Download Microsoft Azure AD

Skip to main content This browser is no longer supported. Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Active Directory Rights Management Services Mobile Device Extension Article08/02/2022 In this article -->You can download the Active Directory Rights Management Services (AD RMS) mobile device extension from the Microsoft Download Center and install this extension on top of an existing AD RMS deployment. This lets users protect and consume sensitive data when their device supports the latest API-enlightened apps. For example, users can do the following on their mobile devices:Use the Azure Information Protection app to consume protected text files in different formats (including .txt, .csv, and .xml).Use the Azure Information Protection app to consume protected image files (including .jpg, .gif, and .tif).Use the Azure Information Protection app to open any file that has been generically protected (.pfile format).Use the Azure Information Protection app to open an Office file (Word, Excel, PowerPoint) that is a PDF copy (.pdf and .ppdf format).Use the Azure Information Protection app to open protected email messages (.rpmsg) and protected PDF files on Microsoft SharePoint.Use an AIP-enlightened PDF viewer for cross-platform viewing or to open PDF files that were protected with any AIP-enlightened application.Use your internally developed AIP-enlightened apps that were written by using the MIP SDK.NoteYou can download the Azure Information Protection app from the Microsoft Rights Management page of the Microsoft website. For information about other apps that are supported with the mobile device extension, see the table in the Applications page from this documentation. For more information about the different file types that RMS supports, see the Supported file types and file name extensions section from the Rights Management sharing application administrator guide.ImportantBe sure to read and configure the prerequisites before you install the mobile device extension.For additional information, download the "Microsoft Azure Information Protection" white paper and accompanying scripts from the Microsoft Download Center.Before you install the AD RMS mobile device extension, make sure the following dependencies are in place.RequirementMore informationAn existing AD RMS deployment on Windows Server 2019, 2016, 2012 R2, or 2012, that includes the following: - Your AD RMS cluster must be accessible from the Internet. - AD RMS must be using a full Microsoft SQL Server-based database on a separate server and not the Windows Internal Database that is often used for testing on the same server. - The account that you will use to install the mobile device extension must have sysadmin rights for the SQL Server instance that you're using for AD RMS. - The AD RMS servers must be configured to use SSL/TLS with a valid x.509 certificate that is trusted by the mobile device clients. - If the

Before reading this section, please read the following important note.Depending on the user location, there are four scenarios for the cloud MFA service:Microsoft Entra ID and on-premises AD using federation with AD FS (is required for SSO)Microsoft Entra ID and on-premises AD using DirSync, Azure AD Sync, Azure AD Connect - no password syncMicrosoft Entra ID and on-premises AD using DirSync, Azure AD Sync, Azure AD Connect - with password syncOn-premises Active DirectoryAn Azure account with Global Administrator role is required to download and activate MFA Server. Syncing with Microsoft Entra ID (via AD Connect) or a custom DNS domain aren't required to setup an MFA Server which runs exclusively on-premises.Users need to be imported into MFA Server and be configured for MFA authentication.Parallels RAS authenticates users with MFA Server using the RADIUS second level authentication provider. MFA Server thus needs to be configured to allow RADIUS client connections from the RAS server.The authentication process goes through the following stages:In stage 2 the user can be authenticated using either RADIUS or Windows AD. A prompt to enter the credentials twice (in stage 1 and 6) is avoided by enabling the option to forward the password.

Splashtop supports logging into my.splashtop.com and Splashtop Business app using the same credentials as your SAML 2.0 identity provider. Please follow the below instructions to get the app from Microsoft Entra ID/Azure AD console.Get the app on Microsoft Entra ID/Azure AD console1. Log in Azure AD console. Select Enterprise applications2. Click "+ New application".3. Search Splashtop from the gallery then add.5. After adding the app, select Set up single sign on, then select SAML.6. Edit Basic SAML configuration.Identifier (Entity ID): URL (Assertion Consumer Service URL): on URL: (There are patterns under each three field which you can copy then paste to the corresponding fields.)Leave others without changes.7. Edit User Attributes & Claims.Unique User Identifier: Keep the default value "user.userprincipalname", or modify it to the attribute you use to match the user's email address to their Splashtop account, such as "user.mail". Ensure the selected attribute corresponds to the email address associated with the user's Splashtop account.( The value has to be the email address associated with the Splashtop account).8. Done!***For JIT provisioning, please add a group claim:1. In the set up SSO app on Microsoft Entra ID/Azure AD, go to Single sign-on page.2. On the Attributes Claims block, click Edit.3. On the Edit page, click Add a group claim.4. On the Group Claims setup, select Security Groups.5. Click Save.6. Done!Add user/group to the created appClick Add user/group to add users to the created enterprise application so the user can use SSO feature.Apply for an SSO method from my.splashtop.comNow you have the Login URL, Microsoft Entra ID/Azure AD Identifier, and Download Certificate (Base64). Please follow below instruction to insert the info on our web portal (my.splashtop.com) to apply for enabling the SSO with Microsoft Entra ID/Azure AD. downloading Certificate (Base64), please edit the cert file with a text editor, then copy the contents to insert on my.splashtop.com.Additional Resources:Microsoft Tutorial: Microsoft Entra single sign-on (SSO) integration with SplashtopIf interested you can provision with SCIM for Microsoft Entra ID/Azure AD.See this article: Provisioning setup - Microsoft Entra ID/Azure AD (SCIM)

Can find a comparison of Azure AD editions on Microsoft’s website here.But you should note that the free edition of Azure AD doesn’t include all the features of Azure AD Join. To get the features listed below, you’ll need Azure AD P1 or P2 licenses:Mobile Device Management (MDM) autoenrollmentLocal admin policy customizationSelf-service BitLocker recoveryEnterprise state roaming (ESR)The account I was using to join Windows 10 to Azure AD was assigned a Microsoft 365 Business Standard license. That means there is no Microsoft Intune license included with the Microsoft 365 subscription. To get Intune, which is Microsoft’s MDM service, I would need to either license Intune separately or upgrade to a Microsoft 365 Business Premium license. Nevertheless, I should be able to perform an Azure AD join using a Microsoft 365 Business Standard account.Disable MDM autoenrollmentAfter some digging around on the Internet, I found that the issue is likely connected to MDM autoenrollment. As the Microsoft 365 Business Standard account isn’t licensed for Intune, Azure AD join fails because the account is enabled for MDM autoenrollment.The solution is to disable MDM autoenrollment for the account, or all accounts, in the Azure AD tenant. But hold up. Without an Azure AD P1 or P2 license, there is no access to modify MDM autoenrollment settings.This led me to call Microsoft support. I was advised to assign a trial Azure AD Premium license to an account and turn off MDM autoenrollment. So, that’s what I did. And hey presto, I was able to join the Windows 10 device to Azure AD with no errors. To be clear, the work or school account used to join Windows 10 to Azure AD does not need an Azure AD Premium license. The license is only required to modify the MDM enrollment settings.To disable MDM autoenrollment, follow these