Cloud-only service account and conditional access to log onto local server

[CHiLL]

For Salamander AD, we need to create a cloud global admin account in M365 but it also needs to be have permission to log on/authenticate to a server that is located on-site. I've created the cloud account but struggling with the local server aspect. I believe we need to use conditional access to allow the account to authenticate against the server, but the server OU is not linked via Azure AD Connect and thus doesn't appear as a selectable machine target when configuring conditional access to the server. I believe my options are:

 

1. Link the server OU so all server objects are synced to Entra
   
2. Create a sub-OU just for this server and only link that sub-OU in Azure AD Connect
   
3. Use an authentication agent that I can't seem to find too much information about
   

 

The first option is the easiest - I just wondered if there is any reason why I shouldn't link the server OU, such as security concerns. ChatGPT seems to suggest that it's beneficial for conditional access, but it can have some risks, including increased attack surface by exposing more AD details or unnecessary permissions may be added to the objects.

Edited November 27, 2024 by CHiLL

[CHiLL]

Is anyone able to advise on this, as it appears our Salamander sync is broken until we sort this cloud account with conditional access.

[StephenPink]

Can't you just create a conditional access policy something like this;

- User is Salamander account

- Allow access: from site external IP only

From memory the default is then block all other accesses for that user account

 

Do you need to be as specific as from that server? I don't think you can specify internal IPs in conditional access

 

 

Sorry if vague just quickly typing off the top of my head!

[StephenPink]

Can't you just create a conditional access policy something like this;

- User is Salamander account

- Allow access: from site external IP only

From memory the default is then block all other accesses for that user account

 

Do you need to be as specific as from that server? I don't think you can specify internal IPs in conditional access

 

 

Sorry if vague just quickly typing off the top of my head!

 

Ignore me - found my notes from the last Salamander. I did the below, as they don't require Cloud Admin access (excuse formatting):

 

 

Salamander Accounts and Permissions

Based on the instructions in the Salamander pre-reqs the below AD account has been created;

[TABLE=width: 1]

[TR]

[TD] Username

[/TD]

[TD] Password

[/TD]

[TD] Location

[/TD]

[TD] Member of

[/TD]

[TD] Additional Permissions

[/TD]

[/TR]

[TR]

[TD] USERNAME

[/TD]

[TD] PASSWORD

[/TD]

[TD] OU

[/TD]

[TD] LOCAL AD GROUPS

[/TD]

[TD] Delegated Control with the following permissions:

- List contents, Read all properties, Write all properties, Read permissions, Create User objects, Delete User objects

Applies to:

- This object and all descendant objects

Delegated Control with the following permissions:

- List contents, Read all properties, Read permissions, Change password, Reset password

Applies to:

- Descendant User Objects

Set on the following OUs:

- OU

[/TD]

[/TR]

[TR]

[TD]

[/TD]

[TD]

[/TD]

[TD]

[/TD]

[TD]

[/TD]

[TD] Delegated Control with the following permissions:

- List contents, Read all properties, Read permissions, Create Group objects, Delete Group objects

Applies to:

- This object and all descendant objects

 

Set on the following OUs:

- OU

Delegated Control with the following permissions:

- List contents, Read all properties, Read permissions, Create Group objects, Delete Group objects

Applies to:

- This object and all descendant objects

 

Set on the following OUs:

- OU

[/TD]

[/TR]

[/TABLE]

 

In addition, the Group Policy Object "" has been created and applied, to grant the Salamander AD Account Local Administrator rights on SERVER.

This is NOT synced to Azure for security purposes . The below Azure user has been created to enable a mailbox for notification emails;

[TABLE=width: 1]

[TR]

[TD] Username

[/TD]

[TD] Password

[/TD]

[TD] License

[/TD]

[TD] Roles

[/TD]

[TD] Additional Permissions

[/TD]

[/TR]

[TR]

[TD] Salamander@DOMAIN

[/TD]

[TD] In Credentials

[/TD]

[TD] Office 365 A1 for faculty (no desktop apps required)

[/TD]

[TD] No additional roles required

[/TD]

[TD] No additional permissions required

[/TD]

[/TR]

[/TABLE]

[CHiLL]

Thanks for your reply @StephenPink, however is that related to the Salamander account being created in the on-site AD environment and then being synced online? We are being told by Salamander that it is now a requirement that the account must be cloud-only, as in not an on-site account synched to Azure.

[StephenPink]

Yes but not synced - think this was last year? So there is an-site AD account, and then a separate, cloud-only account - but that is only used for email notifications. Assuming you're using AD Connect/Entra Connect/whatever it's been renamed to now, is that not still the case? Wondering if something else has changed either with Microsoft or Salamander that's changed the cloud account requirements?

[CHiLL]

Yes but not synced - think this was last year? So there is an-site AD account, and then a separate, cloud-only account - but that is only used for email notifications. Assuming you're using AD Connect/Entra Connect/whatever it's been renamed to now, is that not still the case? Wondering if something else has changed either with Microsoft or Salamander that's changed the cloud account requirements?

We are using Azure AD Connect, but Salamander have said "Microsoft has made some changes to its security requirements.", so I think it's a fairly recent change.

Edited November 27, 2024 by CHiLL

[StephenPink]

We are using Azure AD Connect, but Salamander have said "Microsoft has made some changes to its security requirements.", so I think it's a fairly recent change.

 

Hm maybe check with Salamander what they require admin access for in Azure/Entra? If syncing from local AD I can't see why they would - Microsoft have changed the requirements regarding MFA for admin accounts in Azure/Entra, but like I said, the Salamander account shouldn't need to have admin permissions?

[psydii]

I had a "we need global admin without MFA" response to a change request I made recently. Seems so odd to me, I thought that the method papercut uses would be transferable to the set of rights needed to perform the sort of user/group/mailbox customisations salamander needs.

 

Maybe I missed it, but I think a support/blog/post from them might be in order to explain what appears to be a retrograde step in their approach to security.

[CHiLL]

Hm maybe check with Salamander what they require admin access for in Azure/Entra? If syncing from local AD I can't see why they would - Microsoft have changed the requirements regarding MFA for admin accounts in Azure/Entra, but like I said, the Salamander account shouldn't need to have admin permissions?

Salamander just told me to contact Microsoft if we are unsure. I have a ticket open with them, but it's pretty slow going at the moment. I've only had the "we've got your ticket" and an introductory reply from the assigned agent so far. They need the admin rights to not only create the on-site AD accounts, but also manage the accounts, licensing, SDS and other scheduled tasks and configurations that they run.

 

I had a "we need global admin without MFA" response to a change request I made recently. Seems so odd to me, I thought that the method papercut uses would be transferable to the set of rights needed to perform the sort of user/group/mailbox customisations salamander needs.

 

Maybe I missed it, but I think a support/blog/post from them might be in order to explain what appears to be a retrograde step in their approach to security.

It would have been nice to have known about it before our sync broke completely and this needs to be done in order to get it working again.