O365 Auth - no Group Assignement

Hello,

To grant access to vaults and/or folders to Office365 users, you must use Azure AD groups for the User Groups in DVLS. If your AD is replicated in Azure and some users will connect using their O365 account, then the AD Groups and the Azure AD Groups must bet set in the permissions.

To import Azure AD Groups, go in Administration - User Groups and select Import from Azure to create them.



Best regards,

Hi Erica

Thanks for the explaination.
That makes sense, but we have an azure sync which means, all the groups have the same name.

Is it really necessary to have all ad groups twice and then setting all vaults up with at minimum of 2 permissions?


Ive right now 230 vaults which means a ton of manual work...

Thanks,
Andreas

Hi Andreas,

Thank you for the information.

As your AD is replicated in Azure, we do not recommend to use both authentication methods to avoid duplication of the groups. Even if the groups have the same names, DVLS manage them as two different authentication systems.

The solution would be to only enable domain authentication or Office365 authentication.

Best regards,

Hi Erica

I just implemented a workaround by writing a User Import Script, which checks AD as Source and creates the "Domain" Users on DVLS when not existent there.
Now all Users are able to login via O365 and using the Domain Auth Groups.

Maybe it would be nice, if DVLS has an auto import Function, which imports/creates all Domain Users as scheduled Task.

We only want to use O365 Auth, because DVLS doesnt support SAML or even Kerberos SSO yet.

Best Regards,
Andreas

Hi Andreas,

Thank you for your feedback.

It seems you have found a working scenario but we cannot certify that you won't experience unwanted behaviour with the cross-authentication method using Active Directory (Users and User Groups) with Office365 authentication.

Because you are using only Domain User Groups for the permissions, as mentioned in your original post, Office365 accounts can't get access to anything. Then make sure you have disabled the Automatic User Creation for both Domain and Office365 authentication in the DVLS settings.

Best regards,