Azure Active Directory + Active Directory

Jorge_Henriques 0
Viewed 50

can you guys help me with a question?

I have an ADDS created on Azure and a Windows Server 2019 (Active Directory) virtual machine hosted at Azure either.

I'm having problems to change the attributes and using the logon hours options trought the user's account... "You do not have permission to change the logon hours attribute, your changes won't be saved".

At Windows Server 2019, i have the enterprise admin permission. At Azure, i have the administrator permition and still having theses issues.

Can someone give me a clue to solve this?

Thanks.

azure-active-directory azure
1 Answers

• In Azure ADDS, you will have to add your signing in ID to the Windows Server VM, i.e., the Azure ADDS DC to the Azure AD DC Administrators group in your Azure AD tenant. Once, you have added your user ID in this group, you will be able to configure the ‘logon hours’ attribute in the managed domain joined Windows Server VM.

• Also, though you are the administrator, but it is not clear what permissions you are assigned. As a result, you need to be assigned the ‘Domain Services Contributor’ Azure role for creating the required Azure ADDS resources along with ‘Application Administrator’ and ‘Groups Administrator’ Azure AD roles in your tenant.

Thus, if you ensure that the above changes are done, you will surely be able to change the ‘logon hours’ attribute. Please find the below snapshot for your reference: -

Azure AD Groups

Logon hours AD

To know more about this, kindly follow the below links: -

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-management-vm#administrative-tasks-you-can-perform-on-a-managed-domain

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance-advanced#prerequisites

Kartik Bhiwapurkar0
Related