Enabling PRT support for Username and Password user for Entra ID Domains Federated to TruU

SCRIPTS PENDING UPDATE

Prerequisites:

Hybrid Federated Environments: Ensure your setup involves a hybrid federated environment where user accounts are synchronized from an on-premises Active Directory to Entra ID using Entra ID Connect. Password access is only possible under these conditions
Password Hash Synchronization: Verify that Password hash synchronization is enabled in Entra ID Connect
Multi-Factor Authentication (MFA): Ensure that MFA is not enabled for Entra ID users. TruU utilizes the OAuth 2.0 ROPC (Resource Owner Password Credentials) flow to verify passwords, which does not support MFA

Verify that Entra ID Connect synchronizes password hashes

To verify that Entra ID Connect synchronizes password hashes from an on-premises AD to Entra ID, follow these steps:

Open the Entra ID Connect application on a Windows machine
Click on Configure
Select Customize synchronization options and then click Next
Log in to Entra ID using a global administrator account and proceed through all steps up to the “Optional Features” section. Ensure that the Password hash synchronization option is enabled at this stage

Configuring Home Realm Discovery policy

As mentioned earlier, the Home Realm Discovery (HRD) policy enables TruU to authenticate passwords within a federated environment. This policy needs to be specifically applied to the client—TruU’s application registered in Entra—configured within the TruU Management console’s directory settings. Without this setup, the policy will not take effect. Below is an example demonstrating the creation of an HRD policy using the Entra ID PowerShell module for the TruU IDS Application.

Creating an HRD Policy

To create a new Home Realm Discovery (HRD) policy, follow this script:

$AzureADPreview = Get-Module AzureADPreview
if($AzureADPreview.Name -eq "AzureADPreview"){
    Write-Host "AzureADPreview is installed, moving forward for authentication"}
else{
Write-Host "AzureADPreview is not installed, Installing ...."
Install-Module AzureADPreview
}

#Connect-AzureAD  user willl be prompted to enter 

$TruUApp = Read-Host "Enter the name of TruU IDS Application that you created during the directory setup for TruU"

$AzureADServicePrincipal = Get-AzureADServicePrincipal -SearchString $TruUApp

Write-Host "Creating New HomeRealmDiscoveryPolicy for TruU"

$HomeRealmDiscoveryPolicy = New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AllowCloudPasswordValidation`":true}}") -DisplayName TruUPasswordAuth -Type HomeRealmDiscoveryPolicy -IsOrganizationDefault $false

Write-Host "Deploying HomeRealmDiscoveryPolicy with $TruUApp"
Add-AzureADServicePrincipalPolicy -Id $AzureADServicePrincipal.ObjectId -RefObjectId $HomeRealmDiscoveryPolicy.id

Removing the HRD Policy

If you need to disable password verification later, you can remove the HRD policy by using the following command:

$AzureADPreview = Get-Module AzureADPreview
if($AzureADPreview.Name -eq "AzureADPreview"){
    Write-Host "AzureADPreview is installed, moving forward for authentication"}
else{
Write-Host "AzureADPreview is not installed, Installing ...."
Install-Module AzureADPreview
}

#Connect-AzureAD  user willl be prompted to enter 

#$TruUApp = Read-Host "Enter the name of TruU IDS Application that you created during the directory setup for TruU"

#$AzureADServicePrincipal = Get-AzureADServicePrincipal -SearchString $TruUApp

$AzureADpolicies =Get-AzureADPolicy
if($AzureADpolicies -eq $Null){
write-host "Unabel to find TruUPasswordAuth policy"
}
ForEach($AzureADPolicy in $AzureADpolicies)
{
if($AzureADPolicy.DisplayName -eq "TruUPasswordAuth"){
    write-host "Removing TruUPasswordAuth policy"
    Remove-AzureADPolicy -Id $AzureADPolicy.Id
    }
 else{write-host "Unabel to find TruUPasswordAuth policy"}
 }

Approving a Delegated Permission in Entra

The ROPC OAuth 2.0 flow used by TruU for password verification requires the “user.Read” scope to function correctly. This permission must also be granted to the application in Entra. To configure this permission:

Open the Microsoft Entra ID service (former Azure AD) in Entra Portal
Go to App registrations, then navigate to , then API permissions
Click Add a Permission to proceed

This process allows you to grant the necessary permission for the application

Add a new Microsoft Graph delegated to “User.Read” permission as you can see below
After adding the permission, you must grant administrative consent to the permission
Click the Grant admin consent for … button

Overview

TruU Tenant Setup

Infrastructure Configuration

TruU Adapters & Integrations

Deploy TruU on Windows

Deploy TruU on macOS

Deploy Shared Workstation

Deploy Continuous Authentication

Admin Console Overview

Enabling PRT support for Username and Password user for Entra ID Domains Federated to TruU

Prerequisites:

Verify that Entra ID Connect synchronizes password hashes

Configuring Home Realm Discovery policy

Creating an HRD Policy

Removing the HRD Policy

Approving a Delegated Permission in Entra

​Prerequisites:

​Verify that Entra ID Connect synchronizes password hashes

​Configuring Home Realm Discovery policy

​Creating an HRD Policy

​Removing the HRD Policy

​Approving a Delegated Permission in Entra

Prerequisites:

Verify that Entra ID Connect synchronizes password hashes

Configuring Home Realm Discovery policy

Creating an HRD Policy

Removing the HRD Policy

Approving a Delegated Permission in Entra