Step by Step: Enable MFA for All Users in Office 365

October 24, 2019 Leave a comment

A new feature currently in preview for Azure AD is Conditional Access Policies (CAP) using pre-built policies. It is currently available for organizations with Azure AD Free (This is pretty much everyone that has Azure AD Connect enabled). Admins can now make use of four conditional access policies. The four policies are:

  1. Require MFA for admins
  2. End User Protection
  3. Block Legacy Authentication
  4. Require MFA for Service Management

For this article, I’ll go over how to enable policy number 2, which will force all users to register with MFA (within 14 days) and force an MFA check during “Risky situations.” I would also recommend enabling policy number 1 in addition.…

Continue Reading →

Intune RBAC – Delegate Permissions Explained

September 18, 2019 Leave a comment

There are lots of permissions that can be delegated in Intune/Microsoft365 Device Management. Understanding what each of those permissions is for and when to assign them is, therefore, a little difficult. With this post, I’ve gone through the task of outlining all of the delegate permissions in Intune as of September 2019. I’ll try to keep this up to date, but if I fail to, just leave a comment telling me something has changed and I’ll get things fixed.…

Continue Reading →

Step by Step: Intune Delegation with RBAC #3

September 10, 2019 Leave a comment

< Previous |

So far, this guide has covered terminology and theory used to develop Delegated Administrator roles for Intune’s RBAC system and how to create users with limited rights to Intune in Step by Step: Intune Admin Delegation with RBAC #1
Next, we covered building RBAC scope tags and assigning those tags with device groups in Step by Step: Intune Delegation with RBAC #2
For this article, we’ll cover the creation of an actual Role in Intune.…

Continue Reading →

Intune – Permissions for iOS and Android Devices

Leave a comment

I was going to include this in part 3 of my Intune RBAC guide, but it’s a lot of stuff, so I’m making a separate post for it. With that said, here are the permissions you will want to set for a normal, run of the mill iOS and Android device manager in Intune. This permission set has no Windows device permissions, so you will need to add those if you want a management role for all devices.…

Continue Reading →

Step by Step: Intune Delegation with RBAC #1

August 29, 2019 Leave a comment

| Next >

RBAC

RBAC, or Role Based Access Control is a methodology for assigning permissions to users based on their job role(s). Administrative Rights delegation benefits from RBAC methodology by restricting rights to the people who need them without granting excessive permission. It contrasts with the most common AD access control methodology, Discretionary Access Control (DAC).…

Continue Reading →