Azure Portal Access

[jaminben]

Good Morning,

 

We've just setup an Azure Basic service and have noticed that students can login to the Azure Portal using their domain credentials.

 

I've read about Conditional access in Azure Active Directory but it appears as though you may need a Premium account which we don't have.

 

How is everyone else handling this?

 

Thanks

 

Ben

[Katy]

I had never thought to even try this myself, pupils can log in to azure portal on our installation too... although it does look like they can't alter anything, and if they attempt to create/buy resources it tells them they need to set up a subscription (which needs their card details) but still would rather them not be able to log in to it... also noticed they basically have an easy to browse read-only view of the entire synced AD domain too!!

[jaminben]

I had never thought to even try this myself, pupils can log in to azure portal on our installation too... although it does look like they can't alter anything, and if they attempt to create/buy resources it tells them they need to set up a subscription (which needs their card details) but still would rather them not be able to log in to it... also noticed they basically have an easy to browse read-only view of the entire synced AD domain too!!

 

That's my main concern... the fact they can view the synced structure.

[jaminben]

I submitted a support request asking MS if there was any other option and the result of that can be seen below:

 

 

-enable block sign-in setting for this users individually but in this case it will also block access to portal.office.com

-block portal.azure.com as restricted site -this will only work for internal access

-use Conditional Access feature (as you know this requires AD Premium)

[jaminben]

MS have just replied again...

 

As we cannot block the sign in for the users to portal.azure.com we can limit the read access for the users- so they cannot see the other users in Azure Active Directory -they will still be able to

sign in .

To activate this setting you will have to run the below Windows Powershell commands:

Connect-msolservice (use Global Adminitstrator credentials)

Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false

 

Will try this next week.