Azure Active Directory Password Writeback

hi guys hope you all doing well and welcome back to our series of Azure Active Directory and in this video we are going to talk about password right back now if you're watching the series from the beggining in the last video we have discussed about self-service password reset where as the agenda of this video will be knowing what is password right back how exactly it works how to enable password right back on in Ethernet and what are the logs that you should refer to to troubleshoot password right back issues so in a nutshell password right back is actually a service that's been enabled on aad Connect so that the sync identities can reset their password using self-service password reset and the core fundamental behind this is that this service helps assure Active Directory to write bad passwords to your local Active Directory now since this is a premium feature offered by our Active Directory what you need is a charade a premium p1 license but if you have any of these schools available in your tenant you can assign them to users and they will be able to use this particular feature now the a couple of benefits using password right back the very first one is on Prem password policies are applied that means the complexity the character checksum and the password age all the policies that you have to find on Prem will be applied to the password reset request whenever initiated by any of the user it's a real-time synchronous process that means the moment user tries to reset the password at the same time it has been a return back to your Active Directory also as a admin you can reset the password of the user from Portal Roger calm but as of now it has not supported from office 365 portal and the best part behind enabling password right back is that there are no inbound ports required on your aad connect server because it's the sync engine password sync engine itself which queries our Active Directory to see if there is any requests pending to get updated on Prem or not now let's talk about how to enable password right back for that I'm going to switch to my machine where I have installed a ad connect so that I can show you the settings that you have to do in order to enable password right back so this is my machine where ad Connect is installed and now what I'm going to do is I'm going to run the configuration was odd because then only we would be able to enable or disable any feature which is available now this requires global admin credential for my current setup it is already enabled so if I'll click on let's say view current configuration and I'll click on next as you can see it is showing password right path enabled but in order to enable this feature what you have to do is you have to click on customize synchronization options then click on next enter your global admin credential and then when will come at this particular option of optional features it will give you the option to enable or disable password right back now since you are making changes to the current configuration or you're just enabling password right back try not to make any changes from the options which were already selected from your previous setup so as you can see right now password right back has enabled for me now for your setup you have to just select this option and then click on next add a synchronization process will be initiated once the password right back is enabled for your tenant now there is one more thing which is very important and which I would like to show you guys and that is the logs that get generated for a 80 Connect so for that you have to go to program data and then select this folder of aad connect now since I have already enabled password right back in my tenant so what I'll do is I'll check the trace logs wither and I can show you what all happens when you try to enable a particular feature so now what you have to do is just search for password right back and then there will be a log name - password right barkis utility which we'll show you what exactly going on so as you can see that this is where the password right back was enabled by one of my global admin and as you can see that these are the different endpoints which are accessed in order to enable this feature for your tenant now if you are getting some error while an enabling password write back for your particular tenant then what you can do is you can actually refer to these logs and these logs will help you to figure out what exactly going wrong so now we have enabled password right back and then the next process is to check how exactly it works so for that what I'm going to do is I'm going to switch to my machine where I have a different browser and where I will try to reset the password for one of my user and let's see if it works or not so this is my browser from where I'll try to reset the password for one of my user and then we'll check what are the logs that are getting generated on event viewer off your AAT connect server so I'm just typing my username and then I'll type the CAPTCHA on mentioned here d.j xq5 and I'll click on next now as of now there are certain things which are getting verified the very first one is whether the user is a licensed or not the second one is whether password right back is enabled for your tenant or not and the third one is whether the user has completed the registration process or not if the user has not completed the registration process then all this information will not be shown to you so what I'll do is I'll quickly verify my contact number here and then I'll resume the video so I have received the OTP now and I'll click on next now the moment I will click on next I will be prompted to change my password I'm typing a new password for me that should comply all the policies of on-prem environment that means my password should be complex enough so that it should adhere the policies defined on-prem and then only the possible reset policy will get completed and the password will be written back to your active directory and as you can see that my password has been successfully reset now I'll switch back to my aad connect server and I will show you the logs that get generated so I'm just going to refresh the logs which are getting generated and Windows application log and then let's see if you are getting any password reset logs and as you can see it is showing that for this user which is IDP our concepts were calm the password has been successfully reset now if there will be any issue likewise permission issue or any end point which is not accessible you will get different type of errors and the fact is that this is the same console which you have to refer so that you can get more insights that if password write back is failing what could be a reason behind that so I'll quickly search for some errors that I was getting initially so that I can show you how to fix this problem now as you can see that these are the errors that I'm getting and if I open any one of them as you can see it says that there is a particular end point which was not able to communicate properly or there was some connection loss so all my agenda is that you know that if for any user the password reset services failing just come to this console says with that UPN and you will be able to figure out what exactly the issue is and why any user cannot reset the password so now I'm going to switch to my deck whether I will be telling you the exact flow how exactly the password fightback works so whenever any user tries to sign into a ka dot ms /s SPR what exactly happens that it is checked whether the user is licensed or not we use this feature and whether password right back has enabled or not now when I say password right BAC is enabled or not what you have to make sure that user should be enabled to use the feature call self-service Password Reset which requires a group assignment and where an I user should be a member of that particular group you can also do this for all of you users this is something which I have covered in a lot more detail in our previous video now the next thing that happens that once the user has successfully registered you can also verify whether both the options that you have selected as a required information is available for that particular user or not for that you have to go to user and then click on authentication methods so once all these things are in place the user can reset the password and if it is failing for some reason you can actually refer to the logs which I have just shown you now let's quickly talk about the summary of what all we have discussed we have discussed about the password right path process how to enable it all aad connect configuration is required how to refer different logs to check whether password write back as a service facing some issue or password reset request for a user is not getting complete now as for the playlist we have tried to cover all the setup information which is moreover related to Azure Active Directory but this video of the next video will be the last video for our Active Directory where and I will be covering about the band password if you guys think that I have missed something or if you want me to create a specific video for any particular feature please share in the comment section and I'll try to cover them thank you so much thanks for your time have a quoit ahead and if you have learned something new please feel free to subscribe

Channel: Concepts Work

Views: 10,109

Keywords: Azure Active Directory, Azure AD, Office 365, Password Writeback, Self Service Password Reset

Id: ICIltEEA3LI

Length: 10min 31sec (631 seconds)

Published: Sun Nov 10 2019