Episode 187 – AAD Alternate Login ID and Sensitive by Default in SharePoint

In Episode 187, Ben and Scott discuss the newly announced preview for alternate login IDs in Azure Active Directory, enabling "sensitive by default" labels with DLP in SharePoint Online, and the GA of the new Microsoft Secure Score. Transcript Email Download New Tab - Welcome to Episode 187 of the Microsoft Cloud IT pro podcast, recorded live on July 14 2020. This is a show about Microsoft 365 and Azure from the perspective of IT pros and end users. Where we discuss the topic or recent news and how it relates to you. In this episode, Ben and Scott covers some recent Microsoft 365 News, including Azure AD alternate login ID, sensitive by default in SharePoint and OneDrive and some other security related news. It's Wednesday, this has me all thrown off my game, cause I'm going on vacation, and I'm not-- - It's not even Wednesday, it's only Tuesday. - Yeah, see, I told you. Tuesday has me all turned off my game. Cause I am going on vacation to a remote cottage in Michigan to enjoy the sun and the sand and the water in social isolation from everyone, including a cell phone signal. - You think it's gonna be done. - Yes, I'm actually looking forward to it. My parents have a cottage up there, I have not seen it yet. So they got it like a year ago and I have not been up there to visit or to see the cottage because the last time we were up there it was winter. And just you don't go up there in the winter. Well, you could, but my kids would not have enjoyed it as much as I would have. - I think it's safe to say one does not go to Michigan in the winter, let alone to the cottage, the remote cottage at Michigan. - At Michigan, one absolutely goes to Michigan because there's snow to play in. - Yeah. - Then well billing to be had, sledding to be done, snowboarding. All of the fun winter sports. - Yeah, and you can almost go find yourself a real mountain. - I could, I could just go to Denver instead or to Utah or Montana, Canada. All of the above definitely have better skiing. But they're also-- - The northeast. - All the more expensive and I don't have family there. - The Northwest, little bit of Europe, bring the family with you. - I have always wanted to go to the Alps, to go skiing. My brother has done it, I have not. - I will not discourage you. - Perfect. - You should live your dreams. - Now I just have to convince my family. I need to get all my kids skiing. Do you know how hard it is to teach kids to ski and snowboard in Florida? - I do as I've been flying my mind around too, to do the same thing. - Yeah, once they get a little older, we'll teach them. We'll get them and then I'll go to Switzerland and-- - I'm gonna teach them how to ride the one wheel cause that's not like snowboarding, but it's close. - How close is it? Because I believe you have had the privilege of riding a one wheel a lot. - I bought one so yeah, now I gotta get my money's worth out of it. - Yes well, but do you get to ride it or have your kids hijacked it? - No, I ride it. - Okay. Is it like snowboarding then? - Not quite with the stock tire that comes on it. I think you need a different tire to make it feel a little bit more like that. But it is super fun. It's definitely a thing that you can get into with potentially like a deeper carve than a longboard. It's different than skateboarding or snowboarding or skiing, or any of those things, but it's definitely fun. It's addicting. - I might have to add that to my Christmas list, birthday list when I stopped buying LEGO sets. are a great way to improve productivity and save time in the workplace and Sperry software has all the add ins you'll ever need. The Save as PDF add in is a best seller and it's great for project backups, legal discovery and more. This add in saves the email and attachments as PDF files, it's easy to download, easy to install and Sperry software's unparalleled Customer service is always ready to help. Download a free trial at Sperry software.com. S-P-E-R-R-Y-S-O-F-T-W-A-R-E.com and see for yourself how great Save as PDF is. Listeners can get 20% off their order today by entering the code "CloudIT". That's cloud IT, C-L-O-U-D-I-T all one word at check out. Sperry software work in email, not on email. - So, in other news, should we talk about cloud news? - Yeah, - We could just turn into the rambling guys podcast. - No, there's been a bunch of fun stuff with Azure AD. - There has been. So this was when, I think it came out yesterday. So it came out Monday, July 13 cause I saw it right before I crawled in bed last night. In this one is that, using some PowerShell now, you can go in and enable user friendly sign in to Azure AD with email as an alternate login to an ID. As an alternate login ID, which is normally your UPN. So this is interesting because I still talk to clients that just assume they're always using their email cause they don't realize email and UPN are 99% of the time, the exact same in Office 365 but in reality, your UPN and your email, do not have to match up one for one. And Microsoft just, I would say they encourage you to keep the same because it does tend to lead to less confusion for people, when your UPN and your email address are the same thing. - True story. So now with this one, you don't have to do that which can come in handy, especially when it comes to, some of those cases where you have trusted domains because I was thinking through this last night and making sure that it all made sense in my head is, a lot of times you may have two different domains you have, well, two different domains, you can't have the same UPN suffix in the two different domains. So people run into problems because of how Azure AD sync works. You can only put it on one server, you have to trust your domain. You have to sync all your users up and then they end up with different UPNs or different email addresses. Now you could in theory, sync two different domains with two different UPNs, set the same email address for all the users and let them use that single email address as their login ID. Instead of having separate UPNs from separate domains. Did I think through all that properly? - I'm still confused as to why you'd want to, you'd be losing the ability for per user resolution, like if every user had the same email address, and you turn this on, what user would it resolve to when they log in? - Sorry, I probably phrased that wrong, not the same user, but users from two different domains with two different UPN all having the same email domain. So think your UPN is user one at Company A, and then you have user B at company two, but they could both have user one at parent company.com and user two at parent company.com as their email address and now use that to log in, even though their primary UPN suffix is different. - Correct, and it should still resolve back, so I haven't turned this one on yet, but it looks like what it's using is any addresses that resolve in the proxy addresses attribute. So as long as you've got that in there, you'd be cleared and ready to go. So it certainly helps out in situations like that. I've worked with a number of organizations where sign in IDs do not equate to email addresses in any way, shape or form. Like every law firm, I've worked for almost 99% of the time, my login for Active Directory was just employee ID, lots of financial institutions were that way. So you'd be a number to log into your computer and then you'd have your email address and all the other things on the other side, which led to all those customizations of like you said, swapping in email address and sending it up as the UPN attribute through AD Connect and weirdness ensues, because users have two different login names and everything else. So effectively with this, you can still keep your UPN, your users still resolve to their UPN. But theoretically, anything that's a match within a proxy addresses attribute should go ahead and get them through. But certainly you wouldn't wanna end up in that situation where multiple users have the same email address and proxy addresses cause I don't know how it would resolve. Does the first one win, does a random one win, that could be a little weird. - Yes, I misspoke there. When I was talking about users with the same email addresses. I meant just users with the same domain. - I totally get where you're going. - But you're still gonna have some weird user behavior, I think with this one cause you're logging in with the email address and effectively what you're doing is, you're using that address for Home RAM discovery, and then relying on things like synced passwords and Azure AD to go ahead and pick things up. So this isn't gonna work if you have ADFS. Cause well, you'd still be redirected through Home RAM discovery or HAD to your ADFS server. But then in ADFS, you're gonna have to use your real login and password. This is you sync your passwords and do password hash synchronization and all that stuff to Azure AD. And you're relying on that as a login mechanism. And then once you've logged in with your email address, you're still resolving to your UPN. So, if you log in with Ben.Stegink, but you're B Stegink is your actual username. That's still what's gonna show up inside of the sweep bar and things like that when you go to your profile. - Yes, and it does look like, like you were saying, it can be any proxy address. So it's not just your primary SMTP but in theory, if I had B Stegink as my UPN and I had an email address that was Ben Stegink and Ben and B Steg and all of those I could in theory use any of those email addresses to login. But you're right, I have not turned this on and tried it yet. I should definitely do that. Because why wouldn't I want to try something that just came out in preview in my primary tenant? - I thought that's what your primary tenant was there for? ...