Microsoft Azure Training - [48] Azure Active Directory - Part 1 (Exam 70-533) Video Lecture | Microsoft Azure: A-Z Guide - Database Management

hi everyone welcome to Club Rangers
Microsoft as your training as all of you
know I'm Sean Ismail I'm a Microsoft
Azure MVP and that's my contact
information below there for email
Twitter blog as well as LinkedIn and
YouTube all the slides are at on
SlideShare and this is the URL so once
this recording is complete and it's live
you'll find this slide over there posted
as well so today we are going to talk
about as your active directory and this
is part one and I just wanted to let you
know that there will be multiple parts
to as your active directory because
there's a lot to cover and there is a
lot to cover not only from an exam point
of view but also so much that you can do
in real life with as your active active
directory and I want to go over all of
that
so before we start as your sect of
directory I wanted to let you know that
one of the hardest thing couple years up
you know when as I mean as your and I
was working with Azure I found out that
as your active directory in one way is
very different from how your regular
Active Directory or on-premises Windows
Server Active Directory is and at the
same time and as cliche as this may
sound it's a lot like the on purposes
active directory as well so initially
today's session is going to have some
theory and couple of demos but there
will be a lot of parts where you will be
confused and this is expected and the
reason behind that is initially when I
was trying to learn this I kept looking
for only the similarities that you have
with on-premises Active Directory and
that was probably one of the issues I
had because the similarities were just
not there initially when Azure Active
Directory came out as time progressed
and as your Active Directory matured
it's now looking more and more like the
as your active update Active Directory
you have with Windows Server and the
domain controllers and everything you
have on premises as well so if you are a
little bit confused in the beginning
don't worry about it this is something I
went through as well
in the subsequent
parts or sessions that I have on as
you've Active Directory I'll try to
bring it together and make a overall
make an overall sense of what this is
and what it may do for you okay so let's
get it started so what is as your Active
Directory and this is where I want you
to keep like pretty open mind on
understanding what this is
so Microsoft's definition of Azure
Active Directory is basically a
cloud-based directory or identity
management service so the directory part
we understand and somewhat understand
the identity management service because
this is no different from on-premises
right so it's a cloud-based directory
let's put it that way it is also
something that provides secure access
for organizations and users for
applications in the clouds as well as
on-premises so this can be some sort of
an idea application or secure access
options for these applications that are
cloud native which means they are born
in the cloud as well as on-premises and
it will start making more sense as we
keep going in this session it's multi
tenant what that means is that multiple
I mean you have a tenant I have a tenant
all the organizations that are
subscribing to Azure or other services
as you will see has an azure active
directory created from them and it's not
like you're connecting to one large
active directory that Microsoft provides
and you have you know everything
together Microsoft's make sure that
whenever your Active Directory is
created my one is created every once
it's created there is some sort of
distinction there in separation there so
they don't match you can't
in fact view other people's directory
either okay so it's pretty good so what
can be it used for so it can be used for
access to applications so that means
that you have an application that you
created on the cloud around premises you
can use as yours Active Directory to
provide access to that you can configure
SSO which is single sign-on and there
are multiple partners that keep adding
themselves to keep building partnerships
with Azure or Microsoft to provide
partnerships so you may have a login
somewhere else
and you could use your Azure Active
Directory credentials to log in to those
websites or those applications okay you
can provision users and group
this is no different from any active
director we have ever learned you can
have users and groups created in this
directory you can expand on premises
active directory implementation to add
sure so this is an hybrid configuration
so what this does without getting into
too much details as we will have at
least if not two sessions at least one
session dedicated to this hybrid
implementation you can have your Active
Directory on-premises the domain
controller that we all know you can have
all that Active Directory information
expand to your cloud environments as
your Active Directory there are tools to
do that to make sure that this both are
in sync this by no means means that as
your Active Directory is like a domain
controller that is a replica or a domain
controller that is extending from
on-premises Active Directory do not
think that okay this is not a secondary
domain controller or anything we'll get
into this later it can be used for
information protection so all the IT
services it can also do information
rights protections and management you
can develop that as well and plenty of
other benefits and we will talk about it
as the session progresses if this slide
is a little confusing don't worry about
it but this is an overview of what in
general as your Active Directory can do
okay so obviously we cannot get into a
conversation of Active Directory if we
do not do a comparison between our
on-premises Active Directory domain
services and that's what I'm trying to
do in this very brief slide over here
without there's a long list but I'm
going to just tell you what this is
doing here
so a DDS or Active Directory domain
services is a traditional server role on
Windows Server right I mean we were
doing this since ever and what it does
is that it's a feature of Windows Server
and it can be deployed on physical or
virtual machines no different nothing
that you do not know okay so as your
Active Directory is obviously not your
server role and you know you are not
really deploying it to a physical and
virtual machine as your Active Directory
is actually a service that's provided by
Microsoft Azure okay so it's like a
as offering platform as a service
offering Microsoft is taking care of
everything they're just giving you an a
you know a platform or just giving you
an interface to create your directory
okay so both as your Active Directory
and as your I mean Active Directory
domain services store directory data and
manages communication between users and
resources including user login processes
authentication and directory search
searches so this two are similar because
they both are the polar air directory
right among many things the both are
just a directory which stores
information it helps you create all this
log and processes authentication
directory search searches it's only not
only users is also other resources right
so what's happening here is that this
this point here is the similarity
between these two things as Radian a DDS
having said that as your ad is primarily
an identity solution okay so there's a
lot of things as your ad will not do
like a you know domain services on
premises the general theme here is that
we are going to use this Active
Directory as your Active Directory for
identity purposes okay
it has a flat structure so it does not
have object units or oh use
organizational units or whatever you
call it so you will not see that
familiar console where you go and see
multiple use and you keep clicking them
it's a tree structure you are not going
to see that as your Active Directory is
a flat structure okay it cannot be
queried through LDAP so this is a very
important thing that your Active
Directory on-premises does you can have
any application or LDAP queries you can
do to that so as your Active Directory
uses REST API over HTTP it's also called
a de Graaff API if you hear that term
somewhere so you're basically making a
REST API calls to query as well as
perform all the functions on as you're
aiding okay and obviously you can have
your applications make those calls for
you so it's the integration is actually
more I mean it's not that LDAP was not a
very Universal standard but it's going
towards REST API over HTTP to do
more and more of those so that's the
differentiation as your ad also does not
use Kerberos authentication which is
very popular and it's there in every
domains services a TDS on premises all
admins and you know Active Directory
people know about this this is not
something as your ad uses it in fact it
uses like things like authentication is
perform through like sam'l WS Federation
open ID connect and auth
so if you don't completely understand
what these are don't worry about it yet
this is not where we'll be getting into
details for this but if you're a
developer you definitely need to
understand learning or you most likely
not reduce you know sam'l tokens w's
Federation and things like that okay
so given that as your Active Directory
is a web service it perfectly makes
sense because those are the open
standards those are the different ways
to communicate standard ways to
communicate with Azure Active Directory
okay so before we go any further I kept
using throughout this training tenant
and I explained a little bit before what
tenant means but let's actually
understand this in context of Azure
Active Directory because this is very
important okay in as you're a tenant
means that organization so for cloud
Ranger I have a tenant for your
organization you might have a tenant for
your personal subscription when you
signed up with hotmail Gmail or
outlook.com email address you'll have
your tenant dot on microsoft.com okay if
it's your organization they probably
gave a lot more thought about it and
this tenant over here was probably a
little bit more thought about when they
went and got that tenant or the tenant
ID it does not matter in a larger sense
of things because I'll show you why it
doesn't but this is something a tenant
means so this tenant is also it's a
logical container rate it has all your
stuff in there okay so every time you
create a tenant what will happen is that
you get a dedicated instance of as your
active directory service so every tenant
by default will come with your default
as your ad service
you can have multiple directories
created but let's not get there for now
but you think you'll I mean it's one
there one of them is there so Microsoft
ensures by design and this is very
important that is each tenant is
isolated and separate so whatever you do
in your tenant subscription or I kept
using I keep I keep using tenant and
subscription interchangeably because
this sort of our but you know for this
purpose just think that they are and you
have to remember that in your
subscription you obviously don't see my
stuff in my subscription items your
stuff because our tenants are isolated
and separated Microsoft does that by
design now the question is how to get a
tenant well you probably already have a
tenant if you have an azure trial
subscription or and as your subscription
right but there are other ways to get a
tenant and as your active directory so
since Microsoft's online business
services completely rely on as you're
ready for sign-in and other identity
needs services that you get from
Microsoft already provide you that so
you most likely already have a tenant
with as your Active Directory if you
have add as your subscription if you
have a Microsoft Office 365 subscription
if you have Microsoft Intune or
Microsoft Dynamics CRM online these are
Microsoft services that Microsoft
provides the week and as your ad already
created so chances are you might be in
the group of over here that you have an
azure subscription so if you have an
edge your subscription a default
directory as your active directory has
been created for you okay now a couple
of things multiple directories can be
created in a tenant so just because you
have one as your subscription and you
have a default directory it does not
mean that you cannot have multiple
directories okay you can have multiple
directories in fact today in a demo we
will be creating one that we will be
playing with but you can actually have
one okay the other thing is same
subscription can have multiple azure
directories so if you have an S 0
subscription like I mentioned previous
one you can have multiple directories in
there as well so now moving on my
soft as your Active Directory additions
so you know it's important that since
this is a service
Microsoft has different editions when it
comes to as your Active Directory this
is not something that we are familiar
with on premises on purposes what did we
have let's say we had Server 2012
Standard or Enterprise or now we have
Server 2016 enterprise or standard it
did not matter what kind of a DDS or
Active Directory domain services we had
all of them out of the box had similar
features right having said that though
as your Active Directory since it's a
web service it can have multiple tiers
so they Microsoft obviously created
multiple tiers because since it's a
service Microsoft figured out that hey
not everyone will require all the
services so there is a way we can tear
this and obviously the charges for this
are different when you get into more
higher premium editions it actually
charges you more because it provides you
more and more features and functions
that you ideally wouldn't need with a
free Edition for example so as your
Active Directory comes in I mean during
the time of this recording its 2017
right now it has four editions right now
the free edition that you will get right
away with the subscriptions it also has
a basic subscription and it has premium
one and premium two subscriptions as
well so you can actually go to this link
over here that I have on the slide to go
and see a full comparison of this
editions ok it's important that you go
and see that and see what are the
differences between that in fact you
know what I'm going to go to a browser
and show you what what this different
subscription is actually having just
briefly without getting into too much
details just give me a minute here so I
hope you can see my screen here ok so
this is the URL that I went to so as
your active directory features and
capabilities there's some nice videos
over here explaining you what as your
active directories and all that and a
little bit of marketing material but
this is what we are interesting in
interested in comparing generally they
have little features of free basic and
premium editions ok
so these are all the features that you
have in your free basic premium one
premium doing this for office -
absolutely you can see that most of
these things are similar but towards the
end a lot of things only come in in your
premium editions that you don't have
anywhere so Windows 10 Active Directory
ad join you'll only get that for example
in premium one in premium two what
Microsoft is basically saying the
metrics that you're looking over here is
that they're things that you do not need
right out of the box because you're not
going to do that for most of our
purposes for your basic editions we'll
just work you can see group based access
management self-service password
self-service Password Reset and all that
this thing in a free edition you don't
need all of that but more of like if you
need something else you can go into
basic so as you go beyond the basic
there are charges that will incur if
you'll incur if you go and get this
other editions okay so this is a good
place to actually see what as your
Active Directory also can do because
there are things that I did not talk
about that here like self-service
Password Reset application proxy so it's
a good place to actually explore and
spend some time to find out what as your
Active Directory can do for you okay and
check out some of the videos over here
some of these some of these are little
dated it's not as recent because as you
know and as your things are like
changing so rapidly anyway so that's
what it is when it comes to Active
Directory editions now moving on I'm
going to have a demo here so this is
what I'm going to do right now I'm going
to show you management of Azure Active
Directory users and groups and I'm going
to show you the two ways that you can
use to create well I'm going to show one
of them actually not the second one two
ways you can do this so one is the cloud
identity this is what we will focus on
on the portal when I go through the demo
and the one is the directory
synchronized identities so I'm going to
go on our subscription my subscription
creating user couple users create maybe
a group and show you how that is done
but just to let you know that's not the
only way you can create users you can in
you know ingest users from other mediums
to like in the beginning of the session
I mentioned you can have your
on-premises directory users and groups
kind of moved or synchronized into as
your Active Directory and there are ways
to do that I'll not cover
in this session because that's a quite a
large topic for a different session all
by itself okay so let's go to my
subscription and get started on this
demo alrighty so I'm in my subscription
here logged in this is my basic
subscription there's not a whole lot
going on over here so once you were in
your subscription you need to go to as
your active directory if you don't see
your as your active directory go to more
services here you know search for active
directory or something and it will show
up over here
and you can go as you can see on the new
portable and unfortunately the new
portal has still is in preview in 2017
right now there's a lot of this you can
actually do in the old portal and I'm
just not going to go there I'm going to
just show you everything in the new
portal but there's a lot that are still
there in the old poro
ok Microsoft is working to actually
bring that back in and that's what's
happening over here so we'll go to as
your active directory and like I
mentioned my subscription or your
subscription will come with already
active directory created for you and
provisioned once you had got this
subscription right so if you see that I
my directors name is cloud Ranger active
directory your will be probably a
default as your directory or default
directory it doesn't matter you can
change this name but one should be
created for you so once you click on
that as your active directory you should
see this okay in here you can see
there's an overview there's a QuickStart
a couple of things in the menu over here
users and group enterprise applications
application proxies licenses ad connect
domain names password reset user
settings so a bunch of stuff you can
explore here we are not going to go
through all of them but we'll go with
most of them during this session anyways
I mean in in subsequent sessions for
this series anyways so the one we are
interested in right now is users and
groups so this is like choir at this
point you would be opening ad you see on
premises like Active Directory users and
computers console so I kind of think
this is like that but it's not exactly
like that
so let's go to users and groups and as
you can see there's no tree structure
like we would see in on
Active Directory it looks a little
different so we go to all users and in
all users obviously that's me Sean and
clarinet and I have one for Tammy you
can see this in user I created and it's
Tammy and this is where I want to show
you the tenant ID like my tenant ID is
Sean cloud Ranger on microsoft.com
your will be probably something else
over here this Glock Ranger don't dotnet
is a custom domain
I'll show about show that to you in a
bit but ideally every user that you will
create will have this one like Tammy's
here Tammy at Sean Cloud Ranger on
Microsoft calm your will be your tenant
on microsoft.com or your organization
named on microsoft.com okay so let's go
ahead and create a create user from here
you can go add user and it's going to
ask you what's going to be the name and
everything else so before I do that I
want to like absolutely make sure that
you understand this term and tenant name
in fact let's actually click on that I
did not want to click on that but I'm
going to take this part and I'm going to
copy that
and I'll tell you why you'll have to do
that okay so let's go back to this power
off and go add and I am going to have
the name here called well let's name
this person Terry Terry Fox if you all
okay I'll give you a brief history of
Terry Fox in a bit but just T Fox and
this is where I was mentioning that you
really need to remember what he call it
you really need to remember that tenant
ID over here so over here the domain
name that is expecting it could have an
user with a different ID or different
email address or whatever for now we are
going to make sure this has and let's
click up side and it should check out
this should have the they should have
the domain name over here which is of my
tenant Sean cloud Ranger or Microsoft
comm or whatever you have here you could
actually have a real email address - and
it will be sent outside to your user and
this is a different scope I don't want
to talk about it right now but make sure
that your you know it's a Microsoft ID
or it's an ID that's coming from your
Active Directory so I want to make sure
that you get this part correct from your
tenant ID that you have done or
Microsoft comm if you do not then you
are not going to get this checkbox here
so for now let's leave it this way and
by the way
terry terry fox it's a it's a very
interesting name i'm from canada and you
know terry fox is a very well-known name
over here it was a it was gentleman and
you know he was his one leg was
amputated I know it's going a little bit
off our topic but I just want to make
sure that you know we understand his
legacy where I got this name from so if
you go to Wikipedia and Terry Fox you
can actually see him his leg was
amputated and what he did was due to
cancer and what he did was he tried to
run across cross country in Canada with
just just one lake and he did not
completely make it but because it bring
well-known legacy here and it's a it's
very well-known icon so I just thought
I'll use that name up here anyways Terry
Fox T Fox at Sean Club range or
Microsoft calm profile default groups I
don't have any groups you have a
directory role you have multiple roles
here so I'm going to give this person
let's see I'll make this person rather
than a user a global administrator of my
subscription so I'm going to just leave
it at that you can keep it whatever you
want and you can show password over here
I'm going to just copy this password for
future reference and keep it somewhere
having said that that's all you need to
create this user okay so if you recall
our on-premises you know how we create a
and user there were more attributes that
we would have put in there but oops
there'll be more attributes that we
would have put in there but here on
Azure Active Directory that's all you
need you need the name you need the
username does the full username profiles
do properties and that's password and
that's pretty much about it there's
nothing else you need so let's click on
create here and we'll wait couple of
seconds for this to show up as you can
see Carrie Fox showed up and that's the
that's the you know tenant ID over here
for this user as well so technically in
our directory we now have a user let's
go and see the user settings
you know what the user can do what the
user cannot do you can you know have
some information that you can put in
here device settings is where you
actually let the user you know register
a device to the subscription so it's
saying users may register the devices
with Active Directory so you can have a
device like you can have a mobile phone
or not just a mobile phone you can have
other devices that you can connect
through this user to as your
multi-factor authentication to join
devices we're not doing anything there
from a device point-of-view but I'm just
showing you here that you can do this
over here group settings the usual is
probably not in any group you can
actually check activities for this user
they have this user actually you know
done anything or not and you can see
that this feature is not available in
the free version so you have to use a
free trial for a different measure
Active Directory Edition to get some of
this information ok so this is where you
can see that most of the stuff is there
for you this user and some things are
not because it requires a different
subscription but having said that though
coming back here all users you can see
that user is created over there so
technically what can you do that now
that this user user is created well one
thing for sure since this is part of
this as your subscription you can use
this user to actually log in to this as
your subscription so let's actually try
one of those things click over here the
way I'm going to do that is I'm going to
use an incognito window so it does not
break my current session so go to portal
dodger calm and we have this user so I'm
going to go get all the information for
this user from here as you can see now
that becomes the email address obviously
if I get this correct one five six so we
create the password that was created was
temporary so once we do that as you can
see it came over here as well so put the
current password while that just waits
or else one five or six I'm going to do
something different here and update
password and sign it so we should be
able to sign in to this subscription
through that user okay
so as you can see over here T Fox ad now
you have this user activated completely
with the current password and they can
do everything having said that though
this is not the one the usage of any
user right I mean we know that active
dicted this user can be used for other
things like let's say you're creating an
app online and whoa a web service you
can connect that to this directory and
have this user have a customized access
to your application in fact it can be
used for an application that you can
connect from on-premises to do that so
the applications of this directory is
numerous as yours idea was an identity
service so this was more for like a you
have your organizational app and what
can you do about it like you know how
can you give users access to that so
rather than having an entire Active
Directory domain services implementation
you can just create a directory and do
that from here right so that's all we
are doing over here creating the users
and let's move on now coming back to our
slides so that's what we did we did the
cloud identity so we created an identity
and this identity or this directory is
ready to you know be integrated with
other applications or other services for
now ok so moving up to the next demo
here I want to talk about custom domains
and this is probably I don't it is part
of your exam 7533 but it has probably
more real-world implications of real
world usage than just exam so if you can
pay some attention they'll be great so
what can custom domains do for you you
can actually have a custom domain name
that can be added to your as your ad
tenant okay I'm going to actually bring
up my virtual machine over here as I
talk with you this is the part we are
talking about right now Shawn at cloud
Ranger darknet it's not Shawn at Shawn
cloud Ranger on Microsoft this is what
Microsoft gives you and this is what I'm
talking about right now
okay so your organization is probably
not going to use this entire thing it's
going to probably have your organization
net or com org whatever that is there so
basically that's what we are trying to
do here so you can have a custom domain
attached to your tenant okay it's done
for simplicity of management like Shawn
at Club Ranger net is much easier to
remember or it makes more sense or will
make more sense for your organization
than having the tenant named on
Microsoft comm write the domain used
must be registered so yes if cloud
Ranger dotnet was not registered you
cannot use a random domain name so
unfortunately if you are going to follow
this you're going to follow this demo if
you do not have a domain name that you
can play around with it's not going to
work you you have to have access to some
domain if you are in an organization
nothing really changes so you could do
that to test it but obvious disclaimer
if you do not know what you're doing
with your do you know domain name your
organizational domain name do not touch
it
but if you do have an access and you
know what you're doing then you can
definitely follow around so all it does
that you have to have access to the DNS
records so all it does is that it
creates a txt record right so a txt
record must be created for domain
verification so once you have the domain
verification done as your will know you
own this domain and it will attach that
with your Active Directory tenant so for
example if you try to do this with cloud
Ranger dotnet or I'm going to use a
different domain if you don't have
access to the authoritive DNS records
where you can create this txt record you
can't obviously do that and the reason
is quite obvious because you don't own
that domain so you can't do that so if
you have a personal domain name you can
add that txt record if you have an
organizational one you have access to
you can put the txt record you can
remove that later and no big deal okay
each subscription can have up to 900
domains I can never think of a reason
why you will have it but each
subscription can have up to 900 domain
names this is actually created for I
think service providers or you know a
product that you have outside where
you're providing a directory in the
backend and other people are associating
theirs so each subscription actually has
a limit so unless you are in that
category of service provider I don't see
you actually going there but sure the
capability is there the custom domain
name can be made the primary domain top
- your tenant so in my you know in my
subscription or the subscription you
attach this to so instead of like you
say you know your tenant name there are
Microsoft com you have your domain comm
as the primary so every time you're
creating a user that's the primary or
that's the primary one every time you
generate a user will be created as ok so
I'll show you that as well a a couple of
things that I will not well one thing
for sure I will not be able to show you
is the DNS record and txt record edition
I'll show you what Microsoft provides
you you need to take that information go
to whoever your authoritative DNS
provider is log in there and add that
record let me let me tell you when I
added my record with my domain names
Dana's authority provider it took me
almost 36 hours before that DNS record
was picked up by Azure so you know and I
have seen this thing happen within five
minutes DNS records can take so long to
propagate that you know as your may not
or your services may not be able to do
that so if you're adding this txt record
today you might not
we don't go crazy thinking oh my god why
is not as your portal picking it up
because it may not okay just because
it's taking time for me took 36 hours I
did mine me in the past and I left it
that way and that's how I did it so
let's go ahead and show you a demo on
how to add that custom domain like I
mentioned before I already have one
custom domain edit here but you remember
you can add up to 900 so I'm going to
use a completely different one and let
me actually go and show you how to do
that so close this out if you remember
when we went to as yours
directory portal over here we went and
saw something called domain names okay
this is where we are going to go so
let's click on that domain names here
click on domain names and you can see
one domain name that's for sure at level
for me is Sean cloud range or
microsoft.com okay
so at this is my primary one so I said
that I'm going to go add a new domain
name in there and by the way if you're
wondering where why cloud Ranger dotnet
is not over here because that is the
domain name that I had because cloud
Ranger dotnet is also a Microsoft
account so from this context I'm
actually using that Microsoft's account
to have this user there okay so don't
worry about it you are going to see
exactly I try to make this look like
exactly what you're going to see and
that's exactly what you're going to see
over here okay your tenant which will be
available and its primary so let's go
ahead and add a custom domain and the
custom domain that I'm going to add is
one second okay as this will be the
domain name you have you cannot have any
random domain name here that you do not
own so do not try it's not going to just
work it's going to be Sean is now CA as
you can see the check mark came in here
I'm going to click Add domain so as soon
as I created add domain it did not add
it what it's doing is providing me the
instruction on how they are edger is
going to go verify that that domain
belongs to me and like I mentioned it's
basically going to go ask you for adding
a txt record well you can use MX record
instead it's a new feature that came out
but I would say don't use that this is
the easiest one just go and add a txt
record and that is going to be the value
of the txt record MS equals to whatever
you're going to get obviously get a
totally different number over here you
can add this to your domain and you're
going to click on verify and you should
be able to add that too and after it's
done so if you recall what I mentioned
earlier on the slides is after adding
this record if you click on verify and
it says that it's not finding it it's
just because two things can happen
either you've got this number wrong over
here you did not record it correctly so
can copied over here and copy it and put
it properly
make sure you know actually how to add a
txt record to your DNS address it's
definitely not going to happen so that's
one thing or the other thing that
happened to me was that the DNS did not
propagate propagate that number so when
I kept hitting verify it did not it took
me thirty six hours to come over here
and click verify and get that in my case
obviously I have that txt record already
there well this is going to fail because
I did not out there but what will happen
is that you create that txt record and
it will verify that and it will get
attached to your subscription as you can
see when I click verify it could not
find the DNS record because I did not go
and do that right and you are going to
get the same thing you will keep getting
the same thing even after you added that
if it did not propagate properly okay so
make sure that you go ahead and give it
time and actually in fact as you're
tilting over here you can take up to 72
hours to propagate here right so once
you do that you will see that added over
here so now that we have done that I did
not verify it's actually saying short as
well CA is there but it's not verified
it's unverified means azure does not
know if you own it or not okay so once
this is done what is the use of this
well let's come over here you come to
azure active directory go to add users
and in add add users I'll just go to all
you know all users and add an user what
I'll be able to do is I don't know John
Doe go J do add short as well chopped
see it this is what we are trying to
accomplish okay obviously it's not it
the reason it's actually throwing this
person as a guest as you can see is
because it does not very sean is Mel CA
is not verified if it was verified this
will not try to go in as an email you'll
be just able to add this user because
that's part of your directory obviously
it is not part of my directory so it's
thinking it's an external user and that
is the email address right sorry it is
an email address so that brings me to
the other thing if strana smelter CA was
a registered domain or
hatch them into this I would not get
this but having said that you can
actually go to any domain for that
matter and you can you can add this user
if it checks out obviously this will
check out because it's thinking it's a
different user from another organization
with another email address right so
there is a way to do that you can try
this out with with your current email
address like any Gmail Hotmail or
outlook.com email address and see what
happens and actually add that user so
it's letting you invite an user who is
not part of your Active Directory okay
and this is why it's happening but that
was not our goal our goal was to make
sure that we are using our own Active
Directory to do that with a custom
domain so if we had this verified from
the domain names over here obviously
let's discard that if we actually had
this one verified that will totally work
out actually let me see if I can do this
real quickly and show you it might just
take that log of a time but let me give
a shot so I went at edit this AeroGarden
yeah I keep verifying it it still
doesn't show up it's going to take a
while like I don't know how many hours
to actually show up and you know let
that verify here so unfortunately I
won't be able to show that but once
that's done you'll see the status as
available at that point you can actually
change that to primary unfortunately we
can do that over here right now but you
should be able to change that primary
and create users in this directory with
that custom domain name and this is
actually quite applicable to your
original functionality of an application
or your organization where you do not
want to use this whole thing okay so
let's go back to our slides right now
the last quick topic I'm going to cover
is management of azure ad with
PowerShell and you know Microsoft is
notorious on you know talking about
things in PowerShell and bringing that
up during exams and doing all those nice
things so let's talk about a little bit
on on about PowerShell in there okay
so we can go and if you recall that we
actually have the PowerShell for your
Azure subscription we were doing that
for our you know
you know back in the days with the old
porter we had the SM model we were doing
that then we have the arm model the
resource manager or the new topic the
whole as your resource manager or arm
you keep hearing about that model so we
had our Azure PowerShell which was doing
everything
unfortunately for as your ad you cannot
use that same PowerShell modules you'll
need a different set of modules that you
need to download to work with as your ad
and it is very powerful because you can
use the powershell materials or
powershell commandlets to not only add
user lookup users you know bulk user
user addition and creation you can do a
bunch of things with PowerShell I mean I
don't have to tell you the benefits of
having a command layers available to
interact with a service right so there
are really two models this is where it
gets a little confusing there are two
models of PowerShell when it's the older
one or we call it the MS online mode you
okay you might be quite familiar with
the MS online model if you're working
with office 365
because office 365 uses this MS online
module from PowerShell to add users and
do everything else right if you do not
that's fine but the older one is called
ms online module it's being deprecated
as we speak means Microsoft is moving on
to a newer model and it's sometimes
referred to as version one okay and then
you have the newer model which is called
the Azure Active Directory version 2
module what is happening over here is
Microsoft is moving with these newer
commandlets and the older commandlets
that are available for through ms online
modal are being migrated there so now
it's a good thing and a bad thing so the
good thing is that you know ms online
modal is what you are going to be tested
on so this is something that's well
established it has been there for couple
a years you know there's a lot of
resources you can read a lot of things
you are already familiar with if you are
doing office 365 so you don't have to
learn a whole lot to figure that out the
bad thing is that hey there's already a
new thing out out there that's going to
become production and that's where
Microsoft is going but you're not really
going to learn that great I mean it's
not going to happen for you for this
exam so if you are trying to do that
work you can use both but from an exam
point of view ms online model is
you're going to be tested on so how do
you get this module it's obviously as
your Active Directory version 1 or ms
online module you can go to this link
and you can get all the details about
that and with the version 2 you can get
all the details over there so we are
going to go to the first link actually
let me go grab my browser and get the
first link all right here's the browser
so I'm at that link that I had on the
slide over there if you go there it says
MS online module it's actually going to
tell you this is an older MS one
powershell and really this was the other
link you can actually click it from here
you can see where Microsoft is going
Microsoft is going towards these modules
over here okay but we were to stick back
to these commandlets of these modules
this is what we need okay you can
install this from here so that's why I
had that link you can install MS on that
version too so if you go to this link
from here you can see how you can you
know install this module to your
PowerShell you can go open up your
partial module and you can not fun you
can actually download this from here and
enable this that's the command lid
you're going to use instruct audio name
in the sunlight okay there are other
ways you could actually you could Bing
or Google for MS online module what I
went and did was I went and installed
that from an older method and once I did
that it went and it created Microsoft
Active Directory model for Windows
PowerShell so when I actually go and run
this it will give me access to that
information or it would take me to the
portal which has access okay so what we
are going to do is I'm going to show you
only a couple of commandlets that I'm
going to show you how to log in there
and we are not going to go over a lot of
commandlets from here I'm going to show
you how to probably create an user but
that's all we are going to do let's
actually go to my subscription here
first you will need to log in so we are
going to log in using this user okay so
let's go and grab this user and I'll
tell you why let's see
correct em Sol service as soon as I
create tab this showed up the reason
this showed up is because that means
that this module was successfully
installed if you actually do that and
you don't get anything you're not going
to you're not going to see you'll never
see this thing come up it'll just say
it's a bad command LED or something like
that so obviously my modules were
installed properly that's why it came up
so I'm going to use this one and if I
remember the password correctly this is
very similar to how we run command
lights in a regular shell right I mean
you would have something come up and ask
you to sign in so I'm going to sign in
obviously the signing worked out over
here
great so that means we are that means we
are connected to this service so I'm
going to go and run a command get MS o L
Microsoft online subscription let me see
if it gives me a subscription info I'm
actually not using the premium P do but
it was you will see something else over
here you will see some subscription info
that you have or you may not see
anything there because your subscription
does not have any other editions or
anything there
let's run something more useful I'm
going to yeah let's get all the users
get is oops sorry somewhere else get in
so L user I believe we can click on that
yep you can see it's actually going to
my subscription to that active directory
and all these users right if you
remember we created this user this is
that user so you know that you are now
connected you want to click you are now
connected to your Active Directory and
that's why you're seeing all this
information from there ok let's try one
more command lit so let's go I'm going
to actually show you I wanted to do that
go to get out of here go to my users
these are all the users I have currently
right ok so let's go ahead and see that
ok these are all the users so
new m sol user so I'm going to create a
new user I'm going to have the user
principal name I'm going to call this
whatever they Sam add so this is going
to be the full user principal name or
the UPN correct so this is going to be
Sean cloud Ranger dot or Microsoft oops
come so as you can see this part you
know from an Active Directory point of
view you know if the using is still the
same convention it's calling it an e UPN
so Sam at Sean cloud Ranger
non-microsoft comm what else we need we
can put a display nin this is what we'll
call it just calling Sam Anderson and
we'll have a there are many things you
can put away we can put a first name
we'll just call him Sam we can have a
last name and we can call it header side
and that's all you probably need to get
started let's click on that okay it's
also giving you a password this is very
similar to how we did this form on
portal so if we do now a get em Sol user
we should now see Sam over there okay
so that's how you can see that so one
thing I wanted to show you over here is
the documentation where did I get this
info so you remember the website we came
over here the MS online module so if you
do a you know I was searching for this
so look for new ms oil user and you can
click on this over here the good part is
you can see all these commandlets that
are available to you and how to run that
so it actually tells you the new ms oil
user gets an as your Active Directory
user in fact it also tells you that what
are the what do you what what command
late you need to pass to create this
user so it cannot be any easier than
that in fact it shows you all the
parameters the new MS oil user will take
and it will do that so the good part
over here the really thing I wanted to
show you is all these commandlets that
are available to you in version one or
the MS online module okay these are all
the different commands
that you can check out over here you can
even use that too
you can even use that to create a group
from here okay so make yourself familiar
with some of these commandlets obviously
you don't have to know all of them but
know the common ones how to use add one
delete one create a group remove a group
and that's really yet I mean you don't
have to know everything you're not going
to be tested on everything but it's good
to know what this can do for you okay
now let's go back to our up stick over
here close this go to users and groups I
want to go to all users and I should see
Sam Henderson over here as well okay so
I just showed you how to do this in
fashion now one thing that's not part of
my slides that I did promise earlier
that I'm going to do you show you is
that right now if you come over here
that's all you see over here right
because I'm in my active subscription
and this is my default as your directory
you see this option over here that's a
switch directory that is actually you
know grayed out because there's nothing
to switch I want to have one directory
how do you create multiple directories
for playing with something okay so let's
go close all of this go to new and I'm
going to put this over here directory as
your active directory let's click on
that you can see once we search for that
it brought up as your active directory
okay so click on as your active
directory it's actually letting us
create a new directory okay so create
directory over here it's actually asking
the name of your organization so you
know it could be whatever name so if I
had cloud Ranger it would have tried to
you know it just verified I mean I don't
know what it's even verifying I mean you
can put any name over here but this is
the most important part you need to
think about we are now creating the
initial domain or the tenant name over
here this name can be anything I have
previously used this for my application
name let's say it's my application one
or whatever the name of my application
to do that this thing you have to
remember over here
that it is actually
unique so I mean you can have something
over here that other people may have
already taken and you may not get that
so let's do test I'm pretty sure test
dot on Microsoft comm is taken by
somebody else because somebody else's I
mean it's a very common image like a
domain name right this tenant ideas
across the board so it has to be
something unique that belongs to you or
you can put that and it can be anything
for me so I will just call this
application name organization name so I
know cloud Ranger dot you know I'm going
to just go try looking for that and see
well obviously took that somewhere else
so that's number two it's actually
saying already in use by another
directory so I'm going to use cloud
Ranger put it random number one two
three four five let's see if that works
of course that's working country of
region I'm going to put mine which is
going to be Canada so this is now going
to be my UPN if you remember that term
right now or this is my tenant ID or my
directories okay so let's do create over
here it takes a little bit of time to
create that but you will have multiple
directories now and you can create many
directories over here based on your
application based on your you know
client your providing service to are
based on your company's name it's just a
basic way to show that you know you can
have multiple directories so let me
let's create this it's going to take a
little bit of time couple of minutes
anyways to finish once it's done it's
going to log you in directly to that
directory by logging in nine-minute ill
just bring the page up to show you your
directory and i'll show you the
differences once it comes up so I'll
pause here let's actually see the
progress yeah it's still creating the
directory here so you can see it's going
to be creating this directory for a
little while because in the backend it's
actually creating that you know creating
rating the entire thing for you it's
provisioning Azure does the whole heavy
lifting in the backend for you and
that's what it's doing right now so I'll
pause and well guess what I didn't have
to pause it's actually successfully
created directory took about one like a
minute or two I think so yeah this
should be done right now so if I go to
directory over here this is obviously
the directory you now see that switch
directory showed up here
so if I click on switch directory
I should be able to go to the other
directory let's see grading this let me
go and refresh the portal because when I
switch directory it's just not showing
me that the directory I can switch to ok
the portal does that some time and by
the way I want to preview portal here so
let's try this
no worries ok let it load so ok that's
fine let's try to switch directory ok so
now when I create switch directory you
can see that this is the directory out
before we did not see anything here but
it's showing this is the default
directory I am in but I can also move to
the new directory we created so if you
remember this is the tenant ID cloud
Ranger 1 2 3 4 so let's go click on that
and see what happens it should actually
take me to another subscription
altogether there should be no recess
there's resources absolutely what I was
expecting
and I'm going to go and oops show this
here go down go to as your active
directory it actually flipped as you can
see over here it actually flip oops what
happened here let's you're not chrome is
acting up a little bit but you I'm not
actually my current subscription this is
actually a different subscription you
know how it looks go create as your
active directory and it moved me back to
my original subscription so actually
change the directory hopefully you're
not going to have has been travel as I
am because it's on the previous row so
go to as your active directory and see
if it's working or not this time ok so
this is the new directory ok see this
one the name change it's just called
cloud Ranger and if you go and see the
users you should see oh come on let's
remove the preview part from here too
much of a hassle the preview poor oh
that's what you need to do things in the
right pearl
well at least you guys are seeing this
couple of times said you're never going
to forget this it's going to be engraved
in your mind okay I'm just hoping it's
not a chrome issue and it was a preview
portal issue so the difference between
the preview portal and the portal you're
doing is the preview parole starts
incorporating stuff that are yet not
public I mean it's not g8 public like
you can obviously go to preview your
parole but as you're calm and get that
but it's not ready for primetime
so let me see we are now in the right
directory users and groups and users and
groups if I go to all users
I should see only one user okay straw
net cloud range of that so this is
absolutely a totally different directory
as you can see my other users are not
there and the reason they're not there
is because I'm in a different directory
which one I just created for you okay so
this is where you can see that obviously
you can go back to the our original one
what I want to show you over here is
that this is a directory I don't want it
to linger around I mean I really don't
need it because this was just for
demonstration what we can do is we can
delete the directory as well so it's
basically saying that you know are these
all things uh you know if is it used by
anything is there any resources that if
there obviously it's a brand-new one I
did not do anything there's no one
besides me who use an user so these all
requirements have checked out so I can
delete it sometimes you may not be able
to do that right because if your
director is being used it's going to
show a cross mark over here and say what
you need to do to click that for me I
can just delete this directory because I
don't need it it was just for
demonstration purposes but that's how
you can actually have multiple
directories in your subscription and do
that now it's telling us that hey this
directory is no longer there so let's
actually go back to our original
directory and when you are doing this
directory it's kind of showing what's
involved in the directory for you and
it's logging you in and all that but
this is what it is right so if I go to
as your active directory right now and
it's still deleting that if I go to
users and group obviously I'll be able
to see all my current users
okay and once you refresh this browser
and this directory has been deleted it's
no longer going to be there okay cool so
that concludes this demo so going back
to our slides over here just going back
to this partial I know we took a little
bit of a tangent to show how to create a
new directory but what's happening over
here is that we we're in this PowerShell
module if you want you can play around
with this PowerShell module version two
where the command layers that are a
little changed but they are migrating
the old commandlets so it should still
work not all of them I suggest that you
stick to ms online modem for now because
it's GA which is publicly available and
you know I mean it's prime time and any
exam questions or anything a based on
that for now in 2017 okay you can go to
this and obviously find that out that
what's the new stuff and play with it
just for in a production or you know
different environment point of view
having said that that concludes our
first session thank you for being with
me training site is available there
that's the YouTube channel the slides
for this will be posted in this location
if you don't find it right away don't
worry about it
it will be posted there my twitter is at
action is mail email is shown at cloud
range of dotnet and my LinkedIn profile
if you wish to connect it's there so
this was part 1 of as your active
directory there will be subsequent or
multiple parts to this to get into more
details on some stuff and other
functions and features that we can do
with as your active directory and like I
mentioned in my previous sessions before
that some of this are I mean most of
these are covered for your exam but
there are things that I do cover that
help you to actually function in your
job and make sure what's available there
today to you know put it in context on
what you can do with this or not okay so
I'll have out some other sessions which
are not completely part of your exams
but I'll try to mention which ends or
not well I don't know for a fact but I
can kind of guess from Microsoft's
curriculum that they're not probably not
going to touch on those because though
they're new feature or whatever but I'll
mention them so it works out for you
just like in the previous slide I did
with Active Directory partial Modi in
version 2 it's not part of your exams
but it's good to mention it's there
anyways guys thank you for viewing and
please like the videos please please
please if you like them to subscribe to
the channel
and I'll see you in the next session
thanks bye