Devices are AzureAD joined but using local accounts

Posted by BulletRisen@reddit | sysadmin | View on Reddit | 7 comments

Got sent to a new client to audit their current setup etc. I've noticed all their users are logging in with local accounts despite the laptops being joined to AzureAD.. don't even know where to start with this one. Security, compliance, user management etc etc. How do IT teams actually allow this stuff to happen, or am I overreacting ??

Reply to Post

7 Comments

[-]

St0nywall@reddit

An AzureAD account is not the same as an Active Directory account. You're getting your terminologies mixed up I think. Since the devices are registered in AzureAD and users log into the device with their AzureAD account, the operating system will setup a local account to store the profile. All policies you push via Intune will still be applied, because they are just registry entries after all.

[-]

BulletRisen@reddit (OP)

No I understand the difference, the users are logging in with local windows accounts. No single sign on, no user policies being applied. Their passwords never expire for example. The laptops were setup with a local account, username doesn’t even match their UPN in azure and they access their resources individually via each app. Conditional access is there but it’s not configured to block anything. A user got his account locked out the other day and the only I could do was talk him through logging in via the local admin account and then reset via computer management. It’s bizarre and I have no idea what the logic was to deploy 100s of laptops like this. One laptop I logged onto wasn’t even joined to azure at all, the user was just working locally with no corp policies applied.

[-]

St0nywall@reddit

I'd like to say "I can't even imagine how that could have happened", but I've been around the block enough that I've seen a lot of face smackers. Good luck fixing it!

[-]

securityreaderguy@reddit

Are you sure they're local and not on-prem AD managed? This doesn't sound right. You should still be able to manage the device.

[-]

BulletRisen@reddit (OP)

100% local, they don’t have an on premise systems. All their systems are cloud based.

[-]

securityreaderguy@reddit

So they're associating accounts with Ms accounts per device to allow access to things like their mail accounts in outlook? Or just not using Exchange?

[-]

BulletRisen@reddit (OP)

There’s no conditional access, or was never setup correctly. Each app connects individually, outlook to EO, one drive for files, teams etc. just a mess