Hello everyone. In today’s article, we’ll demonstrate how to restrict access to Azure resources using AD FS access control rules for domains federated with Azure AD. With ADFS access control rules, you can control internal and external access to an RPT (relying party trust) using location, device status, or even access containing a specific attribute.
In this article, we’ll perform the following activities:
- We’ll create an access control rule in AD FS using an on-premises AD security group.
- We’ll apply the created rule to the RPT Microsoft Office 365 Identity Platform Worldwide.
- We’ll test a user’s access to the Azure management portal without belonging to the security group.
- We’ll add the same user to the security group and test access to the Azure portal again.
Creating an Access Control Rule in AD FS
Let’s start by accessing the AD FS management console and performing the steps below:
1 – Select the Access Control Policies option.
2 – Select the Add Access Control Policy… option
In the Name field, give your policy a name and a description (optional).
Click Add to add a new rule to your policy.
Let’s create a rule that allows access for users in a specific group. To do this, we’ll perform the steps below:
1 – In the Permit box, select the from specific groups option.
2 – Click specific to select the on-premises AD group to be used for this rule.
Let’s select the security group by performing the following steps:
1 – Select the Security groups option.
2 – Click Add.
Let’s look up the security group name and select it following the steps below:
1 – We’ll look up the security group by name and click Check names.
2 – Click OK.
Click OK.
Confirm again by clicking OK.
We can see in the image below that the policy has been created, but it’s not yet in use.
Let’s assign the created policy to the RPT by performing the steps below:
1 – Select the Relying Party Trusts option.
2 – Select the RPT you want to apply the policy to.
3 – Select the Edit Access Control Policy… option
Select the created policy and click Apply.
Testing Access Without Belonging to the Security Group
Let’s test access to the Azure portal without the user being part of the security group defined in the access policy.
We can see below that the “Licensed_users” security group is empty.
Let’s access the Azure portal using the login jack@ulyneves.com.
The access is redirected to the AD FS portal because this is a federated environment. Let’s enter the password and click Sign in.
As shown in the image below, the policy we created restricted access to the Azure portal because user Jack is not part of the security group we defined.
Testing Access With the User Added to the Security Group
Let’s now add user Jack to the “Licensed_users” security group used for this demonstration.
With the user belonging to the security group, access to the Azure portal is granted by AD FS.
Summary
In today’s article, we demonstrated how to create an access policy in AD FS to restrict access to Azure resources using security groups.
I hope this content has contributed to expanding your knowledge of AD FS.
Did you like the post? Like and share it. 🙂
If you have any suggestions or comments, let us know.
[ ]’s
Ulysses Neves
