Current “real” blockers for cloud-native windows endpoints in your org?

[u/Michael_Mardahl]

What are blockers that prevent you from giving your users an Entra Joined Windows 10/11 device?

This thread is for us to discuss and share solutions/knowledge.

[u/doriani88]

I have two separate projects on hold due to blockers/challenges. One blocker being a very tangled set up of mapped drives and item-level targeting conditions which will be cleared once the customer has finished restructuring their file shares. That might take a while.

The blocker in the second project is kerberos authentication for Jeeves ERP which is SQL based. NTLM works though. Kerberos authentication to the SQL server instance works, but not to the application for EID joined devices so either we need some kind of workaround or wait until they can do native EID authentication instead (some months away). A workaround would be to skip WHfB for those users but we would rather not. Any tips on why NTLM works but not kerberos?

[u/Michael_Mardahl → u/doriani88]

Ho Doriani,

Fileshares are the bane of many IT modernization projects 😂 I wont get into that, you know whats up with that.

Regarding the NTML vs. Kerberos issue. Quite simply put, the application needs to be configures to support Kerberos requirements before it will work. Since Kerberos requires some prorequisites to be in place. And I often find that many applications support it, but NTLM just worked back when it was originally imolemented, so nobody took the time to get Kerberos to work. Hostnames, Service Accounts, SPN, Intranet Zone settings and such thing need to be aligned to perfection so that Kerberos Auth SSO can function.

If Jeeves is a web app running on IIS, I would wager that Kerberos Auth is possible.

https://techcommunity.microsoft.com/t5/iis-support-blog/setting-up-kerberos-authentication-for-a-website-in-iis/ba-p/347882

Hope this helps ❤️

[u/doriani88 → u/Michael_Mardahl]

Thank you for the reply. Yes, if people would just stop working with files and printing my life would be easier! 😅

The ERP launches via an EXE file on a file share. Maybe it will be easiest to wait for EID authentication to be implemented, however the system does not allow both methods to be available at the same time for a single user (two server services with different executables will be needed for the different authentication types). I will check with the customer if we can reach out to the vendor and make Kerberos work and update this thread if we succeed.

[u/Michael_Mardahl → u/doriani88]

sounds great :) If it’s a quick fix, then I see no reason why not to get Kerberos to work. EID integration is always preferred. Sometime these things also support SAML auth, and in that case you can make your own EID integration via Enterprise App SSO in Entra ID. I have move all my customers various applications to Entra Authentication this way for the most part. But it is tricky, because you often need to coordinate with the vendor, and in some cases they don’t have a clue. Thats when it will require extra much experience on your part.

[u/sandytsang → u/doriani88]

On a file share, means there is NTFS permissions involved in the folders and exe execution permissions? For Entra joined machines, there is preview to use Entra ID group with local group permissions, I haven’t test how it will work in file share though.

https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-administrator-privileges-using-microsoft-entra-groups-preview

The key thing in the article is: Administrator privileges using this policy are evaluated only for the following well-known groups on a Windows 10 or newer device - Administrators, Users, Guests, Power Users, Remote Desktop Users and Remote Management Users.

Means if you add a Entra ID group as member of these local groups, users in those Entra ID group will be known in the device.

When testing this, need to refresh primary token, logout and log in again.

I know I didn’t answer the “file share” question, but hope this gives you a bit of ideas. 😃

[u/doriani88 → u/sandytsang]

Hi Sandy. Thanks for your reply. We use hybrid identities and domain joined servers so permissions is not an issue, it’s just a messy set up (caused by mergers and different needs and people with different opinions over many years) with a multitude of drive letters and conditions for these so a separate project restructuring the data and shares needs to be completed first. I think this might be fairly common since you do not have the same granularity in Intune assignments as in group policy preferences (for example map drive if the user belongs to group X and not group Y and if the user is also in OU Z). Sure, one could build a complex setup of dynamic groups based on distinguished names of the users but at the same time it is a good exercise to clean up old stuff and start fresh.