Skip to main content

Microsoft Entra

Overview

This integration is designed to manage named locations in Microsoft Azure Conditional Access policies via the Microsoft Graph API. It allows users to add, delete, or flush named locations related to specific IP addresses. This integration with knocknoc enables IP whitelisting within Microsoft 365. An example of a user's experience can be found below:

  1. User attempts to access Microsoft 365 services:

    image.png

  2. User must authenticate with knocknoc and will see their granted ACL on the right hand side:

    image.pngimage.png

     

  3. User can now access Microsoft 365 services:

    image.png

Prerequisites

Before running this script, ensure that you have the following prerequisites installed and configured:

  • Powershell - Install PowerShell on your system. For Debian, follow these steps: 
    # Update the list of packages
sudo apt-get update

# Install pre-requisite packages.
sudo apt-get install -y wget

# Download the PowerShell package file
wget https://github.com/PowerShell/PowerShell/releases/download/v7.4.3/powershell_7.4.3-1.deb_amd64.deb

###################################
# Install the PowerShell package
sudo dpkg -i powershell_7.4.3-1.deb_amd64.deb

# Resolve missing dependencies and finish the install (if necessary)
sudo apt-get install -f

# Delete the downloaded package file
rm powershell_7.4.3-1.deb_amd64.deb
  • Azure Enterprise Application: An enterprise application must be created to allow knocknoc to authenticate and change conditional access policies and named locations. Create an enterprise application, create a client secret, and copy the application's client id, azure tenant id and secret. You'll need these later.

  • Microsoft Graph API Permissions: Ensure that the application has the necessary permissions to access the Microsoft Graph API,API. particularlyFor forknocknoc managingto conditionalwork accessas policiesintended, andonly namedone locations.graph TheseAPI canpermission beis found below:required.

    Keeping these permissions as restrictive as possible prevents a major breach in the event that your application is compromised. 

     

  • Conditional Access Policy/Policies: Knocknoc needs to be able to distinguish between policies it can amend and policies it cannot. Therefore, knocknoc looks for a prepending "knocknoc_" ahead of the name of the ACL.  For example, a conditional access policy might be named "knocknoc_financedepartment" with specific rules around applications and services that group can access. These must be created PRIOR to configuring anything in the knocknoc admin portal. 

  • Credentials File: Ensure that a credentials file is present at /opt/knocknoc-agent/etc/entra-credentials.sh with the following content:

      
    entra_clientid=""
entra_tenantid=""
entra_clientsecret=""

    You will need to input the necessary ClientID for your  Azure Enterprise Application, your Azure Tenant ID and your application's client secret. 

Admin Portal Configuration

Back to top