May 022022

The error “User does not have access Microsoft.Subscription/aliases/read over scope providers/Microsoft.Subscription/aliases/X ” can be fixed using these steps:

  1. First determine who the user or principal trying to read Microsoft.Subscription/aliases is.
  2. Next as an Azure AD Global Administrator run Azure Resource Elevation process ( https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin#azure-portal) so you have “User Access Administrator” permissions at the “/” scope
  3. Finally, using Azure PowerShell or Azure CLI cmds, add the user or principal referenced in the error to the Reader role at the root “/” scope as shown below.
# Azure PowerShell Example:
New-AzRoleAssignment -ObjectId 1bc23456-2456-4a8a-8b9a-c327f407d41e -Scope / -RoleDefinitionName "Reader"

# Azure CLI Example:
az role assignment create --role Reader --assignee 1bc23456-2456-4a8a-8b9a-c327f407d41e --scope /

NOTE: In the above example “1bc23456-2456-4a8a-8b9a-c327f407d41e” is the Azure AD Object ID of the user or service principal who received the error. Find this value with Get-AzAdUser / Get-AzAdServiceprincipal or az ad user / az ad sp cmds.

Feb 032022

To grant an Azure AD B2C support engineer proper consent to your Azure AD B2C tenant diagnostic logs, please follow the below steps.

These steps must be followed by a user who has a valid Guest\External account access to your Azure AD B2C tenant. Meaning, you can use the Azure Portal’s directory switcher to switch between your standard Azure AD tenant and login to your Azure AD B2C tenant. This user should also have administrative permissions in the Azure AD B2C tenant.


  1. First from your standard Azure AD tenant, open a new support case via Azure Portal’s support blade at https://aka.ms/azuresupportrequest
  2. Chose the following options
    • Issue Type = Technical
    • Subscription = <Select the Azure Billing Subscription for your Azure AD B2C tenant>
    • Service = All Services
    • Service Type = Azure Active Directory Business To Consumer (B2C)


  1. On the next blade, be sure to fill out the following options:
    • Which B2C tenant is the problem occurring in? = Fill out the b2ctenant.onmicrosoft.com or tenant ID of your B2C TENANT
    • Advanced diagnostic information = Yes , so Azure support engineer has permissions for the life of the support case to access your B2C tenant diagnostic logs.


  1. At this point you can submit the case, and then share your case # with your Azure AD B2C support engineer so they can use it to review B2C diagnostic logs.
Nov 142021

If you have password writeback enabled and a user performs self service password reset (SSPR), the user’s new password should be written back to on-premise AD as a non-expired password. That is, after the password is written back to on-premise attribute PwdLastSet should be updated with the timestamp of the password reset:

PwdLastSet attribute containing timestamp.

Additionally, the on-prem AD user’s account option flags should not have “User must change password at next logon” flag set:

User must change password at next logon flag not set.

These two factors would indicate the user’s password is not a temporary password that expires but a permanent one as expected.

Why would “User must change password at next logon” flag be enabled after password writeback?

If instead, the above to factors are not true, then something went wrong with the password writeback operation and the password will be considered temporary\expired. This will mean the end user will have to change their password during the next logon to an on-premise AD joined resource. This is not expected behavior.

No PwdLasetSet attribute defined, indicating temporary\expired password
User must change password at next logon flag is set

The most common reason is that the Azure AD Connect on-premise AD service account (typically MSOL_b38random9b@domain.com does not have sufficient permissions on the domain to perform “Unexpire password” operation

Most default Windows AD domains will have this permission granted to at the root domain level to all “Authenticated Users” and so MSOL service account will have this permission as well :

Unexpire password permission for Authenticated Users at domain root

However, I have seen a number of scenarios where for security reasons this permission might not be granted to all users. If this is the case, you will want to ensure you grant the MSOL service account this permission manually to root domain and all descendant objects:

Manually add Unexpire password permission for MSOL service account at root domain level and all descendant objects

Once this is applied, you should be able to have the user reset their password via SSPR and the password writeback operation will not set the “User must change password at next logon” flag as it will set the PwdLastSet timestamp succesfully.

Note if there are any other permission related errors, follow the Enable password writeback to on-premises \ Configure account permission for Azure AD Connect public doc for all of the permissions required.

Another quick note that has caused some confusion…

If instead of the end user performing SSPR from https://aka.ms/sspr the AAD admin is resetting the user’s password on the user’s behalf from the Azure AD portal -> User Profile -> Reset Password link.

Admin initiated password reset

Then it is by design \ expected for the on-premise “User must change password at next logon” flag to be selected during the password writeback operation. This is because admin initiated password reset only sets a temporary password not a permanent one.

This fact is explained in https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-reset-password-azure-portal#to-reset-a-password but is also mentioned in the Azure AD portal’s dialog during the reset password operation

Jul 202021

On a recent support case we had a customer who was trying to automate Privileged Identity Management (PIM) role assignments for Azure Resources with PowerShell. We could not find any public end to end documentation on the syntax to make this work. After some trial and error we found the following syntax works.

NOTE: PIM can assign both Azure AD roles and Azure resource roles so both scenarios are shown below. Additionally, make sure you have the latest version of AzureADPreview module installed.

Assigning Azure AD roles

For this scenario there is a public doc explaining the syntax which can be found at PowerShell for Azure AD roles in Privileged Identity Management . For roleDefinitionID you can also look these IDs up on Azure AD built-in roles doc

PowerShell code example:

### Azure AD PIM Example

$tenantID = "91ceb514-5ead-468c-a6ae-048e103d57f0"
$roleDisplayName = "Global Administrator"
$roleDefinitionID = (Get-AzureADMSRoleDefinition -Filter "DisplayName eq '$roleDisplayName'").Id
$targetuserID = (Get-AzureADUser -ObjectId User.Name@jasonfritts.me).ObjectId  # Replace user ID

$schedule = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedSchedule
$schedule.Type = "Once"
$schedule.StartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$schedule.EndDateTime =  ((Get-Date).AddDays(1)).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")

# Create temporary eligible role assignment
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId 'aadRoles' -ResourceId $tenantID -RoleDefinitionId $roleDefinitionID -SubjectId $targetuserID -Type 'adminAdd' -AssignmentState 'Eligible' -schedule $schedule -reason "testing"

# Create temporary active role assignment
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId 'aadRoles' -ResourceId $tenantID -RoleDefinitionId $roleDefinitionID -SubjectId $targetuserID -Type 'adminAdd' -AssignmentState 'Active' -schedule $schedule -reason "testing"

Assigning Azure Resource Roles

For Azure Resource roles I could not find any end to end public doc examples but after trial and error the below steps were confirmed to work.

NOTE: The additional cmds compared to Azure AD role scenario are to convert ARM subscription IDs and ARM role IDs into their PIM resource IDs. For roleDefinitionID you can also look up built-in role IDs on Azure built-in roles doc if you are using custom roles, you can look these up in Azure Portal -> Subscription blade -> Access Control -> Roles

PowerShell code example:

## Azure Resource PIM Example

$subscriptionID = "ed6a63cc-c71c-4bfa-8bf7-c1510b559c72"
$roleDefinitionID = "b24988ac-6180-42a0-ab88-20f7382dd24c" #Built-in Contributor Role Definition ID example
$targetuserID = (Get-AzureADUser -ObjectId User.Name@jasonfritts.me).ObjectId  # Replace user ID

# Convert IDs to PIM IDs
$SubscriptionPIMID = (Get-AzureADMSPrivilegedResource -ProviderId 'AzureResources' -Filter "ExternalId eq '/subscriptions/$subscriptionID'").Id
$RoleDefinitionPIMID = (Get-AzureADMSPrivilegedRoleDefinition -ProviderId 'AzureResources' -Filter "ExternalId eq '/subscriptions/$subscriptionID/providers/Microsoft.Authorization/roleDefinitions/$roleDefinitionID'" -ResourceId $subscriptionPIMID).Id

$schedule = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedSchedule
$schedule.Type = "Once"
$schedule.StartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
$schedule.EndDateTime =  ((Get-Date).AddDays(1)).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")

# Create temporary eligible role assignment
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId 'AzureResources' -ResourceId $SubscriptionPIMID -RoleDefinitionId $RoleDefinitionPIMID -SubjectId $targetuserID -Type 'adminAdd' -AssignmentState 'Eligible' -schedule $schedule -reason "testing"

# Create temporary active role assignment
Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId 'AzureResources' -ResourceId $SubscriptionPIMID -RoleDefinitionId $RoleDefinitionPIMID -SubjectId $targetuserID -Type 'adminAdd' -AssignmentState 'Active' -schedule $schedule -reason "testing"

Jun 032021

Occasionally you may be alerted to an existing Azure AD service principal whose client secret is scheduled to expire soon. From the Azure AD portal -> Application Registrations -> App -> Certificates & Secrets blade it is not possible to extend the expiration of an existing secret. You can only create a new one.

This can be a problem because the portal auto-generates the secret to be a random value. So you would have to go and update all your application code\configs to use this new secret value.

Luckily, with Azure PowerShell module you can both create a new secret with the same value as your existing one and set it’s expiration date manually preventing any unnecessary work to update application code\configs.

Example Script:

# Get service principal
$sp = Get-AzADServicePrincipal -DisplayName "MyTestApp"

# View current password Ids and expirations
Get-AzADSpCredential -ObjectId $sp.Id

#choose expiration date
$start = get-date
$end = $start.AddYears(150)

#Set same password as current password
$SecureStringPassword = ConvertTo-SecureString -String "c0[Ndh_@G/j8tB4aqbq66R]P*0MVwB.h" -AsPlainText -Force
New-AzADAppCredential -ApplicationId $sp.ApplicationId -StartDate $start -EndDate $end -Password $SecureStringPassword

# Verify new credential expiration
Get-AzADAppCredential -ApplicationId $sp.ApplicationId
Apr 032021

I have seen a few questions regarding if Azure AD Domain Services supports Remote Desktop Services (RDS) licensing services.

These questions mostly are around whether or not Per User license auditing reports are supported as this requires AD user attribute updates when the RD Licensing Server issues a per user CAL to the user. In Azure AD Domain Services user writes are only allowed from Azure AD itself, not within Azure AD Domain Services (where the user objects are read only).

This process IS supported as long as the administrator installing the Remote Desktop Licensing server role on the Windows Server host is a member of the Azure AD group “AAD DC Administrators” when they are installing the Remote Desktop Licensing server role. You can verify membership from within your AAD DS joined workstation with cmd:

whoami /groups

Once you have verified membership in “AAD DC Administrators”, after installation of the Remote Desktop Licensing role, you should find that the server’s Windows AD computer object has been added to the “Terminal Server License Servers” security group as shown below:

If this is not the case, verify that the security permissions on the “Terminal server License Servers” group show that the “AAD DC Administrators” group has the effective permission “Write Members” as shown below:

And on a user within AADDC Users OU, view security effective permissions for the Terminal Service License Servers group and verify it has read\write permissions on the following msTS user attributes shown below:

If you do not see this ACL entry for Terminal Server License servers, you should open a support case as this would be unexpected behavior. If the Remote Desktop Licensing Server computer object is not a member of the “Terminal Server License Server” group then you may find the following error in your Event Logs:

Log Name: System
Source: Microsoft-Windows-TerminalServices-Licensing
Event ID : 4105
Level: Warning
User: N/A
Computer: <computer name>
The Terminal Services license server cannot update the license attributes for user <user name> in the Active Directory Domain <domain name>. Ensure that the computer account for the license server is a member of Terminal Server License Servers group in Active Directory domain <domain name>.
If the license server is installed on a domain controller, the Network Service account also needs to be a member of the Terminal Server License Servers group.
If the license server is installed on a domain controller, after you have added the appropriate accounts to the Terminal Server License Servers group, you must restart the Terminal Services Licensing service to track or report the usage of TS Per User CALs.
Win32 error code: 0x80070005

Once computer membership in Terminal Server License Servers group has been confirmed, you should find no issues tracking Per-user CAL issuance in RD Licensing Manager:

Viewing any user’s AD attributes after they were issued a per user CAL should show that the necessary license tracking has been successfully written to the user in Azure AD Domain Services:

A Per-user CAL license report should also successfully list these users:

I hope this clears up any questions around the compatibility

Aug 042020

Occasionally we receive support cases from customers performing audits of their Azure AD Audit or Sign in logs and do not know what the service principal \ actor ” Microsoft Approval Management “ is.

After review with Microsoft product engineering teams it was confirmed this is a 1st Party Microsoft Service Principal for the following services and may be logged in customer audit logs during the operation of any of these services in your tenant.

  1. Dynamic Groups
  2. Self Service Group Management
  3. O365 Group Expiration policy

Any of the operations performed by these services such as calculating group memberships, applying group memberships, performing group expirations etc.  will be logged in Azure AD audit logs as being performed by “Microsoft Approval Management”.  All of the operations performed by these services, are documented in the links above.

You can confirm this service principal is in your AAD tenant with the AzureADPreview PowerShell module and the following cmd

Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Approval Management'" | fl *

Where you should confirm that the PublisherName = “Microsoft Services” and you may find it listed with the AppID of “65d91a3d-ab74-42e6-8a2f-0add61688c74” or “38049638-cc2c-4cde-abe4-4479d721ed44”


If this service principal is disabled you may experience strange behavior in the Azure AD Portal when trying to manage groups.

One example, if this service principal has been disabled by the AAD Global Administrator any operation on groups in the AAD portal may return an error : “Unable to complete due to service connection error. Please try again later”

Portal error : Unable to complete due to service connection error. Please try again later.

If you receive this error, verify that the Microsoft Approval Management enterprise application has not been disabled.

  1. Go to AAD -> Enterprise Apps blade : Enterprise applications – Microsoft Azure
  2. Then browse to All applications Set filters to Application type = All Applications, Status = Any, Application Visibility = Any In search box type the appID 65d91a3d-ab74-42e6-8a2f-0add61688c74

3. Open this app’s properties Choose Enabled for users to sign in = Yes Hit Save

4. Then retry their group operation which failed

NOTE: You may also want to check for app ID 38049638-cc2c-4cde-abe4-4479d721ed44 to verify it is enabled as well.

If you have other unknown principals showing up in your AAD logs and you would like to verify they are Microsoft 1st party principals please use the Feedback sections of the below articles

Unknown Actors in AAD Audit Reports
Verify first-party Microsoft applications in sign-in reports

Aug 042020

We have received a few cases in AAD Audit Log support topic around AAD audit logs showing a service principal named “Microsoft Substrate Management” has created users in their AAD tenant and they have no idea who this principal is.

If you have other unknown principals showing up in your AAD logs and you would like to verify they are Microsoft 1st party principals please use the Feedback sections of the below articles

Unknown Actors in AAD Audit Reports
Verify first-party Microsoft applications in sign-in reports

You can find this service principal in your tenant using AzureADPreview Powershell module and the following cmd:

Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Substrate Management'" | fl *

Where you should be able to confirm this is a 1st Party principal (PublisherName = Microsoft Services) with AppID = 98db8bd6-0cc0-4e67-9de5-f187f1cd1b41

After investigation, it was determined that the “Microsoft Substrate Management” service principal is a 1st party service principal used by Exchange Online during dual write operations to AAD. When for example a mailbox is created directly in Exchange Online, this service principal may show up in your audit logs as the actor who created the user account the mailbox will be assigned to.

More information on dual write operations in Exchange Online can be referenced at https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-online-improvements-to-accelerate-replication-of/ba-p/837218

For a better picture of the actor who initiated the request in Exchange Online, you will need to search the Office 365 Unified Audit Log in the timeframe of the activity via steps mentioned in the following articles:

Hope this helps someone!

Jul 162020

The following are my notes for setting up Azure AD B2B Direct Federation with a GSuite domain. The official documentation can be referenced at https://docs.microsoft.com/en-us/azure/active-directory/b2b/direct-federation. Note that if you only want to invite Gmail.com users you can use Google Federation steps instead https://docs.microsoft.com/en-us/azure/active-directory/b2b/google-federation

Steps to configure AAD B2B Direct Federation with GSuite Domain

  1. Login to https://admin.google.com -> Security -> Authentication -> SSO with SAML Applications -> Download Metadata file

  1. Choose Download Metadata, and save the returned GoogleIDPMetadata.xml locally

  1. Browse to https://portal.azure.com -> Azure AD -> External Identities -> All identity providers -> New SAML/WS-Fed IdP .  Choose protocol = SAML, domain name = gSuite domain name, method = parse metadata file.  Browse to your GoogleIDPMetadata.xml file and hit parse, then save:

  1. From https://support.google.com/a/answer/6363817?hl=en  follow Step 3. “Set up Google as a SAML identity provider (IdP)” and Browse to https://admin.google.com -> Apps -> SAML Apps -> New App
  1. Filter existing apps by “Microsoft Office 365” and add the app
  2. Download Metadata locally to .XML file
  3. Save
  4. Browse back to apps and choose “Microsoft Office 365”
  5. Edit Attribute Mapping to be as follows
IDPEmail* Basic Information Primary Email
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent Basic Information Primary Email
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress Basic Information Primary Email
  1. From https://support.google.com/a/answer/6363817?hl=en  follow Step 4. “Enable the Office 365 app” and Choose Edit Service -> Service Status -> ON for everyone
Google Admin Portal -> Apps -> Web and Mobile Apps -> Microsoft Office 365 -> User Access -> Edit
User Access -> ON for everyone
  1. Lastly Invite the Guest GSuite domain User from Azure AD
    1. Now From Azure AD portal -> Invite New User -> Invite a user from G Suite domain
    2. G Suite user gets invite email, and clicks redemption link and signs in with G Suite credentials to redeem invite successfully

Finally, if needed you can manually configure GSuite Direct Federation using Azure AD Preview PowerShell module and example script below (note your GSuite metadata will be different)


$federationSettings = New-Object Microsoft.Open.AzureAD.Model.DomainFederationSettings
$federationSettings.PassiveLogOnUri ="https://accounts.google.com/o/saml2/idp?idpid=C01ypkxdy"
$federationSettings.ActiveLogOnUri = "https://accounts.google.com/o/saml2/idp?idpid=C01ypkxdy"
$federationSettings.LogOffUri = "https://accounts.google.com/o/saml2/idp?idpid=C01ypkxdy"
$federationSettings.IssuerUri = "https://accounts.google.com/o/saml2?idpid=C01ypkxdy"
$federationSettings.SigningCertificate= "MIIDdDCC_EXAMPLECERT_lMlRYzq4"

$domainName = "jfritts.xyz"

New-AzureADExternalDomainFederation -ExternalDomainName $domainName  -FederationSettings $federationSettings

Apr 072020

We occasionally get support cases from customers who when browsing to their Azure Portal’s subscription blade see a subscription type with a strange name “Access to Azure Active Directory” and get strange errors like “Unknown” role or “Unauthorized” or “Unable to access data” or “The current subscription does not allow you to perform any actions on Azure resources. Use a different subscription.”

TLDR: These subscriptions do NOT host Azure AD. These are legacy subscriptions that can no longer be managed by customer portal. If causing issues they are safe to delete but can only be deleted via support ticket today. For more info read below details.


Access to Azure Active Directory Subscription example
Access to Azure Active Directory subscription errors examples

History of the Access to Azure Active Directory subscription

The “Access to Azure Active Directory” subscriptions are a legacy subscription type that are no longer used.  They were used prior to the current Azure Portal (https://portal.azure.com). 

At that time the classic Azure portal (https://manage.windowsazure.com) that was used to manage Azure Active Directory and other Azure resources only allowed access if the user had a Azure subscription associated to their user account. It utilized the classic Azure roles such as “Subscription Admin” \ “Billing Admin” \ and “Co-Administrator” only so you had to have one of these roles in order to login. It did not take into account Azure AD roles like Global Administrator etc.

This caused issues when the Azure AD admin didn’t have an Azure resource subscription necessarily, so these “dummy” subscriptions were created for such access.
You can read this blog post for a bit more history if you are interested:  https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/Azure-AD-Mailbag-Azure-Subscriptions-and-Azure-AD/ba-p/249661 which describes the need for these subscriptions and how admins would get one assigned to them when needed.

Today no such access subscription is required as we now separate AAD RBAC permissions (Global Administrator etc) and Azure Resource subscription RBAC permissions (Owner, Contributor, Reader etc) and do not limit user’s access to https://portal.azure.com.

How to delete the Access to Azure Active Directory subscription

If these subscriptions are causing you problems, or you would just like to cleanup your Azure environment from unneeded subscriptions you can get these subscriptions removed from your account by opening a support case and requesting the subscription be deleted. Unfortunately, as the errors suggest these subscriptions cannot be managed using the current Azure Portal.

These subscriptions do not host any data and removing them will have no impact to your Azure Active Directory tenant, data, users, groups, or other subscriptions.

Hope this helps someone!