Azure Active Directory
Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.
Thank you for joining our community and helping improve Azure AD!
Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...
-
Deny Access Control in the RBAC
Please add the options below to RBAC.
Disable inheritance.
Deny.137 votesWe recently added deny capability to Azure’s RBAC system, in the form of deny assignments that can be set by the system only. The first Azure feature to use deny is BluePrint. We intend to add a configurable deny capability in the future, but have not yet announced any details.
Cheers,
/Stuart and Balaji -
Add support to Azure AD B2C for the on-behalf-of flow.
In order for a web API to call another downstream web API as the user, Azure AD B2C needs to support the OAuth on-behalf-of flow.
According to the following reference, this isn't supported in B2C: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-apps#web-api-chains-on-behalf-of-flow
I also cannot find this feature on the Azure Roadmap.
130 votes -
Span AADDS domain across multi regions
Span the same AADDS domain to multi regions - currently only possible with vnet pairing and VPN gateways. Would also add redundancy to the domain if say a region were to go down or the AADDS service were to stop within a region.
129 votesUPDATE 01/06/2020
Engineering remains in-progress.Engineering has begun work on this.
-
Integrate Azure AD PIM with on-premises AD
Azure AD PIM is a cool feature, and easy to use. The on-premises MIMPAM solution is the exact opposite experience. It requires a lot of infrastructure to be in place, and different skillsets are needed to make it secure. It's simply too expensive and complex for a lot of organizations to use.
Integrating AAD PIM with on-premises AD would solve these issues. A cloud based solution, paid by usage (license per user).
128 votes -
Password expiry reminder email notification
Most people are having separate accounts for accessing Azure AD. It will be good if there is an email to remind users to change their passwords as the users may not login to their cloud accounts frequently.
127 votes -
Group-based Licensing for Nested Groups
Nested groups have been around for a VERY long time. It is ridiculous that group-based licensing doesn't support nested groups. Please add support for nested groups ASAP!
126 votes -
Find all users with app passwords
We think that it's necessary to have a command for PowerShell to show app passwords per user. It would also need to show what app the password is being used for. MFA is pointless with thousands of app passwords. Not every user we've enforced has set up app passwords. this is what me and many other admins would like to know.
124 votes -
AADB2C Password history policy
Allow us to set passwords must not be the same as the previous passwords used by a user. The number should be configurable, so not the same as the last 10 passwords used by the individual for example.
123 votes -
Powershell Enable PIM Role Assignment
We plan to utilize PIM for Azure Resources (Resource Groups), however it is currently not possible to automate thorugh Powershell. It would be nice if existing Roles could be made eligable and configurated with it's settings thorugh powershell when creating resources/resource groups through powershell.
122 votes -
Query Azure AD Devices BitLocker recovery key via PowerShell
Please allow query Azure AD Devices BitLocker recovery key via PowerShell
121 votes -
Flutter / Dart Support
We need a native Flutter / Dart plugin. Flutter is the top trending respository on GitHub! https://github.com/trending
It's a very bad decision not to write any plugin's for Flutter / Dart. Once again Microsoft will be left out and will be forced to play catch up at a later date. There are many plugins for AWS, but NONE for Azure!
As of today:
Xamarin Forms has 2k likes
Flutter has over 28k likes!121 votes -
B2C Roadmap
Deliver a roadmap which shows what functionality is planned and under review.
120 votesHi all, unfortunately we don’t have plans to share out a public roadmap. This is constantly changing as we’re listening to customer requests. We will continue to update feedback.azure items as they come up so feel free to suggest anything you are curious about.
-
Add group as owner on Azure AD Application and Service Principal
When managing Application and Service Principal objects in Azure Active Directory, it's difficult to provide granular access controls.
Azure currently supports adding "Users" as Owners through the Azure Portal, and we can also assign other "Service Principals" as Owners using PowerShell (or by creating the new SPN with an existing SPN), however it's not possible to add a Group.
When you try to do this, you get the following error message:
#
PS C:> Add-AzureADApplicationOwner -ObjectId <removed> -RefObjectId <removed>
Add-AzureADApplicationOwner : Error occurred while executing AddApplicationOwner
Code: RequestBadRequest
Message: The reference target 'Group<removed>' of type 'Group' is invalid…119 votes -
SSPR - Allow user unlock from the windows 10 logon screen.
You recently implemented the password reset from the Windows 10 logon screen. However, the possibility of unlocking the user when they remembered the password was lacking.
I remember that this functionality already exists through the MIM or Azure reset link.
116 votesHi folks! Thank you for your feedback. We don’t yet have plans to release this feature, but we are still considering it. We will update you if anything changes.
-
Custom password complexity
Allow the ability to set different password complexities for local accounts in a B2C tenant.
116 votesWe have a private preview of this feature available. If you are interested in joining, please contact aadb2cpreview@microsoft.com with the name of your tenant.
/Sam
-
Azure AD Password Policy
Azure AD should provide more parameters to configure as per the users need.
For example as per my organisation's Security policy, the minimum password length required is 12. But there is no way to configure this parameter from 8.
The Azure AD platform should provide the ability for users to configure the below password policy at least.
1. Password history
2. Password complexity of temporary password generated by Azure
3. Password length114 votes -
Implement the ability to join Mac OS X to Azure AD
It would great to have the ability to allow Mac OS X users with the ability to join Azure AD.
113 votes -
Fully Support WebSocket protocol in Azure AD Application Proxy
The current Application Proxy does not support rewriting ws:// or wss:// URLS from my testing.
We have an application that has it's content (HTML, JavaScript, images ...) hosted by IIS and a standalone service that provides data through websockets.
I created an app proxy for the IIS component requesting content rewriting and created a second app proxy for the websocket service. However, it seems that the first app proxy doesn't know to rewrite the embedded ws:// URLS to point them to the second app proxy.
Also, running a websocket tester against the second app proxy external URL fails as it…
113 votesWe are planning to fully support WebSockets. We will update when we have more details.
-
Restricting Access Of Azure Service Principals – Using Conditional Access
If anyone has the below information, can connect to Azure from any network and issue Azure PS commands.
<#
Display Name : MS-PoC-ServicePrincipal
APP ID : XXXXXXXXXXXX
Tenant ID : YYYYYYYYYYY
Object ID : ZZZZZZZZZZZZZ
Key : oooooooooo
MS Link
https://github.com/squillace/staging/blob/master/articles/resource-group-authenticate-service-principal.md>
Best possible scenario is to restrict is using RBAC. Agreed.
An extra layer of conditional access to the Azure Service Principal would be good. This security flaw can compromise the AAD data, since most of the Service Principals have OAuth2 enabled and Read access to AAD.
Can MS look into this please.
I had raised case with MS…112 votesWe’ve started work on this, focused on policy based on IP range.
-
Request for registration of OATH token and connection to user:
We would like you to allow end users to register OATH token by themselves as well as other multi-factor authentication notifications (i.e. telephone and SMS)
If our request above is not permitted, please consider the following to reduce the time and effort of the administrator:
- Registering OATH token information prior to registration of associated user information
- Connecting the user and OATH token by GUI operation from Azure portal instead of importing CSV
- No entering authentication code when activating OATH token112 votes
- Don't see your idea?