Set up your enterprise for working remotely in Azure: FAQ

Microsoft offers a free E1 license for six months to enable your employees to increase their productivity from home through Microsoft Teams. For information about licensing, and to check your eligibility, go to: Manage the Office 365 E1 Trial.

Microsoft Teams uses identities stored in Microsoft Entra ID. You can integrate Microsoft Entra ID with on-premises AD environments. For more information, see Microsoft 365 integration with on-premises environments

Microsoft offers a free A1 license for education. For information about licensing, go to Get Office 365 free for your entire school. The following documentation provides useful information about how to enable remote learning at your school or university:

• Get started with Microsoft Teams for remote learning
• Create your Office 365 tenant account

The answer depends on your current deployment. If you already have a VPN solution, you can integrate it by using our multi-factor authentication (MFA) solution to add another layer of security.

If you don't have a VPN solution yet, you can proceed with the deployment, and use a Windows gateway to allow remote access by having MFA as an extra layer of security.

Yes, we provide technical guides.

If you have an Azure MFA server already in operation, and you have to use it, you can create such a deployment by using an existing VPN solution or a Windows gateway. (Notice that this kind of deployment has been deprecated, and only existing customers can use it.)

Here are examples of MFA server integration with third-party VPNs:

Advanced scenarios with Azure MFA Server

Here's how to integrate Azure MFA server with gateway.

If you're using the MFA NPS extension, see the following articles for technical details:

• Integrate your Remote Desktop Gateway infrastructure
• Integrate your VPN infrastructure with Azure MFA

The following table provides multiple scenarios in which to deploy MFA.

For more information about how each MFA type works and when to use it, go to Plan an Azure Multi-Factor Authentication deployment.

Microsoft Entra ID provides several methods to achieve this based on your current scenario:

• If the user has Microsoft Entra ID P1 or P2 and wants to enable SSPR-U (SSPR for users), we recommend this option:

  Enable Microsoft Entra self-service password reset

• If the user doesn't have Microsoft Entra ID P1 or P2, and uses an Active Directory Federation Services (AD FS) for federation but doesn't have any SSPR, we recommend this option:

If the user doesn't have Microsoft Entra ID P1 or P2 but wants to use ADFS to change the password endpoint, they must explicitly enable the endpoint (Update password customization). They can do this also on a proxy endpoint. Doing this enables the capability on AD FS.

Users can send a claim that is named "passwordchangeurl" for the URL as a claim to Microsoft Entra ID. Microsoft Entra ID will honor this for Windows 10, Microsoft Entra joined workstations that are running Windows 10, version 1703 or a later version. The user will be directed to the URL that is shown in the claim when the user presses Ctrl+Alt+Del.

Here's are some sample references on claims in the context of AD FS:

Configure AD FS to Send Password Expiry Claims

Yes. Microsoft Entra ID Free or standalone Office 365 licenses use security defaults to require MFA for users and administrators.

To learn how to manage your users' MFA settings, go to View the status for a user.

Microsoft Entra ID enables single sign-on to devices, apps, and services from anywhere through connected devices. IT professionals get the controls they must have to manage and secure your organization's resources. For more information, go to Getting devices in Microsoft Entra ID.

You can connect three kinds of devices to Microsoft Entra ID: Microsoft Entra registered, Microsoft Entra joined, or Microsoft Entra hybrid joined, depending on your infrastructure. For more information, go to Getting devices in Microsoft Entra ID.

No. An extra license is not required. Because the Microsoft Entra ID Free license is enabled by default together with the Office 365 license, users can connect devices to Microsoft Entra ID.

After you reset your password, you have to log out and log back in by using the new password.

When you reset your password on a Microsoft Entra hybrid joined device, you must have a line of sight to the domain controller. If you're outside the corporate network, make sure that you're connected through a VPN. Then, log out and log back in by using the new password.

Yes. You still have access to Office 365 resources from Microsoft Entra hybrid joined devices from outside the corporate network unless you change your password.

If you're using Windows Hello for Business (WHfB) to sign in a Microsoft Entra hybrid joined device, you will retain access to Office 365 resources even after changing your password.

You can verify the health status for all join types (Microsoft Entra hybrid joined, Microsoft Entra joined, and Microsoft Entra register) by using the Device Registration Troubleshooter Tool.

Run the dsregcmd /status command from a Microsoft Entra hybrid joined or Microsoft Entra joined device, and check whether AzureAdPrt is set as YES. For more information, go to SSO state.

The following are the device registration steps for Microsoft Entra hybrid joined:

1. The device tries to retrieve the tenant ID and domain name from the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD.
2. If step 1 fails, the device communicates with the Local AD (configuration partition) to get the tenant's information form the Service Connection Point (SCP). (You can get SCP information by using Device Registration SCP Tool PowerShell.)
3. The device communicates with the Microsoft Entra tenant.
4. The device authenticates against either Microsoft Entra ID or a federation service (for example, ADFS).
5. The device registration process finishes.

For more information, go to Hybrid Microsoft Entra Device Registration.

The Device Registration Troubleshooter Tool runs more than 30 tests to identify and fix the most common device registration issues for all join types (Microsoft Entra hybrid joined, Microsoft Entra joined, and Microsoft Entra register).

Double-check the device connection to Microsoft Entra ID. Also check the Microsoft Entra PRT value. For more information, go to SSO state.

Yes. You can allow users to change their password from home. Here's how to configure the password writeback feature:

1. Enable the password writeback feature from Microsoft Entra Connect. For more information, go to Enable password writeback in Microsoft Entra Connect.

2. Set the required permission to the Microsoft Entra Connect account by running the following PowerShell commands on the Microsoft Entra Connect server:

   Import-Module "C:\Program Files\Microsoft Entra Connect\AdSyncConfig\AdSyncConfig.psm1"
   

   Set-ADSyncPasswordWritebackPermissions -ADConnectorAccountNameAADConnectAccount -ADConnectorAccountDomain domain.local
   

   To get ADConnectorAccountName and ADConnectorAccountDomain values:

   Get-ADSyncADConnectorAccount
   

3. To enable password writeback from Azure portal, go to Enable password writeback for SSPR.

The required licenses are listed in the following article:

How does self-service password reset writeback work in Microsoft Entra ID?

For a Microsoft Entra Connect server that is running behind a firewall or through a proxy, open the ports and URLs that are listed in this article.

Third-party information disclaimer

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.