this time. We will keep you updated as we get closer.
-
Support logout and single logout with SAML 2.0 claims provider
Support for logout and single logout with SAML 2.0 IdP configured as claims provider on B2C.
The logout and single logout os both requested in some customer cases and in relation to the Danish governments IdP called "NemLog-in". In relation to the Danish governments IdP it is a requirement to support logout and single logout to connect to the central federation.
89 votesUnfortunately this is not planned within the next 12 months. If this is needed for your scenarios keep voting on this item and we will review at a later date.
-
User Opt-In to Azure MFA with Office 365
We have enabled MFA at our Office 365 tenant, but requires Admins to enable users. For organizations that would like to phase MFA in for their users, it would be nice for users to self opt-in sort of like they do with personal email accounts. Then over time, administrators can "require" MFA by a certain date for users holding out. One way to handle this is to include a link for the end user under user settings to "Sign up for Multi-Factor Authentication". Right now, nothing appears under a users security settings until they are enabled by an administrator. Thx!
87 votes -
Automatically enable MFA for all members of an Azure AD Group.
Add the ability to automatically enable MFA for all members of an Azure AD group as they are added, in addition ask if MFA should be automatically disabled for users being removed. This could be via an option within the users setting of an Azure AD group.
85 votesToday, you can use conditional access to enforce MFA on a per-group basis. This is Microsoft’s recommended enforcement model.
We will be updating the per-user enforcement of MFA to more closely match how conditional access works, but this is still in the design phase.Richard
-
Notify before App Registrations Client secret expiry
For secrets and certificates in Azure Key Vault we can set up certificate contact and "EmailAtNumberOfDaysBeforeExpiry".
For App Registrations with client secrets, they just expire (and we get outages).
Please make it possible to get notifications about everything that expire in AAD before they expire, so that we can keep our services running.
No, this can't be monitored/pulled from outside of Azure, as we e.g. run in national clouds where we don't have access on our own.
84 votes
- Don't see your idea?