GSA - Web content filtering - Custom blocked page
Hello everyone, I have a quick question. I just tested the 'Web Content Filtering' of Global Secure Access. However, in Microsoft's documentation, two processes are mentioned for displaying blocked sites (related to HTTP and HTTPS). I wanted to know if it is possible to create a custom page (for example, adding the company logo, indicating the reason for blocking such as the associated web category, etc.). I tried to search, but no documentation related to this is available (or at least I couldn't find it). Thanks in advance for the help!
What is your SOP for old risky users?
Recently have been tasked with leveraging Entra ID to it's full potential. We've a suite of different tools we use for alerting, so the Risky Users component was essentially ignored for a couple years, and there's a buildup of alerts for sign-in attempts I can't even pull logs for. These users would've been required to change their password since the date on most of these, and we have some hybrid environments I plan on enabling self-clearing for. But wondering what other MSPs have done in this scenario?
How to Recover a Global admin account without MFA
Hi Community I have created a Global admin account in a tenant, unfortunately I had to reset my mobile device, and the MFA codes / setup are gone. I know the password for the account though, without being able to access MFA, I'm not able to login anymore. I have no other admin accounts / Privileged accounts setup. Is there any way to recover from this situation?
Limitations on Modifying Enterprise Applications in Azure AD
Hi All, I'm curious about the limitations on modifying Enterprise Applications in Azure AD. Specifically, are there any restrictions on how frequently we can make changes to attributes, ACS, or reply URLs? I understand that modifying these settings can impact user access, but I'm concerned about potential rate limits or other restrictions that might prevent frequent updates. Any insights or best practices for managing these changes would be greatly appreciated. Post Script We don't have a dedicated QA environment, so understanding these limitations will help us plan our changes carefully.
New role recommendation: Read Only Exchange Admin
To fully leverage PIM, we are transitioning to Entra roles wherever possible. We wish we could get off of customized Exchange RBAC roles, but the Exchange Recipient Admin role, lacks access to information like mail flow rules, which is essential for troubleshooting mail delivery issues. We would appreciate the introduction of a read-only role that allows viewing all information in Exchange without the ability to make changes.
Enterprise Application AWS IAM Identity Centre
Hi Can someone please help... I have configured AWS IAM Identity Centre Enterprise Application, this works fine for internal users but I can not get external users working correctly as the username keeps looking at UPN rather e mail In the Enterprise Application i have set claim conditional But when I look into AWS under users I still see the guest users have there username set as the UPN in Entra not there E Mail address. Any ideas as to what i can do to sort this out?
No Application acces policy found fpr graph API in MS Teams Virtual Integration
Hello , I’ve encountered an issue while integrating Microsoft Teams Virtual Events using Microsoft Graph API and would appreciate any guidance on how to resolve it. Here’s the setup: I have registered an application in Microsoft Entra ID. The app is granted application-level permissions: 1. VirtualEvent.Read.All 2. VirtualEventRegistration-Anon.ReadWrite.All I’ve set up an OAuth flow for users to authenticate with their Microsoft accounts and approve these permissions. After authentication, the user is redirected back to our app, where we fetch an application access token. The issue: We receive an access token successfully. The Entra ID dashboard shows that the app has the required permissions. However, when using the Graph API to access virtual events (Teams webinars), I receive the following error: GET: https://graph.microsoft.com/beta/solutions/virtualEvents/webinars/:id Response: { "error": { "code": "General", "message": "No application access policy found for the app (707b5896-7828-4010-834e-74d3201a3137) on the user (7f27a9fb-af1a-4d36-a102-3a9591e6aaf9).", "innerError": { "request-id": "00af9b4e-043c-4f93-8a02-a5ee14e7d29c", "date": "2024-10-02T09:10:26", "client-request-id": "00af9b4e-043c-4f93-8a02-a5ee14e7d29c" } } } My question: What does this error mean? Could this issue be related to any additional application access policies that need to be set up for Microsoft Teams or Exchange? How should I go about troubleshooting or resolving this issue? Any help or pointers would be much appreciated! Thank you!Is it Possible to Create a Conditional Access Policy for Non-Interactive Sign-Ins Based on Location?
Hi everyone, I'm looking to create a Conditional Access policy in Azure AD that targets non-interactive sign-ins based on the user's location. Specifically, I want to restrict non-interactive logins if they originate from outside a specific geographic region. Is it possible to configure such a policy? If so, what are the necessary steps and considerations? Any guidance or documentation links would be greatly appreciated! Thanks!Password recovery using alternative email address
Hi, I am in charge of a school, having one tenant. The tenant includes both staff and students. I have enabled Password reset (SSPR) for a selected security group (containing all staff) to use their mobile number to reset their Office 365 password. I logged in to Microsoft Entra, went on Manage > Password reset > Properties, Enabled it for 'Selected', selected the security group and selected Email and mobile phone. It works for all staff that are members of the selected security group. Now, I would like to enable SSPR for students using an alternative email address. All my students are grouped in one security group. So I went to Password Reset > Authentication Methods, clicked on Email OTP and enabled it for 1 group containing all my students. When I login to myaccount.microsoft.com and click on Security Info, when I click to add a sign-in method, I am NOT having 'Email' in the method pull-down menu: May I please ask what am I doing wrong? My objective is to have mobile phone for staff SSPR and email for students. Is it supported by Microsoft in the first place? Please help Thanks
How can I turn off PIM Digest emails?
Hi all, We currently receive a weekly digest email with an update on our risky users/sign ins. However, I check these daily and act accordingly, so we really don't need them. I tried disabling the weekly digest and unticking my role, but still they come. Can these weekly PIM digest emails be turned off and if so, how?
