Categories

This article will cover how to enable and configure CoreView management sessions. 


Note: To activate Password Rotation, Admin roles are needed. More information in the "How it works: CoreView Admin Account" article.


CoreView Management Session Overview 


CoreView management session allows operators to execute management actions, custom actions, and workflows. The management session needs to be active when performing actions. The management session needs to be enabled using Microsoft 365 administrator credentials.  

There are 2 possible configurations for CoreView management sessions: 

  • Default - Microsoft Global Admin without MFA enabled credentials required 
    CoreView creates an interactive PowerShell session with Office 365. As there isn't a good way to feed the token value into this session the Global Admin account used to activate management session must NOT have MFA enabled.  
  • Advanced - No credentials required. Service account needed. 
    This feature enables lower-level admins and help-desk operators to make delegated changes to defined user accounts, as no Microsoft credentials are used to enable this type of management session. 

 

How to enable CoreView management session 

 

The management session can be enabled by every operator with the ‘Management’ role.  

Enabling CoreView management session ‘Default’ and ‘Advanced’ configuration is quite similar, the difference for delegated operators is the need to enter credentials when using the ‘Default’ configuration. 

When the username and password have been filled in (or the ‘Advanced’ management session is enabled), operators can start the management session clicking on the ‘Turn on management session’ button.  


Graphical user interface, text, application, email Description automatically generated 

 

Enabling the management session can require some time, normally a few minutes. Once it is enabled, the header will show the ‘Management ON’ message. Clicking on that, operators can view further details and turn it off.  


Graphical user interface, text, application, email Description automatically generated 

How to configure the CoreView management session 

 
CoreView management sessions have two different configurations. If you are a tenant administrator, you can change this setting and enable the ‘Advanced’ management session.  


This configuration is the preferred one as it prevents the sprawl of administrative accounts on Microsoft, while keeping everything within CoreView. This also ensures that delegated operators have the required permissions to perform management action at all times, as permissions themselves are set only on CoreView (other than on Microsoft as well). Finally, the ‘Advanced’ management configuration automatically turns on the session when operators execute actions if the session happens to be off.  


CoreView creates a service account with the following Administrative roles: Authentication Administrator, Exchange Administrator, Global Reader, Reports Reader, SharePoint Administrator, Teams Administrator, and User Administrator. The credentials for this account are stored within Microsoft Azure Key Vault and changed once a week. Key Vault is a hardware security module specifically designed to store highly confidential information such as passwords and credit card information. With the credentials stored in Key Vault, CoreView can elevate its privileges without ever having access to the password itself. In addition, Key Vault automatically changes the password each week. 


The password length is 16 characters, and its complexity is composed by:  

  • Upper and lower case letters  
  • Special characters  
  • Numbers 


Key Vault allows CoreView to gain access to an authorization token on demand, allowing it to elevate the rights of the service account and perform the action requested by the operator. This allows you to delegate very specific actions to an operator who would otherwise need to be entrusted with Global Admin credentials. All operations are audited by Microsoft Azure directly.  


To enable the ‘Advanced’ management session, first turn on the session using the ‘Default’ mode and Microsoft Global Admin without MFA enabled credentials. 

 


Graphical user interface, text, application, email Description automatically generated 

 

Once the management session is active, open the management session section to reveal the configuration. Turn on the ‘Enable Advanced management’ and the ‘Auto-enable management session’ toggles to fully take advantage of this feature.

 

Graphical user interface, text, application, email Description automatically generated 

 

 

Credentials used to activate the management in the ‘Advanced’ mode will not not have MFA enabled because they are used behind the scenes by back-end services.  But the management user could be covered by the company policies or conditional access enabled that requires MFA for all the Global Admin and privileged accounts, including the 4ward365.admin/coreview.admin account. This will also cause issues when trying to activate the Management Session.  

 

To resolve this problem, you need to check what is the policy that is currently blocking the access of our management account by using the what if analysis on 4ward365.admin/coreview.admin account: 
How to use the What If tool to check Azure AD conditional access policies

  

Then, please follow a simple manual procedure to configure Allowed IP for our management user (4ward365.admin/coreview.admin and MFA will be mandatory outside of it. You can find the steps in the article below: 

How to ensure security for CoreView service accounts : CoreView 


Note: In case the policy is enabled, you won't see that the MFA is enabled for the users from the Azure Active Directory Admin center. 

Graphical user interface, text, application Description automatically generated