-## January 2023

-### New articles

-### Updated articles

-## December 2022

-### New articles

-### Updated articles

-You can scope synchronization to only user accounts that originated in the cloud. Within that synchronization scope, you can filter for specific groups os users. You can choose between cloud only groups, on-premises groups, or both. For more information about how to configure scoped synchronization, see [Configure scoped synchronization](scoped-synchronization.md).

-For connectivity to applications that don't support the aforementioned protocols and standards, customers and [partners](https://social.technet.microsoft.com/wiki/contents/articles/1589.fim-2010-mim-2016-management-agents-from-partners.aspx) have built custom [ECMA 2.0](/previous-versions/windows/desktop/forefront-2010/hh859557(v=vs.100)) connectors for Microsoft Identity Manager (MIM) 2016. You can now use those ECMA 2.0 connectors with the lightweight Azure AD provisioning agent, without needing MIM sync deployed. \

-If you've got a customer connector in MIM, you can export it by following the instructions [here](on-premises-migrate-microsoft-identity-manager.md#export-a-connector-configuration-from-mim-sync). You need to save the XML file, the DLL, and related software for your connector.

-### Registering authentication methods

-The following authentication methods can't be registered as part of combined registration interrupt mode:

-* [Microsoft Authenticator (phone sign-in)](https://support.microsoft.com/account-billing/add-your-work-or-school-account-to-the-microsoft-authenticator-app-43a73ab5-b4e8-446d-9e54-2a4cb8e4e93c) - Can be registered from the Authenticator app.

-* [FIDO2](howto-authentication-passwordless-security-key.md) - can be registered using [combined registration managed mode](concept-registration-mfa-sspr-combined.md#manage-mode).

-* [Certificate-based authentication](concept-certificate-based-authentication.md) - Require administrator setup, cannot be registered by the user.

-* [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use) - Can be registered in the Windows Out of Box Experience (OOBE) or the Windows Settings menu.

-If a user isn't registered for these methods, they can't access the resource until the required method is registered. For the best user experience, make sure users complete combined registered in advance for the different methods they may need to use.

-Android needs a middleware application to be able to support smartcard or security keys with certificates. To support YubiKeys with Azure AD CBA, YubiKey Android SDK has been integrated into the Microsoft broker code which can be leveraged through the latest MSAL

-Since Azure AD CBA with YubiKey on Android mobile is enabled via the latest MSAL, YubiKey Authenticator app is not a requirement for Android support.

-## Common questions

-System-preferred MFA doesn't affect users who sign in by using Active Directory Federation Services (AD FS) or Network Policy Server (NPS) extension. Those users don't see any change to their sign-in experience.

-These include Microsoft Edge, Chrome, Firefox, and Safari.

-1. Under **Assignments**, select **Users or workload identities**.. Choose the users and groups you want this policy to apply to, then select **Done**.

-1. Select **Done** on the *Locations* window, then select **Done** on the *Conditions* window.

-Some methods can't be registered during sign-in, or they need more setup beyond the combined registration. For more information, see [Registering authentication methods](concept-authentication-strengths.md#registering-authentication-methods).

-* An (optional) AWS Master account

-### 3. Set up the AWS master account connection (Optional)

-1. If your organization has Service Control Policies (SCPs) that govern some or all of the member accounts, set up the master account connection in the **Permissions Management Onboarding - AWS Master Account Details** page.

- Setting up the master account connection allows Permissions Management to auto-detect and onboard any AWS member accounts that have the correct Permissions Management role.

-1. In the **Permissions Management Onboarding - AWS Master Account Details** page, enter the **Master Account ID** and **Master Account Role**.

-1. Open another browser window and sign in to the AWS console for your master account.

-1. Return to Permissions Management, and in the **Permissions Management Onboarding - AWS Master Account Details** page, select **Launch Template**.

- This AWS CloudFormation stack creates a role in the master account with the necessary permissions (policies) to collect SCPs and list all the accounts in your organization.

-1. Return to Permissions Management, and in **Permissions Management Onboarding - AWS Master Account Details**, select **Next**.

- You can enter up to 10 account IDs. Click the plus icon next to the text box to add more account IDs.

-You have the ability to specify only certain subscriptions to manage and monitor with MEPM (up to 10 per collector). Follow the steps below to configure these subscriptions to be monitored:

-Choose from 3 options to manage GCP projects.

-#### Option 1: Automatically manage

-The automatically manage option allows projects to be automatically detected and monitored without extra configuration. Steps to detect list of projects and onboard for collection:

-Firstly, grant Viewer and Security Reviewer role to service account created in previous step at organization, folder or project scope.

-Once done, the steps are listed in the screen, which shows how to further configure in the GPC console, or programmatically with the gcloud CLI.

-Once everything has been configured, click next, then 'Verify Now & Save'.

-Any current or future projects found get onboarded automatically.

-To view status of onboarding after saving the configuration:

-#### Option 2: Enter authorization systems

- You can either download and run the script at this point or you can do it in the Google Cloud Shell, as described [later in this article](onboard-gcp.md#4-run-scripts-in-cloud-shell-optional-if-not-already-executed).

-#### Option 3: Select authorization systems

-This option detects all projects that are accessible by the Cloud Infrastructure Entitlement Management application.

-### 3. Set up GCP member projects.

-1. In the **Permissions Management Onboarding - GCP Project Ids** page, enter the **Project IDs**.

- You can enter up to 10 GCP project IDs. Select the plus icon next to the text box to insert more project IDs.

-1. You can choose to download and run the script at this point, or you can do it via Google Cloud Shell, as described in the [next step](onboard-gcp.md#4-run-scripts-in-cloud-shell-optional-if-not-already-executed).

-### 4. Run scripts in Cloud Shell. (Optional if not already executed)

-1. In the **Permissions Management Onboarding - GCP Project Ids** page, select **Launch SSH**.

-1. To copy all your scripts into your current directory, in **Open in Cloud Shell**, select **Trust repo**, and then select **Confirm**.

- The Cloud Shell provisions the Cloud Shell machine and makes a connection to your Cloud Shell instance.

- > [!NOTE]

- > Follow the instructions in the browser as they may be different from the ones given here.

- The **Welcome to Permissions Management GCP onboarding** screen appears, displaying steps you must complete to onboard your GCP project.

-### 5. Paste the environmental variables from the Permissions Management portal.

-1. Return to Permissions Management and select **Copy export variables**.

-1. In the GCP Onboarding shell editor, paste the variables you copied, and then press **Enter**.

-1. Execute the **gcloud auth login**.

-1. Follow instructions displayed on the screen to authorize access to your Google account.

-1. Execute the **sh mciem-workload-identity-pool.sh** to create the workload identity pool, provider, and service account.

-1. Execute the **sh mciem-member-projects.sh** to give Permissions Management permissions to access each of the member projects.

- - If you want to manage permissions through Permissions Management, select **Y** to **Enable controller**.

- - If you want to onboard your projects in read-only mode, select **N** to **Disable controller**.

-1. Optionally, execute **mciem-enable-gcp-api.sh** to enable all recommended GCP APIs.

-1. Return to **Permissions Management Onboarding - GCP Project Ids**, and then select **Next**.

-### 6. Review and save.

-1. In the **Permissions Management Onboarding ΓÇô Summary** page, review the information you've added, and then select **Verify Now & Save**.

-### 7. View the data.

-Token protection creates a cryptographically secure tie between the token and the device (client secret) it's issued to. Without the client secret, the bound token is useless. When a user registers a Windows 10 or newer device in Azure AD, their primary identity is [bound to the device](../devices/concept-primary-refresh-token.md#how-is-the-prt-protected). This connection means that any issued sign-in token is tied to the device significantly reducing the chance of theft and replay attacks.

-Here's a sample Log Analytics query searching the non-interactive sign-in logs for the last seven days, highlighting **Blocked** versus **Allowed** requests by **Application**.

-| where ConditionalAccessPolicies ["enforcedSessionControls"] contains '["Protection"]'

-| extend Result = case (SessionNotSatisfyResult contains 'Protection', 'Block','Allow')

-| where ConditionalAccessPolicies.enforcedSessionControls contains '["Protection"]'

-| extend Result = case (SessionNotSatisfyResult contains 'Protection', 'Block','Allow')

-> Custom controls cannot be used with Identity Protection's automation requiring Azure AD Multifactor Authentication, Azure AD self-service password reset (SSPR), satisfying multifactor authentication claim requirements, to elevate roles in Privileged Identity Manager (PIM), as part of Intune device enrollment, or when joining devices to Azure AD.

-Custom Controls works with a limited set of approved authentication providers. To create a custom control, you should first contact the provider that you wish to utilize. Each non-Microsoft provider has its own process and requirements to sign up, subscribe, or otherwise become a part of the service, and to indicate that you wish to integrate with Conditional Access. At that point, the provider will provide you with a block of data in JSON format. This data allows the provider and Conditional Access to work together for your tenant, creates the new control and defines how Conditional Access can tell if your users have successfully performed verification with the provider.

-Custom controls can't be used with Identity Protection's automation requiring Azure AD Multifactor Authentication, Azure AD self-service password reset (SSPR), satisfying multifactor authentication claim requirements, to elevate roles in Privileged Identity Manager (PIM), as part of Intune device enrollment, or when joining devices to Azure AD.

-description: Learn about refresh tokens emitted by the Azure AD.

-# Microsoft identity platform refresh tokens

-When a client acquires an access token to access a protected resource, the client also receives a refresh token. The refresh token is used to obtain new access/refresh token pairs when the current access token expires. Refresh tokens are also used to acquire extra access tokens for other resources. Refresh tokens are bound to a combination of user and client, but aren't tied to a resource or tenant. As such, a client can use a refresh token to acquire access tokens across any combination of resource and tenant where it has permission to do so. Refresh tokens are encrypted and only the Microsoft identity platform can read them.

-## Prerequisites

-Before reading through this article, it's recommended that you go through the following articles:

-## Refresh token lifetime

-Refresh tokens have a longer lifetime than access tokens. The default lifetime for the refresh tokens is 24 hours for [single page apps](reference-third-party-cookies-spas.md) and 90 days for all other scenarios. Refresh tokens replace themselves with a fresh token upon every use. The Microsoft identity platform doesn't revoke old refresh tokens when used to fetch new access tokens. Securely delete the old refresh token after acquiring a new one. Refresh tokens need to be stored safely like access tokens or application credentials.

-> Refresh tokens sent to a redirect URI registered as `spa` expire after 24 hours. Additional refresh tokens acquired using the initial refresh token carry over that expiration time, so apps must be prepared to rerun the authorization code flow using an interactive authentication to get a new refresh token every 24 hours. Users don't have to enter their credentials and usually don't even see any related user experience, just a reload of your application. The browser must visit the log-in page in a top-level frame to show the login session. This is due to [privacy features in browsers that block third party cookies](reference-third-party-cookies-spas.md).

-## Refresh token expiration

-Refresh tokens can be revoked at any time, because of timeouts and revocations. Your app must handle rejections by the sign-in service gracefully when this occurs. This is done by sending the user to an interactive sign-in prompt to sign in again.

-You can't configure the lifetime of a refresh token. You can't reduce or lengthen their lifetime. Configure sign-in frequency in Conditional Access to define the time periods before a user is required to sign in again. Learn more about [Configuring authentication session management with Conditional Access](../conditional-access/howto-conditional-access-session-lifetime.md).

-Not all refresh tokens follow the rules set in the token lifetime policy. Specifically, refresh tokens used in [single page apps](reference-third-party-cookies-spas.md) are always fixed to 24 hours of activity, as if they have a `MaxAgeSessionSingleFactor` policy of 24 hours applied to them.

-### Revocation

-Refresh tokens can be revoked by the server because of a change in credentials, user action, or admin action. Refresh tokens fall into two classes: tokens issued to confidential clients (the rightmost column) and tokens issued to public clients (all other columns).

-| Change | Password-based cookie | Password-based token | Non-password-based cookie | Non-password-based token | Confidential client token |

-| -- | | -- | - | | - |

-| Password expires | Stays alive | Stays alive | Stays alive | Stays alive | Stays alive |

-| Password changed by user | Revoked | Revoked | Stays alive | Stays alive | Stays alive |

-| User does SSPR | Revoked | Revoked | Stays alive | Stays alive | Stays alive |

-| Admin resets password | Revoked | Revoked | Stays alive | Stays alive | Stays alive |

-| User revokes their refresh tokens [via PowerShell](/powershell/module/microsoft.graph.users.actions/invoke-mginvalidateuserrefreshtoken) | Revoked | Revoked | Revoked | Revoked | Revoked |

-| Admin revokes all refresh tokens for a user [via PowerShell](/powershell/module/microsoft.graph.users.actions/invoke-mginvalidateuserrefreshtoken) | Revoked | Revoked | Revoked | Revoked | Revoked |

-| Single sign-out [on web](v2-protocols-oidc.md#single-sign-out) | Revoked | Stays alive | Revoked | Stays alive | Stays alive |

-> The Virtual Machine Administrator Login and Virtual Machine User Login roles use `dataActions` and can be assigned at the management group, subscription, resource group, or resource scope. We recommend that you assign the roles at the management group, subscription, or resource level and not at the individual VM level. This practice avoids the risk of reaching the [Azure role assignments limit](../../role-based-access-control/troubleshooting.md#limits) per subscription.

-If you see an "Azure role not assigned" error on your SSH prompt, verify that you've configured Azure RBAC policies for the VM that grants the user either the Virtual Machine Administrator Login role or the Virtual Machine User Login role. If you're having problems with Azure role assignments, see the article [Troubleshoot Azure RBAC](../../role-based-access-control/troubleshooting.md#limits).

-You can enforce Conditional Access policies, such as "phishing resistant MFA" using require authentication strength (preview) grant contorl or multifactor authentication or user sign-in risk check, before you authorize access to Windows VMs in Azure that are enabled with Azure AD login. To apply a Conditional Access policy, you must select the **Azure Windows VM Sign-In** app from the cloud apps or actions assignment option. Then use sign-in risk as a condition and/or "phishing resistant MFA" using require authentication strength (preview) grant contorl or require MFA as a control for granting access.

-> If you're having problems with Azure role assignments, see [Troubleshoot Azure RBAC](../../role-based-access-control/troubleshooting.md#limits).

->This information last updated on June 1st, 2023.<br/>You can also download a CSV version of this table [here](https://download.microsoft.com/download/e/3/e/e3e9faf2-f28b-490a-9ada-c6089a1fc5b0/Product%20names%20and%20service%20plan%20identifiers%20for%20licensing.csv).

-Organizations can enforce Conditional Access policies for external B2B collaboration and B2B direct connect users in the same way that theyΓÇÖre enabled for full-time employees and members of the organization. With the introduction of cross-tenant access settings, you can also trust MFA and device claims from external Azure AD organizations. This section describes important considerations for applying Conditional Access to users outside of your organization.

-Lear more: [What is Conditional Access?](../conditional-access/overview.md)

-This section of the [Azure AD operations reference guide](active-directory-ops-guide-intro.md) describes the checks and actions you should take to secure and manage credentials, define authentication experience, delegate assignment, measure usage, and define access policies based on enterprise security posture.

-This section of the [Azure AD operations reference guide](active-directory-ops-guide-intro.md) describes the checks and actions you should take to assess and attest the access granted nonprivileged and privileged identities, audit, and control changes to the environment.

-Get started with the [Azure AD operational checks and actions](active-directory-ops-guide-ops.md).

-In addition to the guidance in the [Azure Active Directory general operations guide](../fundamentals/active-directory-ops-guide-ops.md), we also recommend the following considerations for isolated environments.

-Azure AD also supports direct user assignment to third-party SaaS services (for example, Salesforce, Service Now) for single sign-on and identity provisioning. Direct assignments to resources can be natively governed from the cloud when combined with [Azure AD access reviews](../governance/access-reviews-overview.md) and [Azure AD entitlement management](../fundamentals/active-directory-ops-guide-ops.md). Direct assignment might be a good fit for end-user facing assignment.

-The following are additional operational considerations for Azure AD, specific to multiple isolated environments. Check the [Azure Cloud Adoption Framework](/azure/cloud-adoption-framework/manage/), the [Microsoft cloud security benchmark](/security/benchmark/azure/) and [Azure AD Operations guide](./active-directory-ops-guide-ops.md) for detailed guidance to operate individual environments.

-We have improved My Sign-ins and My Security-Info to give you more clarity on the types of Microsoft Authenticator other Authenticator apps a user has registered. Users will now see Microsoft Authenticator registrations with additional information showing the app as being registered as Push-based MFA or Password-less phone sign-in (PSI) and for other Authenticator apps (Software OATH) we now indicate they're registered as a Time-based One-time password method. For more information, see: [Set up the Microsoft Authenticator app as your verification method](https://support.microsoft.com/account-billing/set-up-the-microsoft-authenticator-app-as-your-verification-method-33452159-6af9-438f-8f82-63ce94cf3d29).

-> Instead of sending a message for every sync error every time it occurs we will send out a daily digest of all errors the backend service has returned. This enables customers to process these errors in a more efficient manner and reduces the number of duplicate error messages.

-* [Tutorial: Configure Cloudflare with Azure AD for secure hybrid access](cloudflare-azure-ad-integration.md)

-|Cloudflare, Inc.|[Tutorial: Configure Cloudflare with Azure AD for secure hybrid access](cloudflare-azure-ad-integration.md)|

-| May | 99.999% | 99.999% | |

-1. To automate the configuration within 8x8, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up 8x8** will direct you to the 8x8 application. From there, provide the admin credentials to sign into 8x8. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup 8x8 manually, sign in to 8x8 [Admin Console](https://admin.8x8.com/) as an administrator.

-1. To automate the configuration within AcquireIO, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding the extension to the browser, click **Set up AcquireIO**, which directs you to the AcquireIO application. From there, provide the admin credentials to sign in to AcquireIO. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to set up AcquireIO manually, in a different web browser window, sign in to AcquireIO as an Administrator.

-1. To automate the configuration within Adobe Identity Management (SAML), you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Adobe Identity Management (SAML)** will direct you to the Adobe Identity Management (SAML) application. From there, provide the admin credentials to sign into Adobe Identity Management (SAML). The browser extension will automatically configure the application for you and automate steps 3-8.

- 

-3. If you want to setup Adobe Identity Management (SAML) manually, in a different web browser window, sign in to your Adobe Identity Management (SAML) company site as an administrator.

-1. To automate the configuration within ADP, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up ADP** will direct you to the ADP application. From there, provide the admin credentials to sign in to ADP. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-1. If you want to set up ADP manually, open a new web browser window and sign in to your ADP company site as an administrator and perform the following steps:

-1. To automate the configuration within Aha!, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Aha!** will direct you to the Aha! application. From there, provide the admin credentials to sign into Aha!. The browser extension will automatically configure the application for you and automate steps 3-8.

- 

-3. If you want to setup Aha! manually, open a new web browser window and sign into your Aha! company site as an administrator and perform the following steps:

-1. To automate the configuration within AlertOps, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup AlertOps** will direct you to the AlertOps application. From there, provide the admin credentials to sign into AlertOps. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup AlertOps manually, open a new web browser window and sign into your AlertOps company site as an administrator and perform the following steps:

-1. To automate the configuration within Amazon Business, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Amazon Business** will direct you to the Amazon Business Single Sign-On application. From there, provide the admin credentials to sign in to Amazon Business Single Sign-On. The browser extension will automatically configure the application for you and automate steps 3-17.

- 

-1. If you want to set up Amazon Business manually, in a different web browser window, sign in to your Amazon Business company site as an administrator.

-1. To automate the configuration within Amplitude, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Amplitude** will direct you to the Amplitude application. From there, provide the admin credentials to sign into Amplitude. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup Amplitude manually, open a new web browser window and sign into your Amplitude company site as an administrator and perform the following steps:

-1. To automate the configuration within Appraisd, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Appraisd** will direct you to the Appraisd application. From there, provide the admin credentials to sign into Appraisd. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Appraisd manually, open a new web browser window and sign into your Appraisd company site as an administrator and perform the following steps:

-1. To automate the configuration within ArcGIS Online, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up ArcGIS Online** will direct you to the ArcGIS Online application. From there, provide the admin credentials to sign in to ArcGIS Online. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-1. If you want to setup ArcGIS Online manually, open a new web browser window and log into your ArcGIS Online company site as an administrator and perform the following steps:

-1. To automate the configuration within ArcGIS Enterprise, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up ArcGIS Enterprise** will direct you to the ArcGIS Enterprise application. From there, provide the admin credentials to sign into ArcGIS Enterprise. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-1. If you want to setup ArcGIS Enterprise manually, log in to your ArcGIS Enterprise company site as an administrator.

-1. To automate the configuration within AskYourTeam, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up AskYourTeam** will direct you to the AskYourTeam application. From there, provide the admin credentials to sign into AskYourTeam. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup AskYourTeam manually, in a different web browser window, sign in to your AskYourTeam company site as an administrator.

-1. To automate the configuration within Atlassian Cloud, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Atlassian Cloud** will direct you to the Atlassian Cloud application. From there, provide the admin credentials to sign into Atlassian Cloud. The browser extension will automatically configure the application for you.

- 

-1. If you want to set up Atlassian Cloud manually, log in to your Atlassian Cloud company site as an administrator and perform the following steps.

-1. To automate the configuration within AWS IAM Identity Center, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up AWS IAM Identity Center** will direct you to the AWS IAM Identity Center application. From there, provide the admin credentials to sign into AWS IAM Identity Center. The browser extension will automatically configure the application for you and automate steps 3-10.

- 

-3. If you want to setup AWS IAM Identity Center manually, in a different web browser window, sign in to your AWS IAM Identity Center company site as an administrator.

-1. To automate the configuration within Box, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Box** will direct you to the Box application. From there, provide the admin credentials to sign into Box. The browser extension will automatically configure the application for you and automate step 3.

- 

-3. If you want to setup Box manually, in a different web browser window, sign in to your Box company site as an administrator and follow the procedure in [Set up SSO on your own](https://community.box.com/t5/How-to-Guides-for-Admins/Setting-Up-Single-Sign-On-SSO-for-your-Enterprise/ta-p/1263#ssoonyourown).

-1. To automate the configuration within CakeHR, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up CakeHR** will direct you to the CakeHR application. From there, provide the admin credentials to sign into CakeHR. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to setup CakeHR manually, open a new web browser window and sign into your CakeHR company site as an administrator and perform the following steps:

-1. To automate the configuration within Carbonite Endpoint Backup, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Carbonite Endpoint Backup** will direct you to the Carbonite Endpoint Backup application. From there, provide the admin credentials to sign into Carbonite Endpoint Backup. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Carbonite Endpoint Backup manually, open a new web browser window and sign into your Carbonite Endpoint Backup company site as an administrator and perform the following steps:

-1. To automate the configuration within Citrix Cloud SAML SSO, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Citrix Cloud SAML SSO** will direct you to the Citrix Cloud SAML SSO application. From there, provide the admin credentials to sign in to Citrix Cloud SAML SSO. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to set up Citrix Cloud SAML SSO manually, log in to your Citrix Cloud SAML SSO company site as an administrator.

-1. To automate the configuration within Clebex, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Clebex** will direct you to the Clebex application. From there, provide the admin credentials to sign into Clebex. The browser extension will automatically configure the application for you and automate steps 3-10.

- 

-3. If you want to setup Clebex manually, in a different web browser window, sign in to your Clebex company site as an administrator.

-1. To automate the configuration within SAP Concur Travel and Expense, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up SAP Concur Travel and Expense** will direct you to the SAP Concur Travel and Expense application. From there, provide the admin credentials to sign into SAP Concur Travel and Expense. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup SAP Concur Travel and Expense manually, in a different web browser window, you need to upload the downloaded **Federation Metadata XML** to [Concur SSO Self-Service Tool](https://www.concursolutions.com/nui/authadmin/ssoadmin) and sign in to your SAP Concur Travel and Expense company site as an administrator.

-1. To automate the configuration within Deskradar, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Setup Deskradar** will direct you to the Deskradar application. From there, provide the admin credentials to sign into Deskradar. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-1. If you want to setup Deskradar manually, open a new web browser window and sign into your Deskradar company site as an administrator and perform the following steps:

-1. To automate the configuration within Displayr, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Displayr** will direct you to the Displayr application. From there, provide the admin credentials to sign into Displayr. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to set up Displayr manually, open a new web browser window and sign into your Displayr company site as an administrator and perform the following steps:

-1. To automate the configuration within dmarcian, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup dmarcian** will direct you to the dmarcian application. From there, provide the admin credentials to sign into dmarcian. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup dmarcian manually, open a new web browser window and sign into your dmarcian company site as an administrator and perform the following steps:

-1. To automate the configuration in DocuSign, you must install the My Apps Secure Sign-in browser extension by selecting **Install the extension**.

- 

-2. After you add the extension to the browser, select **Setup DocuSign**. You're directed to the DocuSign application. From there, provide the admin credentials to sign in to DocuSign. The browser extension automatically configures the application and automates steps 3 through 5.

- 

-3. If you want to set up DocuSign manually, open a new web browser window and sign in to your DocuSign company site as an administrator.

-1. To automate the configuration within Check Point CloudGuard Posture Management, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Check Point CloudGuard Posture Management** will direct you to the Check Point CloudGuard Posture Management application. From there, provide the admin credentials to sign into Check Point CloudGuard Posture Management. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Check Point CloudGuard Posture Management manually, open a new web browser window and sign into your Check Point CloudGuard Posture Management company site as an administrator and perform the following steps:

-1. To automate the configuration within Drift, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Drift** will direct you to the Drift application. From there, provide the admin credentials to sign into Drift. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-3. If you want to setup Drift manually, open a new web browser window and sign into your Drift company site as an administrator and perform the following steps:

-1. To automate the configuration within Dropbox Business, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Dropbox Business** will direct you to the Dropbox Business application. From there, provide the admin credentials to sign into Dropbox Business. The browser extension will automatically configure the application for you and automate steps 3-8.

- 

-3. If you want to setup Dropbox Business manually, open a new web browser window and go on your Dropbox Business tenant and sign on to your Dropbox Business tenant. and perform the following steps:

-1. To automate the configuration within Zoom, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Zoom** will direct you to the Zoom application. From there, provide the admin credentials to sign into Zoom. The browser extension will automatically configure the application for you and automate steps 3-10.

- 

-3. If you want to setup Zoom manually, in a different web browser window, sign in to your Zoom company site as an administrator.

-1. To automate the configuration within Zoom, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Zoom** will direct you to the Zoom application. From there, provide the admin credentials to sign into Zoom. The browser extension will automatically configure the application for you and automate steps 3-10.

- 

-3. If you want to setup Zoom manually, in a different web browser window, sign in to your Zoom company site as an administrator.

-1. To automate the configuration within EasySSO for Confluence, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up EasySSO for Confluence** will direct you to the EasySSO for Confluence application. From there, provide the admin credentials to sign into EasySSO for Confluence. The browser extension will automatically configure the application for you and automate steps 3-9.

- 

-1. If you want to setup EasySSO for Confluence manually, sign into your Atlassian Confluence instance with Administrator privileges and navigate to the **Manage Apps** section.

-1. To automate the configuration within ekarda, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up ekarda** will direct you to the ekarda application. From there, provide the admin credentials to sign into ekarda. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup ekarda manually, in a different web browser window, sign in to your ekarda company site as an administrator.

-1. To automate the configuration within Elium, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Elium** will direct you to the Elium application. From there, provide the admin credentials to sign into Elium. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup Elium manually, open a new web browser window and sign into your Elium company site as an administrator and perform the following steps:

-1. To automate the configuration within Embed Signage, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Embed Signage** will direct you to the Embed Signage application. From there, provide the admin credentials to sign in to Embed Signage. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to set up Embed Signage manually, log in to your Embed Signage company site as an administrator.

-1. To automate the configuration within Envoy, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Envoy** will direct you to the Envoy application. From there, provide the admin credentials to sign into Envoy. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup Envoy manually, open a new web browser window and sign into your Envoy company site as an administrator and perform the following steps.

-1. To automate the configuration within Evernote, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **setup Evernote** will direct you to the Evernote application. From there, provide the admin credentials to sign into Evernote. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Evernote manually, open a new web browser window and sign into your Evernote company site as an administrator and perform the following steps:

-1. To automate the configuration within ExpenseIn, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up ExpenseIn** will direct you to the ExpenseIn application. From there, provide the admin credentials to sign into ExpenseIn. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to setup ExpenseIn manually, log in to your ExpenseIn company site as an administrator.

-1. To automate the configuration within EZOfficeInventory, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up EZOfficeInventory** will direct you to the EZOfficeInventory application. From there, provide the admin credentials to sign into EZOfficeInventory. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to setup EZOfficeInventory manually, open a new web browser window and sign into your EZOfficeInventory company site as an administrator and perform the following steps:

-1. To automate the configuration within FAX.PLUS, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up FAX.PLUS** will direct you to the FAX.PLUS application. From there, provide the admin credentials to sign into FAX.PLUS. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup FAX.PLUS manually, in a different web browser window, sign in to your FAX.PLUS company site as an administrator.

-1. To automate the configuration within Foodee, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Foodee** will direct you to the Foodee application. From there, provide the admin credentials to sign into Foodee. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-3. If you want to setup Foodee manually, open a new web browser window and sign into your Foodee company site as an administrator and perform the following steps:

-1. To automate the configuration within Freedcamp, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Freedcamp** will direct you to the Freedcamp application. From there, provide the admin credentials to sign into Freedcamp. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup Freedcamp manually, open a new web browser window and sign into your Freedcamp company site as an administrator and perform the following steps:

-1. To automate the configuration within Fresh Relevance, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Fresh Relevance** will direct you to the Fresh Relevance application. From there, provide the admin credentials to sign into Fresh Relevance. The browser extension will automatically configure the application for you and automate steps 3-10.

- 

-3. If you want to setup Fresh Relevance manually, in a different web browser window, sign in to your Fresh Relevance company site as an administrator.

-1. To automate the configuration within Freshservice, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Freshservice** will direct you to the Freshservice application. From there, provide the admin credentials to sign into Freshservice. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup Freshservice manually, log in to your Freshservice company site as an administrator.

-1. To automate the configuration within Harness, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Harness** will direct you to the Harness application. From there, provide the admin credentials to sign into Harness. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Harness manually, open a new web browser window and sign into your Harness company site as an administrator and perform the following steps:

-1. To automate the configuration within Help Scout, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Help Scout** will direct you to the Help Scout application. From there, provide the admin credentials to sign into Help Scout. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-1. If you want to setup Help Scout manually, open a new web browser window and sign into your Help Scout company site as an administrator and perform the following steps:

-1. To automate the configuration within Hightail, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Hightail** will direct you to the Hightail application. From there, provide the admin credentials to sign into Hightail. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup Hightail manually, in another browser window, open the **Hightail** admin portal.

-1. To automate the configuration within HRworks Single Sign-On, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up HRworks Single Sign-On** will direct you to the HRworks Single Sign-On application. From there, provide the admin credentials to sign into HRworks Single Sign-On. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-1. If you want to setup HRworks Single Sign-On manually, open a new web browser window and sign into your HRworks Single Sign-On company site as an administrator and perform the following steps:

-1. To automate the configuration within IDrive360, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up IDrive360** will direct you to the IDrive360 application. From there, provide the admin credentials to sign into IDrive360. The browser extension will automatically configure the application for you and automate steps 3-10.

- 

-3. If you want to setup IDrive360 manually, in a different web browser window, sign in to your IDrive360 company site as an administrator.

-1. To automate the configuration within InVision, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up InVision** will direct you to the InVision application. From there, provide the admin credentials to sign into InVision. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup InVision manually, in a different web browser window, sign in to your InVision company site as an administrator.

-1. To automate the configuration within Kanbanize, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Kanbanize** will direct you to the Kanbanize application. From there, provide the admin credentials to sign into Kanbanize. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Kanbanize manually, open a new web browser window and sign into your Kanbanize company site as an administrator and perform the following steps:

-1. To automate the configuration within Kendis - Azure AD Integration, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Kendis - Azure AD Integration** will direct you to the Kendis - Azure AD Integration application. From there, provide the admin credentials to sign into Kendis - Azure AD Integration. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup Kendis - Azure AD Integration manually, in a different web browser window, sign in to your Kendis - Azure AD Integration company site as an administrator.

-1. To automate the configuration within Knowledge Anywhere LMS, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Knowledge Anywhere LMS** will direct you to the Knowledge Anywhere LMS application. From there, provide the admin credentials to sign into Knowledge Anywhere LMS. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Knowledge Anywhere LMS manually, open a new web browser window and sign into your Knowledge Anywhere LMS company site as an administrator and perform the following steps:

-1. To automate the configuration within Litmus, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Litmus** will direct you to the Litmus application. From there, provide the admin credentials to sign into Litmus. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Litmus manually, in a different web browser window, sign in to your Litmus company site as an administrator.

-1. To automate the configuration within LogMeIn, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up LogMeIn** will direct you to the LogMeIn application. From there, provide the admin credentials to sign into LogMeIn. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to setup LogMeIn manually, in a different web browser window, sign in to your LogMeIn company site as an administrator.

-1. To automate the configuration within Marketo, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Marketo** will direct you to the Marketo application. From there, provide the admin credentials to sign into Marketo. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Marketo manually, in a different web browser window, sign in to your Marketo company site as an administrator.

-1. To automate the configuration within Meraki Dashboard, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Meraki Dashboard** will direct you to the Meraki Dashboard application. From there, provide the admin credentials to sign into Meraki Dashboard. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Meraki Dashboard manually, in a different web browser window, sign in to your Meraki Dashboard company site as an administrator.

-1. To automate the configuration within monday.com, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Setup monday.com** which will direct you to the monday.com application. From there, provide the admin credentials to sign into monday.com. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to set up monday.com manually, open a new web browser window and sign in to monday.com as an administrator and perform the following steps:

-1. To automate the configuration within MyWorkDrive, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Setup MyWorkDrive** will direct you to the MyWorkDrive application. From there, provide the admin credentials to sign into MyWorkDrive. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-1. If you want to setup MyWorkDrive manually, In a different web browser window, sign in to MyWorkDrive as a Security Administrator.

-1. To automate the configuration within Nuclino, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Nuclino** will direct you to the Nuclino application. From there, provide the admin credentials to sign into Nuclino. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Nuclino manually, open a new web browser window and sign into your Nuclino company site as an administrator and perform the following steps:

-1. To automate the configuration within OneDesk, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up OneDesk** will direct you to the OneDesk application. From there, provide the admin credentials to sign into OneDesk. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to setup OneDesk manually, open a new web browser window and sign into your OneDesk company site as an administrator and perform the following steps:

-1. To automate the configuration within OpsGenie, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up OpsGenie** will direct you to the OpsGenie application. From there, provide the admin credentials to sign into OpsGenie. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup OpsGenie manually, in a different web browser window, sign in to your OpsGenie company site as an administrator.

-1. To automate the configuration within People, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup People** will direct you to the People application. From there, provide the admin credentials to sign into People. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup People manually, open a new web browser window and sign into your People company site as an administrator and perform the following steps:

-1. To automate the configuration within Perimeter 81, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Perimeter 81** will direct you to the Perimeter 81 application. From there, provide the admin credentials to sign into Perimeter 81. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Perimeter 81 manually, in a different web browser window, sign in to your Perimeter 81 company site as an administrator.

-1. To automate the configuration within productboard, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding the extension to the browser, click **Set up productboard**, which directs you to the productboard application. From there, provide the admin credentials to sign in to productboard. The browser extension will automatically configure the application for you.

- 

-1. If you want to set up single sign-on on **productboard** manually, you need to send the **App Federation Metadata Url** to [productboard support team](mailto:support@productboard.com). They set this setting to have the SAML SSO connection set properly on both sides.

-1. To automate the configuration within PurelyHR, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up PurelyHR** will direct you to the PurelyHR application. From there, provide the admin credentials to sign into PurelyHR. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to set up PurelyHR manually, open a new web browser window and sign in to your PurelyHR company site as an administrator and perform the following steps:

-1. To automate the configuration within RingCentral, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up RingCentral** will direct you to the RingCentral application. From there, provide the admin credentials to sign into RingCentral. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-1. If you want to setup RingCentral manually, open a new web browser window and sign into your RingCentral company site as an administrator and perform the following steps:

-1. To automate the configuration within Saba Cloud, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Saba Cloud** will direct you to the Saba Cloud application. From there, provide the admin credentials to sign into Saba Cloud. The browser extension will automatically configure the application for you and automate steps 3-9.

- 

-1. If you want to setup Saba Cloud manually, in a different web browser window, sign in to your Saba Cloud company site as an administrator.

-1. To automate the configuration within Salesforce, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Salesforce** will direct you to the Salesforce Single Sign-On application. From there, provide the admin credentials to sign in to Salesforce Single Sign-On. The browser extension will automatically configure the application for you and automate steps 3-13.

- 

-1. If you want to set up Salesforce manually, open a new web browser window and sign in to your Salesforce company site as an administrator and perform the following steps:

-1. To automate the configuration within SAP Cloud Identity Services, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up SAP Cloud Identity Services** will direct you to the SAP Cloud Identity Services application. From there, provide the admin credentials to sign into SAP Cloud Identity Services. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to set up SAP Cloud Identity Services manually, in a different web browser window, go to the SAP Cloud Identity Services administration console. The URL has the following pattern: `https://<tenant-id>.accounts.ondemand.com/admin`. Then read the documentation about SAP Cloud Identity Services at [Integration with Microsoft Azure AD](https://developers.sap.com/tutorials/cp-ias-azure-ad.html).

-1. To automate the configuration within ScaleX Enterprise, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up ScaleX Enterprise** will direct you to the ScaleX Enterprise application. From there, provide the admin credentials to sign into ScaleX Enterprise. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup ScaleX Enterprise manually, open a new web browser window and sign into your ScaleX Enterprise company site as an administrator and perform the following steps:

-1. To automate the configuration within Screencast-O-Matic, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Screencast-O-Matic** will direct you to the Screencast-O-Matic application. From there, provide the admin credentials to sign into Screencast-O-Matic. The browser extension will automatically configure the application for you and automate steps 3-10.

- 

-1. If you want to setup Screencast-O-Matic manually, open a new web browser window and sign into your Screencast-O-Matic company site as an administrator and perform the following steps:

-1. To automate the configuration within **Citrix ShareFile**, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Citrix ShareFile** will direct you to the Citrix ShareFile application. From there, provide the admin credentials to sign into Citrix ShareFile. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup Citrix ShareFile manually, in a different web browser window, sign in to your Citrix ShareFile company site as an administrator.

-1. To automate the configuration within Slack, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Slack** will direct you to the Slack application. From there, provide the admin credentials to sign into Slack. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to set up Slack manually, in a different web browser window, sign in to your Slack company site as an administrator.

-1. To automate the configuration within SmartDraw, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up SmartDraw** will direct you to the SmartDraw application. From there, provide the admin credentials to sign into SmartDraw. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to setup SmartDraw manually, open a new web browser window and sign into your SmartDraw company site as an administrator and perform the following steps:

-1. To automate the configuration within Soloinsight-CloudGate SSO, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Soloinsight-CloudGate SSO** will direct you to the Soloinsight-CloudGate SSO application. From there, provide the admin credentials to sign into Soloinsight-CloudGate SSO. The browser extension will automatically configure the application for you and automate steps 3-8.

- 

-3. If you want to setup Soloinsight-CloudGate SSO manually, open a new web browser window and sign into your Soloinsight-CloudGate SSO company site as an administrator and perform the following steps:

-1. To automate the configuration within StatusPage, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up StatusPage** will direct you to the StatusPage application. From there, provide the admin credentials to sign into StatusPage. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup StatusPage manually, in a different web browser window, sign in to your StatusPage company site as an administrator.

-1. To automate the configuration within Tableau Cloud, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Tableau Cloud** will direct you to the Tableau Cloud application. From there, provide the admin credentials to sign into Tableau Cloud. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to set up Tableau Cloud manually, in a different web browser window, sign in to your Tableau Cloud company site as an administrator.

-1. To automate the configuration within **TargetProcess**, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **setup TargetProcess** will direct you to the TargetProcess application. From there, provide the admin credentials to sign into TargetProcess. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

- **If you want to configure the application manually perform the following steps:**

-1. To automate the configuration within Teamphoria, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Teamphoria** will direct you to the Teamphoria application. From there, provide the admin credentials to sign into Teamphoria. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Teamphoria manually, open a new web browser window and sign into your Teamphoria company site as an administrator and perform the following steps:

-1. To automate the configuration within Terraform Cloud, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Terraform Cloud** will direct you to the Terraform Cloud application. From there, provide the admin credentials to sign into Terraform Cloud. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup Terraform Cloud manually, in a different web browser window, sign in to your Terraform Cloud company site as an administrator.

-1. To automate the configuration within TextMagic, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup TextMagic** will direct you to the TextMagic application. From there, provide the admin credentials to sign into TextMagic. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup TextMagic manually, open a new web browser window and sign into your TextMagic company site as an administrator and perform the following steps:

-1. To automate the configuration within Timeclock 365 SAML, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Timeclock 365 SAML** will direct you to the Timeclock 365 SAML application. From there, provide the admin credentials to sign into Timeclock 365 SAML. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-3. If you want to set up Timeclock 365 SAML manually, in a different web browser window, sign in to your Timeclock 365 SAML company site as an administrator.

-| | |

-## OneClick SSO

-| Logo | Application tutorial for single sign-on |

-| : | : |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-| |

-1. To automate the configuration within Upshotly, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Upshotly** will direct you to the Upshotly application. From there, provide the admin credentials to sign into Upshotly. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-3. If you want to setup Upshotly manually, in a different web browser window, sign in to your Upshotly company site as an administrator.

-1. To automate the configuration within Velpic SAML, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Velpic SAML** will direct you to the Velpic SAML application. From there, provide the admin credentials to sign into Velpic SAML. The browser extension will automatically configure the application for you and automate steps 3-8.

- 

-3. If you want to setup Velpic SAML manually, open a new web browser window and sign into your Velpic SAML company site as an administrator and perform the following steps:

-1. To automate the configuration within Wandera RADAR Admin, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Wandera RADAR Admin** will direct you to the Wandera RADAR Admin application. From there, provide the admin credentials to sign into Wandera RADAR Admin. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-3. If you want to setup Wandera RADAR Admin manually, open a new web browser window and sign into your Wandera RADAR Admin company site as an administrator and perform the following steps:

-1. To automate the configuration within Watch by Colors, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **setup Watch by Colors** will direct you to the Watch by Colors application. From there, provide the admin credentials to sign into Watch by Colors. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-3. If you want to setup Watch by Colors manually, open a new web browser window and sign into your Watch by Colors company site as an administrator and perform the following steps:

-1. To automate the configuration within Way We Do, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Setup Way We Do** will direct you to the Way We Do application. From there, provide the admin credentials to sign into Way We Do. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup Way We Do manually, open a new web browser window and sign into your Way We Do company site as an administrator and perform the following steps:

-1. To automate the configuration within Webcargo, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Webcargo** will direct you to the Webcargo Single Sign-On application. From there, provide the admin credentials to sign in to Webcargo Single Sign-On. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to set up Webcargo manually, open a new web browser window and sign in to your Webcargo company site as an administrator and perform the following steps:

-1. To automate the configuration within Whimsical, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Whimsical** will direct you to the Whimsical application. From there, provide the admin credentials to sign into Whimsical. The browser extension will automatically configure the application for you and automate steps 3-4.

- 

-3. If you want to setup Whimsical manually, in a different web browser window, sign in to your Whimsical company site as an administrator.

-1. To automate the configuration within WhosOffice, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up WhosOffice** will direct you to the WhosOffice application. From there, provide the admin credentials to sign into WhosOffice. The browser extension will automatically configure the application for you and automate steps 3-7.

- 

-3. If you want to setup WhosOffice manually, in a different web browser window, sign in to your WhosOffice company site as an administrator.

-1. To automate the configuration within Wootric, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Wootric** will direct you to the Wootric application. From there, provide the admin credentials to sign into Wootric. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Wootric manually, in a different web browser window, sign in to your Wootric company site as an administrator.

-1. To automate the configuration within Workplace by Meta, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Set up Workplace by Meta** will direct you to the Workplace by Meta application. From there, provide the admin credentials to sign into Workplace by Meta. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

-1. If you want to setup Workplace by Meta manually, open a new web browser window and sign into your Workplace by Meta company site as an administrator and perform the following steps:

-1. To automate the configuration within Workteam, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Workteam** will direct you to the Workteam application. From there, provide the admin credentials to sign into Workteam. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Workteam manually, open a new web browser window and sign into your Workteam company site as an administrator and perform the following steps:

-1. To automate the configuration within XaitPorter, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup XaitPorter** will direct you to the XaitPorter application. From there, provide the admin credentials to sign into XaitPorter. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup XaitPorter manually, open a new web browser window and sign into your XaitPorter company site as an administrator and perform the following steps:

-1. To automate the configuration within **Yodeck**, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **setup Yodeck** will direct you to the Yodeck application. From there, provide the admin credentials to sign into Yodeck. The browser extension will automatically configure the application for you and automate steps 3-5.

- 

- **If you want to configure the application manually perform the following steps:**

-1. To automate the configuration within **Zendesk**, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **setup Zendesk** will direct you to the Zendesk application. From there, provide the admin credentials to sign into Zendesk. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to set up Zendesk manually, open a new web browser window and sign into your Zendesk company site as an administrator and perform the following steps:

-1. To automate the configuration within Zoom, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Set up Zoom** will direct you to the Zoom application. From there, provide the admin credentials to sign into Zoom. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Zoom manually, in a different web browser window, sign in to your Zoom company site as an administrator.

-1. To automate the configuration within Zscaler One, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Zscaler One** will direct you to the Zscaler One application. From there, provide the admin credentials to sign into Zscaler One. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Zscaler One manually, open a new web browser window and sign into your Zscaler One company site as an administrator and perform the following steps:

-1. To automate the configuration within Zscaler Three, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Zscaler Three** will direct you to the Zscaler Three application. From there, provide the admin credentials to sign into Zscaler Three. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Zscaler Three manually, open a new web browser window and sign into your Zscaler Three company site as an administrator and perform the following steps:

-1. To automate the configuration within Zscaler, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-1. After adding extension to the browser, click on **Setup Zscaler** will direct you to the Zscaler application. From there, provide the admin credentials to sign into Zscaler. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-1. If you want to setup Zscaler manually, open a new web browser window and sign into your Zscaler company site as an administrator and perform the following steps:

-1. To automate the configuration within Zscaler Two, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Zscaler Two** will direct you to the Zscaler Two application. From there, provide the admin credentials to sign into Zscaler Two. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Zscaler Two manually, open a new web browser window and sign into your Zscaler Two company site as an administrator and perform the following steps:

-1. To automate the configuration within Zscaler ZSCloud, you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Zscaler ZSCloud** will direct you to the Zscaler ZSCloud application. From there, provide the admin credentials to sign into Zscaler ZSCloud. The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Zscaler ZSCloud manually, open a new web browser window and sign into your Zscaler ZSCloud company site as an administrator and perform the following steps:

-1. To automate the configuration within Zscaler Private Access (ZPA), you need to install **My Apps Secure Sign-in browser extension** by clicking **Install the extension**.

- 

-2. After adding extension to the browser, click on **Setup Zscaler Private Access (ZPA)** will direct you to the Zscaler Private Access (ZPA) application. From there, provide the admin credentials to sign into Zscaler Private Access (ZPA). The browser extension will automatically configure the application for you and automate steps 3-6.

- 

-3. If you want to setup Zscaler Private Access (ZPA) manually, open a new web browser window and sign into your Zscaler Private Access (ZPA) company site as an administrator and perform the following steps:

-| AC.L1-3.1.2<br><br>**Practice statement:** Limit information system access to the types of transactions and functions that authorized users are permitted to execute.<br><br>**Objectives:**<br>Determine if:<br>[a.] the types of transactions and functions that authorized users are permitted to execute are defined; and<br>[b.] system access is limited to the defined types of transactions and functions for authorized users. | You're responsible for configuring access controls such as Role Based Access Controls (RBAC) with built-in or custom roles. Use role assignable groups to manage role assignments for multiple users requiring same access. Configure Attribute Based Access Controls (ABAC) with default or custom security attributes. The objective is to granularly control access to resources protected with Azure AD.<br><br>Set up RBAC<li>[Overview of role-based access control in Active Directory ](../roles/custom-overview.md)[Azure AD built-in roles](../roles/permissions-reference.md)<li>[Create and assign a custom role in Azure Active Directory](../roles/custom-create.md)<br><br>Set up ABAC<li>[What is Azure attribute-based access control (Azure ABAC)](../../role-based-access-control/conditions-overview.md)<li>[What are custom security attributes in Azure AD?](../fundamentals/custom-security-attributes-overview.md)<br><br>Configure groups for role assignment<li>[Use Azure AD groups to manage role assignments](../roles/groups-concept.md) |

-| AC.L1-3.1.20<br><br>**Practice statement:** Verify and control/limit connections to and use of external information systems.<br><br>**Objectives:**<br>Determine if:<br>[a.] connections to external systems are identified;<br>[b.] the use of external systems is identified;<br>[c.] connections to external systems are verified;<br>[d.] the use of external systems is verified;<br>[e.] connections to external systems are controlled and or limited; and<br>[f.] the use of external systems is controlled and or limited. | You're responsible for configuring conditional access policies using device controls and or network locations to control and or limit connections and use of external systems. Configure Terms of Use (TOU) for recorded user acknowledgment of terms and conditions for use of external systems for access.<br><br>Set up Conditional Access as required<li>[What is Conditional Access?](../conditional-access/overview.md)<li>[Require managed devices for cloud app access with Conditional Access](../conditional-access/require-managed-devices.md)<li>[Require device to be marked as compliant](../conditional-access/require-managed-devices.md)<li>[Conditional Access: Filter for devices](../conditional-access/concept-condition-filters-for-devices.md)<br><br>Use Conditional Access to block access<li>[Conditional Access - Block access by location](../conditional-access/howto-conditional-access-policy-location.md)<br><br>Configure terms of use<li>[Terms of use](../conditional-access/terms-of-use.md)<li>[Conditional Access require terms of use ](../conditional-access/require-tou.md) |

-| AC.L1-3.1.22<br><br>**Practice statement:** Control information posted or processed on publicly accessible information systems.<br><br>**Objectives:**<br>Determine if:<br>[a.] individuals authorized to post or process information on publicly accessible systems are identified;<br>[b.] procedures to ensure FCI isn't posted or processed on publicly accessible systems are identified;<br>[c.] a review process is in place prior to posting of any content to publicly accessible systems; and<br>[d.] content on publicly accessible systems is reviewed to ensure that it doesn't include federal contract information (FCI). | You're responsible for configuring Privileged Identity Management (PIM) to manage access to systems where posted information is publicly accessible. Require approvals with justification prior to role assignment in PIM. Configure Terms of Use (TOU) for systems where posted information is publicly accessible for recorded acknowledgment of terms and conditions for posting of publicly accessible information.<br><br>Plan PIM deployment<li>[What is Privileged Identity Management?](../privileged-identity-management/pim-configure.md)<li>[Plan a Privileged Identity Management deployment](../privileged-identity-management/pim-deployment-plan.md)<br><br>Configure terms of use<li>[Terms of use](../conditional-access/terms-of-use.md)<li>[Conditional Access require terms of use ](../conditional-access/require-tou.md)<li>[Configure Azure AD role settings in PIM - Require Justification](../privileged-identity-management/pim-how-to-change-default-settings.md) |

-* [Configure Azure Active Directory for CMMC compliance](configure-azure-active-directory-for-cmmc-compliance.md)

-| AC.L2-3.1.3<br><br>**Practice statement:** Control the flow of CUI in accordance with approved authorizations.<br><br>**Objectives:**<br>Determine if:<br>[a.] information flow control policies are defined;<br>[b.] methods and enforcement mechanisms for controlling the flow of CUI are defined;<br>[c.] designated sources and destinations (for example, networks, individuals, and devices) for CUI within the system and between intercfeetonnected systems are identified;<br>[d.] authorizations for controlling the flow of CUI are defined; and<br>[e.] approved authorizations for controlling the flow of CUI are enforced. | Configure Conditional Access policies to control the flow of CUI from trusted locations, trusted devices, approved applications and require app protection policy. For finer grained authorization to CUI, configure app-enforced restrictions(Exchange/SharePoint Online), App Control (with Microsoft Defender for Cloud Apps), Authentication Context. Deploy Azure AD Application Proxy to secure access to on-premises applications.<br>[Location condition in Azure Active Directory Conditional Access ](../conditional-access/location-condition.md)<br>[Grant controls in Conditional Access policy - Require device to be marked as compliant](../conditional-access/concept-conditional-access-grant.md)<br>[Grant controls in Conditional Access policy - Require hybrid Azure AD joined device](../conditional-access/concept-conditional-access-grant.md)<br>[Grant controls in Conditional Access policy - Require approved client app](../conditional-access/concept-conditional-access-grant.md)<br>[Grant controls in Conditional Access policy - Require app protection policy](../conditional-access/concept-conditional-access-grant.md)<br>[Session controls in Conditional Access policy - Application enforced restrictions](../conditional-access/concept-conditional-access-session.md)<br>[Protect with Microsoft Defender for Cloud Apps Conditional Access App Control](/defender-cloud-apps/proxy-intro-aad)<br>[Cloud apps, actions, and authentication context in Conditional Access policy ](../conditional-access/concept-conditional-access-cloud-apps.md)<br>[Remote access to on-premises apps using Azure AD Application Proxy](../app-proxy/application-proxy.md)<br><br>**Authentication Context**<br>[Configuring Authentication context & Assign to Conditional Access Policy](../conditional-access/concept-conditional-access-cloud-apps.md)<br><br>**Information Protection**<br>Know and protect your data; help prevent data loss.<br>[Protect your sensitive data with Microsoft Purview](/microsoft-365/compliance/information-protection?view=o365-worldwide&preserve-view=true)<br><br>**Conditional Access**<br>[Conditional Access for Azure information protection (AIP)](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/conditional-access-policies-for-azure-information-protection/ba-p/250357) <br><br>**Application Proxy**<br>[Remote access to on-premises apps using Azure AD Application Proxy](../app-proxy/application-proxy.md) |

-* [Configure Azure Active Directory for CMMC compliance](configure-azure-active-directory-for-cmmc-compliance.md)

-* [Configure Azure Active Directory for CMMC compliance](configure-azure-active-directory-for-cmmc-compliance.md)

-|**1.2.1** Configuration standards for NSC rulesets are: </br> Defined </br> Implemented </br> Maintained|Integrate access technologies such as VPN, remote desktop, and network access points with Azure AD for authentication and authorization, if the access technologies support modern authentication. Ensure NSC standards, which pertain to identity-related controls, include definition of Conditional Access policies, application assignment, access reviews, group management, credential policies, etc. [Azure AD operations reference guide](../fundamentals/active-directory-ops-guide-intro.md)|

-* [Configure Azure Active directory to meet FedRAMP High Impact level](configure-azure-active-directory-for-fedramp-high-impact.md)

-MYACR=myContainerRegistry

-$MYACR = 'myContainerRegistry'

-MYACR=myContainerRegistry

-$MYACR = 'myContainerRegistry'

-| Endpoints for [Azure Application Insights integration](api-management-howto-app-insights.md) | Optional³ | Optional³ | Minimal required endpoints are:<ul><li>`rt.services.visualstudio.com:443`</li><li>`dc.services.visualstudio.com:443`</li><li>`{region}.livediagnostics.monitor.azure.com:443`</li></ul>Learn more in [Azure Monitor docs](../azure-monitor/app/ip-addresses.md#outgoing-ports) |

-| Endpoints for [Event Hubs integration](api-management-howto-log-event-hubs.md) | Optional³ | Optional³ | Learn more in [Azure Event Hubs docs](../event-hubs/network-security.md) |

-| Endpoints for [external cache integration](api-management-howto-cache-external.md) | Optional³ | Optional³ | This requirement depends on the external cache that is being used |

-³ Only required when feature is used and requires public IP address, port, and hostname information.<br/>

- To enable TLS/SSL certificate chain building and validation, the API Management service needs outbound network connectivity to `ocsp.msocsp.com`, `mscrl.microsoft.com`, and `crl.microsoft.com`. This dependency is not required if any certificate you upload to API Management contains the full chain to the CA root.

- Outbound access on port `53` is required for communication with DNS servers. If a custom DNS server exists on the other end of a VPN gateway, the DNS server must be reachable from the subnet hosting API Management.

-## Developer portal CAPTCHA

- <version>4.7.0</version>

- <version>4.7.0</version>

- - Removed Hyperscale/Citus scale-out capabilities. Focus will be on providing a single node Postgres server service. All user experiences have had terms and concepts like `Hyperscale`, `server groups`, `worker nodes`, `coordinator nodes`, and so forth. removed. **BREAKING CHANGE**

- - The postgresql container image is based on [CBL-Mariner](https://github.com/microsoft/CBL-Mariner) base OS image.

-1. In the "Kubernetes" category, choose the **Configure Kubernetes clusters with Flux v2 configuration using public Git repository** built-in policy definition.

-1. Give the policy assignment an easily identifiable **Name** and **Description**.

-1. Select **Next**.

-1. Select **Next**.

-1. Verify **Create a managed identity** is checked, and that the identity will have **Contributor** permissions.

-1. Select **Review + create**.

-After creating the policy assignment, the configuration is applied to new Azure Arc-enabled Kubernetes or AKS clusters created within the scope of policy assignment.

-* CBL-Mariner 1.0, 2.0

- > The Virtual Machine Administrator Login and Virtual Machine User Login roles use `dataActions` and can be assigned at the management group, subscription, resource group, or resource scope. We recommend that you assign the roles at the management group, subscription, or resource level and not at the individual VM level. This practice avoids the risk of reaching the [Azure role assignments limit](../../role-based-access-control/troubleshooting.md#limits) per subscription.

-> At this time, Redis 6 does not support Access Control Lists (ACL) or geo-replication between a Redis 4 cache and Redis 6 cache.

-|Canada Central| 100 | 20 |

-## Limitations

-The Azure Linux Container Host has the following limitation:

-If there are areas you would like to have priority, please file an issue in the [AKS GitHub repository](https://github.com/Azure/AKS/issues).

- * **Pricing Tier**: select the appropriate pricing tier, the default value for the template is S0.

-|OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE | Specify the cloud environment where the workspace is located. <br> 0 = Azure commercial cloud (default). <br> 1 = Azure Government. |

-1. (Optional) In the **Custom properties** section, if you've configured action groups for this alert rule, you can add custom properties in key:value pairs to the alert notification payload to add more information to it. Add the property **Name** and **Value** for the custom property you want included in the payload.

- The format for extracting values from the common schema, use a "$", and then the path of the [common schema](https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-common-schema) field inside curly brackets. For example: `${data.essentials.monitorCondition}`.

- "inheritedAttributes": [

- {

- "key": "mycustomer",

- "type": "string"

- }

- ]

-Date list was last updated: 06/01/2023.

-## Microsoft.SecurityDetonation/SecurityDetonationChambers

-<!-- Data source : arm-->

-|Metric|Exportable via Diagnostic Settings?|Metric Display Name|Unit|Aggregation Type|Description|Dimensions|

-||||||||

-|% Processor Time |Yes |% CPU |Percent |Average |Percent CPU utilization |No Dimensions |

-<!--Gen Date: Thu Jun 01 2023 09:57:38 GMT+0300 (Israel Daylight Time)-->

-<!--Gen Date: Thu Jun 01 2023 09:57:38 GMT+0300 (Israel Daylight Time)-->

- | Brazil South | France Central | UAE North | South Africa North | Australia East |

- | Canada Central | Germany West Central | | | Central India |

- | US Gov Virginia | Sweden Central | | | China North 3 |

- | West US 2 | Switzerland North | | | |

- | West US 3 | | | | |

- | Health Data | [AHDSMedTechDiagnosticLogs](/azure/azure-monitor/reference/tables/AHDSMedTechDiagnosticLogs) |

-When a Log Analytics workspace is linked to a dedicated cluster, the workspace billing plan in workspace is changed per cluster plan, new data ingested to the workspace is routed to the cluster, and existing data remains in Log Analytics cluster. Linking a workspace has no affect on data ingestion and query experiences.

-Queries and experiences aren't affected by the

-If the dedicated cluster is configured with customer-managed keys (CMK), new ingested data is encrypted with your key. The system abstracts the data location, you can query data as usual while the system performs cross-cluster queries in the background.

-# workspace() expression in Azure Monitor log query

-The `workspace` expression is used in an Azure Monitor query to retrieve data from a specific workspace in the same resource group, another resource group, or another subscription. This is useful to include log data in an Application Insights query and to query data across multiple workspaces in a log query.

-## Arguments

-## Notes

-* You must have read access to the workspace.

-* Identifying a workspace by its ID or Azure Resource ID is strongly recommended since unique, removes ambiguity, and more performant.

-* A related expression is `app` that allows you to query across Application Insights applications.

-[Bicep version 1.2 or newer](./install.md) is required to use this feature.

-<a name="ultra-disk-backup">Ultra SSD disks</a> | Supported with [Enhanced policy](backup-azure-vms-enhanced-policy.md). The support is currently in preview. <br><br> Supported region(s) - Sweden Central, South Central US and East US <br><br> To enroll your subscription for this feature, [fill this form](https://forms.office.com/r/1GLRnNCntU). <br><br> - Configuration of Ultra disk protection is supported via Recovery Services vault only. This configuration is currently not supported via virtual machine blade. <br><br> - Cross-region restore is currently not supported for machines using Ultra disks.

-<a name="premium-ssd-v2-backup">Premium SSD v2 disks</a> | Supported with [Enhanced policy](backup-azure-vms-enhanced-policy.md). The support is currently in preview. <br><br> Supported region(s) - East US, West Europe and South Central US. <br><br> To enroll your subscription for this feature, [fill this form](https://forms.office.com/r/h56TpTc773). <br><br> - Configuration of Premium v2 disk protection is supported via Recovery Services vault only. This configuration is currently not supported via virtual machine blade. <br><br> - Cross-region restore is currently not supported for machines using Premium v2 disks.

-Currently, you must use the Azure portal if you want to specify the Standard SKU. If you use the Azure CLI or Azure PowerShell to configure Bastion, the SKU can't be specified and defaults to the Basic SKU.

-| Azure PowerShell | Basic |[How-to](bastion-create-host-powershell.md) |

-| Azure CLI | Basic| [How-to](create-host-cli.md) |

-> [!NOTE]

-> As shown in the examples, use the `--location` parameter with `--resource-group` for every command to ensure that the resources are deployed together.

-1. Create a public IP address for Azure Bastion. The public IP is the public IP address the Bastion resource on which RDP/SSH will be accessed (over port 443). The public IP address must be in the same region as the Bastion resource you're creating.

- Hourly pricing starts from the moment Bastion is deployed, regardless of outbound data usage. Bastion pricing is a combination of hourly pricing based on SKU and instances (scale units), plus data transfer rates. For more information, see [Pricing](https://azure.microsoft.com/pricing/details/azure-bastion/).

-Use the [Connection steps](#steps) in the following section to connect to your VM. You can also use any of the following articles to connect to a VM. Some connection types require the Bastion [Standard SKU](configuration-settings.md#skus).

-### <a name="steps"></a>Connection steps

-> Azure CDN from Akamai is scheduled to be retired on October 31, 2023. For more information, see [**Migrate CDN provider**](cdn-change-provider.md) for guidance on migrating to another Azure CDN provider.

-description: Understand how Azure Chaos Studio makes chaos experiments and chaos targets available in Azure regions.

-# Regional availability of Azure Chaos Studio

-This article describes the regional availability model for Azure Chaos Studio, specifically the difference between a region where experiments can be deployed and one where resources can be targeted. It also provides an overview of Chaos Studio's high availability model.

-Chaos Studio is a regional Azure service, which means that the service is deployed and run within an Azure region. However, Chaos Studio has two regional components - the region where an experiment is deployed and the region where a resource is targeted. A chaos experiment can target a resource in a different region than the experiment (cross-region targeting), but in order to enable chaos experimentation on targets in more regions, Chaos Studio's set of regions in which you can do **resource targeting** is a superset of the regions in which you can create and manage **experiments**. You can [view the list of regions where Chaos Studio and resource targeting are available here](https://azure.microsoft.com/global-infrastructure/services/?products=chaos-studio).

-A [chaos experiment](chaos-studio-chaos-experiments.md) is an Azure resource that describes the faults that should be run and the resources those faults should be run against. An experiment is deployed to a single region and the following information and operations stay within that region:

-* The experiment definition, which includes the hierarchy of steps, branches, and actions, the faults and parameters defined, and the resource IDs of target resources. Open-ended properties in the experiment resource JSON including the step name, branch name, and any fault parameters are stored in region and treated as system metadata.

-* The experiment execution each time an experiment is run, or the activity that orchestrates the execution of steps, branches, and actions.

-* The experiment history, which includes details such as the step, branch, and action timestamps, status, IDs, and any error messages for each historical experiment run. This data is treated as system metadata.

-A [chaos target](chaos-studio-targets-capabilities.md) enables Chaos Studio to interact with an Azure resource. Faults in a chaos experiment run against a chaos target, but the target resource can be in a different region than the experiment. A resource can only be onboarded as a chaos target if Chaos Studio resource targeting is available in that region. The list of regions where resource targeting is available is a superset of the regions where experiments can be created. A chaos target is deployed to the same region as the target resource and the following information and operations stay in that region:

-* The target definition, which includes basic metadata about the target. Agent-based targets have one user-configurable property: the [identity that will be used to connect the agent to the chaos agent service](chaos-studio-permissions-security.md#agent-authentication).

-* The capability definitions, which include basic metadata about the capabilities enabled on a target.

-* The action execution. When an experiment runs a fault, the fault itself (for example, shutting down a VM) happens within the target region.

-Chaos Studio is a regional, zone-redundant service (in regions that support availability zones). In the case of an availability zone outage, any chaos operation may fail, but experiment metadata, history, and details should remain available and the service should not see a full outage.

-Now that you understand the region availability model for Chaos Studio, you are ready to:

-description: Learn how to start, stop, view details, and view history for a chaos experiment in Azure Chaos Studio

-# Run and manage an experiment in Azure Chaos Studio

-You can use a chaos experiment to verify that your application is resilient to failures by causing those failures in a controlled environment. This article provides an overview of how to use a chaos experiment that you have previously created.

-2. Search for **Chaos Studio (preview)** in the search bar.

-3. Click on **Experiments**. This is the experiment list view you can start, stop, or delete experiments in bulk or create a new experiment.

- 

-4. Click on your experiment. The experiment overview page allows you to start, stop, and edit your experiment, view essential details about the resource, and view history. Click the **Start** button then click **OK** to start your experiment.

- 

-5. The experiment status shows *PreProcessingQueued*, then *WaitingToStart*, and finally *Running*.

-1. Once the experiment is running, click **Details** on the current run under **History** to see detailed status and errors.

- 

-2. The experiment details view shows the execution status of each step, branch, and fault. Click on a fault.

- 

-3. Fault details shows additional information about the fault execution including which targets have failed or succeeded and why. If there is an error running your experiment, debugging information appears here.

- 

-## Edit experiment

-1. Return to the Experiment Overview and click the **Edit** button.

- 

-2. This is the same experiment designer as was used to create the experiment. You can add or remove steps, branches, and faults, and edit fault parameters and targets. To edit a fault, click on the **...** beside the fault.

- 

-3. When you are finished editing, click **Save**. If you want to discard your changes without saving, click the **Close (X)** button in the top right.

- 

-## Delete experiment

-1. Return to the experiment list and check the experiment(s) you want to delete. Click **Delete** in the toolbar above the experiment list. You may need to click the ellipsis (...) to see the delete option depending on screen resolution.

- 

-2. Click **Yes** to confirm you want to delete the resource.

-3. Alternatively, you can open an experiment and click the **Delete** button in the toolbar.

-description: Run and manage a chaos experiment with Azure Chaos Studio using REST APIs.

-> Injecting faults can impact your application or service. Be careful not to disrupt customers.

-The Chaos Studio API provides support for starting experiments programmatically. You can also use the ARM client and the Azure CLI to execute these commands from the console. These examples are for the Azure CLI.

-The Chaos Studio REST APIs can be used to:

-* Start, stop, and manage experiments

-* View and manage targets

-* Query experiment status

-* Query and delete subscription configurations

-The `AZ CLI` utility can be used to perform these actions from the command line.

-> To get more verbose output with the AZ CLI, append `--verbose` to the end of each command. This will return more metadata when commands execute, including `x-ms-correlation-request-id` which aids in debugging.

-### Chaos Provider Commands

-#### List details about the `Microsoft.Chaos` Resource Provider

-#### List all the operations of the Chaos Studio Resource Provider

-### Chaos Target and Agent Commands

-#### List all the Targets or Agents under a subscription

-### Chaos Experiment Commands

-#### List all experiments in a resource group

-#### Get status of an experiment

-## Parameter Definitions

-| Parameter Name | Definition | Lookup |

-| {apiVersion} | Version of the API to be used when executing the command provided | Can be found in the [API documentation](/rest/api/chaosstudio/) |

-| {experimentId} | Azure Resource ID for the experiment | Can be found in the [Chaos Studio Experiment Page](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.chaos%2Fchaosexperiments) |

-| {chaosProviderType} | Type or Name of Chaos Studio Provider | Available providers can be found in the [List of current Provider Config Types](chaos-studio-fault-providers.md) |

-| {experimentName.json} | JSON containing the configuration of the chaos experiment | Generated by the user |

-| {subscriptionId} | Subscription ID where the target resource is located | Can be found in the [Subscriptions Page](https://portal.azure.com/#blade/Microsoft_Azure_Billing/SubscriptionsBlade) |

-| {resourceGroupName} | Name of the resource group where the target resource is located | Can be fond in the [Resource Groups Page](https://portal.azure.com/#blade/HubsExtension/BrowseResourceGroups) |

-| {executionDetailsId} | Execution ID of an experiment execution | Can be found in the [Chaos Studio Experiment Page](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.chaos%2Fchaosexperiments) |

-description: Understand the throttling and usage limits for Azure Chaos Studio

-# Azure Chaos Studio service limits

-This article provides service limits for Azure Chaos Studio.

-| -- | -- |

-Chaos Studio applies limits to all ARM operations. Requests made over the limit are throttled. All request limits are applied for a five-minute interval unless otherwise specified.

-| -- | -- |

-| Microsoft.Chaos/targets/capabilities/read | 1800 |

-description: Understand how to control resource onboarding in Azure Chaos Studio by using targets and capabilities.

-# Targets and capabilities in Azure Chaos Studio

-Before you can inject a fault against an Azure resource, the resource must first have corresponding targets and capabilities enabled. Targets and capabilities control which resources are enabled for fault injection and which faults can run against those resources. Using targets and capabilities [along with other security measures](chaos-studio-permissions-security.md) you can avoid accidental or malicious fault injection with Chaos Studio. For example, with targets and capabilities you can allow the CPU pressure fault to run against your production virtual machines while preventing the kill process fault from running against them.

-A chaos **target** enables Chaos Studio to interact with a resource for a particular target type. A **target type** represents the method of injecting faults against a resource. Resource types that only support service-direct faults have one target type, for example the `Microsoft-CosmosDB` type for Azure Cosmos DB. Resource types that support service-direct and agent-based faults have two target types: one for the service-direct faults (for example, `Microsoft-VirtualMachine`), and one for the agent-based faults (always `Microsoft-Agent`).

-A target is an extension resource created as a child of the resource that is being onboarded to Chaos Studio (for example, a Virtual Machine or Network Security Group). A target defines the target type that is enabled on the resource. For example, if onboarding an Azure Cosmos DB instance with this resource ID:

-The Azure Cosmos DB resource will have a child resource formatted like this:

-A **capability** enables Chaos Studio to run a particular fault against a resource, such a shutting down a virtual machine. Capabilities are unique per target type and represent the fault that they enable, for example, `CPUPressure-1.0`. [Visit the Chaos Studio fault library](chaos-studio-fault-library.md) to understand all available faults and their corresponding capability names and target types.

-A capability is an extension resource created as a child of a target. For example, if enabling the shutdown fault on a Virtual Machine with a service-direct target ID:

-The target resource will have a child resource formatted like this:

-An experiment can only inject faults on onboarded targets with the corresponding capabilities enabled.

-## Listing capability names and parameters

-For reference, a list of capability names, fault URNs, and parameters is available [in our fault library](chaos-studio-fault-library.md), but you can use the HTTP response to creating a capability or do a GET on an existing capability to get this information on demand. For example, doing a GET on a VM shutdown capability:

-Will return the following JSON:

-The `properties.urn` property is used to define the fault you want to run in a chaos experiment. To understand the schema for this fault's parameters, you can GET the schema referenced by `properties.parametersSchema`.

-returns the following JSON:

-Now that you understand what targets and capabilities are, you are ready to:

-sky_object

-dark_light

-object_screen

-object_sculpture

-sky_sun

-people_swimming

-outdoor_pool

-trans_trainstation

-Authentication is done by adding the HTTP request header **Ocp-Apim-Subscription-Key** and setting it to your vision key. The call is made to the URL `https://<endpoint>/computervision/imageanalysis:segment&api-version=2023-02-01-preview`, where `<endpoint>` is your unique computer vision endpoint URL. See [Select a mode ](./background-removal.md#select-a-mode) section for another query string you add to this URL.

- <version>1.28.0</version>

- implementation 'com.microsoft.cognitiveservices.speech:client-sdk-embedded:1.28.0@aar'

- * Document Translation isn't supported in the free tier. Select Standard S1 to try that feature.

-&emsp; 🆕 The ***Model Upgrade Wizard*** feature is added to **Workspace settings** to help guide customers through the V1-model-upgrade-to-new-platform process. For more information, *see* [Custom Translator platform upgrade](platform-upgrade.md).

-&emsp; 🆕 The ***Copy Model*** feature is added to **Model details** to enable the copying of models from one workspace to another. This feature enables model lifecycle management (development → testing → production) and/or scaling. For more information, *see* [Copy a custom model](how-to/copy-model.md).

- &emsp; Published model security is enhanced and restricted access is enabled within **Workspace settings** to allow only linked Translator resources to request translation.

-&emsp; Supported language pairs are listed in the following table. For higher quality, we encourage you to retrain your models accordingly. For more information, *see* [Language support](../language-support.md#custom-translator-language-pairs).

-||

-> [!div class="nextstepaction"]

-> [I ran into an issue with the prerequisites.](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?Pillar=Language&Product=Document-translation&Page=quickstart&Section=Prerequisites)

-> [!div class="nextstepaction"]

-> [I ran into an issue retrieving my key and endpoint.](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?Pillar=Language&Product=Document-translation&Page=quickstart&Section=Retrieve-your-keys-and-endpoint)

-> [!div class="nextstepaction"]

-> [I ran into an issue creating blob storage containers with authentication.](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?Pillar=Language&Product=Document-translation&Page=quickstart&Section=Create-blob-storage-containers)

- $parameters = @{

- -ResourceGroupName "myresourcegroup"

- -Name "myaccount"

- }

- $parameters = @{

- -ResourceGroupName "myresourcegroup"

- -Name "myaccount"

- }

- $parameters = @{

- -ResourceGroupName "myresourcegroup"

- -Name "myaccount"

- }

-# Query deployment to extract entities

-You can query the deployment programmatically using the [Prediction API](https://aka.ms/ct-runtime-api) or through the Client libraries (Azure SDK).

-First you will need to get your resource key and endpoint:

-First you will need to get your resource key and endpoint:

-First you will need to get your resource key and endpoint:

-First you will need to get your resource key and endpoint:

-* [**Quickstarts**](quickstart.md) are getting-started instructions to guide you through making requests to the service.

-* [**How-to guides**](how-to/call-api.md) contain instructions for using the service in more specific or customized ways.

-An AI system includes not only the technology, but also the people who will use it, the people who will be affected by it, and the environment in which it is deployed. Read the [transparency note for sentiment analysis](/legal/cognitive-services/language-service/transparency-note-sentiment-analysis?context=/azure/cognitive-services/language-service/context/context) to learn about responsible AI use and deployment in your systems. You can also see the following articles for more information:

-az containershow --name acilinuxcontainergroup --resource-group myResourceGroup

-description: Quotas, limits, and region availability of the Azure Container Instances service.

-# Quotas and limits for Azure Container Instances

-All Azure services include certain default limits and quotas for resources and features. This article details the default quotas and limits for Azure Container Instances.

-Availability of compute, memory, and storage resources for Azure Container Instances varies by region and operating system. For details, see [Resource availability for Azure Container Instances](container-instances-region-availability.md).

-Use the [List Usage](/rest/api/container-instances/2022-09-01/location/list-usage) API to review current quota usage in a region for a subscription.

-## Service quotas and limits

-## Next steps

-Certain default limits and quotas can be increased. To request an increase of one or more resources that support such an increase, please submit an [Azure support request][azure-support] (select "Quota" for **Issue type**).

-<!-- LINKS - External -->

-[azure-support]: https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest

-For information about quotas and other limits in your deployments, see [Quotas and limits for Azure Container Instances](container-instances-quotas.md).

-> [!IMPORTANT]

-For networking scenarios and limitations, see [Virtual network scenarios and resources for Azure Container Instances](container-instances-virtual-network-concepts.md).

-1. Create a new JSON object with the configuration of the new custom role.

-> [!NOTE]

-> *Partial document update* operation is based on the [RFC spec](https://www.rfc-editor.org/rfc/rfc6902#appendix-A.14). To escape a ~ character you need to add 0 or a 1 to the end.

- "tags": [

- "r-series"

- ]

- { "op": "add", "path": "/tags/-", "value": "featured-bikes" }

- "quantity": 25

- "color": "silver",

- "tags": [

- "r-series",

- "featured-bikes"

- ]

-> [!NOTE]

-> *target path* refers to a location within the JSON document

-| Operation type | Description |

-| | |

-| **Add** | `Add` performs one of the following, depending on the target path: <br/> &bull; If the target path specifies an element that doesn't exist, it's added. <br/> &bull; If the target path specifies an element that already exists, its value is replaced. <br/> &bull; If the target path is a valid array index, a new element is inserted into the array at the specified index. This shifts existing elements after the new element. <br/> &bull; If the index specified is equal to the length of the array, it appends an element to the array. Instead of specifying an index, you can also use the `-` character. It also results in the element being appended to the array.<br /> **Note**: Specifying an index greater than the array length results in an error. |

-| **Set** | `Set` operation is similar to `Add` except with the Array data type. If the target path is a valid array index, the existing element at that index is updated. |

-| **Replace** | `Replace` operation is similar to `Set` except it follows *strict* replace only semantics. In case the target path specifies an element or an array that doesn't exist, it results in an error. |

-| **Remove** | `Remove` performs one of the following, depending on the target path: <br/> &bull; If the target path specifies an element that doesn't exist, it results in an error. <br/> &bull; If the target path specifies an element that already exists, it's removed. <br/> &bull; If the target path is an array index, it's deleted and any elements above the specified index are shifted back one position.<br /> **Note**: Specifying an index equal to or greater than the array length would result in an error. |

-| **Increment** | This operator increments a field by the specified value. It can accept both positive and negative values. If the field doesn't exist, it creates the field and sets it to the specified value. |

-> [!NOTE]

-To analyze large operational datasets while minimizing any effects on the performance of mission-critical transactional workloads, traditionally Azure Cosmos DB extracts and processes the operational data. These operations are performed by using Extract-Transform-Load (ETL) pipelines. ETL pipelines require many layers of data movement resulting in much operational complexity, and performance effects on your transactional workloads. It also increases the latency to analyze the operational data from the time of origin.

-When compared to the traditional ETL-based solutions, Azure Synapse Link for Azure Cosmos DB offers several advantages such as:

-### Reduced complexity with No ETL jobs to manage

-Azure Synapse Link allows you to directly access Azure Cosmos DB analytical store using Azure Synapse Analytics without complex data movement. Any updates made to the operational data are visible in the analytical store in near real-time with no ETL or change feed jobs. You can run large-scale analytics against analytical store, from Azure Synapse Analytics, without extra data transformation.

-Azure Synapse Link brings together Azure Cosmos DB analytical store with Azure Synapse Analytics runtime support. This integration enables you to build cloud native HTAP (Hybrid transactional/analytical processing) solutions that generate insights based on real-time updates to your operational data over large datasets. It unlocks new business scenarios to raise alerts based on live trends, build near real-time dashboards, and business experiences based on user behavior.

-Azure Synapse Link is recommended in the following cases:

-* If you're an Azure Cosmos DB customer and you want to run analytics, BI, and machine learning over your operational data. In such cases, Azure Synapse Link provides a more integrated analytics experience without impacting your transactional storeΓÇÖs provisioned throughput. For example:

- * If you're running analytics or BI on your Azure Cosmos DB operational data directly using separate connectors today, or

- * If you're running ETL processes to extract operational data into a separate analytics system.

-* Azure Synapse Link for Azure Cosmos DB isn't supported for Cassandra, and Table APIs. It's supported for API for NoSQL and MongoDB. And it is in preview for Gremlin API.

- - Azure Active Directory B2C Directories

- - Azure Bastion

- - Azure Firewalls

- - Azure NetApp Files

- - Data Factory

- - Databricks

- - Load balancers

- - Machine Learning workspace Compute instances

- - Network Watcher

- - Notification Hubs

- - Service Bus

- - Time Series Insights

-|[Mapping data flow](concepts-data-flow-overview.md) (source/-)|&#9312; |

-Azure DDoS Protection customers have access to the DDoS Rapid Response (DRR) team, who can help with attack investigation during an attack as well as post-attack analysis. See [DDoS Rapid Response](ddos-rapid-response.md) for more details, including when you should engage the DRR team.

-What file types are supported for sensitive data discovery? | Supported file types (you can't select a subset) - .doc, .docm, .docx, .dot, .odp, .ods, .odt, .pdf, .pot, .pps, .ppsx, .ppt, .pptm, .pptx, .xlc, .xls, .xlsb, .xlsm, .xlsx, .xlt, .csv, .json, .psv, .ssv, .tsv, .txt., xml, .parquet, .avro, .orc.

-# Drive your organization to remediate security recommendations with governance

-Onboarding Agentless Container posture in Defender CSPM will allow you to gain all its [capabilities](concept-agentless-containers.md#agentless-container-posture-preview).

- > The next time you return to this page of the Azure portal, the **Enable for Linux machines** button won't be shown. To disable the integration for Linux, you'll need to disable it for Windows too by clearing the checkbox for **Allow Microsoft Defender for Endpoint to access my data**, and selecting **Save**.

-

-| **Defender for Endpoint integration** | Defender for Servers integrates with Defender for Endpoint and protects servers with all the features, including:<br/><br/>- [Attack surface reduction](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) to lower the risk of attack.<br/><br/> - [Next-generation protection](/microsoft-365/security/defender-endpoint/next-generation-protection), including real-time scanning and protection and [Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/next-generation-protection).<br/><br/> - EDR, including [threat analytics](/microsoft-365/security/defender-endpoint/threat-analytics), [automated investigation and response](/microsoft-365/security/defender-endpoint/automated-investigations), [advanced hunting](/microsoft-365/security/defender-endpoint/advanced-hunting-overview), and [Microsoft Defender Experts](/microsoft-365/security/defender-endpoint/endpoint-attack-notifications).<br/><br/> - Vulnerability assessment and mitigation provided by [Microsoft Defender Vulnerability Management (MDVM)](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities) as part of the Defender for Endpoint integration. With Plan 2, you can get premium MDVM features, provided by the [MDVM add-on](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-capabilities#vulnerability-managment-capabilities-for-servers).| :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 1."::: | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Licensing** | Defender for Servers covers licensing for Defender for Endpoint. Licensing is charged per hour instead of per seat, lowering costs by protecting virtual machines only when they're in use.| :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 1."::: | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Defender for Endpoint provisioning** | Defender for Servers automatically provisions the Defender for Endpoint sensor on every supported machine that's connected to Defender for Cloud.| :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 1."::: | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Unified view** | Defender for Endpoint alerts appear in the Defender for Cloud portal. You can get detailed information in the Defender for Endpoint portal.| :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 1."::: | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Threat detection for OS-level (agent-based)** | Defender for Servers and Defender for Endpoint detect threats at the OS level, including virtual machine behavioral detections and *fileless attack detection*, which generates detailed security alerts that accelerate alert triage, correlation, and downstream response time.<br>[Learn more](alerts-reference.md#alerts-windows) | :::image type="icon" source="./mediE](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response) | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Threat detection for network-level (agentless)** | Defender for Servers detects threats that are directed at the control plane on the network, including network-based detections for Azure virtual machines. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Microsoft Defender Vulnerability Management (MDVM) Add-on** | Enhance your vulnerability management program consolidated asset inventories, security baselines assessments, application block feature, and more. [Learn more](deploy-vulnerability-assessment-defender-vulnerability-management.md). | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Security Policy and Regulatory Compliance** | Customize a security policy for your subscription and also compare the configuration of your resources with requirements in industry standards, regulations, and benchmarks. Learn more about [regulatory compliance](regulatory-compliance-dashboard.md) and [security policies](security-policy-concept.md) | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2.":::|

-| **[Qualys vulnerability assessment](deploy-vulnerability-assessment-vm.md)** | As an alternative to Defender Vulnerability Management, Defender for Cloud can deploy a Qualys scanner and display the findings. You don't need a Qualys license or account. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2.":::|

-**[Adaptive application controls](adaptive-application-controls.md)** | Adaptive application controls define allowlists of known safe applications for machines. To use this feature, Defender for Cloud must be enabled on the subscription. | Not supported in Plan 1 |:::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **Free data ingestion (500 MB) in workspaces** | Free data ingestion is available for [specific data types](faq-defender-for-servers.yml#what-data-types-are-included-in-the-daily-allowance-). Data ingestion is calculated per node, per reported workspace, and per day. It's available for every workspace that has a *Security* or *AntiMalware* solution installed. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **[Just-in-time virtual machine access](just-in-time-access-overview.md)** | Just-in-time virtual machine access locks down machine ports to reduce the attack surface. To use this feature, Defender for Cloud must be enabled on the subscription. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **[Adaptive network hardening](adaptive-network-hardening.md)** | Network hardening filters traffic to and from resources by using network security groups (NSGs) to improve your network security posture. Further improve security by hardening the NSG rules based on actual traffic patterns. To use this feature, Defender for Cloud must be enabled on the subscription. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **[File integrity monitoring](file-integrity-monitoring-overview.md)** | File integrity monitoring examines files and registries for changes that might indicate an attack. A comparison method is used to determine whether suspicious modifications have been made to files. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-| **[Docker host hardening](harden-docker-hosts.md)** | Assesses containers hosted on Linux machines running Docker containers, and then compares them with the Center for Internet Security (CIS) Docker Benchmark. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-[Network map](protect-network-resources.md) | Provides a geographical view of recommendations for hardening your network resources. | Not supported in Plan 1| :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2."::: |

-[Agentless scanning](concept-agentless-data-collection.md) | Scans Azure virtual machines by using cloud APIs to collect data. | Not supported in Plan 1 | :::image type="icon" source="./media/icons/yes-icon.png" alt-text="Icon that shows it's supported in Plan 2.":::

-## Sample script

- This script migrates an Azure SQL Server to the Vulnerability Assessment Express Configuration feature, and then scans all databases that belong to the selected server.

- This script migrates Azure SQL Server to the Vulnerability Assessment Express Configuration feature.

- It deletes the current Vulnerability Assessment settings (if exists), this step will reset all the Vulnerability Assessment scans and baseline for all databases.

-$SubscriptionId = "<subscriptionid>" # The Subscription id that the server belongs to.

-$ResourceGroupName = "<resource group>" # The Resource Group that the server belongs to.

-$ServerName = "<server name>" # The SQL server name that we want to apply the new SQL Vulnerability Assessment policy to (short name, without suffix).

-$Force = $false # Will remove the classic Vulnerability Assessment configurations without asking for confirmation.

-$APIVersion = "2022-05-01-preview"

-function SetSqlVulnerabilityAssessmentServerSetting($SubscriptionId, $ResourceGroupName, $ServerName){

- $Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/sqlVulnerabilityAssessments/default?api-version=" + $APIVersion

-function RunSqlVulnerabilityAssessmentScanOnUserDatabase($SubscriptionId, $ResourceGroupName, $ServerName, $DatabaseName){

- $Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/databases/$DatabaseName/sqlVulnerabilityAssessments/defualt/initiateScan?api-version=" + $APIVersion

-function RunSqlVulnerabilityAssessmentScanOnSystemDatabase($SubscriptionId, $ResourceGroupName, $ServerName, $DatabaseName){

- $Uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/sqlVulnerabilityAssessments/default/initiateScan?api-version=" + $APIVersion + "&systemDatabaseName=$DatabaseName"

- SendRestRequest -Method "Post" -Uri $Uri

-function SendRestRequest(

- [Parameter(Mandatory=$True)]

- [string] $Method,

- [Parameter(Mandatory=$True)]

- [string] $Uri,

- [parameter( Mandatory=$false )]

- [string] $Body = "DEFAULT")

-{

- $AccessToken = Get-AzAccessToken

- $Token = "Bearer $($AccessToken.Token)"

- $headers = @{

- 'Authorization' = $Token

- }

- Method = $Method

- Uri = $Uri

- Headers = $headers

- ContentType = "application/json"

- if(!($Body -eq "DEFAULT"))

- {

- $Params = @{

- Method = $Method

- Uri = $Uri

- Body = $Body

- Headers = $headers

- ContentType = "application/json"

- }

-

- Invoke-RestMethod @Params

-function HaveVulnerabilityAssessmentSetting($ResourceGroupName, $ServerName, $Databases)

-{

- Write-Host "Check Vulnerability Assessment setting for '$($ServerName)' server"

- if(![string]::IsNullOrEmpty($vaServerSetting.StorageAccountName))

- {

- return $true

- foreach ($database in $Databases)

- {

- Write-Host "Check VA settings for '$($database.DatabaseName)' database"

- $vaDatabaseSetting = Get-AzSqlDatabaseVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $database.DatabaseName

- if(![string]::IsNullOrEmpty($vaDatabaseSetting.StorageAccountName))

- {

- return $true

- }

-Connect-AzAccount

-Set-AzContext $SubscriptionId

-$databases = Get-AzSqlDatabase -ResourceGroupName $ResourceGroupName -ServerName $ServerName | where {$_.DatabaseName -ne "master"}

-if($haveVaSetting)

-{

- Write-Host "Classic Configurations detected."

- if(!$Force)

- {

- Write-Host "We are going to remove the current Vulnerability Assessment setting for this server and underlying databases, this step will reset all the Vulnerability Assessment scans and baseline for all databases ($($databases.Count) under this server)"

- $Confirmation = Read-Host -Prompt "Do you approve (y/n)?"

- if($Confirmation -ne "y")

- {

- Write-Host "You chose not to approve the migration process. Existing VA settings will not be changed."

- return

-

- # Removing Classic Configuration database Vulnerability Assessment setting

- foreach ($database in $Databases)

- {

- Write-Host "Clear Classic Configuration Vulnerability Assessment setting for '$($database.DatabaseName)' database"

- Clear-AzSqlDatabaseVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $database.DatabaseName

- # Removing Classic Configuration server Vulnerability Assessment setting

- Write-Host "Clear Classic Configuration Vulnerability Assessment setting for '$($ServerName)' server"

- Clear-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName $ResourceGroupName -ServerName $ServerName

-# Set Express Configuration SQL Vulnerability Assessment Setting

-Write-Host "Add Express Configuration Vulnerability Assessment feature setting for '$($ServerName)' server"

-$Respond = SetSqlVulnerabilityAssessmentServerSetting -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName

-if( $Respond.properties.state.Equals("Enabled") )

-{

- Write-Host "Congratulations! your server '$($ServerName)' server is set up with Vulnerability Assessment Express Configuration!"

-else

-{

- Write-Host "There was a problem to enable Vulnerability Assessment Express Configuration on the '$($ServerName)' server, please try again"

-# Scan on all the databases

-foreach ($database in $Databases)

-{

- Write-Host "Run scan on '$($database.DatabaseName)' database"

- RunSqlVulnerabilityAssessmentScanOnUserDatabase -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $database.DatabaseName

-Write-Host "Run scan on 'master' database"

-RunSqlVulnerabilityAssessmentScanOnSystemDatabase -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName "master"

-Write-Host "The migration process completed, the new scan results will be available in a couple of minutes."