Microsoft Entra ID, Azure & Intune: gestione identità moderna

Il modello di identità Microsoft moderno

Microsoft ha unificato la gestione identità sotto Microsoft Entra ID (precedentemente Azure Active Directory). In ambiente ibrido, Entra ID si sincronizza con l'Active Directory on-premise tramite Entra Connect.

On-Premise                    Cloud
┌───────────────┐             ┌───────────────────────┐
│ Active        │  Entra      │  Microsoft Entra ID   │
│ Directory     │◄──Connect──►│  (ex Azure AD)        │
│ Domain        │             │                       │
└───────────────┘             │  ┌─────────────────┐  │
                              │  │  Microsoft 365  │  │
                              │  │  Intune         │  │
                              │  │  Azure          │  │
                              │  └─────────────────┘  │
                              └───────────────────────┘

Entra Connect: configurazione ibrida

Installazione e sincronizzazione





Import-Module ADSync
Get-ADSyncConnectorRunStatus


Start-ADSyncSyncCycle -PolicyType Delta


Start-ADSyncSyncCycle -PolicyType Initial

Verifica utenti sincronizzati


Connect-MgGraph -Scopes "User.Read.All"


Get-MgUser -Filter "onPremisesSyncEnabled eq true" | 
  Select DisplayName, UserPrincipalName, OnPremisesSyncEnabled

Conditional Access: policy di accesso

Il Conditional Access è il sistema di policy che decide chi può accedere a cosa, da dove e con quali condizioni.

Policy base: MFA per accessi esterni

{
  "displayName": "Require MFA - External Access",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeGroups": ["All Users"]
    },
    "locations": {
      "excludeLocations": ["Named Location - Office"]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa"]
  }
}

Policy: blocca paesi ad alto rischio


$params = @{
  "@odata.type" = "#microsoft.graph.countriesAndRegionsNamedLocation"
  DisplayName = "Allowed Countries"
  CountriesAndRegions = @("IT", "US", "GB", "DE")
  IncludeUnknownCountriesAndRegions = $false
}
New-MgIdentityConditionalAccessNamedLocation -BodyParameter $params

Intune: Device Management

Enrollment automatico Windows





Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM" `
  -Name "AutoEnrollMDM" -Value 1 -Type DWord

Compliance Policy Windows 10/11

Configura da Intune → Devices → Compliance policies:

{
  "displayName": "Windows Compliance - Standard",
  "scheduledActionsForRule": [{
    "ruleName": "NonCompliant",
    "scheduledActionConfigurations": [{
      "actionType": "block",
      "gracePeriodHours": 48
    }]
  }],
  "settings": {
    "bitLockerEnabled": true,
    "codeIntegrityEnabled": true,
    "secureBootEnabled": true,
    "defenderEnabled": true,
    "osMinimumVersion": "10.0.19041",
    "passwordRequired": true,
    "passwordMinimumLength": 12,
    "passwordRequiredType": "alphanumeric"
  }
}

Automazione con PowerShell e Graph API

Script: onboarding completo




param(
    [string]$Nome,
    [string]$Cognome, 
    [string]$Reparto,
    [string]$Ruolo,
    [string]$Manager
)


Connect-MgGraph -Scopes "User.ReadWrite.All", "Group.ReadWrite.All"


$username = "$($Nome.ToLower()).$($Cognome.ToLower())"
$upn = "[email protected]"
$password = [System.Web.Security.Membership]::GeneratePassword(14, 3)


$newUser = New-MgUser -DisplayName "$Nome $Cognome" `
  -UserPrincipalName $upn `
  -MailNickname $username `
  -AccountEnabled $true `
  -Department $Reparto `
  -JobTitle $Ruolo `
  -PasswordProfile @{
    Password = $password
    ForceChangePasswordNextSignIn = $true
  }

Write-Host "✅ Utente creato: $upn"


$skuId = (Get-MgSubscribedSku | Where {$_.SkuPartNumber -eq "SPB"}).SkuId
Set-MgUserLicense -UserId $newUser.Id `
  -AddLicenses @{SkuId = $skuId} `
  -RemoveLicenses @()

Write-Host "✅ Licenza assegnata"


$groupId = (Get-MgGroup -Filter "displayName eq '$Reparto'").Id
New-MgGroupMember -GroupId $groupId -DirectoryObjectId $newUser.Id

Write-Host "✅ Aggiunto al gruppo $Reparto"


Write-Host "`n=== CREDENZIALI ==="
Write-Host "Username: $upn"
Write-Host "Password temporanea: $password"

Script: report licenze


Connect-MgGraph -Scopes "Directory.Read.All"

Get-MgSubscribedSku | ForEach-Object {
    [PSCustomObject]@{
        Prodotto    = $_.SkuPartNumber
        Acquistate  = $_.PrepaidUnits.Enabled
        Assegnate   = $_.ConsumedUnits
        Disponibili = $_.PrepaidUnits.Enabled - $_.ConsumedUnits
    }
} | Format-Table -AutoSize

BitLocker con Intune

Policy BitLocker automatica


$devices = Get-MgDeviceManagementManagedDevice -All

foreach ($device in $devices) {
    if ($device.OperatingSystem -eq "Windows") {
        $compliance = Get-MgDeviceManagementManagedDeviceCompliancePolicyState `
          -ManagedDeviceId $device.Id
        
        [PSCustomObject]@{
            Device     = $device.DeviceName
            User       = $device.UserDisplayName
            BitLocker  = ($compliance | Where {$_.DisplayName -match "BitLocker"}).State
            OS         = $device.OsVersion
        }
    }
} | Export-Csv "bitlocker-report.csv" -NoTypeInformation

Best Practice

✅ Entra ID P2 per Privileged Identity Management (PIM) — accesso privilegiato just-in-time
✅ Naming convention chiara per gruppi e app registrations
✅ Breakglass account — almeno 2 account admin esclusi da Conditional Access
✅ Audit log abilitati e monitorati (almeno 90 giorni)
✅ App registrations con permessi minimi necessari
❌ Evita Global Admin per operazioni quotidiane — usa ruoli specifici
❌ Non sincronizzare account di servizio AD on-prem in cloud