AzuMFA Extension for NPS – Stopped working

So, Azure MFA Extension for NPS was setup RDS and it was working till last week.


Allow of sudden the MFA notification stopped.  User no longer get notification on their mobile, text or a call when they try to sign into any server through RDS (Outside the network)

Diagnosis :

  • When we tried the office 365 portal, it worked just fine.  Users got their notification on to their device and allowed to access the portal.
  • In the logs, we see lot of
    • Source:        Microsoft-AzureMfa-AuthZ
    • Event ID:      4
    • Description:
    • NPS Extension for Azure MFA: Radius request is missing NAS Identifier and Nas IpAddress attribute.Populating atleast one of these fields is recommended
  • Authentication with Azure MFA
    • Source:        Microsoft-AzureMfa-AuthZ
    • Event ID:      2
    • Computer:
    • Description:
    • NPS Extension for Azure MFA: Unknown exception

So, at this point I don’t know what was wrong, as it was working without any issues.  No changes made recently

After having to go through the following article

The line which struck me is the following.

The NPS Extension for Azure MFA is available to customers with licenses for Azure Multi-Factor Authentication (included with Azure AD Premium, EMS, or an MFA stand-alone license). Consumption-based licenses for Azure MFA such as per user or per authentication licenses are not compatible with the NPS extension.

For testing, i assigned a MFA Standalone license for a user – It worked.

But still i was confused why it was working all this while? After speaking to MS, the preview version was active and MS their functionality for 30 more days so the client can choose a plan. (Client claimed that they never received any communication)

Hope this helps.




Recently Microsoft released office security that created lot of issues for the clients who heavily uses outlook add-ins for business purposes.

Some of them are Enterprise vault, Sales force and so on.

Thought there is a fix released by MS on February release, upon testing the result didn’t change.

So, if you decide to uninstall that patch you can either use your patch management software like SCCM or WSUS. But if you want a quick if you don’t have a patch management software, the follow the instructions,

  1. Create a .bat file with the following and save in sysvol folder on a DC@echo offmsiexec.exe /package {90140000-001A-0409-0000-0000000FF1CE} /uninstall {6DE885AE-8E0F-4FEA-8AA2-77D455F8A6AA} /qn /quiet /norestart


  2. Create a GPO that applies to all the workstations (if that is what you intended to do)
  3. Edit the policy and Navigate to “Policies->Windows settings->Scripts->Go to properties of Startup, Add the script to the list

User needs to reboot the machine to make sure it removes the patch successfully.

Note: I’ve seen cases that this patch got installed directly but not through SCCM or WSUS.  Though there is a GPO to restrict the update.  If you have an idea how this patch could have installed, comment.

Microsoft Intune – Things to remember before you use new Azure integrated Intune

As you may already know that Microsoft decided and moved from Classic Intune to Azure integrated Intune.  There are few things that needs to considered before you decide to use Azure integrated Intune for patch management.

  • The app groups that are created in Classic intune are being migrated to Azure integrated Intune.  These groups cannot be used in Classic intune anymore.  If you would like to patch the workstations with the existing group or create a new groups, it wont work – Microsoft acknowledged this as bug and awaiting resolution (This has been resolved now)
  • If there is a policy that exists in the Classic portal and you are using Azure integrated intune, and has a software update ring, then there might be a policy conflict.  Make sure the Classic Intune are removed.
  • Classic Intune can only manage the devices using Intune management agent.  Azure integrated Intune can manage the devices only if the device is enrolled as Mobile Device.  If the agent is present in the workstations, it cant be enrolled as mobile device.  So first thing you should do is to remove the Agent.
  • If the Agent is present in the workstation it cant be enrolled to new Azure integrated Intune.  You have to uninstall the agent, you can use  This will create a Schedule Tasks.  It may take about 5 to 10 mins.  It uses ProvisioningUtil.exe located under C:\Program Files\Microsoft\OnlineManagement\Common.  If you have custom installation path or if the exe doesn’t exist, then you might need to install the Agent again and run this script again.
  • If you are planning to migrate to Azure integrated Intune from Classic Intune, make sure the device is not listed in the Classic portal.  If the device is visible, then before enrolling, make sure the workstation entry is removed from the Classic portal.  Sometimes you may see entries in both the portal, In that case, you have to remove the device from both the portal, and re-enroll.
  • Finally, version upgrade of windows 10 is not straight forward.

Hope this helps


Spectre – Vulnerabilities

Recently Google Project Zero team has identified a vulnerabilities on CPU that is affecting all AMD, Intel and ARM Processors.

The variants of the issue identified so far,

Variant 1: bounds check bypass (CVE-2017-5753)
Variant 2: branch target injection (CVE-2017-5715)
Variant 3: rogue data cache load (CVE-2017-5754)

The entire Azure / Office 365 platform from Microsoft is being patched and rebooted as a matter of priority to resolve this problem.  You might have already got notification to do a redeploy at your convenience or MS would have forced it last week.

To take care of the on-prem infrastructure, MS has released patches

No patches will be available for Windows XP, Vista, 2000, 2003 etc.

These patches only mitigate the exposure of vulnerability but not resolve.  You MUST update your infrastructure as soon as possible and also check for any manufacture update like BIOS or driver updates

*Google Chrome, IE, Firefox also got some updates last week to handle this vulnerabilities.

Hope this information was useful.


Blocking Third Party application to access Office 365

When you have your users on office 365, they tend to use integrate their account with third party cloud applications.

The advantage and dis-advantage of using office 365 is that it integrates seamlessly with the third-part cloud application.

One such application that i came across is that CloudHQ.  It is very good product.  When you work with different client, and their respective application, CloudHQ, helps get those information to one place.

For example, If a user has a office 365 mailbox and a gmail account.  He can extract all the emails from office 365 and transfer it to gmail account.

All you have to do is just authenticate authroize CloudHQ to use your office 365 account.

CloudHQ can do lot more than what i just described.

To some organization, they don’t want their user to take the corporate data to external application which is not allowed.

How a user can sign-up to these applications (I user CloudHQ as an example)

Go to the website


Sign-up using the office 365 account


Logon screen to office 365


Authorize CloudHQ to your office365 account,


As soon as it is done, admin can see this application under Enterprise application list


Right now, this user has authorized CloudHq to access the office365.  From CloudHQ, you can authorize your personal email account, such as gmail, as the destination to copy the emails.

To avoid this,

You might wonder if disable active sync or other features may allow you to control access of the users – NOPE.

Even if you disable EWS, user will be able to authorize the application to access their office 365 account.

The only way to control this is by setting the restriction in Azure portal.  You can block all the application except few MS application or which ever way works for you.


Hope this was useful.


X-Microsoft-Exchange-Diagnostics-untrusted header – (NDR) Message header is too large – (Resolved)

Note : This issue has been fixed by Microsoft.  This article is just for an information

If your office 365 is setup to amend signatures to your email that are going out to external domains or attaching disclaimers to the email, then

There is existing issue.

The size of the message header grows drastically if you have this setup.  If you look at the messaging header, the content might be filled up like below,

X-Microsoft-Exchange-Diagnostics-untrusted: 1;VI1PR0602MB3232;7:eitiAZyhSkfzWdu2wx4WYDDsg97GybOhP52ygjEEopTGZOnqE44bl













Because of the large size of the message header, the recipient domain may reject your email saying it is not complaint or message header size is too large.

To fix the problem,

You can remove the X-Microsoft-Exchange-Diagnostics-untrusted header using transport rule,


Or Simply wait until Microsoft fix it.


ADConnect Sync Issue – Resource/Active forest topology

Recently i’ve encountered an issue with the AD connect. I thought it is worth sharing with others.


There are 2 forest

1. Forest A and Forest B
2. Exchange is installed on Forest A
4. Forest B users mailbox are on Exchange server which is in the same forest
3. Forest A users mailboxes are on Exchange server which is in the forest B

The typical setup of the organization is below



For office 365 migration, AD Connect has 3 connectors

Connector for Forest B – Syncs the user attributes of forest A
Connector for Forest A – Sycns the AD object attributes of Forest A
Connector for Office 365 – Projects the object and their attributes to Azure AD

Forest B users mailboxes are migrated to office 365, Forest A users mailboxes are still on prem.

The reason for projecting the forest A object to AD Azure is to make use of sharepoint online and eventually migrate them to office 365.


Ok, the issue here is that, one of user from forest A is assigned with share point but unable to login to it.


Sequence of steps that i tried to fix this eventually helped me understand

How AD Connect works.

1. Sharepoint license assinged correctly, and the sites are ok (with the help of sharepoint support i confirmed it is setup correctly comparing with the rest of them)
2. Searched the Forest A connector to see if the user AD attributes are projected – yes it does
3. Searched the Forest B connector to see if the mailbox attributes are projected – yes it does
4. The immutableID of the user object from AD Azure matches the base64 objectGuid of the AD object matches the Forest A (this proves that source anchor is from Forest A)

The catch is, Both the connectors are projecting assuming both are different object

How this supposed to work

1. the attributes of the user from Forest B called msExchMasterAccountSid is matched with the objectGuid attribute of the user in Forest A
2. The AD object on Forest A must be disabled
3. The metaverse should combine the AD attributes from Forest A and Exchange attributes from Forest B and project it to AD Azure


1. Move the user object to non-sync OU on both the forest A & B
2. force the Delta synchronization on all 3 connectors
3. Move the user object in Forest A to syncing OU
4. Run the full synchronization on Connect for forest A, Connector for Office 365
5. Move the user object n Forest B to Syncing OU
6. Run the full synchronization on Connect for forest B

This resolved the problem

But what difference does it make?

Lesson learnt is,

When we create the connector it automatically takes the first priority, so Forest B was project disable object. The second connector created was Forest A, it took the second priority.
For some reason the metaverse cannot combine the disabled Forest B (Exchange attributes) and Forest A ( AD Attributes).
By manually syncing one after the other, the issue was resolved.

But wait, should i do it everytime when new user is created – NO

You can change the priority by yourself using “Rule Editor” which gets installed along with the AD Connect. Keep the priority of the the active forest at the top and the resource forest first to the bottom.

Hope this was useful