TechIDManager EntraID/Azure AD agent install (Base & Link)

The TechIDManager agent installs in EntraID (Azure AD) to provide MSPs with the same setup options available for all other TechIDManager agents.

It offers the same capabilities, including:

Automatic creation of unique accounts for every tech in every tenant they have access to in EntraID (Azure AD)

Daily password rotation (every 24 hours)

Role assignments tailored to each tech

Just-In-Time (JIT) or managed accounts

Roles for these accounts are assigned using the same grouping and triplet system that applies to other TechIDManager agents.

If you have questions or want to learn more, feel free to schedule a demo or Q&A session about TechIDManager. We also offer white glove installations, and you can book assistance for setup.

To install TechIDAgent.EntraID, you must have:

An active TechIDManager subscription, and

A single Azure subscription that can run an Azure Function with a consumption plan, all within one tenant (usually your MSP’s tenant).

This setup is required for a specific security reason. At Ruffian Software, we do not have access to your clients’ tenants—and we don’t want it. We never ask for or store OAuth tokens, Bearer tokens, GA passwords, or any other credentials for your clients’ tenants. These types of tokens have been compromised in too many recent attacks and grant too much access for any security vendor to hold responsibly.

For TechIDManager to create users and set passwords, something must run with permission inside the tenant’s context. We accomplish this by running a function in your MSP’s tenant that has enterprise app connections to each client tenant.

This code runs on Microsoft-provided hardware, in the context of the client tenant.

The Azure Function requires a consumption plan, which costs about $0.25 per month per tenant—yes, just 25 cents. If you don’t already have one, the easiest option to set up is a “Pay-As-You-Go” plan.

These instructions assume you have TechIDManager setup and working.

A little note on GCC/GCC-High. This works with GCC and GCC-High. The Base install must be on the same type of tenant as the Links. 

To update a TechIDAgent.EntraID installation run the Base script just like the initial install and it will recognize the install to convert it to a Base install. You will then need to run the Link executable on your own tenant to make it be an agent.

Base Install: (do this once in the MSP tenant)

 .\Deploy_TechIDAgent_EntraID_version.ps1

Link Install: (do this for each client tenant)

 .\TechIDAgent.EntraID.Installer.exe

Options that effect how TechIDAgent.EntraID runs are settable in the TechIDPortal. Most of these parallel the command line options for the TechIDAgent. In the Function Configuration set an “Application Setting” on the screen at the right.

1. RmmName – The RMM name for this domain that shows in the TechIDClient
2. FriendlyName – The friendly name for this domain that shows in the TechIDClient
3. UserName – The same formatting for Username as described for TechIDAgent ( https://ruffiansoftware.com/username-feature-in-domainservice-piece-of-techidmanger )
4. DisplayName – The same formatting for Display name as described for TechIDAgent ( https://ruffiansoftware.com/username-feature-in-domainservice-piece-of-techidmanger )
5. HourToRun – The hour (out of 0-23) time at which TechIDAgent.EntraID should run and change passwords. Since Azure consumption plans are based on UTC clock this should be 5 to run near midnight on the east coast of the USA.
6. JustInTime – Enable Just-In-Time accounts on this agent.
   1. “Yes” for Just-In-Time accounts
   2. “No” for Managed accounts (default)
7. UsageLocation – Set the UsageLocation of the techs. 
8. DomainName – The domain name to use when creating accounts, or looking for synced accounts in a hybrid setup. This will default to the “onmicrosoft.com” domain found in the tenant. If more than one “onmicrosoft.com” domain exists, you should specify one.
9. Hybrid- Determine if TechIDManager should only use accounts created and managed by ADConnect or should created and manage accounts in EntraID directly.
   1. This can be set to “No” to ignore the existence of synced accounts and create and manage tech accounts directly in EntraID. Existing accounts with matching names are taken over by TechIDManager.
   2. This can be set to “Yes” to only set roles on users that are found that match TechIDManager created users from a hybrid domain that is running the TechIDManager TechIDAgent on a DC that is synced to EntraID. These users will be looked for with the Username from the HydridDomain and only with the DomainName configuration from above. It is up to ADConnect to create these users and sync the password from the DC.
10. HybridDomainGuid – Must be set if TechIDAgent.Hybrid is set to “Yes” 
    1. Should be set to the DomainGuid of the TechIDAgent running on the domain that is being synced to this Azure Tenant. This DomainGuid can be found in the TechIDPortal by clicking on the gear icon in the Domains page or by running “TechIDAgent.exe show” on the source DC.

These options can be set at anytime and will take effect within a few minutes

Some common errors when running the Base installation script:

1. If you get a “Decryption Error [WinError -2146893813]” or similar at the very start of the script.
   1. Exit the PowerShell window,
   2. Close all browser windows accessing azure stuff,
   3. On your computer delete the folder c:\Users\<YourUserName>\.azure
   4. Try the script again.
2. If you get an error “About you don’t have permission to make a resource group in a subscription”.
   1. Make sure you are signed in with an account that is a Global Administrator
   2. Make sure you are an “Owner” of that subscription by looking in https://portal.azure.com under “Subscriptions” and “Roles”. If you are not, user the “+ Add” button on the roles screen to add yourself as an owner.
3. If you get an error “(AuthorizationFailed) The client ‘live.com#???@????.com’ with object id ‘????’ does not have authorization to perform action ‘Microsoft.Web/sites/config/list/action’ over scope ‘/subscriptions/???..???/appsettings’ or the scope is invalid.
   1. Make sure you are an “Owner” of that subscription by looking in https://portal.azure.com under “Subscriptions” and “Roles”. If you are not, user the “+ Add” button on the roles screen to add yourself as an owner.
4. If you get an error that there are no subscriptions
   1. Add a pay-as-you-go subscription to the tenant.
   2. Go to https://portal.azure.com
   3. Login to the tenant in question
   4. Click on “More Services”
   5. Click on “Subscriptions”
   6. Click on “Add”….finish the subscription setup.
   7. Try the script again.

Return to step 4 to install more agents.