| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| active-directory-b2c | Deploy Custom Policies Github Action | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/deploy-custom-policies-github-action.md | For the GitHub Action to access data in Microsoft Graph, grant the registered ap GitHub secrets are encrypted environment variables that you create in an organization, repository, or repository environment. In this step, you store the application secret for the application you registered earlier in the [Register an MS Graph application](#register-a-microsoft-graph-application) step. -The GitHub Action for deploying Azure AD B2C custom policies uses the secret to acquire an access token that is used to interact with the Microsoft Graph API. For more information, see [Creating encrypted secrets for a repository](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#creating-encrypted-secrets-for-a-repository). +The GitHub Action for deploying Azure AD B2C custom policies uses the secret to acquire an access token that is used to interact with the Microsoft Graph API. For more information, see [Creating encrypted secrets for a repository](https://docs.github.com/actions/security-guides/using-secrets-in-github-actions#creating-encrypted-secrets-for-a-repository). To create a GitHub secret, follow these steps: To test the workflow you created, **Push** the changes of your custom policy. On ## Optional: Schedule your workflow -The workflow you created is triggered by the [push](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push) event. If you prefer, you can choose another event to trigger the workflow, for example a [pull request](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request). +The workflow you created is triggered by the [push](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#push) event. If you prefer, you can choose another event to trigger the workflow, for example a [pull request](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#pull_request). -You can also schedule a workflow to run at specific UTC times using [POSIX cron syntax](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/crontab.html#tag_20_25_07). The schedule event allows you to trigger a workflow at a scheduled time. For more information, see [Scheduled events](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#scheduled-events). +You can also schedule a workflow to run at specific UTC times using [POSIX cron syntax](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/crontab.html#tag_20_25_07). The schedule event allows you to trigger a workflow at a scheduled time. For more information, see [Scheduled events](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#scheduled-events). The following example triggers the workflow every day at 5:30 and 17:30 UTC: To edit your workflow: ## Next steps -- Learn how to configure [Events that trigger workflows](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows)+- Learn how to configure [Events that trigger workflows](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows) |
| active-directory-b2c | Partner F5 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-b2c/partner-f5.md | The BIG-IP has required Azure AD B2C requests in its preconfigured request set. | Parameter | Parameter name | Parameter value| |-|||-| client-id | client-id |N/A | +| client_id | client_id |N/A | | nonce | nonce| N/A|-| redirect-uri | redirect-uri | N/A| +| redirect_uri | redirect_uri | N/A| | scope | scope | N/A|-| response-type | response-type | N/A| -| client-secret | client-secret |N/A | +| response_type | response_type | N/A| +| client_secret | client_secret |N/A | | custom | grant_type | authorization_code | **Auth redirect request: Enabled** The BIG-IP has required Azure AD B2C requests in its preconfigured request set. | Parameter | Parameter name | Parameter value| |||-|-| client-id | client-id | N/A| -| redirect-uri | redirect-uri |N/A | -| response-type |response-type |N/A | +| client_id | client_id | N/A| +| redirect_uri | redirect_uri |N/A | +| response_type |response_type |N/A | | scope | scope | N/A| | nonce | nonce | N/A| |
| active-directory-domain-services | Alert Ldaps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/alert-ldaps.md | This article helps you understand and resolve common alerts with secure LDAP acc When you enable secure LDAP, it's recommended to create additional rules that restrict inbound LDAPS access to specific IP addresses. These rules protect the managed domain from brute force attacks. To update the network security group to restrict TCP port 636 access for secure LDAP, complete the following steps: -1. In the Azure portal, search for and select **Network security groups**. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Network security groups**. 1. Choose the network security group associated with your managed domain, such as *AADDS-contoso.com-NSG*, then select **Inbound security rules** 1. Select **+ Add** to create a rule for TCP port 636. If needed, select **Advanced** in the window to create a rule. 1. For the **Source**, choose *IP Addresses* from the drop-down menu. Enter the source IP addresses that you want to grant access for secure LDAP traffic. |
| active-directory-domain-services | Alert Nsg | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/alert-nsg.md | The following default inbound and outbound security rules are applied to the net To verify the existing security rules and make sure the default ports are open, complete the following steps: -1. In the Azure portal, search for and select **Network security groups**. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Network security groups**. 1. Choose the network security group associated with your managed domain, such as *AADDS-contoso.com-NSG*. 1. On the **Overview** page, the existing inbound and outbound security rules are shown. To verify the existing security rules and make sure the default ports are open, To add a missing security rule, complete the following steps: -1. In the Azure portal, search for and select **Network security groups**. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Network security groups**. 1. Choose the network security group associated with your managed domain, such as *AADDS-contoso.com-NSG*. 1. Under **Settings** in the left-hand panel, click *Inbound security rules* or *Outbound security rules* depending on which rule you need to add. 1. Select **Add**, then create the required rule based on the port, protocol, direction, etc. When ready, select **OK**. |
| active-directory-domain-services | Alert Service Principal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/alert-service-principal.md | If a required service principal is deleted, the Azure platform can't perform aut To check which service principal is missing and must be recreated, complete the following steps: -1. In the Azure portal, select **Azure Active Directory** from the left-hand navigation menu. -1. Select **Enterprise applications**. Choose *All applications* from the **Application Type** drop-down menu, then select **Apply**. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Enterprise applications**. Choose *All applications* from the **Application Type** drop-down menu, then select **Apply**. 1. Search for each of the following application IDs. For Azure Global, search for AppId value *2565bd9d-da50-47d4-8b85-4c97f669dc36*. For other Azure clouds, search for AppId value *6ba9a5d4-8456-4118-b521-9c5ca10cdf84*. If no existing application is found, follow the *Resolution* steps to create the service principal or re-register the namespace. | Application ID | Resolution | The managed domain's health automatically updates itself within two hours and re If application ID *443155a6-77f3-45e3-882b-22b3a8d431fb*, *abba844e-bc0e-44b0-947a-dc74e5d09022*, or *d87dcbc6-a371-462e-88e3-28ad15ec4e64* is missing from your Azure AD directory, complete the following steps to re-register the *Microsoft.AAD* resource provider: -1. In the Azure portal, search for and select **Subscriptions**. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Subscriptions**. 1. Choose the subscription associated with your managed domain. 1. From the left-hand navigation, choose **Resource Providers**. 1. Search for *Microsoft.AAD*, then select **Re-register**. |
| active-directory-domain-services | Change Sku | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/change-sku.md | In Azure Active Directory Domain Services (Azure AD DS), the available performan You select a SKU when you create the managed domain, and you can switch SKUs up or down as your business needs change after the managed domain has been deployed. Changes in business requirements could include the need for more frequent backups or to create additional forest trusts. For more information on the limits and pricing of the different SKUs, see [Azure AD DS SKU concepts][concepts-sku] and [Azure AD DS pricing][pricing] pages. -This article shows you how to change the SKU for an existing Azure AD DS managed domain using the Azure portal. +This article shows you how to change the SKU for an existing Azure AD DS managed domain using the [Microsoft Entra admin center](https://entra.microsoft.com). ## Before you begin For more information on these limits, see [Azure AD DS SKU features and limits][ ## Select a new SKU -To change the SKU for a managed domain using the Azure portal, complete the following steps: +To change the SKU for a managed domain using the [Microsoft Entra admin center](https://entra.microsoft.com), complete the following steps: -1. At the top of the Azure portal, search for and select **Azure AD Domain Services**. Choose your managed domain from the list, such as *aaddscontoso.com*. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Azure AD Domain Services**. Choose your managed domain from the list, such as *aaddscontoso.com*. 1. In the menu on the left-hand side of the Azure AD DS page, select **Settings > SKU**. -  +  1. From the drop-down menu, select the SKU you wish for your managed domain. If you have a resource forest, you can't select *Standard* SKU as forest trusts are only available on the *Enterprise* SKU or higher. Choose the SKU you want from the drop-down menu, then select **Save**. -  +  It can take a minute or two to change the SKU type. |
| active-directory-domain-services | Check Health | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/check-health.md | Title: Check the health of Azure Active Directory Domain Services | Microsoft Docs -description: Learn how to check the health of an Azure Active Directory Domain Services (Azure AD DS) managed domain and understand status messages using the Azure portal. +description: Learn how to check the health of an Azure Active Directory Domain Services (Azure AD DS) managed domain and understand status messages. -Azure Active Directory Domain Services (Azure AD DS) runs some background tasks to keep the managed domain healthy and up-to-date. These tasks include taking backups, applying security updates, and synchronizing data from Azure AD. If there are issues with the Azure AD DS managed domain, these tasks may not successfully complete. To review and resolve any issues, you can check the health status of a managed domain using the Azure portal. +Azure Active Directory Domain Services (Azure AD DS) runs some background tasks to keep the managed domain healthy and up-to-date. These tasks include taking backups, applying security updates, and synchronizing data from Azure AD. If there are issues with the Azure AD DS managed domain, these tasks may not successfully complete. To review and resolve any issues, you can check the health status of a managed domain using the Microsoft Entra admin center. This article shows you how to view the Azure AD DS health status and understand the information or alerts shown. ## View the health status -The health status for a managed domain is viewed using the Azure portal. Information on the last backup time and synchronization with Azure AD can be seen, along with any alerts that indicate a problem with the managed domain's health. To view the health status for a managed domain, complete the following steps: +The health status for a managed domain is viewed using the Microsoft Entra admin center. Information on the last backup time and synchronization with Azure AD can be seen, along with any alerts that indicate a problem with the managed domain's health. To view the health status for a managed domain, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. +1. Sign in to [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../active-directory/roles/permissions-reference.md#global-administrator). +1. Search for and select **Azure AD Domain Services**. 1. Select your managed domain, such as *aaddscontoso.com*. 1. On the left-hand side of the Azure AD DS resource window, select **Health**. The following example screenshot shows a healthy managed domain and the status of the last backup and Azure AD synchronization: -  +  The *Last evaluated* timestamp of the health page shows when the managed domain was last checked. The health of a managed domain is evaluated every hour. If you make any changes to a managed domain, wait until the next evaluation cycle to view the updated health status. |
| active-directory-domain-services | Compare Identity Solutions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/compare-identity-solutions.md | Although the three Active Directory-based identity solutions share a common name * **Active Directory Domain Services (AD DS)** - Enterprise-ready lightweight directory access protocol (LDAP) server that provides key features such as identity and authentication, computer object management, group policy, and trusts. * AD DS is a central component in many organizations with an on-premises IT environment, and provides core user account authentication and computer management features. * For more information, see [Active Directory Domain Services overview in the Windows Server documentation][overview-adds].-* **Azure Active Directory (Azure AD)** - Cloud-based identity and mobile device management that provides user account and authentication services for resources such as Microsoft 365, the Azure portal, or SaaS applications. +* **Azure Active Directory (Azure AD)** - Cloud-based identity and mobile device management that provides user account and authentication services for resources such as Microsoft 365, the Microsoft Entra admin center, or SaaS applications. * Azure AD can be synchronized with an on-premises AD DS environment to provide a single identity to users that works natively in the cloud. * For more information about Azure AD, see [What is Azure Active Directory?][whatis-azuread] * **Azure Active Directory Domain Services (Azure AD DS)** - Provides managed domain services with a subset of fully compatible traditional AD DS features such as domain join, group policy, LDAP, and Kerberos / NTLM authentication. Although the three Active Directory-based identity solutions share a common name This overview article compares and contrasts how these identity solutions can work together, or would be used independently, depending on the needs of your organization. > [!div class="nextstepaction"]-> [To get started, create an Azure AD DS managed domain using the Azure portal][tutorial-create] +> [To get started, create an Azure AD DS managed domain using the Microsoft Entra admin center][tutorial-create] ## Azure AD DS and self-managed AD DS If on-premises AD DS and Azure AD are configured for federated authentication us ## Next steps -To get started with using Azure AD DS, [create an Azure AD DS managed domain using the Azure portal][tutorial-create]. +To get started with using Azure AD DS, [create an Azure AD DS managed domain using the Microsoft Entra admin center][tutorial-create]. You can also learn more about [management concepts for user accounts, passwords, and administration in Azure AD DS][administration-concepts] and [how objects and credentials are synchronized in a managed domain][synchronization]. |
| active-directory-domain-services | Concepts Forest Trust | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/concepts-forest-trust.md | Before you can create a forest trust, you need to verify you have the correct Do To create a forest trust, you must be a member of the Domain Admins group (in the forest root domain) or the Enterprise Admins group in Active Directory. Each trust is assigned a password that the administrators in both forests must know. Members of Enterprise Admins in both forests can create the trusts in both forests at once and, in this scenario, a password that is cryptographically random is automatically generated and written for both forests. -A managed domain forest supports up to five one-way outbound forest trusts to on-premises forests. The outbound forest trust for Azure AD Domain Services is created in the Azure portal. You don't manually create the trust with the managed domain itself. The incoming forest trust must be configured by a user with the privileges previously noted in the on-premises Active Directory. +A managed domain forest supports up to five one-way outbound forest trusts to on-premises forests. The outbound forest trust for Azure AD Domain Services is created in the Microsoft Entra admin center. You don't manually create the trust with the managed domain itself. The incoming forest trust must be configured by a user with the privileges previously noted in the on-premises Active Directory. ## Trust processes and interactions |
| active-directory-domain-services | Create Forest Trust Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/create-forest-trust-powershell.md | To complete this article, you need the following resources and privileges: * You need [Application Administrator](../active-directory/roles/permissions-reference.md#application-administrator) and [Groups Administrator](../active-directory/roles/permissions-reference.md#groups-administrator) Azure AD roles in your tenant to enable Azure AD DS. * You need [Domain Services Contributor](../role-based-access-control/built-in-roles.md#contributor) Azure role to create the required Azure AD DS resources. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this article, you create and configure the outbound forest trust from a managed domain using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this article, you create and configure the outbound forest trust from a managed domain using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Deployment process Before you start, make sure you understand the [network considerations and recom * Confirm that your on-premises domain controller can connect to the managed VM using `ping` or remote desktop, for example. * Verify that your management VM can connect to your on-premises domain controllers, again using a utility such as `ping`. -1. In the Azure portal, search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com* and wait for the status to report as **Running**. +1. In the Microsoft Entra admin center, search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com* and wait for the status to report as **Running**. When running, [update DNS settings for the Azure virtual network](tutorial-create-instance.md#update-dns-settings-for-the-azure-virtual-network) and then [enable user accounts for Azure AD DS](tutorial-create-instance.md#enable-user-accounts-for-azure-ad-ds) to finalize the configurations for your managed domain. To correctly resolve the managed domain from the on-premises environment, you ma ## Create inbound forest trust in the on-premises domain -The on-premises AD DS domain needs an incoming forest trust for the managed domain. This trust must be manually created in the on-premises AD DS domain, it can't be created from the Azure portal. +The on-premises AD DS domain needs an incoming forest trust for the managed domain. This trust must be manually created in the on-premises AD DS domain, it can't be created from the Microsoft Entra admin center. To configure inbound trust on the on-premises AD DS domain, complete the following steps from a management workstation for the on-premises AD DS domain: To configure inbound trust on the on-premises AD DS domain, complete the followi 1. Choose **Trusts** tab, then **New Trust** 1. Enter the name of the managed domain, such as *aaddscontoso.com*, then select **Next** 1. Select the option to create a **Forest trust**, then to create a **One way: incoming** trust.-1. Choose to create the trust for **This domain only**. In the next step, you create the trust in the Azure portal for the managed domain. -1. Choose to use **Forest-wide authentication**, then enter and confirm a trust password. This same password is also entered in the Azure portal in the next section. +1. Choose to create the trust for **This domain only**. In the next step, you create the trust in the Microsoft Entra admin center for the managed domain. +1. Choose to use **Forest-wide authentication**, then enter and confirm a trust password. This same password is also entered in the Microsoft Entra admin center in the next section. 1. Step through the next few windows with default options, then choose the option for **No, do not confirm the outgoing trust**. You can't validate the trust relation because your delegated admin account to the managed domain doesn't have the required permissions. This behavior is by design. 1. Select **Finish** |
| active-directory-domain-services | Create Ou | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/create-ou.md | To create a custom OU, you use the Active Directory Administrative Tools from a > [!NOTE] > To create a custom OU in a managed domain, you must be signed in to a user account that's a member of the *AAD DC Administrators* group. -1. Sign in to your management VM. For steps on how to connect using the Azure portal, see [Connect to a Windows Server VM][connect-windows-server-vm]. +1. Sign in to your management VM. For steps on how to connect using the Microsoft Entra admin center, see [Connect to a Windows Server VM][connect-windows-server-vm]. 1. From the Start screen, select **Administrative Tools**. A list of available management tools is shown that were installed in the tutorial to [create a management VM][tutorial-create-management-vm]. 1. To create and manage OUs, select **Active Directory Administrative Center** from the list of administrative tools. 1. In the left pane, choose your managed domain, such as *aaddscontoso.com*. A list of existing OUs and resources is shown: |
| active-directory-domain-services | Csp | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/csp.md | The following important considerations apply when administering a managed domain ## Next steps -To get started, [enroll in the Azure CSP program](/partner-center/enrolling-in-the-csp-program). You can then enable Azure AD Domain Services using the [Azure portal](tutorial-create-instance.md) or [Azure PowerShell](powershell-create-instance.md). +To get started, [enroll in the Azure CSP program](/partner-center/enrolling-in-the-csp-program). You can then enable Azure AD Domain Services using the [Microsoft Entra admin center](tutorial-create-instance.md) or [Azure PowerShell](powershell-create-instance.md). |
| active-directory-domain-services | Delete Aadds | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/delete-aadds.md | Title: Delete Azure Active Directory Domain Services | Microsoft Docs -description: Learn how to disable, or delete, an Azure Active Directory Domain Services managed domain using the Azure portal +description: Learn how to disable, or delete, an Azure Active Directory Domain Services managed domain -# Delete an Azure Active Directory Domain Services managed domain using the Azure portal +# Delete an Azure Active Directory Domain Services managed domain If you no longer need an Azure Active Directory Domain Services (Azure AD DS) managed domain, you can delete it. There's no option to turn off or temporarily disable an Azure AD DS managed domain. Deleting the managed domain doesn't delete or otherwise adversely impact the Azure AD tenant. -This article shows you how to use the Azure portal to delete a managed domain. +This article shows you how to use the Microsoft Entra admin center to delete a managed domain. > [!WARNING] > **Deletion is permanent and can't be reversed.** This article shows you how to use the Azure portal to delete a managed domain. To delete a managed domain, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../active-directory/roles/permissions-reference.md#global-administrator). +1. Search for and select **Azure AD Domain Services**. 1. Select the name of your managed domain, such as *aaddscontoso.com*. 1. On the **Overview** page, select **Delete**. To confirm the deletion, type the domain name of the managed domain again, then select **Delete**. |
| active-directory-domain-services | Deploy Azure App Proxy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/deploy-azure-app-proxy.md | To create a VM for the Azure AD Application Proxy connector, complete the follow Perform the following steps to download the Azure AD Application Proxy connector. The setup file you download is copied to your App Proxy VM in the next section. -1. Sign in to the [Azure portal](https://portal.azure.com) with a user account that has *Enterprise administrator* permissions in Azure AD. -1. Search for and select **Azure Active Directory** at the top of the portal, then choose **Enterprise applications**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../active-directory/roles/permissions-reference.md#global-administrator). +1. Search for and select **Enterprise applications**. 1. Select **Application proxy** from the menu on the left-hand side. To create your first connector and enable App Proxy, select the link to **download a connector**. 1. On the download page, accept the license terms and privacy agreement, then select **Accept terms & Download**. Perform the following steps to download the Azure AD Application Proxy connector ## Install and register the Azure AD Application Proxy connector -With a VM ready to be used as the Azure AD Application Proxy connector, now copy and run the setup file downloaded from the Azure portal. +With a VM ready to be used as the Azure AD Application Proxy connector, now copy and run the setup file downloaded from the Microsoft Entra admin center. 1. Copy the Azure AD Application Proxy connector setup file to your VM. 1. Run the setup file, such as *AADApplicationProxyConnectorInstaller.exe*. Accept the software license terms. With a VM ready to be used as the Azure AD Application Proxy connector, now copy * If Internet Explorer Enhanced Security Configuration is turned on for the VM where you install the connector, the registration screen might be blocked. To allow access, follow the instructions in the error message, or turn off Internet Explorer Enhanced Security during the install process. * If connector registration fails, see [Troubleshoot Application Proxy](../active-directory/app-proxy/application-proxy-troubleshoot.md). 1. At the end of the setup, a note is shown for environments with an outbound proxy. To configure the Azure AD Application Proxy connector to work through the outbound proxy, run the provided script, such as `C:\Program Files\Microsoft AAD App Proxy connector\ConfigureOutBoundProxy.ps1`.-1. On the Application proxy page in the Azure portal, the new connector is listed with a status of *Active*, as shown in the following example: +1. On the Application proxy page in the Microsoft Entra admin center, the new connector is listed with a status of *Active*, as shown in the following example: -  +  > [!NOTE] > To provide high availability for applications authenticating through the Azure AD Application Proxy, you can install connectors on multiple VMs. Repeat the same steps listed in the previous section to install the connector on other servers joined to the managed domain. |
| active-directory-domain-services | How To Data Retrieval | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/how-to-data-retrieval.md | You can create a user in the Azure AD portal or by using Graph PowerShell or Gra You can create a new user using the Azure Active Directory portal. To add a new user, follow these steps: -1. Sign in to the [Azure portal](https://portal.azure.com/) in the User Administrator role for the organization. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](../active-directory/roles/permissions-reference.md#user-administrator). -1. Search for and select *Azure Active Directory* from any page. --1. Select **Users**, and then select **New user**. +1. Browse to **Identity** > **Users**, and then select **New user**.  |
| active-directory-domain-services | Join Centos Linux Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/join-centos-linux-vm.md | If you have an existing CentOS Linux VM in Azure, connect to it using SSH, then If you need to create a CentOS Linux VM, or want to create a test VM for use with this article, you can use one of the following methods: -* [Azure portal](../virtual-machines/linux/quick-create-portal.md) +* [Microsoft Entra admin center](../virtual-machines/linux/quick-create-portal.md) * [Azure CLI](../virtual-machines/linux/quick-create-cli.md) * [Azure PowerShell](../virtual-machines/linux/quick-create-powershell.md) |
| active-directory-domain-services | Join Coreos Linux Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/join-coreos-linux-vm.md | If you have an existing CoreOS Linux VM in Azure, connect to it using SSH, then If you need to create a CoreOS Linux VM, or want to create a test VM for use with this article, you can use one of the following methods: -* [Azure portal](../virtual-machines/linux/quick-create-portal.md) +* [Microsoft Entra admin center](../virtual-machines/linux/quick-create-portal.md) * [Azure CLI](../virtual-machines/linux/quick-create-cli.md) * [Azure PowerShell](../virtual-machines/linux/quick-create-powershell.md) |
| active-directory-domain-services | Join Rhel Linux Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/join-rhel-linux-vm.md | If you have an existing RHEL Linux VM in Azure, connect to it using SSH, then co If you need to create a RHEL Linux VM, or want to create a test VM for use with this article, you can use one of the following methods: -* [Azure portal](../virtual-machines/linux/quick-create-portal.md) +* [Microsoft Entra admin center](../virtual-machines/linux/quick-create-portal.md) * [Azure CLI](../virtual-machines/linux/quick-create-cli.md) * [Azure PowerShell](../virtual-machines/linux/quick-create-powershell.md) |
| active-directory-domain-services | Join Suse Linux Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/join-suse-linux-vm.md | If you have an existing SLE Linux VM in Azure, connect to it using SSH, then con If you need to create a SLE Linux VM, or want to create a test VM for use with this article, you can use one of the following methods: -* [Azure portal](../virtual-machines/linux/quick-create-portal.md) +* [Microsoft Entra admin center](../virtual-machines/linux/quick-create-portal.md) * [Azure CLI](../virtual-machines/linux/quick-create-cli.md) * [Azure PowerShell](../virtual-machines/linux/quick-create-powershell.md) To join the managed domain using **SSSD** and the *User Logon Management* module In YaST, select **System > Network Settings**. -1. Select the *Hostname/DNS* tab, then enter the IP address(es) of the managed domain into the text box *Name Server 1*. These IP addresses are shown on the *Properties* window in the Azure portal for your managed domain, such as *10.0.2.4* and *10.0.2.5*. +1. Select the *Hostname/DNS* tab, then enter the IP address(es) of the managed domain into the text box *Name Server 1*. These IP addresses are shown on the *Properties* window in the Microsoft Entra admin center for your managed domain, such as *10.0.2.4* and *10.0.2.5*. Add your own managed domain IP addresses, then select **OK**. To join the managed domain using **winbind** and the *Windows Domain Membership* 1. If you want to change the UID and GID ranges for the Samba users and groups, select *Expert Settings*. -1. Configure Network Time Protocol (NTP) time synchronization for your managed domain by selecting *NTP Configuration*. Enter the IP addresses of the managed domain. These IP addresses are shown on the *Properties* window in the Azure portal for your managed domain, such as *10.0.2.4* and *10.0.2.5*. +1. Configure Network Time Protocol (NTP) time synchronization for your managed domain by selecting *NTP Configuration*. Enter the IP addresses of the managed domain. These IP addresses are shown on the *Properties* window in the Microsoft Entra admin center for your managed domain, such as *10.0.2.4* and *10.0.2.5*. 1. Select **OK** and confirm the domain join when prompted for it. |
| active-directory-domain-services | Join Ubuntu Linux Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/join-ubuntu-linux-vm.md | If you have an existing Ubuntu Linux VM in Azure, connect to it using SSH, then If you need to create an Ubuntu Linux VM, or want to create a test VM for use with this article, you can use one of the following methods: -* [Azure portal](../virtual-machines/linux/quick-create-portal.md) +* [Microsoft Entra admin center](../virtual-machines/linux/quick-create-portal.md) * [Azure CLI](../virtual-machines/linux/quick-create-cli.md) * [Azure PowerShell](../virtual-machines/linux/quick-create-powershell.md) |
| active-directory-domain-services | Join Windows Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/join-windows-vm.md | To complete this tutorial, you need the following resources: If you already have a VM that you want to domain-join, skip to the section to [join the VM to the managed domain](#join-the-vm-to-the-managed-domain). -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you create a Windows Server VM to join to your managed domain using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this tutorial, you create a Windows Server VM to join to your managed domain using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Create a Windows Server virtual machine To see how to join a computer to a managed domain, let's create a Windows Server If you already have a VM that you want to domain-join, skip to the section to [join the VM to the managed domain](#join-the-vm-to-the-managed-domain). -1. From the Azure portal menu or from the **Home** page, select **Create a resource**. +1. From the Microsoft Entra admin center menu or from the **Home** page, select **Create a resource**. 1. From **Get started**, choose **Windows Server 2016 Datacenter**. -  +  1. In the **Basics** window, configure the core settings for the virtual machine. Leave the defaults for *Availability options*, *Image*, and *Size*. If you already have a VM that you want to domain-join, skip to the section to [j 1. By default, VMs created in Azure are accessible from the Internet using RDP. When RDP is enabled, automated sign-in attacks are likely to occur, which may disable accounts with common names such as *admin* or *administrator* due to multiple failed successive sign-in attempts. - RDP should only be enabled when required, and limited to a set of authorized IP ranges. This configuration helps improve the security of the VM and reduces the area for potential attack. Or, create and use an Azure Bastion host that allows access only through the Azure portal over TLS. In the next step of this tutorial, you use an Azure Bastion host to securely connect to the VM. + RDP should only be enabled when required, and limited to a set of authorized IP ranges. This configuration helps improve the security of the VM and reduces the area for potential attack. Or, create and use an Azure Bastion host that allows access only through the Microsoft Entra admin center over TLS. In the next step of this tutorial, you use an Azure Bastion host to securely connect to the VM. Under **Public inbound ports**, select *None*. If you already have a VM that you want to domain-join, skip to the section to [j In the **Networking** pane, select the virtual network in which your managed domain is deployed, such as *aaads-vnet* 1. In this example, the existing *aaads-subnet* is shown that the managed domain is connected to. Don't connect your VM to this subnet. To create a subnet for the VM, select **Manage subnet configuration**. -  +  1. In the left-hand menu of the virtual network window, select **Address space**. The virtual network is created with a single address space of *10.0.2.0/24*, which is used by the default subnet. Other subnets, such as for *workloads* or Azure Bastion may also already exist. If you already have a VM that you want to domain-join, skip to the section to [j In the following example, an additional IP address range of *10.0.5.0/24* is added. When ready, select **Save**. -  +  1. Next, in the left-hand menu of the virtual network window, select **Subnets**, then choose **+ Subnet** to add a subnet. 1. Select **+ Subnet**, then enter a name for the subnet, such as *management*. Provide an **Address range (CIDR block)**, such as *10.0.5.0/24*. Make sure that this IP address range doesn't overlap with any other existing Azure or on-premises address ranges. Leave the other options as their default values, then select **OK**. -  +  1. It takes a few seconds to create the subnet. Once it's created, select the *X* to close the subnet window. 1. Back in the **Networking** pane to create a VM, choose the subnet you created from the drop-down menu, such as *management*. Again, make sure you choose the correct subnet and don't deploy your VM in the same subnet as your managed domain. If you already have a VM that you want to domain-join, skip to the section to [j 1. Set **Boot diagnostics** to *Off*. Leave the other options as their default values, then select **Review + create**. 1. Review the VM settings, then select **Create**. -It takes a few minutes to create the VM. The Azure portal shows the status of the deployment. Once the VM is ready, select **Go to resource**. +It takes a few minutes to create the VM. The Microsoft Entra admin center shows the status of the deployment. Once the VM is ready, select **Go to resource**. - + ## Connect to the Windows Server VM -To securely connect to your VMs, use an Azure Bastion host. With Azure Bastion, a managed host is deployed into your virtual network and provides web-based RDP or SSH connections to VMs. No public IP addresses are required for the VMs, and you don't need to open network security group rules for external remote traffic. You connect to VMs using the Azure portal from your web browser. If needed, [create an Azure Bastion host][azure-bastion]. +To securely connect to your VMs, use an Azure Bastion host. With Azure Bastion, a managed host is deployed into your virtual network and provides web-based RDP or SSH connections to VMs. No public IP addresses are required for the VMs, and you don't need to open network security group rules for external remote traffic. You connect to VMs using the Microsoft Entra admin center from your web browser. If needed, [create an Azure Bastion host][azure-bastion]. To use a Bastion host to connect to your VM, complete the following steps: 1. In the **Overview** pane for your VM, select **Connect**, then **Bastion**. -  +  1. Enter the credentials for your VM that you specified in the previous section, then select **Connect**. -  +  If needed, allow your web browser to open pop-ups for the Bastion connection to be displayed. It takes a few seconds to make the connection to your VM. |
| active-directory-domain-services | Manage Dns | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/manage-dns.md | To complete this article, you need the following resources and privileges: To create and modify DNS records in a managed domain, you need to install the DNS Server tools. These tools can be installed as a feature in Windows Server. For more information on how to install the administrative tools on a Windows client, see install [Remote Server Administration Tools (RSAT)][install-rsat]. -1. Sign in to your management VM. For steps on how to connect using the Azure portal, see [Connect to a Windows Server VM][connect-windows-server-vm]. +1. Sign in to your management VM. For steps on how to connect using the Microsoft Entra admin center, see [Connect to a Windows Server VM][connect-windows-server-vm]. 1. If **Server Manager** doesn't open by default when you sign in to the VM, select the **Start** menu, then choose **Server Manager**. 1. In the *Dashboard* pane of the **Server Manager** window, select **Add Roles and Features**. 1. On the **Before You Begin** page of the *Add Roles and Features Wizard*, select **Next**. |
| active-directory-domain-services | Manage Group Policy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/manage-group-policy.md | To complete this article, you need the following resources and privileges: To create and configure Group Policy Object (GPOs), you need to install the Group Policy Management tools. These tools can be installed as a feature in Windows Server. For more information on how to install the administrative tools on a Windows client, see install [Remote Server Administration Tools (RSAT)][install-rsat]. -1. Sign in to your management VM. For steps on how to connect using the Azure portal, see [Connect to a Windows Server VM][connect-windows-server-vm]. +1. Sign in to your management VM. For steps on how to connect using the Microsoft Entra admin center, see [Connect to a Windows Server VM][connect-windows-server-vm]. 1. **Server Manager** should open by default when you sign in to the VM. If not, on the **Start** menu, select **Server Manager**. 1. In the *Dashboard* pane of the **Server Manager** window, select **Add Roles and Features**. 1. On the **Before You Begin** page of the *Add Roles and Features Wizard*, select **Next**. |
| active-directory-domain-services | Network Considerations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/network-considerations.md | You can connect a virtual network to another virtual network (VNet-to-VNet) in t  -For more information on using virtual private networking, read [Configure a VNet-to-VNet VPN gateway connection by using the Azure portal](../vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal.md). +For more information on using virtual private networking, read [Configure a VNet-to-VNet VPN gateway connection by using the Microsoft Entra admin center](../vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal.md). ## Name resolution when connecting virtual networks The following network security group Inbound rules are required for the managed | Service tag | CorpNetSaw | * | Any | RDP | 3389 | TCP | Allow | Optional | Debugging for support | -Note that the **CorpNetSaw** service tag isn't available by using Azure portal, and the network security group rule for **CorpNetSaw** has to be added by using [PowerShell](powershell-create-instance.md#create-a-network-security-group). +Note that the **CorpNetSaw** service tag isn't available by using the Microsoft Entra admin center, and the network security group rule for **CorpNetSaw** has to be added by using [PowerShell](powershell-create-instance.md#create-a-network-security-group). Azure AD DS also relies on the Default Security rules AllowVnetInBound and AllowAzureLoadBalancerInBound. |
| active-directory-domain-services | Notifications | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/notifications.md | -The health of an Azure Active Directory Domain Services (Azure AD DS) managed domain is monitored by the Azure platform. The health status page in the Azure portal shows any alerts for the managed domain. To make sure issues are responded to in a timely manner, email notifications can be configured to report on health alerts as soon as they're detected in the Azure AD DS managed domain. +The health of an Azure Active Directory Domain Services (Azure AD DS) managed domain is monitored by the Azure platform. The health status page in the Microsoft Entra admin center shows any alerts for the managed domain. To make sure issues are responded to in a timely manner, email notifications can be configured to report on health alerts as soon as they're detected in the Azure AD DS managed domain. This article shows you how to configure email notification recipients for a managed domain. ## Email notification overview -To alert you of issues with a managed domain, you can configure email notifications. These email notifications specify the managed domain that the alert is present on, as well as giving the time of detection and a link to the health page in the Azure portal. You can then follow the provided troubleshooting advice to resolve the issues. +To alert you of issues with a managed domain, you can configure email notifications. These email notifications specify the managed domain that the alert is present on, as well as giving the time of detection and a link to the health page in the Microsoft Entra admin center. You can then follow the provided troubleshooting advice to resolve the issues. The following example email notification indicates a critical warning or alert was generated on the managed domain: The following example email notification indicates a critical warning or alert w ### Why would I receive email notifications? -Azure AD DS sends email notifications for important updates about the managed domain. These notifications are only for urgent issues that impact the service and should be addressed immediately. Each email notification is triggered by an alert on the managed domain. The alerts also appear in the Azure portal and can be viewed on the [Azure AD DS health page][check-health]. +Azure AD DS sends email notifications for important updates about the managed domain. These notifications are only for urgent issues that impact the service and should be addressed immediately. Each email notification is triggered by an alert on the managed domain. The alerts also appear in the Microsoft Entra admin center and can be viewed on the [Azure AD DS health page][check-health]. Azure AD DS doesn't send emails for advertisement, updates, or sales purposes. You can also choose to have all *Global Administrators* of the Azure AD director To review the existing email notification recipients or add additional recipients, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../active-directory/roles/permissions-reference.md#authentication-policy-administrator). +1. Search for and select **Azure AD Domain Services**. 1. Select your managed domain, such as *aaddscontoso.com*. 1. On the left-hand side of the Azure AD DS resource window, select **Notification settings**. The existing recipients for email notifications are shown. 1. To add an email recipient, enter the email address in the additional recipients table. To review the existing email notification recipients or add additional recipient ## Frequently asked questions -### I received an email notification for an alert but when I logged on to the Azure portal there was no alert. What happened? +### I received an email notification for an alert but when I logged on to the Microsoft Entra admin center there was no alert. What happened? -If an alert is resolved, the alert is cleared from the Azure portal. The most likely reason is that someone else who receives email notifications resolved the alert on the managed domain, or it was autoresolved by Azure platform. +If an alert is resolved, the alert is cleared from the Microsoft Entra admin center. The most likely reason is that someone else who receives email notifications resolved the alert on the managed domain, or it was autoresolved by Azure platform. ### Why can I not edit the notification settings? -If you're unable to access the notification settings page in the Azure portal, you don't have the permissions to edit the managed domain. Contact a global administrator to either get permissions to edit Azure AD DS resource or be removed from the recipient list. +If you're unable to access the notification settings page in the Microsoft Entra admin center, you don't have the permissions to edit the managed domain. Contact a global administrator to either get permissions to edit Azure AD DS resource or be removed from the recipient list. ### I don't seem to be receiving email notifications even though I provided my email address. Why? |
| active-directory-domain-services | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/overview.md | An Azure AD DS managed domain lets you run legacy applications in the cloud that Azure AD DS integrates with your existing Azure AD tenant. This integration lets users sign in to services and applications connected to the managed domain using their existing credentials. You can also use existing groups and user accounts to secure access to resources. These features provide a smoother lift-and-shift of on-premises resources to Azure. > [!div class="nextstepaction"]-> [To get started, create an Azure AD DS managed domain using the Azure portal][tutorial-create] +> [To get started, create an Azure AD DS managed domain using the Microsoft Entra admin center][tutorial-create] Take a look at our short video to learn more about Azure AD DS. To learn more about your identity options, [compare Azure AD DS with Azure AD, A The following features of Azure AD DS simplify deployment and management operations: -* **Simplified deployment experience:** Azure AD DS is enabled for your Azure AD tenant using a single wizard in the Azure portal. +* **Simplified deployment experience:** Azure AD DS is enabled for your Azure AD tenant using a single wizard in the Microsoft Entra admin center. * **Integrated with Azure AD:** User accounts, group memberships, and credentials are automatically available from your Azure AD tenant. New users, groups, or changes to attributes from your Azure AD tenant or your on-premises AD DS environment are automatically synchronized to Azure AD DS. * Accounts in external directories linked to your Azure AD aren't available in Azure AD DS. Credentials aren't available for those external directories, so can't be synchronized into a managed domain. * **Use your corporate credentials/passwords:** Passwords for users in Azure AD DS are the same as in your Azure AD tenant. Users can use their corporate credentials to domain-join machines, sign in interactively or over remote desktop, and authenticate against the managed domain. To learn more about Azure AD DS compares with other identity solutions and how s * [Learn how Azure AD Domain Services synchronizes with your Azure AD directory][synchronization] * To learn how to administrator a managed domain, see [management concepts for user accounts, passwords, and administration in Azure AD DS][administration-concepts]. -To get started, [create a managed domain using the Azure portal][tutorial-create]. +To get started, [create a managed domain using the Microsoft Entra admin center][tutorial-create]. <!-- INTERNAL LINKS --> [compare]: compare-identity-solutions.md |
| active-directory-domain-services | Policy Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/policy-reference.md | Title: Built-in policy definitions for Azure Active Directory Domain Services description: Lists Azure Policy built-in policy definitions for Azure Active Directory Domain Services. These built-in policy definitions provide common approaches to managing your Azure resources. Previously updated : 09/13/2023 Last updated : 09/15/2023 definitions for Azure Active Directory Domain Services. For additional Azure Pol other services, see [Azure Policy built-in definitions](../governance/policy/samples/built-in-policies.md). -The name of each built-in policy definition links to the policy definition in the Azure portal. Use +The name of each built-in policy definition links to the policy definition in the Microsoft Entra admin center. Use the link in the **Version** column to view the source on the [Azure Policy GitHub repo](https://github.com/Azure/azure-policy). |
| active-directory-domain-services | Powershell Create Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/powershell-create-instance.md | $domainServiceParams = @{ New-AzADDomainService @domainServiceParams ``` -It takes a few minutes to create the resource and return control to the PowerShell prompt. The managed domain continues to be provisioned in the background, and can take up to an hour to complete the deployment. In the Azure portal, the **Overview** page for your managed domain shows the current status throughout this deployment stage. +It takes a few minutes to create the resource and return control to the PowerShell prompt. The managed domain continues to be provisioned in the background, and can take up to an hour to complete the deployment. In the Microsoft Entra admin center, the **Overview** page for your managed domain shows the current status throughout this deployment stage. -When the Azure portal shows that the managed domain has finished provisioning, the following tasks need to be completed: +When the Microsoft Entra admin center shows that the managed domain has finished provisioning, the following tasks need to be completed: * Update DNS settings for the virtual network so virtual machines can find the managed domain for domain join or authentication. * To configure DNS, select your managed domain in the portal. On the **Overview** window, you are prompted to automatically configure these DNS settings. $domainServiceParams = @{ New-AzADDomainService @domainServiceParams ``` -It takes a few minutes to create the resource and return control to the PowerShell prompt. The managed domain continues to be provisioned in the background, and can take up to an hour to complete the deployment. In the Azure portal, the **Overview** page for your managed domain shows the current status throughout this deployment stage. +It takes a few minutes to create the resource and return control to the PowerShell prompt. The managed domain continues to be provisioned in the background, and can take up to an hour to complete the deployment. In the Microsoft Entra admin center, the **Overview** page for your managed domain shows the current status throughout this deployment stage. -When the Azure portal shows that the managed domain has finished provisioning, the following tasks need to be completed: +When the Microsoft Entra admin center shows that the managed domain has finished provisioning, the following tasks need to be completed: * Update DNS settings for the virtual network so virtual machines can find the managed domain for domain join or authentication. * To configure DNS, select your managed domain in the portal. On the **Overview** window, you are prompted to automatically configure these DNS settings. |
| active-directory-domain-services | Powershell Scoped Synchronization | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/powershell-scoped-synchronization.md | To provide authentication services, Azure Active Directory Domain Services (Azur By default, all users and groups from an Azure AD directory are synchronized to an Azure AD DS managed domain. If you have specific needs, you can instead choose to synchronize only a defined set of users. -This article shows you how to create a managed domain that uses scoped synchronization and then change or disable the set of scoped users using Azure AD PowerShell. You can also [complete these steps using the Azure portal][scoped-sync]. +This article shows you how to create a managed domain that uses scoped synchronization and then change or disable the set of scoped users using Azure AD PowerShell. You can also [complete these steps using the Microsoft Entra admin center][scoped-sync]. ## Before you begin |
| active-directory-domain-services | Scoped Synchronization | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/scoped-synchronization.md | Title: Scoped synchronization for Azure AD Domain Services | Microsoft Docs -description: Learn how to use the Azure portal to configure scoped synchronization from Azure AD to an Azure Active Directory Domain Services managed domain +description: Learn how to use the Microsoft Entra admin center to configure scoped synchronization from Azure AD to an Azure Active Directory Domain Services managed domain -# Configure scoped synchronization from Azure AD to Azure Active Directory Domain Services using the Azure portal +# Configure scoped synchronization from Azure AD to Azure Active Directory Domain Services using the Microsoft Entra admin center To provide authentication services, Azure Active Directory Domain Services (Azure AD DS) synchronizes users and groups from Azure AD. In a hybrid environment, users and groups from an on-premises Active Directory Domain Services (AD DS) environment can be first synchronized to Azure AD using Azure AD Connect, and then synchronized to an Azure AD DS managed domain. By default, all users and groups from an Azure AD directory are synchronized to a managed domain. If only some users need to use Azure AD DS, you can instead choose to synchronize only groups of users. You can filter synchronization for groups on-premises, cloud only, or both. -This article shows you how to configure scoped synchronization and then change or disable the set of scoped users using the Azure portal. You can also [complete these steps using PowerShell][scoped-sync-powershell]. +This article shows you how to configure scoped synchronization and then change or disable the set of scoped users using the Microsoft Entra admin center. You can also [complete these steps using PowerShell][scoped-sync-powershell]. :::image type="content" border="true" source="./media/scoped-synchronization/filter.png" alt-text="Screenshot of group filter option."::: To learn more about the synchronization process, see [Understand synchronization ## Enable scoped synchronization -To enable scoped synchronization in the Azure portal, complete the following steps: +To enable scoped synchronization in the Microsoft Entra admin center, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. 1. Select **Synchronization** from the menu on the left-hand side. 1. For *Synchronization scope*, select **All** or **Cloud Only**. 1. To filter synchronization for selected groups, click **Show selected groups**, choose whether to synchronize cloud-only groups, on-premises groups, or both. For example, the following screenshot shows how to synchronize only three groups that were created in Azure AD. Only users who belong to those groups will have their accounts synchronized to Azure AD DS. Changing the scope of synchronization causes the managed domain to resynchronize To modify the list of groups whose users should be synchronized to the managed domain, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. 1. Select **Synchronization** from the menu on the left-hand side. 1. To add a group, choose **+ Add groups** at the top, then choose the groups to add. 1. To remove a group from the synchronization scope, select it from the list of currently synchronized groups and choose **Remove groups**. Changing the scope of synchronization causes the managed domain to resynchronize To disable group-based scoped synchronization for a managed domain, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. 1. Select **Synchronization** from the menu on the left-hand side. 1. Clear the check box for **Show selected groups**, and click **Save synchronization scope**. |
| active-directory-domain-services | Security Audit Events | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/security-audit-events.md | -You can archive events into Azure storage and stream events into security information and event management (SIEM) software (or equivalent) using Azure Event Hubs, or do your own analysis and using Azure Log Analytics workspaces from the Azure portal. +You can archive events into Azure storage and stream events into security information and event management (SIEM) software (or equivalent) using Azure Event Hubs, or do your own analysis and using Azure Log Analytics workspaces from the Microsoft Entra admin center. ## Security audit destinations You can use Azure Storage, Azure Event Hubs, or Azure Log Analytics workspaces a The following table outlines scenarios for each destination resource type. > [!IMPORTANT]-> You need to create the target resource before you enable Azure AD DS security audits. You can create these resources using the Azure portal, Azure PowerShell, or the Azure CLI. +> You need to create the target resource before you enable Azure AD DS security audits. You can create these resources using the Microsoft Entra admin center, Azure PowerShell, or the Azure CLI. | Target Resource | Scenario | |:|:| |Azure Storage| This target should be used when your primary need is to store security audit events for archival purposes. Other targets can be used for archival purposes, however those targets provide capabilities beyond the primary need of archiving. <br /><br />Before you enable Azure AD DS security audit events, first [Create an Azure Storage account](../storage/common/storage-account-create.md).|-|Azure Event Hubs| This target should be used when your primary need is to share security audit events with additional software such as data analysis software or security information & event management (SIEM) software.<br /><br />Before you enable Azure AD DS security audit events, [Create an event hub using Azure portal](../event-hubs/event-hubs-create.md)| -|Azure Log Analytics Workspace| This target should be used when your primary need is to analyze and review secure audits from the Azure portal directly.<br /><br />Before you enable Azure AD DS security audit events, [Create a Log Analytics workspace in the Azure portal.](../azure-monitor/logs/quick-create-workspace.md)| +|Azure Event Hubs| This target should be used when your primary need is to share security audit events with additional software such as data analysis software or security information & event management (SIEM) software.<br /><br />Before you enable Azure AD DS security audit events, [Create an event hub using Microsoft Entra admin center](../event-hubs/event-hubs-create.md)| +|Azure Log Analytics Workspace| This target should be used when your primary need is to analyze and review secure audits from the Microsoft Entra admin center directly.<br /><br />Before you enable Azure AD DS security audit events, [Create a Log Analytics workspace in the Microsoft Entra admin center.](../azure-monitor/logs/quick-create-workspace.md)| -## Enable security audit events using the Azure portal +## Enable security audit events using the Microsoft Entra admin center -To enable Azure AD DS security audit events using the Azure portal, complete the following steps. +To enable Azure AD DS security audit events using the Microsoft Entra admin center, complete the following steps. > [!IMPORTANT] > Azure AD DS security audits aren't retroactive. You can't retrieve or replay events from the past. Azure AD DS can only send events that occur after security audits are enabled. -1. Sign in to the Azure portal. -1. At the top of the Azure portal, search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a Global Administrator. +1. Search for and select **Azure AD Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. 1. In the Azure AD DS window, select **Diagnostic settings** on the left-hand side. 1. No diagnostics are configured by default. To get started, select **Add diagnostic setting**. |
| active-directory-domain-services | Suspension | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/suspension.md | The following behavior is experienced when a managed domain is in the *Suspended ### How do you know if your managed domain is suspended? -You see an [alert][resolve-alerts] on the Azure AD DS Health page in the Azure portal that notes the domain is suspended. The state of the domain also shows *Suspended*. +You see an [alert][resolve-alerts] on the Azure AD DS Health page in the Microsoft Entra admin center that notes the domain is suspended. The state of the domain also shows *Suspended*. ### Restore a suspended domain To restore the health of a managed domain that's in the *Suspended* state, complete the following steps: -1. In the Azure portal, search for and select **Domain services**. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Domain services**. 1. Choose your managed domain from the list, such as *aaddscontoso.com*, then select **Health**. 1. Select the alert, such as *AADDS503* or *AADDS504*, depending on the cause of suspension. 1. Choose the resolution link that's provided in the alert and follow the steps to resolve it. |
| active-directory-domain-services | Template Create Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/template-create-instance.md | The following complete Resource Manager sample template creates a managed domain } ``` -This template can be deployed using your preferred deployment method, such as the [Azure portal][portal-deploy], [Azure PowerShell][powershell-deploy], or a CI/CD pipeline. The following example uses the [New-AzResourceGroupDeployment][New-AzResourceGroupDeployment] cmdlet. Specify your own resource group name and template filename: +This template can be deployed using your preferred deployment method, such as the [Microsoft Entra admin center][portal-deploy], [Azure PowerShell][powershell-deploy], or a CI/CD pipeline. The following example uses the [New-AzResourceGroupDeployment][New-AzResourceGroupDeployment] cmdlet. Specify your own resource group name and template filename: ```powershell New-AzResourceGroupDeployment -ResourceGroupName "myResourceGroup" -TemplateFile <path-to-template> ``` -It takes a few minutes to create the resource and return control to the PowerShell prompt. The managed domain continues to be provisioned in the background, and can take up to an hour to complete the deployment. In the Azure portal, the **Overview** page for your managed domain shows the current status throughout this deployment stage. +It takes a few minutes to create the resource and return control to the PowerShell prompt. The managed domain continues to be provisioned in the background, and can take up to an hour to complete the deployment. In the Microsoft Entra admin center, the **Overview** page for your managed domain shows the current status throughout this deployment stage. -When the Azure portal shows that the managed domain has finished provisioning, the following tasks need to be completed: +When the Microsoft Entra admin center shows that the managed domain has finished provisioning, the following tasks need to be completed: * Update DNS settings for the virtual network so virtual machines can find the managed domain for domain join or authentication. * To configure DNS, select your managed domain in the portal. On the **Overview** window, you are prompted to automatically configure these DNS settings. |
| active-directory-domain-services | Troubleshoot Alerts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/troubleshoot-alerts.md | Inside a virtual network, VMs can make requests to Azure resources in the same I To resolve this alert, delete your existing managed domain and recreate it in a virtual network with a private IP address range. This process is disruptive as the managed domain is unavailable and any custom resources you've created like OUs or service accounts are lost. 1. [Delete the managed domain](delete-aadds.md) from your directory.-1. To update the virtual network IP address range, search for and select *Virtual network* in the Azure portal. Select the virtual network for Azure AD DS that incorrectly has a public IP address range set. +1. To update the virtual network IP address range, search for and select *Virtual network* in the Microsoft Entra admin center. Select the virtual network for Azure AD DS that incorrectly has a public IP address range set. 1. Under **Settings**, select *Address Space*. 1. Update the address range by choosing the existing address range and editing it, or adding an additional address range. Make sure the new IP address range is in a private IP range. When ready, **Save** the changes. 1. Select **Subnets** in the left-hand navigation. Azure AD DS creates additional resources to function properly, such as public IP This alert is generated when one of these required resources is deleted. If the resource was deleted less than 4 hours ago, there's a chance that the Azure platform can automatically recreate the deleted resource. The following steps outline how to check the health status and timestamp for resource deletion: -1. In the Azure portal, search for and select **Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select **Domain Services**. Choose your managed domain, such as *aaddscontoso.com*. 1. In the left-hand navigation, select **Health**. 1. In the health page, select the alert with the ID *AADDS109*. 1. The alert has a timestamp for when it was first found. If that timestamp is less than 4 hours ago, the Azure platform may be able to automatically recreate the resource and resolve the alert by itself. This error is unrecoverable. To resolve the alert, [delete your existing managed Some automatically generated service principals are used to manage and create resources for a managed domain. If the access permissions for one of these service principals is changed, the domain is unable to correctly manage resources. The following steps show you how to understand and then grant access permissions to a service principal: -1. Read about [Azure role-based access control and how to grant access to applications in the Azure portal](../role-based-access-control/role-assignments-portal.md). +1. Read about [Azure role-based access control and how to grant access to applications in the Microsoft Entra admin center](../role-based-access-control/role-assignments-portal.md). 2. Review the access that the service principal with the ID *abba844e-bc0e-44b0-947a-dc74e5d09022* has and grant the access that was denied at an earlier date. ## AADDS112: Not enough IP address in the managed domain The virtual network subnet for Azure AD DS needs enough IP addresses for the aut To resolve this alert, delete your existing managed domain and re-create it in a virtual network with a large enough IP address range. This process is disruptive as the managed domain is unavailable and any custom resources you've created like OUs or service accounts are lost. 1. [Delete the managed domain](delete-aadds.md) from your directory.-1. To update the virtual network IP address range, search for and select *Virtual network* in the Azure portal. Select the virtual network for the managed domain that has the small IP address range. +1. To update the virtual network IP address range, search for and select *Virtual network* in the Microsoft Entra admin center. Select the virtual network for the managed domain that has the small IP address range. 1. Under **Settings**, select *Address Space*. 1. Update the address range by choosing the existing address range and editing it, or adding an additional address range. Make sure the new IP address range is large enough for the managed domain's subnet range. When ready, **Save** the changes. 1. Select **Subnets** in the left-hand navigation. Resource locks can be applied to Azure resources to prevent change or deletion. To check for resource locks on the Azure AD DS components and remove them, complete the following steps: -1. For each of the managed domain's network components in your resource group, such as virtual network, network interface, or public IP address, check the operation logs in the Azure portal. These operation logs should indicate why an operation is failing and where a resource lock is applied. +1. For each of the managed domain's network components in your resource group, such as virtual network, network interface, or public IP address, check the operation logs in the Microsoft Entra admin center. These operation logs should indicate why an operation is failing and where a resource lock is applied. 1. Select the resource where a lock is applied, then under **Locks**, select and remove the lock(s). ## AADDS116: Resources are unusable Policies are applied to Azure resources and resource groups that control what co To check for applied policies on the Azure AD DS components and update them, complete the following steps: -1. For each of the managed domain's network components in your resource group, such as virtual network, NIC, or public IP address, check the operation logs in the Azure portal. These operation logs should indicate why an operation is failing and where a restrictive policy is applied. +1. For each of the managed domain's network components in your resource group, such as virtual network, NIC, or public IP address, check the operation logs in the Microsoft Entra admin center. These operation logs should indicate why an operation is failing and where a restrictive policy is applied. 1. Select the resource where a policy is applied, then under **Policies**, select and edit the policy so it's less restrictive. ## AADDS120: The managed domain has encountered an error onboarding one or more custom attributes |
| active-directory-domain-services | Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/troubleshoot.md | This failure is due to name conflicts for the domain name on the virtual network Check if there's an application named *Azure AD Domain Services Sync* in your Azure AD directory. If this application exists, delete it, then try again to enable Azure AD DS. To check for an existing application and delete it if needed, complete the following steps: -1. In the Azure portal, select **Azure Active Directory** from the left-hand navigation menu. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), select **Azure Active Directory** from the left-hand navigation menu. 1. Select **Enterprise applications**. Choose *All applications* from the **Application Type** drop-down menu, then select **Apply**. 1. In the search box, enter *Azure AD Domain Services Sync*. If the application exists, select it and choose **Delete**. 1. Once you've deleted the application, try to enable Azure AD DS again. Check if you've disabled an application with the identifier *00000002-0000-0000- To check the status of this application and enable it if needed, complete the following steps: -1. In the Azure portal, select **Azure Active Directory** from the left-hand navigation menu. -1. Select **Enterprise applications**. Choose *All applications* from the **Application Type** drop-down menu, then select **Apply**. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), seearch for and select **Enterprise applications**. +1. Choose *All applications* from the **Application Type** drop-down menu, then select **Apply**. 1. In the search box, enter *00000002-0000-0000-c000-00000000000*. Select the application, then choose **Properties**. 1. If **Enabled for users to sign-in** is set to *No*, set the value to *Yes*, then select **Save**. 1. Once you've enabled the application, try to enable Azure AD DS again. |
| active-directory-domain-services | Tutorial Configure Ldaps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/tutorial-configure-ldaps.md | To complete this tutorial, you need the following resources and privileges: * If needed, [install the Remote Server Administration Tools (RSAT)][rsat] for *Active Directory Domain Services and LDAP*. * You need [Application Administrator](../active-directory/roles/permissions-reference.md#application-administrator) and [Groups Administrator](../active-directory/roles/permissions-reference.md#groups-administrator) Azure AD roles in your tenant to enable secure LDAP. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you configure secure LDAP for the managed domain using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this tutorial, you configure secure LDAP for the managed domain using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Create a certificate for secure LDAP The *.CER* certificate file can now be distributed to client computers that need With a digital certificate created and exported that includes the private key, and the client computer set to trust the connection, now enable secure LDAP on your managed domain. To enable secure LDAP on a managed domain, perform the following configuration steps: -1. In the [Azure portal](https://portal.azure.com), enter *domain services* in the **Search resources** box. Select **Azure AD Domain Services** from the search result. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), enter *domain services* in the **Search resources** box. Select **Azure AD Domain Services** from the search result. 1. Choose your managed domain, such as *aaddscontoso.com*. 1. On the left-hand side of the Azure AD DS window, choose **Secure LDAP**. 1. By default, secure LDAP access to your managed domain is disabled. Toggle **Secure LDAP** to **Enable**. With a digital certificate created and exported that includes the private key, a 1. Enter the **Password to decrypt .PFX file** set in a previous step when the certificate was exported to a *.PFX* file. 1. Select **Save** to enable secure LDAP. -  +  A notification is displayed that secure LDAP is being configured for the managed domain. You can't modify other settings for the managed domain until this operation is complete. Some common reasons for failure are if the domain name is incorrect, the encrypt ## Change an expiring certificate 1. Create a replacement secure LDAP certificate by following the steps to [create a certificate for secure LDAP](#create-a-certificate-for-secure-ldap).-1. To apply the replacement certificate to Azure AD DS, in the left menu for Azure AD DS in the Azure portal, select **Secure LDAP**, and then select **Change Certificate**. +1. To apply the replacement certificate to Azure AD DS, in the left menu for Azure AD DS in the Microsoft Entra admin center, select **Secure LDAP**, and then select **Change Certificate**. 1. Distribute the certificate to any clients that connect by using secure LDAP. ## Lock down secure LDAP access over the internet When you enable secure LDAP access over the internet to your managed domain, it Let's create a rule to allow inbound secure LDAP access over TCP port 636 from a specified set of IP addresses. A default *DenyAll* rule with a lower priority applies to all other inbound traffic from the internet, so only the specified addresses can reach your managed domain using secure LDAP. -1. In the Azure portal, select *Resource groups* on the left-hand side navigation. +1. In the [Microsoft Entra admin center](https://entra.microsoft.com), search for and select *Resource groups*. 1. Choose your resource group, such as *myResourceGroup*, then select your network security group, such as *aaads-nsg*. 1. The list of existing inbound and outbound security rules are displayed. On the left-hand side of the network security group window, choose **Settings > Inbound security rules**. 1. Select **Add**, then create a rule to allow *TCP* port *636*. For improved security, choose the source as *IP Addresses* and then specify your own valid IP address or range for your organization. Let's create a rule to allow inbound secure LDAP access over TCP port 636 from a With secure LDAP access enabled over the internet, update the DNS zone so that client computers can find this managed domain. The *Secure LDAP external IP address* is listed on the **Properties** tab for your managed domain: - + Configure your external DNS provider to create a host record, such as *ldaps*, to resolve to this external IP address. To test locally on your machine first, you can create an entry in the Windows hosts file. To successfully edit the hosts file on your local machine, open *Notepad* as an administrator, then open the file *C:\Windows\System32\drivers\etc\hosts* |
| active-directory-domain-services | Tutorial Configure Networking | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/tutorial-configure-networking.md | Title: Tutorial - Configure virtual networking for Azure AD Domain Services | Microsoft Docs -description: In this tutorial, you learn how to create and configure an Azure virtual network subnet or network peering for an Azure Active Directory Domain Services managed domain using the Azure portal. +description: In this tutorial, you learn how to create and configure an Azure virtual network subnet or network peering for an Azure Active Directory Domain Services managed domain using the Microsoft Entra admin center. To complete this tutorial, you need the following resources and privileges: * An Azure Active Directory Domain Services managed domain enabled and configured in your Azure AD tenant. * If needed, the first tutorial [creates and configures an Azure Active Directory Domain Services managed domain][create-azure-ad-ds-instance]. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you create and configure the managed domain using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this tutorial, you create and configure the managed domain using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Application workload connectivity options By default, the Azure virtual network created with the managed domain contains a To create a virtual network subnet for VMs and application workloads, complete the following steps: -1. In the Azure portal, select the resource group of your managed domain, such as *myResourceGroup*. From the list of resources, choose the default virtual network, such as *aadds-vnet*. +1. In the Microsoft Entra admin center, select the resource group of your managed domain, such as *myResourceGroup*. From the list of resources, choose the default virtual network, such as *aadds-vnet*. 1. In the left-hand menu of the virtual network window, select **Address space**. The virtual network is created with a single address space of *10.0.2.0/24*, which is used by the default subnet. Add an additional IP address range to the virtual network. The size of this address range and the actual IP address range to use depends on other network resources already deployed. The IP address range shouldn't overlap with any existing address ranges in your Azure or on-premises environment. Make sure that you size the IP address range large enough for the number of VMs you expect to deploy into the subnet. In the following example, an additional IP address range of *10.0.3.0/24* is added. When ready, select **Save**. -  +  1. Next, in the left-hand menu of the virtual network window, select **Subnets**, then choose **+ Subnet** to add a subnet. 1. Enter a name for the subnet, such as *workloads*. If needed, update the **Address range** if you want to use a subset of the IP address range configured for the virtual network in the previous steps. For now, leave the defaults for options like network security group, route table, service endpoints. In the following example, a subnet named *workloads* is created that uses the *10.0.3.0/24* IP address range: -  +  1. When ready, select **OK**. It takes a few moments to create the virtual network subnet. To peer a virtual network to the managed domain virtual network, complete the fo * **Virtual network**: The virtual network you want to peer to, such as *myVnet* * **Name of the peering from myVnet to aadds-vnet**: A descriptive identifier of the two networks, such as *myvnet-to-aadds-vnet* -  +  Leave any other defaults for virtual network access or forwarded traffic unless you have specific requirements for your environment, then select **OK**. 1. It takes a few moments to create the peering on both the Azure AD DS virtual network and the virtual network you selected. When ready, the **Peering status** reports *Connected*, as shown in the following example: -  +  Before VMs in the peered virtual network can use the managed domain, configure the DNS servers to allow for correct name resolution. For VMs and applications in the peered virtual network to successfully talk to t In this tutorial, let's configure the Azure virtual network DNS servers to direct all queries to the Azure AD DS domain controllers. -1. In the Azure portal, select the resource group of the peered virtual network, such as *myResourceGroup*. From the list of resources, choose the peered virtual network, such as *myVnet*. +1. In the Microsoft Entra admin center, select the resource group of the peered virtual network, such as *myResourceGroup*. From the list of resources, choose the peered virtual network, such as *myVnet*. 1. In the left-hand menu of the virtual network window, select **DNS servers**. 1. By default, a virtual network uses the built-in Azure-provided DNS servers. Choose to use **Custom** DNS servers. Enter the IP addresses for the Azure AD DS domain controllers, which are usually *10.0.2.4* and *10.0.2.5*. Confirm these IP addresses on the **Overview** window of your managed domain in the portal. |
| active-directory-domain-services | Tutorial Create Forest Trust | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/tutorial-create-forest-trust.md | Title: Tutorial - Create a forest trust in Azure AD Domain Services | Microsoft Docs -description: Learn how to create a one-way outbound forest to an on-premises AD DS domain in the Azure portal for Azure AD Domain Services +description: Learn how to create a one-way outbound forest to an on-premises AD DS domain in the Microsoft Entra admin center for Azure AD Domain Services To complete this tutorial, you need the following resources and privileges: > [!IMPORTANT] > You need to use a minimum of *Enterprise* SKU for your managed domain. If needed, [change the SKU for a managed domain][howto-change-sku]. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you create and configure the outbound forest trust from Azure AD DS using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). You need [Application Administrator](../active-directory/roles/permissions-reference.md#application-administrator) and [Groups Administrator](../active-directory/roles/permissions-reference.md#groups-administrator) Azure AD roles in your tenant to modify an Azure AD DS instance. +In this tutorial, you create and configure the outbound forest trust from Azure AD DS using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). You need [Application Administrator](../active-directory/roles/permissions-reference.md#application-administrator) and [Groups Administrator](../active-directory/roles/permissions-reference.md#groups-administrator) Azure AD roles in your tenant to modify an Azure AD DS instance. ## Networking considerations To correctly resolve the managed domain from the on-premises environment, you ma ## Create inbound forest trust in the on-premises domain -The on-premises AD DS domain needs an incoming forest trust for the managed domain. This trust must be manually created in the on-premises AD DS domain, it can't be created from the Azure portal. +The on-premises AD DS domain needs an incoming forest trust for the managed domain. This trust must be manually created in the on-premises AD DS domain, it can't be created from the Microsoft Entra admin center. To configure inbound trust on the on-premises AD DS domain, complete the following steps from a management workstation for the on-premises AD DS domain: To configure inbound trust on the on-premises AD DS domain, complete the followi 1. Choose **Trusts** tab, then **New Trust**. 1. Enter the name for Azure AD DS domain name, such as *aaddscontoso.com*, then select **Next**. 1. Select the option to create a **Forest trust**, then to create a **One way: incoming** trust.-1. Choose to create the trust for **This domain only**. In the next step, you create the trust in the Azure portal for the managed domain. -1. Choose to use **Forest-wide authentication**, then enter and confirm a trust password. This same password is also entered in the Azure portal in the next section. +1. Choose to create the trust for **This domain only**. In the next step, you create the trust in the Microsoft Entra admin center for the managed domain. +1. Choose to use **Forest-wide authentication**, then enter and confirm a trust password. This same password is also entered in the Microsoft Entra admin center in the next section. 1. Step through the next few windows with default options, then choose the option for **No, do not confirm the outgoing trust**. 1. Select **Finish**. If the forest trust is no longer needed for an environment, complete the followi With the on-premises AD DS domain configured to resolve the managed domain and an inbound forest trust created, now create the outbound forest trust. This outbound forest trust completes the trust relationship between the on-premises AD DS domain and the managed domain. -To create the outbound trust for the managed domain in the Azure portal, complete the following steps: +To create the outbound trust for the managed domain in the Microsoft Entra admin center, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**, then select your managed domain, such as *aaddscontoso.com*. +1. In the Microsoft Entra admin center, search for and select **Azure AD Domain Services**, then select your managed domain, such as *aaddscontoso.com*. 1. From the menu on the left-hand side of the managed domain, select **Trusts**, then choose to **+ Add** a trust. 1. Enter a display name that identifies your trust, then the on-premises trusted forest DNS name, such as *onprem.contoso.com*. 1. Provide the same trust password that was used to configure the inbound forest trust for the on-premises AD DS domain in the previous section. 1. Provide at least two DNS servers for the on-premises AD DS domain, such as *10.1.1.4* and *10.1.1.5*. 1. When ready, **Save** the outbound forest trust. -  +  If the forest trust is no longer needed for an environment, complete the following steps to remove it from Azure AD DS: -1. In the Azure portal, search for and select **Azure AD Domain Services**, then select your managed domain, such as *aaddscontoso.com*. +1. In the Microsoft Entra admin center, search for and select **Azure AD Domain Services**, then select your managed domain, such as *aaddscontoso.com*. 1. From the menu on the left-hand side of the managed domain, select **Trusts**, choose the trust, and click **Remove**. 1. Provide the same trust password that was used to configure the forest trust and click **OK**. |
| active-directory-domain-services | Tutorial Create Instance Advanced | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/tutorial-create-instance-advanced.md | Title: Tutorial - Create a customized Azure Active Directory Domain Services managed domain | Microsoft Docs -description: In this tutorial, you learn how to create and configure a customized Azure Active Directory Domain Services managed domain and specify advanced configuration options using the Azure portal. +description: In this tutorial, you learn how to create and configure a customized Azure Active Directory Domain Services managed domain and specify advanced configuration options using the Microsoft Entra admin center. -You can [create a managed domain using default configuration options][tutorial-create-instance] for networking and synchronization, or manually define these settings. This tutorial shows you how to define those advanced configuration options to create and configure an Azure AD DS managed domain using the Azure portal. +You can [create a managed domain using default configuration options][tutorial-create-instance] for networking and synchronization, or manually define these settings. This tutorial shows you how to define those advanced configuration options to create and configure an Azure AD DS managed domain using the Microsoft Entra admin center. In this tutorial, you learn how to: Although not required for Azure AD DS, it's recommended to [configure self-servi > [!IMPORTANT] > After you create a managed domain, you can't move it to a different subscription, resource group, or region. Take care to select the most appropriate subscription, resource group, and region when you deploy the managed domain. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you create and configure the managed domain using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this tutorial, you create and configure the managed domain using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Create a managed domain and configure basic settings To launch the **Enable Azure AD Domain Services** wizard, complete the following steps: -1. On the Azure portal menu or from the **Home** page, select **Create a resource**. +1. On the Microsoft Entra admin center menu or from the **Home** page, select **Create a resource**. 1. Enter *Domain Services* into the search bar, then choose *Azure AD Domain Services* from the search suggestions. 1. On the Azure AD Domain Services page, select **Create**. The **Enable Azure AD Domain Services** wizard is launched. 1. Select the Azure **Subscription** in which you would like to create the managed domain. The following DNS name restrictions also apply: * If the virtual network where you plan to enable the managed domain has a VPN connection with your on-premises network. In this scenario, ensure you don't have a domain with the same DNS domain name on your on-premises network. * If you have an existing Azure cloud service with that name on the Azure virtual network. -Complete the fields in the *Basics* window of the Azure portal to create a managed domain: +Complete the fields in the *Basics* window of the Microsoft Entra admin center to create a managed domain: 1. Enter a **DNS domain name** for your managed domain, taking into consideration the previous points. 1. Choose the Azure **Location** in which the managed domain should be created. If you choose a region that supports Availability Zones, the Azure AD DS resources are distributed across zones for additional redundancy. On the **Summary** page of the wizard, review the configuration settings for you 1. To create the managed domain, select **Create**. A note is displayed that certain configuration options like DNS name or virtual network can't be changed once the Azure AD DS managed has been created. To continue, select **OK**. 1. The process of provisioning your managed domain can take up to an hour. A notification is displayed in the portal that shows the progress of your Azure AD DS deployment. Select the notification to see detailed progress for the deployment. -  +  1. Select your resource group, such as *myResourceGroup*, then choose your managed domain from the list of Azure resources, such as *aaddscontoso.com*. The **Overview** tab shows that the managed domain is currently *Deploying*. You can't configure the managed domain until it's fully provisioned. With Azure AD DS successfully deployed, now configure the virtual network to all 1. To update the DNS server settings for the virtual network, select the **Configure** button. The DNS settings are automatically configured for your virtual network. > [!TIP]-> If you selected an existing virtual network in the previous steps, any VMs connected to the network only get the new DNS settings after a restart. You can restart VMs using the Azure portal, Azure PowerShell, or the Azure CLI. +> If you selected an existing virtual network in the previous steps, any VMs connected to the network only get the new DNS settings after a restart. You can restart VMs using the Microsoft Entra admin center, Azure PowerShell, or the Azure CLI. ## Enable user accounts for Azure AD DS To authenticate users on the managed domain, Azure AD DS needs password hashes i The steps to generate and store these password hashes are different for cloud-only user accounts created in Azure AD versus user accounts that are synchronized from your on-premises directory using Azure AD Connect. -A cloud-only user account is an account that was created in your Azure AD directory using either the Azure portal or Azure AD PowerShell cmdlets. These user accounts aren't synchronized from an on-premises directory. +A cloud-only user account is an account that was created in your Azure AD directory using either the Microsoft Entra admin center or Azure AD PowerShell cmdlets. These user accounts aren't synchronized from an on-premises directory. In this tutorial, let's work with a basic cloud-only user account. For more information on the additional steps required to use Azure AD Connect, see [Synchronize password hashes for user accounts synced from your on-premises AD to your managed domain][on-prem-sync]. |
| active-directory-domain-services | Tutorial Create Instance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/tutorial-create-instance.md | Title: Tutorial - Create an Azure Active Directory Domain Services managed domain | Microsoft Docs -description: In this tutorial, you learn how to create and configure an Azure Active Directory Domain Services managed domain using the Azure portal. +description: In this tutorial, you learn how to create and configure an Azure Active Directory Domain Services managed domain using the Microsoft Entra admin center. -You can create a managed domain using default configuration options for networking and synchronization, or [manually define these settings][tutorial-create-instance-advanced]. This tutorial shows you how to use default options to create and configure an Azure AD DS managed domain using the Azure portal. +You can create a managed domain using default configuration options for networking and synchronization, or [manually define these settings][tutorial-create-instance-advanced]. This tutorial shows you how to use default options to create and configure an Azure AD DS managed domain using the Microsoft Entra admin center. In this tutorial, you learn how to: Although not required for Azure AD DS, it's recommended to [configure self-servi > [!IMPORTANT] > You can't move the managed domain to a different subscription, resource group, or region after you create it. Take care to select the most appropriate subscription, resource group, and region when you deploy the managed domain. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you create and configure the managed domain using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this tutorial, you create and configure the managed domain using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Create a managed domain To launch the **Enable Azure AD Domain Services** wizard, complete the following steps: -1. On the Azure portal menu or from the **Home** page, select **Create a resource**. +1. On the Microsoft Entra admin center menu or from the **Home** page, select **Create a resource**. 1. Enter *Domain Services* into the search bar, then choose *Azure AD Domain Services* from the search suggestions. 1. On the Azure AD Domain Services page, select **Create**. The **Enable Azure AD Domain Services** wizard is launched. 1. Select the Azure **Subscription** in which you would like to create the managed domain. The following DNS name restrictions also apply: * If the virtual network where you plan to enable the managed domain has a VPN connection with your on-premises network. In this scenario, ensure you don't have a domain with the same DNS domain name on your on-premises network. * If you have an existing Azure cloud service with that name on the Azure virtual network. -Complete the fields in the *Basics* window of the Azure portal to create a managed domain: +Complete the fields in the *Basics* window of the Microsoft Entra admin center to create a managed domain: 1. Enter a **DNS domain name** for your managed domain, taking into consideration the previous points. 1. Choose the Azure **Location** in which the managed domain should be created. If you choose a region that supports Azure Availability Zones, the Azure AD DS resources are distributed across zones for additional redundancy. On the **Summary** page of the wizard, review the configuration settings for you 1. To create the managed domain, select **Create**. A note is displayed that certain configuration options such as DNS name or virtual network can't be changed once the Azure AD DS managed has been created. To continue, select **OK**. 1. The process of provisioning your managed domain can take up to an hour. A notification is displayed in the portal that shows the progress of your Azure AD DS deployment. Select the notification to see detailed progress for the deployment. -  +  1. The page will load with updates on the deployment process, including the creation of new resources in your directory. 1. Select your resource group, such as *myResourceGroup*, then choose your managed domain from the list of Azure resources, such as *aaddscontoso.com*. The **Overview** tab shows that the managed domain is currently *Deploying*. You can't configure the managed domain until it's fully provisioned. With Azure AD DS successfully deployed, now configure the virtual network to all 1. To update the DNS server settings for the virtual network, select the **Configure** button. The DNS settings are automatically configured for your virtual network. > [!TIP]-> If you selected an existing virtual network in the previous steps, any VMs connected to the network only get the new DNS settings after a restart. You can restart VMs using the Azure portal, Azure PowerShell, or the Azure CLI. +> If you selected an existing virtual network in the previous steps, any VMs connected to the network only get the new DNS settings after a restart. You can restart VMs using the Microsoft Entra admin center, Azure PowerShell, or the Azure CLI. ## Enable user accounts for Azure AD DS To authenticate users on the managed domain, Azure AD DS needs password hashes i The steps to generate and store these password hashes are different for cloud-only user accounts created in Azure AD versus user accounts that are synchronized from your on-premises directory using Azure AD Connect. -A cloud-only user account is an account that was created in your Azure AD directory using either the Azure portal or Azure AD PowerShell cmdlets. These user accounts aren't synchronized from an on-premises directory. +A cloud-only user account is an account that was created in your Azure AD directory using either the Microsoft Entra admin center or Azure AD PowerShell cmdlets. These user accounts aren't synchronized from an on-premises directory. > In this tutorial, let's work with a basic cloud-only user account. For more information on the additional steps required to use Azure AD Connect, see [Synchronize password hashes for user accounts synced from your on-premises AD to your managed domain][on-prem-sync]. |
| active-directory-domain-services | Tutorial Create Management Vm | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/tutorial-create-management-vm.md | To complete this tutorial, you need the following resources and privileges: * An Azure Bastion host deployed in your Azure AD DS virtual network. * If needed, [create an Azure Bastion host][azure-bastion]. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you create and configure a management VM using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this tutorial, you create and configure a management VM using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Available administrative tasks in Azure AD DS In the previous tutorial, a Windows Server VM was created and joined to the mana To get started, connect to the Windows Server VM as follows: -1. In the Azure portal, select **Resource groups** on the left-hand side. Choose the resource group where your VM was created, such as *myResourceGroup*, then select the VM, such as *myVM*. +1. In the Microsoft Entra admin center, select **Resource groups** on the left-hand side. Choose the resource group where your VM was created, such as *myResourceGroup*, then select the VM, such as *myVM*. 1. In the **Overview** pane for your VM, select **Connect**, then **Bastion**. -  +  1. Enter the credentials for your VM, then select **Connect**. -  +  If needed, allow your web browser to open pop-ups for the Bastion connection to be displayed. It takes a few seconds to make the connection to your VM. |
| active-directory-domain-services | Tutorial Create Replica Set | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/tutorial-create-replica-set.md | Title: Tutorial - Create a replica set in Azure AD Domain Services | Microsoft Docs -description: Learn how to create and use replica sets in the Azure portal for service resiliency with Azure AD Domain Services +description: Learn how to create and use replica sets in the Microsoft Entra admin center for service resiliency with Azure AD Domain Services To complete this tutorial, you need the following resources and privileges: > [!IMPORTANT] > You need to use a minimum of *Enterprise* SKU for your managed domain to support replica sets. If needed, [change the SKU for a managed domain][howto-change-sku]. -## Sign in to the Azure portal +## Sign in to the Microsoft Entra admin center -In this tutorial, you create and manage replica sets using the Azure portal. To get started, first sign in to the [Azure portal](https://portal.azure.com). +In this tutorial, you create and manage replica sets using the Microsoft Entra admin center. To get started, first sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). ## Networking considerations Before you can use replica sets in Azure AD DS, review the following Azure virtu * Peered virtual networks are NOT transitive. > [!TIP]-> When you create a replica set in the Azure portal, the network peerings between virtual networks is created for you. +> When you create a replica set in the Microsoft Entra admin center, the network peerings between virtual networks is created for you. >-> If needed, you can create a virtual network and subnet when you add a replica set in the Azure portal. Or, you can choose existing virtual network resources in the destination region for a replica set and let the peerings be created automatically if they don't already exist. +> If needed, you can create a virtual network and subnet when you add a replica set in the Microsoft Entra admin center. Or, you can choose existing virtual network resources in the destination region for a replica set and let the peerings be created automatically if they don't already exist. ## Create a replica set In this tutorial, you create an additional replica set in an Azure region differ To create an additional replica set, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. +1. In the Microsoft Entra admin center, search for and select **Azure AD Domain Services**. 1. Choose your managed domain, such as *aaddscontoso.com*. 1. On the left-hand side, select **Replica sets**. Each managed domain includes one initial replica set in the selected region, as shown in the following example screenshot: -  +  To create an additional replica set, select **+ Add**. To create an additional replica set, complete the following steps: The following example screenshot shows the process to create a new replica set in *East US*: -  +  1. When ready, select **Save**. The process to create the replica set takes some time as the resources are creat The replica set reports as *Provisioning* as deployment continues, as shown in the following example screenshot. When complete, the replica set shows as *Running*. - + ## Delete a replica set A managed domain is currently limited to five replicas - the initial replica set To delete a replica set, complete the following steps: -1. In the Azure portal, search for and select **Azure AD Domain Services**. +1. In the Microsoft Entra admin center, search for and select **Azure AD Domain Services**. 1. Choose your managed domain, such as *aaddscontoso.com*. 1. On the left-hand side, select **Replica sets**. From the list of replica sets, select the **...** context menu next to the replica set you want to delete. 1. Select **Delete** from the context menu, then confirm you want to delete the replica set. |
| active-directory-domain-services | Use Azure Monitor Workbooks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory-domain-services/use-azure-monitor-workbooks.md | To access the workbook template for the security overview report, complete the f Choose a **Time range**, such as *Last 7 days*, as shown in the following example screenshot: -  +  The **Tile view** and **Chart view** options can also be changed to analyze and visualize the data as desired. |
| active-directory | Accidental Deletions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/accidental-deletions.md | You use accidental deletions to specify a deletion threshold. Anything above the To enable accidental deletion prevention: -1. In the Azure portal, select **Azure Active Directory**. - ::: zone pivot="app-provisioning"-2. Select **Enterprise applications** and then select your application. --3. Select **Provisioning** and then on the provisioning page select **Edit provisioning**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications**. +1. Select your application. +1. Select **Provisioning** and then on the provisioning page select **Edit provisioning**. ::: zone-end ::: zone pivot="cross-tenant-synchronization"-2. Select **Cross-tenant synchronization** > **Configurations** and then select your configuration. --3. Select **Provisioning**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **External Identities** > **Cross-tenant synchronization** > **Configurations** and then select your configuration. +1. Select **Provisioning**. ::: zone-end -4. Under **Settings**, select the **Prevent accidental deletions** check box and specify a deletion +1. Under **Settings**, select the **Prevent accidental deletions** check box and specify a deletion threshold.--5. Ensure the **Notification Email** address is completed. -+1. Ensure the **Notification Email** address is completed. If the deletion threshold is met, an email is sent.--6. Select **Save** to save the changes. +1. Select **Save** to save the changes. When the deletion threshold is met, the job goes into quarantine, and a notification email is sent. The quarantined job can then be allowed or rejected. To learn more about quarantine behavior, see [Application provisioning in quarantine status](application-provisioning-quarantine-status.md). |
| active-directory | Application Provisioning Config Problem No Users Provisioned | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/application-provisioning-config-problem-no-users-provisioned.md | After automatic provisioning has been configured for an application (including v If you observe that users are not being provisioned, consult the [Provisioning logs (preview)](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context) in Azure AD. Search for log entries for a specific user. -You can access the provisioning logs in the Azure portal by selecting **Azure Active Directory** > **Enterprise Apps** > **Provisioning logs (preview)** in the **Activity** section. You can search the provisioning data based on the name of the user or the identifier in either the source system or the target system. For details, see [Provisioning logs (preview)](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context). +You can access the provisioning logs in the Microsoft Entra admin center by browsing to **Identity** > **Applications** > **Enterprise applications** > **Provisioning logs**. You can also select a specific application and then select **Provisioning logs** in the **Activity** section. You can search the provisioning data based on the name of the user or the identifier in either the source system or the target system. For details, see [Provisioning logs (preview)](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context). The provisioning logs record all the operations performed by the provisioning service, including querying Azure AD for assigned users that are in scope for provisioning, querying the target app for the existence of those users, comparing the user objects between the system. Then add, update, or disable the user account in the target system based on the comparison. Below is a list of the general problem areas that you can drill into if you have - [Provisioning logs say users are skipped and not provisioned, even though they are assigned](#provisioning-logs-say-users-are-skipped-and-not-provisioned-even-though-they-are-assigned) ## Provisioning service does not appear to start-If you set the **Provisioning Status** to be **On** in the **Azure Active Directory > Enterprise Apps > \[Application Name\] >Provisioning** section of the Azure portal. However no other status details are shown on that page after subsequent reloads, it is likely that the service is running but has not completed an initial cycle yet. Check the **Provisioning logs (preview)** described above to determine what operations the service is performing, and if there are any errors. +If you set the **Provisioning Status** to be **On** in the **Enterprise applications > \[Application Name\] >Provisioning** section of the Microsoft Entra admin center. However no other status details are shown on that page after subsequent reloads, it is likely that the service is running but has not completed an initial cycle yet. Check the **Provisioning logs (preview)** described above to determine what operations the service is performing, and if there are any errors. >[!NOTE] >An initial cycle can take anywhere from 20 minutes to several hours, depending on the size of the Azure AD directory and the number of users in scope for provisioning. Subsequent syncs after the initial cycle are faster, as the provisioning service stores watermarks that represent the state of both systems after the initial cycle. The initial cycle improves performance of subsequent syncs. |
| active-directory | Application Provisioning Config Problem Scim Compatibility | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/application-provisioning-config-problem-scim-compatibility.md | Below are sample requests to help outline what the sync engine currently sends v ## Upgrading from the older customappsso job to the SCIM job Following the steps below will delete your existing customappsso job and create a new SCIM job. -1. Sign in to the [Azure portal](https://portal.azure.com). -2. In the **Azure Active Directory > Enterprise Applications** section of the Azure portal, locate and select your existing SCIM application. -3. In the **Properties** section of your existing SCIM app, copy the **Object ID**. -4. In a new web browser window, go to https://developer.microsoft.com/graph/graph-explorer and sign in as the administrator for the Azure AD tenant where your app is added. -5. In the Graph Explorer, run the command below to locate the ID of your provisioning job. Replace "[object-id]" with the service principal ID (object ID) copied from the third step. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications**. +1. Locate and select your existing SCIM application. +1. In the **Properties** section of your existing SCIM app, copy the **Object ID**. +1. In a new web browser window, go to https://developer.microsoft.com/graph/graph-explorer and sign in as the administrator for the Azure AD tenant where your app is added. +1. In the Graph Explorer, run the command below to locate the ID of your provisioning job. Replace "[object-id]" with the service principal ID (object ID) copied from the third step. `GET https://graph.microsoft.com/beta/servicePrincipals/[object-id]/synchronization/jobs` Following the steps below will delete your existing customappsso job and create ## Downgrading from the SCIM job to the customappsso job (not recommended) We allow you to downgrade back to the old behavior but don't recommend it as the customappsso does not benefit from some of the updates we make, and may not be supported forever. -1. Sign in to the [Azure portal](https://portal.azure.com). -2. In the **Azure Active Directory > Enterprise Applications > Create application** section of the Azure portal, create a new **Non-gallery** application. -3. In the **Properties** section of your new custom app, copy the **Object ID**. -4. In a new web browser window, go to https://developer.microsoft.com/graph/graph-explorer and sign in as the administrator for the Azure AD tenant where your app is added. -5. In the Graph Explorer, run the command below to initialize the provisioning configuration for your app. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications**. ++1. In the **Create application** section, create a new **Non-gallery** application. +1. In the **Properties** section of your new custom app, copy the **Object ID**. +1. In a new web browser window, go to https://developer.microsoft.com/graph/graph-explorer and sign in as the administrator for the Azure AD tenant where your app is added. +1. In the Graph Explorer, run the command below to initialize the provisioning configuration for your app. Replace "[object-id]" with the service principal ID (object ID) copied from the third step. `POST https://graph.microsoft.com/beta/servicePrincipals/[object-id]/synchronization/jobs` |
| active-directory | Application Provisioning Config Problem | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/application-provisioning-config-problem.md | -Configuring [automatic user provisioning](user-provisioning.md) for an app (where supported), requires that specific instructions be followed to prepare the application for automatic provisioning. Then you can use the Azure portal to configure the provisioning service to synchronize user accounts to the application. +Configuring [automatic user provisioning](user-provisioning.md) for an app (where supported), requires that specific instructions be followed to prepare the application for automatic provisioning. Then you can use the Microsoft Entra admin center to configure the provisioning service to synchronize user accounts to the application. You should always start by finding the setup tutorial specific to setting up provisioning for your application. Then follow those steps to configure both the app and Azure AD to create the provisioning connection. A list of app tutorials can be found at [List of Tutorials on How to Integrate SaaS Apps with Azure Active Directory](../saas-apps/tutorial-list.md). You should always start by finding the setup tutorial specific to setting up pro Once the service is configured, most insights into the operation of the service can be drawn from two places: -- **Provisioning logs (preview)** ΓÇô The [provisioning logs](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context) record all the operations performed by the provisioning service, including querying Azure AD for assigned users that are in scope for provisioning. Query the target app for the existence of those users, comparing the user objects between the system. Then add, update, or disable the user account in the target system based on the comparison. You can access the provisioning logs in the Azure portal by selecting **Azure Active Directory** > **Enterprise Apps** > **Provisioning logs (preview)** in the **Activity** section.+- **Provisioning logs (preview)** ΓÇô The [provisioning logs](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context) record all the operations performed by the provisioning service, including querying Azure AD for assigned users that are in scope for provisioning. Query the target app for the existence of those users, comparing the user objects between the system. Then add, update, or disable the user account in the target system based on the comparison. You can access the provisioning logs in the Microsoft Entra admin center by selecting **Identity** > **Applications** > **Enterprise applications** > **Provisioning logs** in the **Activity** section. -- **Current status ΓÇô** A summary of the last provisioning run for a given app can be seen in the **Azure Active Directory > Enterprise Apps > \[Application Name\] >Provisioning** section, at the bottom of the screen under the service settings. The Current Status section shows whether a provisioning cycle has started provisioning user accounts. You can watch the progress of the cycle, see how many users and groups have been provisioned, and see how many roles are created. If there are any errors, details can be found in the [Provisioning logs (../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context).+- **Current status ΓÇô** A summary of the last provisioning run for a given app can be seen in the **Identity** > **Applications** > **Enterprise applications** > \[Application Name\] > **Provisioning** section, at the bottom of the screen under the service settings. The Current Status section shows whether a provisioning cycle has started provisioning user accounts. You can watch the progress of the cycle, see how many users and groups have been provisioned, and see how many roles are created. If there are any errors, details can be found in the [Provisioning logs (../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context). ## General problem areas with provisioning to consider Below is a list of the general problem areas that you can drill into if you have ## Provisioning service does not appear to start -If you set the **Provisioning Status** to be **On** in the **Azure Active Directory > Enterprise Apps > \[Application Name\] >Provisioning** section of the Azure portal. However no other status details are shown on that page after subsequent reloads. It is likely that the service is running but has not completed an initial cycle yet. Check the **Provisioning logs** described above to determine what operations the service is performing, and if there are any errors. +If you set the **Provisioning Status** to be **On** in the **Identity** > **Applications** > **Enterprise applications** > [Application Name\] > **Provisioning** section of the Microsoft Entra admin center. However no other status details are shown on that page after subsequent reloads. It is likely that the service is running but has not completed an initial cycle yet. Check the **Provisioning logs** described above to determine what operations the service is performing, and if there are any errors. >[!NOTE] >An initial cycle can take anywhere from 20 minutes to several hours, depending on the size of the Azure AD directory and the number of users in scope for provisioning. Subsequent syncs after the initial cycle be faster, as the provisioning service stores watermarks that represent the state of both systems after the initial cycle, improving performance of subsequent syncs. |
| active-directory | Application Provisioning Configuration Api | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/application-provisioning-configuration-api.md | -The Azure portal is a convenient way to configure provisioning for individual apps one at a time. But if you're creating severalΓÇöor even hundredsΓÇöof instances of an application, it can be easier to automate app creation and configuration with the Microsoft Graph APIs. This article outlines how to automate provisioning configuration through APIs. This method is commonly used for applications like [Amazon Web Services](../saas-apps/amazon-web-service-tutorial.md#configure-azure-ad-sso). +The Microsoft Entra admin center is a convenient way to configure provisioning for individual apps one at a time. But if you're creating severalΓÇöor even hundredsΓÇöof instances of an application, it can be easier to automate app creation and configuration with the Microsoft Graph APIs. This article outlines how to automate provisioning configuration through APIs. This method is commonly used for applications like [Amazon Web Services](../saas-apps/amazon-web-service-tutorial.md#configure-azure-ad-sso). **Overview of steps for using Microsoft Graph APIs to automate provisioning configuration** Content-type: application/json ### Test the connection to the application -Test the connection with the third-party application. The following example is for an application that requires a client secret and secret token. Each application has its own requirements. Applications often use a base address in place of a client secret. To determine what credentials your app requires, go to the provisioning configuration page for your application, and in developer mode, click **test connection**. The network traffic will show the parameters used for credentials. For a full list of credentials, see [synchronizationJob: validateCredentials](/graph/api/synchronization-synchronizationjob-validatecredentials?tabs=http&view=graph-rest-beta&preserve-view=true). Most applications, such as Azure Databricks, rely on a BaseAddress and SecretToken. The BaseAddress is referred to as a tenant URL in the Azure portal. +Test the connection with the third-party application. The following example is for an application that requires a client secret and secret token. Each application has its own requirements. Applications often use a base address in place of a client secret. To determine what credentials your app requires, go to the provisioning configuration page for your application, and in developer mode, click **test connection**. The network traffic will show the parameters used for credentials. For a full list of credentials, see [synchronizationJob: validateCredentials](/graph/api/synchronization-synchronizationjob-validatecredentials?tabs=http&view=graph-rest-beta&preserve-view=true). Most applications, such as Azure Databricks, rely on a BaseAddress and SecretToken. The BaseAddress is referred to as a tenant URL in the Microsoft Entra admin center. #### Request ```msgraph-interactive |
| active-directory | Inbound Provisioning Api Concepts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/inbound-provisioning-api-concepts.md | With API-driven inbound provisioning, HR ISVs can ship native synchronization ex ### Scenario 3: Enable system integrators to build more connectors to systems of record Partners can build custom HR connectors to meet different integration requirements around data flow from systems of record to Azure AD. -In all the above scenarios, the integration is greatly simplified as Azure AD provisioning service takes over the responsibility of performing identity profile comparison, restricting the data sync to scoping logic configured by the IT admin and executing rule-based attribute flow and transformation managed in the Microsoft Entra admin portal. +In all the above scenarios, the integration is greatly simplified as Azure AD provisioning service takes over the responsibility of performing identity profile comparison, restricting the data sync to scoping logic configured by the IT admin and executing rule-based attribute flow and transformation managed in the Microsoft Entra admin center. ## End-to-end flow :::image type="content" source="media/inbound-provisioning-api-concepts/end-to-end-workflow.png" alt-text="Diagram of the end-to-end workflow of inbound provisioning." lightbox="media/inbound-provisioning-api-concepts/end-to-end-workflow.png"::: |
| active-directory | Inbound Provisioning Api Configure App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/inbound-provisioning-api-configure-app.md | This feature is available only when you configure the following Enterprise Galle * API-driven inbound user provisioning to on-premises AD ## Prerequisites-To complete the steps in this tutorial, you need access to Microsoft Entra admin portal with the following roles: +To complete the steps in this tutorial, you need access to Microsoft Entra admin center with the following roles: -* Global administrator OR -* Application administrator (if you're configuring inbound user provisioning to Azure AD) OR -* Application administrator + Hybrid identity administrator (if you're configuring inbound user provisioning to on-premises Active Directory) +* [Application Administrator](../roles/permissions-reference.md#application-administrator) (if you're configuring inbound user provisioning to Azure AD) OR +* [Application Administrator](../roles/permissions-reference.md#application-administrator) + [Hybrid Identity Administrator](../roles/permissions-reference.md#hybrid-identity-administrator) (if you're configuring inbound user provisioning to on-premises Active Directory) If you're configuring inbound user provisioning to on-premises Active Directory, you need access to a Windows Server where you can install the provisioning agent for connecting to your Active Directory domain controller. ## Create your API-driven provisioning app 1. Log in to the [Microsoft Entra admin center](<https://entra.microsoft.com>).-2. Browse to **Azure Active Directory -> Applications -> Enterprise applications**. +2. Browse to **Azure Active Directory** > **Applications** > **Enterprise applications**. 3. Click on **New application** to create a new provisioning application. [](media/inbound-provisioning-api-configure-app/provisioning-entra-admin-center.png#lightbox) 4. Enter **API-driven** in the search field, then select the application for your setup: Depending on the app you selected, use one of the following sections to complete ## Start accepting provisioning requests -1. Open the provisioning application's **Provisioning** -> **Overview** page. +1. Open the provisioning application's **Provisioning** > **Overview** page. :::image type="content" source="media/inbound-provisioning-api-configure-app/provisioning-api-endpoint.png" alt-text="Screenshot of Provisioning API endpoint." lightbox="media/inbound-provisioning-api-configure-app/provisioning-api-endpoint.png"::: 1. On this page, you can take the following actions: - **Start provisioning** control button ΓÇô Click on this button to place the provisioning job in **listen mode** to process inbound bulk upload request payloads. |
| active-directory | Insufficient Access Rights Error Troubleshooting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/insufficient-access-rights-error-troubleshooting.md | You can set the registry option to [skip GMSA configuration](https://go.microsof ## Next steps * [Learn more about the Inbound Provisioning API](inbound-provisioning-api-concepts.md)- |
| active-directory | Scim Validator Tutorial | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/scim-validator-tutorial.md | The endpoints are in the `{host}/scim/` directory, and you can use standard HTTP > [!NOTE] > You can only use HTTP endpoints for local tests. The Azure AD provisioning service requires that your endpoint support HTTPS. -1. Download [Postman](https://www.getpostman.com/downloads/) and start the application. +1. Download [Postman](https://www.postman.com/downloads/) and start the application. 1. Copy and paste this link into Postman to import the test collection: `https://aka.ms/ProvisioningPostman`.  |
| active-directory | Use Scim To Provision Users And Groups | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/use-scim-to-provision-users-and-groups.md | The SCIM spec doesn't define a SCIM-specific scheme for authentication and autho |Authorization method|Pros|Cons|Support| |--|--|--|--|-|Username and password (not recommended or supported by Azure AD)|Easy to implement|Insecure - [Your Pa$$word doesn't matter](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/your-pa-word-doesn-t-matter/ba-p/731984)|Not supported for new gallery or non-gallery apps.| +|Username and password (not recommended or supported by Azure AD)|Easy to implement|Insecure - [Your Pa$$word doesn't matter](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/your-pa-word-doesn-t-matter/ba-p/731984)|Not supported for new gallery or non-gallery apps.| |Long-lived bearer token|Long-lived tokens don't require a user to be present. They're easy for admins to use when setting up provisioning.|Long-lived tokens can be hard to share with an admin without using insecure methods such as email. |Supported for gallery and non-gallery apps. | |OAuth authorization code grant|Access tokens have a shorter life than passwords, and have an automated refresh mechanism that long-lived bearer tokens don't have. A real user must be present during initial authorization, adding a level of accountability. |Requires a user to be present. If the user leaves the organization, the token is invalid, and authorization needs to be completed again.|Supported for gallery apps, but not non-gallery apps. However, you can provide an access token in the UI as the secret token for short term testing purposes. Support for OAuth code grant on non-gallery is in our backlog, in addition to support for configurable auth / token URLs on the gallery app.| |OAuth client credentials grant|Access tokens have a shorter life than passwords, and have an automated refresh mechanism that long-lived bearer tokens don't have. Both the authorization code grant and the client credentials grant create the same type of access token, so moving between these methods is transparent to the API. Provisioning can be automated, and new tokens can be silently requested without user interaction. ||Supported for gallery apps, but not non-gallery apps. However, you can provide an access token in the UI as the secret token for short term testing purposes. Support for OAuth client credentials grant on non-gallery is in our backlog.| To help drive awareness and demand of our joint integration, we recommend you up > * Ensure your sales and customer support teams are aware, ready, and can speak to the integration capabilities. Brief your teams, provide them with FAQs and include the integration into your sales materials. > * Craft a blog post or press release that describes the joint integration, the benefits and how to get started. [Example: Imprivata and Azure AD Press Release](https://www.imprivata.com/company/press/imprivata-introduces-iam-cloud-platform-healthcare-supported-microsoft) > * Leverage your social media like Twitter, Facebook or LinkedIn to promote the integration to your customers. Be sure to include @AzureAD so we can retweet your post. [Example: Imprivata Twitter Post](https://twitter.com/azuread/status/1123964502909779968)-> * Create or update your marketing pages/website (e.g. integration page, partner page, pricing page, etc.) to include the availability of the joint integration. [Example: Pingboard integration Page](https://pingboard.com/org-chart-for), [Smartsheet integration page](https://www.smartsheet.com/marketplace/apps/microsoft-azure-ad), [Monday.com pricing page](https://monday.com/pricing/) -> * Create a help center article or technical documentation on how customers can get started. [Example: Envoy + Microsoft Azure AD integration.](https://envoy.help/en/articles/3453335-microsoft-azure-active-directory-integration/) +> * Create or update your marketing pages/website (e.g. integration page, partner page, pricing page, etc.) to include the availability of the joint integration. [Example: Pingboard integration Page](https://pingboard.com/org-chart-for), [Smartsheet integration page](https://www.smartsheet.com/marketplace/apps/directory-integrations), [Monday.com pricing page](https://monday.com/pricing/) +> * Create a help center article or technical documentation on how customers can get started. [Example: Envoy + Microsoft Azure AD integration.](https://envoy.help/en/articles/3453335-microsoft-azure-active-directory-integration) > * Alert customers of the new integration through your customer communication (monthly newsletters, email campaigns, product release notes). ## Next steps |
| active-directory | User Provisioning | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-provisioning/user-provisioning.md | Azure AD user provisioning can help address these challenges. To learn more abou ## What applications and systems can I use with Azure AD automatic user provisioning? -Azure AD features preintegrated support for many popular SaaS apps and human resources systems, and generic support for apps that implement specific parts of the [SCIM 2.0 standard](https://techcommunity.microsoft.com/t5/Identity-Standards-Blog/Provisioning-with-SCIM-getting-started/ba-p/880010). +Azure AD features preintegrated support for many popular SaaS apps and human resources systems, and generic support for apps that implement specific parts of the [SCIM 2.0 standard](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/provisioning-with-scim-getting-started/ba-p/880010). * **Preintegrated applications (gallery SaaS apps)**: You can find all applications for which Azure AD supports a preintegrated provisioning connector in [Tutorials for integrating SaaS applications with Azure Active Directory](../saas-apps/tutorial-list.md). The preintegrated applications listed in the gallery generally use SCIM 2.0-based user management APIs for provisioning. |
| active-directory | App Proxy Protect Ndes | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/app-proxy-protect-ndes.md | Azure AD Application Proxy is built on Azure. It gives you a massive amount of n * If Internet Explorer Enhanced Security Configuration is turned on for the server where you install the connector, the registration screen might be blocked. To allow access, follow the instructions in the error message, or turn off Internet Explorer Enhanced Security during the install process. * If connector registration fails, see [Troubleshoot Application Proxy](application-proxy-troubleshoot.md). 1. At the end of the setup, a note is shown for environments with an outbound proxy. To configure the Azure AD Application Proxy connector to work through the outbound proxy, run the provided script, such as `C:\Program Files\Microsoft AAD App Proxy connector\ConfigureOutBoundProxy.ps1`.-1. On the Application proxy page in the Azure portal, the new connector is listed with a status of *Active*, as shown in the following example: +1. On the Application proxy page in the Microsoft Entra admin center, the new connector is listed with a status of *Active*, as shown in the following example: -  +  > [!NOTE] > To provide high availability for applications authenticating through the Azure AD Application Proxy, you can install connectors on multiple VMs. Repeat the same steps listed in the previous section to install the connector on other servers joined to the Azure AD DS managed domain. -1. After successful installation, go back to the Azure portal. +1. After successful installation, go back to the Microsoft Entra admin center. 1. Select **Enterprise applications**. |
| active-directory | Application Proxy Add On Premises Application | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-add-on-premises-application.md | Title: Tutorial - Add an on-premises app - Application Proxy in Azure Active Directory -description: Azure Active Directory (Azure AD) has an Application Proxy service that enables users to access on-premises applications by signing in with their Azure AD account. This tutorial shows you how to prepare your environment for use with Application Proxy. Then, it uses the Azure portal to add an on-premises application to your Azure AD tenant. +description: Azure Active Directory (Azure AD) has an Application Proxy service that enables users to access on-premises applications by signing in with their Azure AD account. This tutorial shows you how to prepare your environment for use with Application Proxy. Then, it uses the Microsoft Entra admin center to add an on-premises application to your Azure AD tenant. For information about connectors, capacity planning, and how they stay up-to-dat ## Verify the connector installed and registered correctly -You can use the Azure portal or your Windows server to confirm that a new connector installed correctly. +You can use the Microsoft Entra admin center or your Windows server to confirm that a new connector installed correctly. -### Verify the installation through Azure portal +### Verify the installation through Microsoft Entra admin center To confirm the connector installed and registered correctly: Now that you've prepared your environment and installed a connector, you're read | Field | Description | | : | :-- |- | **Name** | The name of the application that appears on My Apps and in the Azure portal. | + | **Name** | The name of the application that appears on My Apps and in the Microsoft Entra admin center. | | **Maintenance Mode** | Select if you would like to enable maintenance mode and temporarily disable access for all users to the application. | | **Internal URL** | The URL for accessing the application from inside your private network. You can provide a specific path on the backend server to publish, while the rest of the server is unpublished. In this way, you can publish different sites on the same server as different apps, and give each one its own name and access rules.<br><br>If you publish a path, make sure that it includes all the necessary images, scripts, and style sheets for your application. For example, if your app is at `https://yourapp/app` and uses images located at `https://yourapp/media`, then you should publish `https://yourapp/` as the path. This internal URL doesn't have to be the landing page your users see. For more information, see [Set a custom home page for published apps](application-proxy-configure-custom-home-page.md). | | **External URL** | The address for users to access the app from outside your network. If you don't want to use the default Application Proxy domain, read about [custom domains in Azure AD Application Proxy](./application-proxy-configure-custom-domain.md). | |
| active-directory | Application Proxy Application Gateway Waf | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-application-gateway-waf.md | Azure Web Application Firewall (WAF) on Azure Application Gateway provides centr ## Deployment steps -This article guides you through the steps to securely expose a web application on the Internet, by integrating the Azure AD Application Proxy with Azure WAF on Application Gateway. In this guide we'll be using the Azure portal. The reference architecture for this deployment is represented below. +This article guides you through the steps to securely expose a web application on the Internet, by integrating the Azure AD Application Proxy with Azure WAF on Application Gateway. In this guide we'll be using the Microsoft Entra admin center. The reference architecture for this deployment is represented below.  ### Configure Azure Application Gateway to send traffic to your internal application. -Some steps of the Application Gateway configuration will be omitted in this article. For a detailed guide on how to create and configure an Application Gateway, see [Quickstart: Direct web traffic with Azure Application Gateway - Azure portal][appgw_quick]. +Some steps of the Application Gateway configuration will be omitted in this article. For a detailed guide on how to create and configure an Application Gateway, see [Quickstart: Direct web traffic with Azure Application Gateway - Microsoft Entra admin center][appgw_quick]. ##### 1. Create a private-facing HTTPS listener. |
| active-directory | Application Proxy Azure Front Door | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-azure-front-door.md | Azure Front Door helps deliver low-latency, high-throughput content at scale fro ## Deployment steps -This article guides you through the steps to securely expose a web application on the Internet, by integrating the Azure AD Application Proxy with Azure Front Door. In this guide we'll be using the Azure portal. The reference architecture for this deployment is represented below. +This article guides you through the steps to securely expose a web application on the Internet, by integrating the Azure AD Application Proxy with Azure Front Door. In this guide we'll be using the Microsoft Entra admin center. The reference architecture for this deployment is represented below. :::image type="content" source="./media/application-proxy-azure-front-door/azure-front-door.png" alt-text="Diagram of deployment described." lightbox="./media/application-proxy-azure-front-door/azure-front-door.png"::: |
| active-directory | Application Proxy Back End Kerberos Constrained Delegation How To | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-back-end-kerberos-constrained-delegation-how-to.md | The consumer of the Kerberos ticket provided by the connector. At this stage, ex - Check the SPN defined against the applicationΓÇÖs settings in the portal. Make sure that the same SPN configured against the target Azure AD account is used by the applicationΓÇÖs app pool. -  +  - Go into IIS and select the **Configuration Editor** option for the application. Navigate to **system.webServer/security/authentication/windowsAuthentication**. Make sure the value **UseAppPoolCredentials** is **True**. |
| active-directory | Application Proxy Config How To | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-config-how-to.md | This article helps you to understand how to configure an Application Proxy appli To learn about the initial configurations and creation of an Application Proxy application through the Admin Portal, follow the [Publish applications using Azure AD Application Proxy](application-proxy-add-on-premises-application.md). -For details on configuring Connectors, see [Enable Application Proxy in the Azure portal](application-proxy-add-on-premises-application.md). +For details on configuring Connectors, see [Enable Application Proxy in the Microsoft Entra admin center](application-proxy-add-on-premises-application.md). For information on uploading certificates and using custom domains, see [Working with custom domains in Azure AD Application Proxy](application-proxy-configure-custom-domain.md). If you are following the steps in the [Publish applications using Azure AD Appli The error message should display in the top-right corner when you create the application. You can also select the notification icon to see the error messages. - + ## Configure connectors/connector groups |
| active-directory | Application Proxy Config Problem | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-config-problem.md | Title: Problem creating an Azure Active Directory Application Proxy application -description: How to troubleshoot issues creating Application Proxy applications in the Azure portal +description: How to troubleshoot issues creating Application Proxy applications in the Microsoft Entra admin center The error message should display in the top right corner when you create the app  ## Next steps-[Enable Application Proxy in the Azure portal](application-proxy-add-on-premises-application.md) +[Enable Application Proxy in the Microsoft Entra admin center](application-proxy-add-on-premises-application.md) |
| active-directory | Application Proxy Config Sso How To | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-config-sso-how-to.md | -To configure SSO, first make sure that your application is configured for Pre-Authentication through Azure Active Directory. To do this configuration, go to **Azure Active Directory** -> **Enterprise Applications** -> **All Applications** -> Your application **-> Application Proxy**. On this page, you see the ΓÇ£Pre AuthenticationΓÇ¥ field, and make sure that is set to ΓÇ£Azure Active Directory. +To configure SSO, first make sure that your application is configured for Pre-Authentication through Azure Active Directory. ++1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses Application Proxy. If you need to change directories, select **Switch directory** and choose a directory that uses Application Proxy. +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**. ++ Look for the ΓÇ£Pre AuthenticationΓÇ¥ field, and make sure that is set. For more information on the Pre-Authentication methods, see step 4 of the [app publishing document](application-proxy-add-on-premises-application.md). -  +  ## Configuring single sign-on modes for Application Proxy Applications Configure the specific type of single sign-on. The sign-on methods are classified based on what type of authentication the backend application uses. App Proxy applications support three types of sign-on: |
| active-directory | Application Proxy Configure Complex Application | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-complex-application.md | |
| active-directory | Application Proxy Configure Connectors With Proxy Servers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md | |
| active-directory | Application Proxy Configure Cookie Settings | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-cookie-settings.md | Additionally, if your back-end application has cookies that need to be available -## Set the cookie settings - Azure portal +## Set the cookie settings - Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -To set the cookie settings using the Azure portal: +To set the cookie settings using the Microsoft Entra admin center: -1. Sign in to the [Azure portal](https://portal.azure.com). -2. Navigate to **Azure Active Directory**ΓÇ»>ΓÇ»**Enterprise applications**ΓÇ»>ΓÇ»**All applications**. -3. Select the application for which you want to enable a cookie setting. -4. Click **Application Proxy**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**. 5. Under **Additional Settings**, set the cookie setting to **Yes** or **No**. 6. Click **Save** to apply your changes. |
| active-directory | Application Proxy Configure Custom Domain | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-custom-domain.md | To configure an on-premises app to use a custom domain, you need a verified Azur ### Create and verify a custom domain To create and verify a custom domain:--1. In Azure Active Directory, select **Custom domain names** in the left navigation, and then select **Add custom domain**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Settings** > **Domain names**. +1. Select **Add custom domain**. 1. Enter your custom domain name and select **Add Domain**. 1. On the domain page, copy the TXT record information for your domain. 1. Go to your domain registrar and create a new TXT record for your domain, based on your copied DNS information. 1. After you register the domain, on the domain's page in Azure Active Directory, select **Verify**. Once the domain status is **Verified**, you can use the domain across all your Azure AD configurations, including Application Proxy. -For more detailed instructions, see [Add your custom domain name using the Azure portal](../fundamentals/add-custom-domain.md). +For more detailed instructions, see [Add your custom domain name using the Microsoft Entra admin center](../fundamentals/add-custom-domain.md). ### Configure an app to use a custom domain To publish your app through Application Proxy with a custom domain: -1. For a new app, in Azure Active Directory, select **Enterprise applications** in the left navigation. Select **New application**. In the **On-premises applications** section, select **Add an on-premises application**. +1. For a new app, in the Microsoft Entra admin center, browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**. +1. Select **New application**. In the **On-premises applications** section, select **Add an on-premises application**. For an app already in **Enterprise applications**, select it from the list, and then select **Application proxy** in the left navigation. To publish your app through Application Proxy with a custom domain:  -10. Follow the instructions at [Manage DNS records and record sets by using the Azure portal](../../dns/dns-operations-recordsets-portal.md) to add a DNS record that redirects the new external URL to the *msappproxy.net* domain in Azure DNS. If a different DNS provider is used, please contact the vendor for the instructions. +10. Follow the instructions at [Manage DNS records and record sets by using the Microsoft Entra admin center](../../dns/dns-operations-recordsets-portal.md) to add a DNS record that redirects the new external URL to the *msappproxy.net* domain in Azure DNS. If a different DNS provider is used, please contact the vendor for the instructions. > [!IMPORTANT] > Ensure that you are properly using a CNAME record that points to the *msappproxy.net* domain. Do not point records to IP addresses or server DNS names since these are not static and may impact the resiliency of the service. |
| active-directory | Application Proxy Configure Custom Home Page | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-custom-home-page.md | Before you set the home page URL, keep in mind the following requirements: - If you make a change to the published app, the change might reset the value of the home page URL. When you update the app in the future, you should recheck and, if necessary, update the home page URL. -You can set the home page URL either through the Azure portal or by using PowerShell. +You can set the home page URL either through the Microsoft Entra admin center or by using PowerShell. -## Change the home page in the Azure portal +## Change the home page in the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -To change the home page URL of your app through the Azure portal, follow these steps: --1. Sign in to the [Azure portal](https://portal.azure.com) as an administrator. -1. Select **Azure Active Directory**, and then **App registrations**. The list of registered apps appears. +To change the home page URL of your app through the Microsoft Entra admin center, follow these steps: +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses Application Proxy. If you need to change directories, select **Switch directory** and choose a directory that uses Application Proxy. +1. Browse to **Identity** > **Applications** > **App registrations**. The list of registered apps appears. 1. Choose your app from the list. A page showing the details of the registered app appears. 1. Under **Manage**, select **Branding**. 1. Update the **Home page URL** with your new path. |
| active-directory | Application Proxy Configure For Claims Aware Applications | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-for-claims-aware-applications.md | |
| active-directory | Application Proxy Configure Hard Coded Link Translation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-hard-coded-link-translation.md | If you need to support one of these two scenarios, use the same internal and ext [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] Getting started with link translation is as easy as clicking a button:--1. Sign in to the [Azure portal](https://portal.azure.com) as an administrator. -2. Go to **Azure Active Directory** > **Enterprise applications** > **All applications** > select the app you want to manage > **Application proxy**. -3. Turn **Translate URLs in application body** to **Yes**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **All applications**. +1. Select the app you want to manage. +1. Turn **Translate URLs in application body** to **Yes**.  4. Select **Save** to apply your changes. |
| active-directory | Application Proxy Configure Native Client Application | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-native-client-application.md | Publish your proxy application as you would any other application and assign use [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] You now need to register your application in Azure AD, as follows:--1. Sign in to the [Azure portal](https://portal.azure.com). -1. Browse to **Azure Active Directory** > **App registrations**. The list of all app registrations appears. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses Application Proxy. If you need to change directories, select **Switch directory** and choose a directory that uses Application Proxy. +1. Browse to **Identity** > **Applications** > **App registrations**. The list of all app registrations appears. 1. Select **New registration**. The **Register an application** page appears. -  +  1. In the **Name** heading, specify a user-facing display name for your application. 1. Under the **Supported account types** heading, select an access level using these guidelines: if (authResult != null) } ``` -The required info in the sample code can be found in the Azure portal, as follows: +The required info in the sample code can be found in the Microsoft Entra admin center, as follows: -| Info required | How to find it in the Azure portal | +| Info required | How to find it in the Microsoft Entra admin center | | | | | \<Tenant ID> | **Azure Active Directory** > **Properties** > **Directory ID** | | \<App ID of the Native app> | **Application registration** > *your native application* > **Overview** > **Application ID** | |
| active-directory | Application Proxy Configure Single Sign On On Premises Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-single-sign-on-on-premises-apps.md | The protocol diagrams below describe the single sign-on sequence for both a serv ## Create an application and set up SAML SSO -1. In the Azure portal, select **Azure Active Directory > Enterprise applications** and select **New application**. +1. In the Microsoft Entra admin center, select **Azure Active Directory > Enterprise applications** and select **New application**. 2. Enter the display name for your new application, select **Integrate any other application you don't find in the gallery**, then select **Create**. The protocol diagrams below describe the single sign-on sequence for both a serv Before you can provide SSO for on-premises applications, you need to enable Application Proxy and install a connector. See the tutorial [Add an on-premises application for remote access through Application Proxy in Azure AD](application-proxy-add-on-premises-application.md) to learn how to prepare your on-premises environment, install and register a connector, and test the connector. Then follow these steps to publish your new application with Application Proxy. For other settings not mentioned below, refer to the [Add an on-premises app to Azure AD](application-proxy-add-on-premises-application.md#add-an-on-premises-app-to-azure-ad) section in the tutorial. -1. With the application still open in the Azure portal, select **Application Proxy**. Provide the **Internal URL** for the application. If you're using a custom domain, you also need to upload the TLS/SSL certificate for your application. +1. With the application still open in the Microsoft Entra admin center, select **Application Proxy**. Provide the **Internal URL** for the application. If you're using a custom domain, you also need to upload the TLS/SSL certificate for your application. > [!NOTE] > As a best practice, use custom domains whenever possible for an optimized user experience. Learn more about [Working with custom domains in Azure AD Application Proxy](application-proxy-configure-custom-domain.md). Before you can provide SSO for on-premises applications, you need to enable Appl ## Update the SAML configuration -1. With the application still open in the Azure portal, select **Single sign-on**. +1. With the application still open in the Microsoft Entra admin center, select **Single sign-on**. 2. In the **Set up Single Sign-On with SAML** page, go to the **Basic SAML Configuration** heading and select its **Edit** icon (a pencil). Make sure the **External URL** you configured in Application Proxy is populated in the **Identifier**, **Reply URL**, and **Logout URL** fields. These URLs are required for Application Proxy to work correctly. |
| active-directory | Application Proxy Configure Single Sign On Password Vaulting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-single-sign-on-password-vaulting.md | Title: Single sign-on to apps with Azure Active Directory Application Proxy -description: Turn on single sign-on for your published on-premises applications with Azure Active Directory Application Proxy in the Azure portal. +description: Turn on single sign-on for your published on-premises applications with Azure Active Directory Application Proxy in the Microsoft Entra admin center. -Azure Active Directory Application Proxy helps you improve productivity by publishing on-premises applications so that remote employees can securely access them, too. In the Azure portal, you can also set up single sign-on (SSO) to these apps. Your users only need to authenticate with Azure AD, and they can access your enterprise application without having to sign in again. +Azure Active Directory Application Proxy helps you improve productivity by publishing on-premises applications so that remote employees can securely access them, too. In the Microsoft Entra admin center, you can also set up single sign-on (SSO) to these apps. Your users only need to authenticate with Azure AD, and they can access your enterprise application without having to sign in again. Application Proxy supports several [single sign-on modes](../manage-apps/plan-sso-deployment.md#choosing-a-single-sign-on-method). Password-based sign-on is intended for applications that use a username/password combination for authentication. When you configure password-based sign-on for your application, your users have to sign in to the on-premises application once. After that, Azure Active Directory stores the sign-in information and automatically provides it to the application when your users access it remotely. You should already have published and tested your app with Application Proxy. If [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -1. Sign in to the [Azure portal](https://portal.azure.com) as an administrator. -1. Select **Azure Active Directory** > **Enterprise applications** > **All applications**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **All applications**. 1. From the list, select the app that you want to set up with SSO. 1. Select **Application Proxy**. 1. Change the **Pre Authentication type** to **Passthrough** and select **Save**. Later you can switch back to **Azure Active Directory** type again! |
| active-directory | Application Proxy Configure Single Sign On With Headers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-single-sign-on-with-headers.md | The following table lists common capabilities required for header-based authenti :::image type="content" source="./media/application-proxy-configure-single-sign-on-with-headers/how-it-works-updated.png" alt-text="How header-based single sign-on works with Application Proxy." lightbox="./media/application-proxy-configure-single-sign-on-with-headers/how-it-works-updated.png"::: -1. The Admin customizes the attribute mappings required by the application in the Azure portal. +1. The Admin customizes the attribute mappings required by the application in the Microsoft Entra admin center. 2. When a user accesses the app, Application Proxy ensures the user is authenticated by Azure AD 3. The Application Proxy cloud service is aware of the attributes required. So the service fetches the corresponding claims from the ID token received during authentication. The service then translates the values into the required HTTP headers as part of the request to the Connector. 4. The request is then passed along to the Connector, which is then passed to the backend application. |
| active-directory | Application Proxy Configure Single Sign On With Kcd | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-configure-single-sign-on-with-kcd.md | |
| active-directory | Application Proxy Connectivity No Working Connector | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-connectivity-no-working-connector.md | If there is no working Connector in a Connector Group for your application, ther To figure out the issue, open the ΓÇ£Application ProxyΓÇ¥ menu in your Application, and look at the Connector Group warning message. If there are no connectors in the group, the warning message specifies the group needs at least one Connector. If you have no active Connectors, the warning message explains that. It is common to have inactive Connectors. -  +  For details on each of these options, see the corresponding section below. The instructions assume that you are starting from the Connector management page. If you are looking at the error message above, you can go to this page by clicking on the warning message. You can also get to the page by going to **Azure Active Directory**, clicking on **Enterprise Applications**, then **Application Proxy.** -  +  ## Download a new Connector To download a new Connector, use the ΓÇ£Download ConnectorΓÇ¥ button at the top Install the connector on a machine with direct line of sight to the backend application. Typically, the connector is installed on the same server as the application. After downloading, the Connector should appear in this menu. click the Connector, and use the ΓÇ£Connector GroupΓÇ¥ drop-down to make sure it belongs to the right group. Save the change. -  +  ## Move an Active Connector |
| active-directory | Application Proxy Connector Groups | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-connector-groups.md | -Each Application Proxy connector is assigned to a connector group. All the connectors that belong to the same connector group act as a separate unit for high-availability and load balancing. All connectors belong to a connector group. If you don't create groups, then all your connectors are in a default group. Your admin can create new groups and assign connectors to them in the Azure portal. +Each Application Proxy connector is assigned to a connector group. All the connectors that belong to the same connector group act as a separate unit for high-availability and load balancing. All connectors belong to a connector group. If you don't create groups, then all your connectors are in a default group. Your admin can create new groups and assign connectors to them in the Microsoft Entra admin center. All applications are assigned to a connector group. If you don't create groups, then all your applications are assigned to a default group. But if you organize your connectors into groups, you can set each application to work with a specific connector group. In this case, only the connectors in that group serve the application upon request. This feature is useful if your applications are hosted in different locations. You can create connector groups based on location, so that applications are always served by connectors that are physically close to them. To group your connectors, you have to make sure you [installed multiple connecto ## Create connector groups Use these steps to create as many connector groups as you want.--1. Sign in to the [Azure portal](https://portal.azure.com). -1. Select **Azure Active Directory** > **Enterprise applications** > **Application proxy**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**. 1. Select **New connector group**. The New Connector Group blade appears.  |
| active-directory | Application Proxy Connector Installation Problem | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-connector-installation-problem.md | |
| active-directory | Application Proxy Connectors | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-connectors.md | The connectors are stateless and have no configuration data on the machine. The Connectors also poll the server to find out whether there is a newer version of the connector. If one is found, the connectors update themselves. -You can monitor your connectors from the machine they are running on, using either the event log and performance counters. Or you can view their status from the Application Proxy page of the Azure portal: +You can monitor your connectors from the machine they are running on, using either the event log and performance counters. Or you can view their status from the Application Proxy page of the Microsoft Entra admin center:  |
| active-directory | Application Proxy Debug Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-debug-apps.md | |
| active-directory | Application Proxy Debug Connectors | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-debug-connectors.md | |
| active-directory | Application Proxy Deployment Plan | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-deployment-plan.md | For detailed information on the topic, see [KCD for single sign-on](application- * **DNS records for URLs** - * Before using custom domains in Application Proxy you must create a CNAME record in public DNS, allowing clients to resolve the custom defined external URL to the pre-defined Application Proxy address. Failing to create a CNAME record for an application that uses a custom domain will prevent remote users from connecting to the application. Steps required to add CNAME records can vary from DNS provider to provider, so learn how to [manage DNS records and record sets by using the Azure portal](../../dns/dns-operations-recordsets-portal.md). + * Before using custom domains in Application Proxy you must create a CNAME record in public DNS, allowing clients to resolve the custom defined external URL to the pre-defined Application Proxy address. Failing to create a CNAME record for an application that uses a custom domain will prevent remote users from connecting to the application. Steps required to add CNAME records can vary from DNS provider to provider, so learn how to [manage DNS records and record sets by using the Microsoft Entra admin center](../../dns/dns-operations-recordsets-portal.md). * Similarly, connector hosts must be able to resolve the internal URL of applications being published. Once your application is published, it should be accessible by typing its extern ### Enable pre-authentication Verify that your application is accessible through Application Proxy accessing it via the external URL.+1. Browse to **Identity** > **Applications** > **Enterprise applications** > **All applications** and choose the app you want to manage. -1. Navigate to **Azure Active Directory** > **Enterprise applications** > **All applications** and choose the app you want to manage. 2. Select **Application Proxy**. However, users still need to carry out day to day privileged operations, so enfo ### Reporting and monitoring -Azure AD provides additional insights into your organizationΓÇÖs application usage and operational health through [audit logs and reports](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context). Application Proxy also makes it very easy to monitor connectors from the Azure portal and Windows Event Logs. +Azure AD provides additional insights into your organizationΓÇÖs application usage and operational health through [audit logs and reports](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context). Application Proxy also makes it very easy to monitor connectors from the Microsoft Entra admin center and Windows Event Logs. #### Application audit logs -These logs provide detailed information about logins to applications configured with Application Proxy and the device and the user accessing the application. [Audit logs](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context) are located in the Azure portal and in [Audit API](/graph/api/resources/directoryaudit) for export. Additionally, [usage and insights reports](../reports-monitoring/concept-usage-insights-report.md?context=azure/active-directory/manage-apps/context/manage-apps-context) are also available for your application. +These logs provide detailed information about logins to applications configured with Application Proxy and the device and the user accessing the application. [Audit logs](../reports-monitoring/concept-provisioning-logs.md?context=azure/active-directory/manage-apps/context/manage-apps-context) are located in the Microsoft Entra admin center and in [Audit API](/graph/api/resources/directoryaudit) for export. Additionally, [usage and insights reports](../reports-monitoring/concept-usage-insights-report.md?context=azure/active-directory/manage-apps/context/manage-apps-context) are also available for your application. #### Application Proxy Connector monitoring -The connectors and the service take care of all the high availability tasks. You can monitor the status of your connectors from the Application Proxy page in the Azure portal. For more information about connector maintenance see [Understand Azure AD Application Proxy Connectors](./application-proxy-connectors.md#maintenance). +The connectors and the service take care of all the high availability tasks. You can monitor the status of your connectors from the Application Proxy page in the Microsoft Entra admin center. For more information about connector maintenance see [Understand Azure AD Application Proxy Connectors](./application-proxy-connectors.md#maintenance).  |
| active-directory | Application Proxy High Availability Load Balancing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-high-availability-load-balancing.md | |
| active-directory | Application Proxy Integrate With Logic Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-logic-apps.md | To follow this tutorial, you will need: When a new Enterprise Application is created, a matching App Registration is also created. The App Registration allows configuration of secure programmatic access using certificates, secrets, or federated credentials. For integration with a Logic App, we will need to configure a client secret key, and configure the API permissions. -1. From the Azure portal, open **Azure Active Directory** +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). -2. Select the **App Registrations** menu item from the navigation pane +1. Browse to **Identity** > **Applications** > **App registrations**. -  +1. From the *App Registrations* window, select the **All applications** tab option -3. From the *App Registrations* window, select the **All applications** tab option --4. Navigate to the application with a matching name to your deployed App Proxy application. For example, if you deployed *Sample App 1* as an Enterprise Application, click the **Sample App 1** registration item +1. Navigate to the application with a matching name to your deployed App Proxy application. For example, if you deployed *Sample App 1* as an Enterprise Application, click the **Sample App 1** registration item > [!NOTE] > If an associated application cannot be found, it may have not been automatically created or may have been deleted. A registration can be created using the **New Registration** button. -5. From the *Sample App 1* detail page, take note of the *Application (client) ID* and *Directory (tenant) ID* fields. These will be used later. +1. From the *Sample App 1* detail page, take note of the *Application (client) ID* and *Directory (tenant) ID* fields. These will be used later.  -6. Select the **API permissions** menu item from the navigation pane +1. Select the **API permissions** menu item from the navigation pane  -7. From the *API permissions* page: +1. From the *API permissions* page: 1. Click the **Add a permission** button When a new Enterprise Application is created, a matching App Registration is als  -8. Select the **Certificates & secrets** menu item from the navigation pane +1. Select the **Certificates & secrets** menu item from the navigation pane  -9. From the *Certificates & secrets* page: +1. From the *Certificates & secrets* page: 1. Select the **Client secrets** tab item |
| active-directory | Application Proxy Integrate With Microsoft Cloud Application Security | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security.md | |
| active-directory | Application Proxy Integrate With Power Bi | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-power-bi.md | Before the Power BI mobile app can connect and access Report Services, you must You can use Microsoft Intune to manage the client apps that your company's workforce uses. Intune allows you to use capabilities such as data encryption and additional access requirements. To learn more about app management through Intune, see Intune App Management. To enable the Power BI mobile application to work with the Intune policy, use the following steps. -1. Go to **Azure Active Directory** and then **App Registrations**. +1. Browse to **Identity** > **Applications** > **App registrations**. 2. Select the application configured in Step 3 when registering your native client application. 3. On the applicationΓÇÖs page, select **API Permissions**. 4. Click **Add a permission**. |
| active-directory | Application Proxy Integrate With Remote Desktop Services | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-remote-desktop-services.md | After setting up RDS and Azure AD Application Proxy for your environment, follow >[!Note] >Your users are asked to authenticate once to Azure AD and once to RD Web, but they have single sign-on to RD Gateway. -4. Select **Azure Active Directory**, and then **App Registrations**. Choose your app from the list. +1. Browse to **Identity** > **Applications** > **App registrations**. Choose your app from the list. 5. Under **Manage**, select **Branding**. 6. Update the **Home page URL** field to point to your RD Web endpoint (like `https://<rdhost>.com/RDWeb`). |
| active-directory | Application Proxy Integrate With Sharepoint Server Saml | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-sharepoint-server-saml.md | To complete this configuration, you need the following resources: - A [custom, verified domain](../fundamentals/add-custom-domain.md) in the Azure AD tenant. The verified domain must match the SharePoint URL suffix. - An SSL certificate is required. See the details in [custom domain publishing](./application-proxy-configure-custom-domain.md). - On-premises Active Directory users must be synchronized with Azure AD Connect, and must be configure to [sign in to Azure](../hybrid/connect/plan-connect-user-signin.md). + - For cloud-only and B2B guest users, you need to [grant access to a guest account to SharePoint on-premises in the Microsoft Entra admin center](../saas-apps/sharepoint-on-premises-tutorial.md#manage-guest-users-access). - An Application Proxy connector installed and running on a machine within the corporate domain. |
| active-directory | Application Proxy Integrate With Sharepoint Server | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-sharepoint-server.md | |
| active-directory | Application Proxy Integrate With Tableau | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-tableau.md | Application Proxy supports the OAuth 2.0 Grant Flow, which is required for Table [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -To publish Tableau, you need to publish an application in the Azure portal. +To publish Tableau, you need to publish an application in the Microsoft Entra admin center. For: For: **To publish your app**: -1. Sign in to the [Azure portal](https://portal.azure.com) as an application administrator. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). -2. Select **Azure Active Directory > Enterprise applications**. +1. Browse to **Identity** > **Applications** > **Enterprise applications**. -3. Select **Add** at the top of the blade. +3. Select **New application** at the top of the blade. 4. Select **On-premises application**. For: ## Testing -Your application is now ready to test. Access the external URL you used to publish Tableau, and login as a user assigned to both applications. +Your application is now ready to test. Access the external URL you used to publish Tableau, and log in as a user assigned to both applications. |
| active-directory | Application Proxy Integrate With Teams | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-teams.md | Your users can add cloud apps to their Teams channels [using tabs](https://suppo If you haven't already, [configure Application Proxy for your tenant and install the connector](../app-proxy/application-proxy-add-on-premises-application.md). Then, publish your on-premises application for remote access. When you're publishing the app, make note of the external URL because it's used to add the app to Teams. -If you already have your apps published but don't remember their external URLs, look them up in the [Azure portal](https://portal.azure.com). Sign in, then navigate to **Azure Active Directory** > **Enterprise applications** > **All applications** > select your app > **Application proxy**. +If you already have your apps published but don't remember their external URLs, look them up in the [Microsoft Entra admin center](https://portal.azure.com). Sign in, then navigate to **Azure Active Directory** > **Enterprise applications** > **All applications** > select your app > **Application proxy**. ## Add your app to Teams Once you publish the app through Application Proxy, let your users know that the  -Once one member of a team adds the tab, it shows up for everyone in the channel. Any users who have access to the app get single sign-on access with the credentials they use for Microsoft Teams. Any users who don't have access to the app can see the tab in Teams, but are blocked until you give them permissions to the on-premises app and the Azure portal published version of the app. +Once one member of a team adds the tab, it shows up for everyone in the channel. Any users who have access to the app get single sign-on access with the credentials they use for Microsoft Teams. Any users who don't have access to the app can see the tab in Teams, but are blocked until you give them permissions to the on-premises app and the Microsoft Entra admin center published version of the app. ## Next steps |
| active-directory | Application Proxy Integrate With Traffic Manager | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-integrate-with-traffic-manager.md | |
| active-directory | Application Proxy Network Topology | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-network-topology.md | In order to optimize the traffic flow and reduce latency to a connector group as > [!IMPORTANT] > Connectors must be using at least version 1.5.1975.0 to use this capability. -1. Sign in to the [Azure portal](https://portal.azure.com/) as an application administrator of the directory that uses Application Proxy. For example, if the tenant domain is contoso.com, the admin should be admin@contoso.com or any other admin alias on that domain. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). 1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses Application Proxy. If you need to change directories, select **Switch directory** and choose a directory that uses Application Proxy.-1. In left navigation panel, select **Azure Active Directory**. -1. Under **Manage**, select **Application proxy**. +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**. 1. Select **New Connector Group**, provide a **Name** for the connector group.-1. Next, under **Advanced Settings** and select the drop down under Optimize for a specific region and select the region closest to the connectors. +1. Next, under **Advanced Settings** and select the drop-down under Optimize for a specific region and select the region closest to the connectors. 1. Select **Create**. :::image type="content" source="./media/application-proxy-network-topology/geo-routing.png" alt-text="Configure a new connector group." lightbox="./media/application-proxy-network-topology/geo-routing.png"::: |
| active-directory | Application Proxy Page Appearance Broken Problem | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-page-appearance-broken-problem.md | |
| active-directory | Application Proxy Page Links Broken Problem | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-page-links-broken-problem.md | |
| active-directory | Application Proxy Page Load Speed Problem | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-page-load-speed-problem.md | |
| active-directory | Application Proxy Ping Access Publishing Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-ping-access-publishing-guide.md | If you've enabled Application Proxy and installed a connector already, you can s The Application Proxy connector is a Windows Server service that directs the traffic from your remote employees to your published applications. For more detailed installation instructions, see [Tutorial: Add an on-premises application for remote access through Application Proxy in Azure Active Directory](../app-proxy/application-proxy-add-on-premises-application.md). -1. Sign in to the [Azure portal](https://portal.azure.com) as an Application Administrator. -1. Browse to **Azure Active Directory** > **Application proxy** > **Download connector service**. The **Application Proxy Connector Download** page appears. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**. +1. Select **Download connector service**. The **Application Proxy Connector Download** page appears.  Downloading the connector should automatically enable Application Proxy for your ### Add your application to Azure AD with Application Proxy -There are two actions you need to take in the Azure portal. First, you need to publish your application with Application Proxy. Then, you need to collect some information about the application that you can use during the PingAccess steps. +There are two actions you need to take in the Microsoft Entra admin center. First, you need to publish your application with Application Proxy. Then, you need to collect some information about the application that you can use during the PingAccess steps. #### Publish your application You'll first have to publish your application. This action involves: To publish your own on-premises application: -1. If you didn't in the previous section, sign in to the [Azure portal](https://portal.azure.com) as an Application Administrator. +1. If you didn't in the previous section, sign in to the [Microsoft Entra admin center](https://portal.azure.com) as an Application Administrator. 1. Browse to **Enterprise applications** > **New application** > **Add an on-premises application**. The **Add your own on-premises application** page appears.  Now assign a user for application testing and choose header-based single sign-on Then make sure your redirect URL is set to your external URL: -1. From the **Azure portal**, browse to **Azure Active Directory** > **App registrations**. A list of applications appears. -1. Select your application. +1. Browse to **Identity** > **Applications** > **App registrations** and select your application. 1. Select the link next to **Redirect URIs**, showing the number of redirect URIs set up for web and public clients. The **\<application name> - Authentication** page appears. 1. Check whether the external URL that you assigned to your application earlier is in the **Redirect URIs** list. If it isn't, add the external URL now, using a redirect URI type of **Web**, and select **Save**. You need to collect these three pieces of information (all GUIDs) to set up your To collect this information: -1. From the **Azure portal**, browse to **Azure Active Directory** > **App registrations**. A list of applications appears. -1. Select your application. The **App registrations** page for your application appears. +1. Browse to **Identity** > **Applications** > **App registrations** and select your application.  To collect this information: **Update the `acceptMappedClaims` field:** -1. Sign in to the [Azure portal](https://portal.azure.com) as an Application Administrator. -1. Browse to **Azure Active Directory** > **App registrations**. A list of applications appears. -1. Select your application. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses Application Proxy. If you need to change directories, select **Switch directory** and choose a directory that uses Application Proxy. +1. Browse to **Identity** > **Applications** > **App registrations** and select your application. 1. From the sidebar of the **App registrations** page for your application, select **Manifest**. The manifest JSON code for your application's registration appears. 1. Search for the `acceptMappedClaims` field, and change the value to `True`. 1. Select **Save**. Now that you've completed all the Azure Active Directory setup steps, you can mo The detailed steps for the PingAccess part of this scenario continue in the Ping Identity documentation. Follow the instructions in [Configuring PingAccess for Azure AD](https://docs.pingidentity.com/access/sources/dita/topic?category=pingaccess&Releasestatus_ce=Current&resourceid=pa_configuring_apps_for_azure) on the Ping Identity web site and download the [latest version of PingAccess](https://www.pingidentity.com/en/lp/azure-download.html). -Those steps help you install PingAccess and set up a PingAccess account (if you don't already have one). Then, to create an Azure AD OpenID Connect (OIDC) connection, you set up a token provider with the **Directory (tenant) ID** value that you copied from the Azure portal. Next, to create a web session on PingAccess, you use the **Application (client) ID** and `PingAccess key` values. After that, you can set up identity mapping and create a virtual host, site, and application. +Those steps help you install PingAccess and set up a PingAccess account (if you don't already have one). Then, to create an Azure AD OpenID Connect (OIDC) connection, you set up a token provider with the **Directory (tenant) ID** value that you copied from the Microsoft Entra admin center. Next, to create a web session on PingAccess, you use the **Application (client) ID** and `PingAccess key` values. After that, you can set up identity mapping and create a virtual host, site, and application. ### Test your application |
| active-directory | Application Proxy Powershell Samples | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-powershell-samples.md | |
| active-directory | Application Proxy Qlik | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-qlik.md | To publish QlikSense, you will need to publish two applications in Azure. Follow these steps to publish your app. For a more detailed walkthrough of steps 1-8, see [Publish applications using Azure AD Application Proxy](../app-proxy/application-proxy-add-on-premises-application.md). -1. Sign in to the [Azure portal](https://portal.azure.com) as a global administrator. -2. Select **Azure Active Directory** > **Enterprise applications**. -3. Select **Add** at the top of the blade. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications**. +3. Select **New application** at the top of the blade. 4. Select **On-premises application**. 5. Fill out the required fields with information about your new app. Use the following guidance for the settings: - **Internal URL**: This application should have an internal URL that is the QlikSense URL itself. For example, **https://demo.qlikemm.com:4244** |
| active-directory | Application Proxy Register Connector Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-register-connector-powershell.md | |
| active-directory | Application Proxy Release Version History | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-release-version-history.md | |
| active-directory | Application Proxy Remove Personal Data | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-remove-personal-data.md | |
| active-directory | Application Proxy Secure Api Access | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-secure-api-access.md | To publish the SecretAPI web API through Application Proxy: 1. Build and publish the sample SecretAPI project as an ASP.NET web app on your local computer or intranet. Make sure you can access the web app locally. -1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). -1. Select **Azure Active Directory**, then select **Enterprise applications**. +1. Browse to **Identity** > **Applications** > **Enterprise applications**. 1. At the top of the **Enterprise applications - All applications** page, select **New application**. You've published your web API through Azure AD Application Proxy. Now, add users Native apps are programs developed to use on a particular platform or device. Before your native app can connect and access an API, you must register it in Azure AD. The following steps show how to register a native app and give it access to the web API you published through Application Proxy. To register the AppProxyNativeAppSample native app:+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). -1. On the Azure Active Directory **Overview** page, select **App registrations**, and at the top of the **App registrations** pane, select **New registration**. +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **App registrations**. ++1. Select **New registration**. 1. On the **Register an application** page: To register the AppProxyNativeAppSample native app: You've now registered the AppProxyNativeAppSample app in Azure Active Directory. To give your native app access to the SecretAPI web API: -1. On the Azure Active Directory **Overview** > **App Registrations** page, select the **AppProxyNativeAppSample** app. +1. On the **App registrations** page, select the **AppProxyNativeAppSample** app. 1. On the **AppProxyNativeAppSample** page, select **API permissions** in the left navigation. |
| active-directory | Application Proxy Security | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-security.md | |
| active-directory | Application Proxy Sign In Bad Gateway Timeout Error | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-sign-in-bad-gateway-timeout-error.md | As a first quick step, double check and fix the internal URL by opening the appl ## Check the application is assigned to a working Connector Group To verify the application is assigned to a working Connector Group:--1. Open the application in the portal by going to **Azure Active Directory**, clicking on **Enterprise Applications**, then **All Applications.** Open the application, then select **Application Proxy** from the left menu. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Application Administrator](../roles/permissions-reference.md#application-administrator). +1. Browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**. 1. Look at the Connector Group field. If there are no active connectors in the group, you see a warning. If you don't see any warnings, move on to verify all [required ports](application-proxy-add-on-premises-application.md) are allowed. 1. If the wrong Connector Group is showing, use the drop-down to select the correct group, and confirm you no longer see any warnings. If the intended Connector Group is showing, click the warning message to open the page with Connector management. 1. From here, there are a few ways to drill in further: |
| active-directory | Application Proxy Troubleshoot | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-troubleshoot.md | This list covers errors that your end users might encounter when they try to acc | This corporate app can’t be accessed right now. Please try again later…The connector timed out. | Your user may get this error when trying to access the app you published if they are not properly defined for this application on the on-premises side. Make sure that your users have the proper permissions as defined for this backend application on the on premises machine. | | This corporate app can’t be accessed. You are not authorized to access this application. Authorization failed. Make sure that the user has a license for Azure Active Directory Premium. | Your user may get this error when trying to access the app you published if they weren't explicitly assigned with a Premium license by the subscriber’s administrator. Go to the subscriber’s Active Directory **Licenses** tab and make sure that this user or user group is assigned a Premium license. | | A server with the specified host name could not be found. | Your user may get this error when trying to access the app you published if the application's custom domain is not configured correctly. Make sure you've uploaded a certificate for the domain and configured the DNS record correctly by following the steps in [Working with custom domains in Azure AD Application Proxy](./application-proxy-configure-custom-domain.md) |-|Forbidden: This corporate app can't be accessed OR The user could not be authorized. Make sure the user is defined in your on-premises AD and that the user has access to the app in your on-premises AD. | This could be a problem with access to authorization information, see [Some applications and APIs require access to authorization information on account objects]( https://support.microsoft.com/help/331951/some-applications-and-apis-require-access-to-authorization-information). In a nutshell, add the app proxy connector machine account to the "Windows Authorization Access Group" builtin domain group to resolve. | +|Forbidden: This corporate app can't be accessed OR The user could not be authorized. Make sure the user is defined in your on-premises AD and that the user has access to the app in your on-premises AD. | This could be a problem with access to authorization information, see [Some applications and APIs require access to authorization information on account objects](https://support.microsoft.com/help/331951/some-applications-and-apis-require-access-to-authorization-information). In a nutshell, add the app proxy connector machine account to the "Windows Authorization Access Group" builtin domain group to resolve. | ## See also * [Enable Application Proxy for Azure Active Directory](application-proxy-add-on-premises-application.md) |
| active-directory | Application Proxy Understand Cors Issues | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-understand-cors-issues.md | |
| active-directory | Application Proxy Wildcard | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy-wildcard.md | The configuration implements the following structure: | Color | Description | | | |-| Blue | Applications explicitly published and visible in the Azure portal. | +| Blue | Applications explicitly published and visible in the Microsoft Entra admin center. | | Gray | Applications you can accessible through the parent application. | ## Scenario 2: General wildcard application with exception |
| active-directory | Application Proxy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-proxy.md | |
| active-directory | Application Sign In Problem On Premises Application Proxy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/application-sign-in-problem-on-premises-application-proxy.md | |
| active-directory | What Is Application Proxy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/app-proxy/what-is-application-proxy.md | With Application Proxy, Azure AD keeps track of users who need to access web app ### An overview of how App Proxy works -Application Proxy is an Azure AD service you configure in the Azure portal. It enables you to publish an external public HTTP/HTTPS URL endpoint in the Azure Cloud, which connects to an internal application server URL in your organization. These on-premises web apps can be integrated with Azure AD to support single sign-on. Users can then access on-premises web apps in the same way they access Microsoft 365 and other SaaS apps. +Application Proxy is an Azure AD service you configure in the Microsoft Entra admin center. It enables you to publish an external public HTTP/HTTPS URL endpoint in the Azure Cloud, which connects to an internal application server URL in your organization. These on-premises web apps can be integrated with Azure AD to support single sign-on. Users can then access on-premises web apps in the same way they access Microsoft 365 and other SaaS apps. Components of this feature include the Application Proxy service, which runs in the cloud, the Application Proxy connector, which is a lightweight agent that runs on an on-premises server, and Azure AD, which is the identity provider. All three components work together to provide the user with a single sign-on experience to access on-premises web applications. Azure AD Application Proxy consists of the cloud-based Application Proxy service Setup and registration between a connector and the App Proxy service is accomplished as follows: 1. The IT administrator opens ports 80 and 443 to outbound traffic and allows access to several URLs that are needed by the connector, the App Proxy service, and Azure AD.-2. The admin signs into the Azure portal and runs an executable to install the connector on an on-premises Windows server. +2. The admin signs into the Microsoft Entra admin center and runs an executable to install the connector on an on-premises Windows server. 3. The connector starts to "listen" to the App Proxy service. 4. The admin adds the on-premises application to Azure AD and configures settings such as the URLs users need to connect to their apps. Connectors also poll the server to find out if there is a newer version of the c > [!NOTE] > You can monitor the Application Proxy [version history page](./application-proxy-release-version-history.md) to be notified when updates have been released by subscribing to its RSS feed. -Each Application Proxy connector is assigned to a [connector group](./application-proxy-connector-groups.md). Connectors in the same connector group act as a single unit for high availability and load balancing. You can create new groups, assign connectors to them in the Azure portal, then assign specific connectors to serve specific applications. It's recommended to have at least two connectors in each connector group for high availability. +Each Application Proxy connector is assigned to a [connector group](./application-proxy-connector-groups.md). Connectors in the same connector group act as a single unit for high availability and load balancing. You can create new groups, assign connectors to them in the Microsoft Entra admin center, then assign specific connectors to serve specific applications. It's recommended to have at least two connectors in each connector group for high availability. Connector groups are useful when you need to support the following scenarios: |
| active-directory | 2 Secure Access Current State | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/architecture/2-secure-access-current-state.md | Use the following series of articles to learn about securing external access to 9. [Secure external access to Microsoft Teams, SharePoint, and OneDrive for Business with Azure AD](9-secure-access-teams-sharepoint.md) 10. [Convert local guest accounts to Azure Active Directory B2B guest accounts](10-secure-local-guest.md)- |
| active-directory | 6 Secure Access Entitlement Managment | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/architecture/6-secure-access-entitlement-managment.md | Use the following series of articles to learn about securing external access to 9. [Secure external access to Microsoft Teams, SharePoint, and OneDrive for Business with Azure AD](9-secure-access-teams-sharepoint.md) 10. [Convert local guest accounts to Azure Active Directory B2B guest accounts](10-secure-local-guest.md)--- - |
| active-directory | 7 Secure Access Conditional Access | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/architecture/7-secure-access-conditional-access.md | Use a naming convention that clarifies policy purpose. External access examples You can block external users from accessing resources with Conditional Access policies. -1. Sign in to the [Azure portal](https://portal.azure.com) as a Conditional Access Administrator, Security Administrator, or Global Administrator. -2. Browse to **Azure Active Directory** > **Security** > **Conditional Access**. -3. Select **New policy**. -4. Enter a policy a name. -5. Under **Assignments**, select **Users or workload identities**. -6. Under **Include**, select **All guests and external users**. -7. Under **Exclude**, select **Users and groups**. -8. Select emergency access accounts. -9. Select **Done**. -10. Under **Cloud apps or actions** > **Include**, select **All cloud apps**. -11. Under **Exclude**, select applications you want to exclude. -12. Under **Access controls** > **Grant**, select **Block access**. -13. Select **Select**. -14. Select **Enable policy** to **Report-only**. -15. Select **Create**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access**. +1. Select **Create new policy**. +1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies. +1. Under **Assignments**, select **Users or workload identities**. + 1. Under **Include**, select **All guests and external users**. + 1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts. +1. Under **Target resources** > **Cloud apps**, select the following options: + 1. Under **Include**, select **All cloud apps** + 1. Under **Exclude**, select applications you want to exclude. +1. Under **Access controls** > **Grant**, select **Block access**, then select **Select**. +1. Confirm your settings and set **Enable policy** to **Report-only**. +1. Select **Create** to create to enable your policy. > [!NOTE]-> You can confirm settings in **report only** mode. See, Configure a Conditional Access policy in repory-only mode, in [Conditional Access insights and reporting](../conditional-access/howto-conditional-access-insights-reporting.md). +> After administrators confirm the settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), they can move the **Enable policy** toggle from **Report-only** to **On**. Learn more: [Manage emergency access accounts in Azure AD](../roles/security-emergency-access.md) There are scenarios when it's necessary to allow access for a small, specific gr Before you begin, we recommend you create a security group, which contains external users who access resources. See, [Quickstart: Create a group with members and view all groups and members in Azure AD](../fundamentals/groups-view-azure-portal.md). -1. Sign in to the [Azure portal](https://portal.azure.com) as a Conditional Access Administrator, Security Administrator, or Global Administrator. -2. Browse to **Azure Active Directory** > **Security** > **Conditional Access**. -3. Select **New policy**. -4. Enter a policy name. -5. Under **Assignments**, select **Users or workload identities**. -6. Under **Include**, select **All guests and external users**. -7. Under **Exclude**, select **Users and groups** -8. Select emergency access accounts. -9. Select the external users security group. -10. Select **Done**. -11. Under **Cloud apps or actions** > **Include**, select **All cloud apps**. -12. Under **Exclude**, select applications you want to exclude. -13. Under **Access controls** > **Grant**, select **Block access**. -14. Select **Select**. -15. Select **Create**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access**. +1. Select **Create new policy**. +1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies. +1. Under **Assignments**, select **Users or workload identities**. + 1. Under **Include**, select **All guests and external users**. + 1. Under **Exclude**, select **Users and groups** and choose your organization's emergency access or break-glass accounts and the external users security group. +1. Under **Target resources** > **Cloud apps**, select the following options: + 1. Under **Include**, select **All cloud apps** + 1. Under **Exclude**, select applications you want to exclude. +1. Under **Access controls** > **Grant**, select **Block access**, then select **Select**. +1. Select **Create** to create to enable your policy. > [!NOTE]-> You can confirm settings in **report only** mode. See, Configure a Conditional Access policy in repory-only mode, in [Conditional Access insights and reporting](../conditional-access/howto-conditional-access-insights-reporting.md). +> After administrators confirm the settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), they can move the **Enable policy** toggle from **Report-only** to **On**. Learn more: [Manage emergency access accounts in Azure AD](../roles/security-emergency-access.md) |
| active-directory | Auth Password Based Sso | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/architecture/auth-password-based-sso.md | You need to protect with pre-authentication and provide SSO through password vau * [What is password based SSO](../manage-apps/what-is-single-sign-on.md) -* [Configure password based SSO for cloud applications ](../manage-apps/configure-password-single-sign-on-non-gallery-applications.md) +* [Configure password based SSO for cloud applications](../manage-apps/configure-password-single-sign-on-non-gallery-applications.md) * [Configure password-based SSO for on-premises applications with Application Proxy](../app-proxy/application-proxy-configure-single-sign-on-password-vaulting.md) |
| active-directory | Auth Sync Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/architecture/auth-sync-overview.md | The following table presents authentication Azure AD integration with legacy aut | [OAuth 2.0 authentication](auth-oauth2.md)| | | |  | | [OIDC authentication](auth-oidc.md)| | | |  | | [Password based SSO authentication](auth-password-based-sso.md)| | | |  |-| [RADIUS authentication]( auth-radius.md)| | | |  | +| [RADIUS authentication](auth-radius.md)| | | |  | | [Remote Desktop Gateway services](auth-remote-desktop-gateway.md)| | | |  | | [Secure Shell (SSH)](auth-ssh.md) | | | |  | | [SAML authentication](auth-saml.md)| | | |  | | [Windows Authentication - Kerberos Constrained Delegation](auth-kcd.md)| | | |  |----- |
| active-directory | Recoverability Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/architecture/recoverability-overview.md | The deletion of some objects can cause a ripple effect because of dependencies. ## Monitoring and data retention -The [Azure AD Audit log](../reports-monitoring/concept-audit-logs.md) contains information on all delete and configuration operations performed in your tenant. We recommend that you export these logs to a security information and event management tool such as [Microsoft Sentinel](../../sentinel/overview.md). You can also use Microsoft Graph to audit changes and build a custom solution to monitor differences over time. For more information on finding deleted items by using Microsoft Graph, see [List deleted items - Microsoft Graph v1.0 ](/graph/api/directory-deleteditems-list?tabs=http). +The [Azure AD Audit log](../reports-monitoring/concept-audit-logs.md) contains information on all delete and configuration operations performed in your tenant. We recommend that you export these logs to a security information and event management tool such as [Microsoft Sentinel](../../sentinel/overview.md). You can also use Microsoft Graph to audit changes and build a custom solution to monitor differences over time. For more information on finding deleted items by using Microsoft Graph, see [List deleted items - Microsoft Graph v1.0](/graph/api/directory-deleteditems-list?tabs=http). ### Audit logs The [Sensitive operations report workbook](../reports-monitoring/workbook-sensit - Directory role and group membership updates for service principals. - Modified federation settings. -The [Cross-tenant access activity workbook ](../reports-monitoring/workbook-cross-tenant-access-activity.md)can help you monitor which applications in external tenants your users are accessing and which applications in your tenant external users are accessing. Use this workbook to look for anomalous changes in either inbound or outbound application access across tenants. +The [Cross-tenant access activity workbook](../reports-monitoring/workbook-cross-tenant-access-activity.md)can help you monitor which applications in external tenants your users are accessing and which applications in your tenant external users are accessing. Use this workbook to look for anomalous changes in either inbound or outbound application access across tenants. ## Operational security |
| active-directory | Sync Scim | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/architecture/sync-scim.md | You want to automatically provision user information from an HCM system to Azure ## Implement SCIM with Azure AD  -* [How provisioning works in Azure AD ](../app-provisioning/how-provisioning-works.md) +* [How provisioning works in Azure AD](../app-provisioning/how-provisioning-works.md) -* [Managing user account provisioning for enterprise apps in the Azure portal ](../app-provisioning/configure-automatic-user-provisioning-portal.md) +* [Managing user account provisioning for enterprise apps in the Azure portal](../app-provisioning/configure-automatic-user-provisioning-portal.md) -* [Build a SCIM endpoint and configure user provisioning with Azure AD ](../app-provisioning/use-scim-to-provision-users-and-groups.md) +* [Build a SCIM endpoint and configure user provisioning with Azure AD](../app-provisioning/use-scim-to-provision-users-and-groups.md) * [SCIM 2.0 protocol compliance of the Azure AD Provisioning Service](../app-provisioning/application-provisioning-config-problem-scim-compatibility.md) |
| active-directory | Concept Authentication Authenticator App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-authenticator-app.md | Consistent with the guidelines outlined in [NIST SP 800-63B](https://pages.nist. FIPS 140 is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems. Testing against the FIPS 140 standard is maintained by the [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program?azure-portal=true). -No changes in configurations are required in Microsoft Authenticator or the Azure portal to enable FIPS 140 compliance. Beginning with Microsoft Authenticator for iOS version 6.6.8, Azure AD authentications will be FIPS 140 compliant by default. +No changes in configurations are required in Microsoft Authenticator or the Microsoft Entra admin center to enable FIPS 140 compliance. Beginning with Microsoft Authenticator for iOS version 6.6.8, Azure AD authentications will be FIPS 140 compliant by default. Authenticator leverages the native Apple cryptography to achieve FIPS 140, Security Level 1 compliance on Apple iOS devices beginning with Microsoft Authenticator version 6.6.8. For more information about the certifications being used, see the [Apple CoreCrypto module](https://support.apple.com/guide/sccc/security-certifications-for-ios-scccfa917cb49/web?azure-portal=true).  |
| active-directory | Concept Authentication Default Enablement | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-default-enablement.md | For example, in response to increasing MFA fatigue attacks, Microsoft recommende There are two ways for protection of a security feature to be enabled by default: -- After a security feature is released, customers can use the Azure portal or Graph API to test and roll out the change on their own schedule. To help defend against new attack vectors, Azure AD may enable protection of a security feature by default for all tenants on a certain date, and there won't be an option to disable protection. Microsoft schedules default protection far in advance to give customers time to prepare for the change. Customers can't opt out if Microsoft schedules protection by default. +- After a security feature is released, customers can use the Microsoft Entra admin center or Graph API to test and roll out the change on their own schedule. To help defend against new attack vectors, Azure AD may enable protection of a security feature by default for all tenants on a certain date, and there won't be an option to disable protection. Microsoft schedules default protection far in advance to give customers time to prepare for the change. Customers can't opt out if Microsoft schedules protection by default. - Protection can be **Microsoft managed**, which means Azure AD can enable or disable protection based upon the current landscape of security threats. Customers can choose whether to allow Microsoft to manage the protection. They can change from **Microsoft managed** to explicitly make the protection **Enabled** or **Disabled** at any time. >[!NOTE] |
| active-directory | Concept Authentication Methods Manage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-methods-manage.md | Most methods also have configuration parameters to more precisely control how th Or let's say you want to enable passwordless authentication with Microsoft Authenticator. You can set extra parameters like showing the user sign-in location or the name of the app being signed into. These options provide more context for users when they sign-in and help prevent accidental MFA approvals. -To manage the Authentication methods policy in the Azure AD portal, click **Security** > **Authentication methods** > **Policies**. +To manage the Authentication methods policy, sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator) and browse to **Protection** > **Authentication methods** > **Policies**. :::image type="content" border="true" source="./media/concept-authentication-methods-manage/authentication-methods-policy.png" alt-text="Screenshot of Authentication methods policy."::: Similarly, let's suppose you enable **Voice calls** for a group. After you enabl The Authentication methods policy provides a migration path toward unified administration of all authentication methods. All desired methods can be enabled in the Authentication methods policy. Methods in the legacy MFA and SSPR policies can be disabled. Migration has three settings to let you move at your own pace, and avoid problems with sign-in or SSPR during the transition. After migration is complete, you'll centralize control over authentication methods for both sign-in and SSPR in a single place, and the legacy MFA and SSPR policies will be disabled. >[!Note]->Hardware OATH tokens and security questions can only be enabled today by using these legacy policies. In the future, these methods will be available in the Authentication methods policy. If you use hardware OATH tokens, which are currently in preview, you should hold off on migrating OATH tokens and don't complete the migration process. If you're using security questions, and don't want to disable them, make sure to keep them enabled in the legacy SSPR policy until the new control is available in the future. +>Security questions can only be enabled today by using the legacy SSPR policy. In the future, it will be made available in the Authentication methods policy. If you're using security questions, and don't want to disable them, make sure to keep them enabled in the legacy SSPR policy until the new control is available in the future. You can migrate the remainder of your authentication methods and still manage security questions in the legacy SSPR policy. To view the migration options, open the Authentication methods policy and click **Manage migration**. The following table describes each option. | Migration in Progress | The Authentication methods policy is used for authentication and SSPR.<br>Legacy policy settings are respected. | | Migration Complete | Only the Authentication methods policy is used for authentication and SSPR.<br>Legacy policy settings are ignored. | -Tenants are set to either Pre-migration or Migration in Progress by default, depending on their tenant's current state. At any time, you can change to another option. If you move to Migration Complete, and then choose to roll back to an earlier state, we'll ask why so we can evaluate performance of the product. +Tenants are set to either Pre-migration or Migration in Progress by default, depending on their tenant's current state. If you start in Pre-migration, you can move to any of the states at any time. If you started in Migration in Progress, you can move between Migration in Progress and Microsoft Complete at any time, but won't be allowed to move to Pre-migration. If you move to Migration Complete, and then choose to roll back to an earlier state, we'll ask why so we can evaluate performance of the product. :::image type="content" border="true" source="./media/concept-authentication-methods-manage/reason.png" alt-text="Screenshot of reasons for rollback."::: |
| active-directory | Concept Authentication Methods | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-methods.md | The following table outlines when an authentication method can be used during a > \* Windows Hello for Business, by itself, does not serve as a step-up MFA credential. For example, an MFA Challenge from Sign-in Frequency or SAML Request containing forceAuthn=true. Windows Hello for Business can serve as a step-up MFA credential by being used in FIDO2 authentication. This requires users to be enabled for FIDO2 authentication to work successfully. -All of these authentication methods can be configured in the Azure portal, and increasingly using the [Microsoft Graph REST API](/graph/api/resources/authenticationmethods-overview). +All of these authentication methods can be configured in the Microsoft Entra admin center, and increasingly using the [Microsoft Graph REST API](/graph/api/resources/authenticationmethods-overview). To learn more about how each authentication method works, see the following separate conceptual articles: The following additional verification methods can be used in certain scenarios: ## Usable and non-usable methods -Administrators can view user authentication methods in the Azure portal. Usable methods are listed first, followed by non-usable methods. +Administrators can view user authentication methods in the Microsoft Entra admin center. Usable methods are listed first, followed by non-usable methods. Each authentication method can become non-usable for different reasons. For example, a Temporary Access Pass may expire, or FIDO2 security key may fail attestation. The portal will be updated to provide the reason for why the method is non-usable. |
| active-directory | Concept Authentication Oath Tokens | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-oath-tokens.md | Helga@contoso.com,1234567,2234567abcdef2234567abcdef,60,Contoso,HardwareKey > [!NOTE] > Make sure you include the header row in your CSV file. -Once properly formatted as a CSV file, a Global Administrator can then sign in to the Azure portal, navigate to **Azure Active Directory** > **Security** > **Multifactor authentication** > **OATH tokens**, and upload the resulting CSV file. +Once properly formatted as a CSV file, a Global Administrator can then sign in to the Microsoft Entra admin center, navigate to **Protection** > **Multifactor authentication** > **OATH tokens**, and upload the resulting CSV file. Depending on the size of the CSV file, it may take a few minutes to process. Select the **Refresh** button to get the current status. If there are any errors in the file, you can download a CSV file that lists any errors for you to resolve. The field names in the downloaded CSV file are different than the uploaded version. |
| active-directory | Concept Authentication Operator Assistance | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-operator-assistance.md | For example, let's say a customer in U.S has an office phone number 425-555-1234 If the setting is **Off**, the system will automatically dial extensions as part of the phone number. Your admin can still specify individual users who should be enabled for operator assistance by prefixing the extension with ΓÇÿ@ΓÇÖ. For example, 425-555-1234x@5678 would indicate that operator assistance should be used, even though the setting is **Off**. -You can check the status of this feature in your own tenant by navigating to the [Azure portal](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade), then in the left pane, click **Security** > **MFA** > **Phone call settings**. Check **Operator required to transfer extensions** to see if the setting is **On** or **Off**. +To check the status of this feature in your own tenant, sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator), then click **Protection** > **Multifactor authentication** > **Phone call settings**. Check **Operator required to transfer extensions** to see if the setting is **On** or **Off**.  |
| active-directory | Concept Authentication Phone Options | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-phone-options.md | For Azure AD Multi-Factor Authentication or SSPR, users can choose to receive a If users don't want their mobile phone number to be visible in the directory but want to use it for password reset, administrators shouldn't populate the phone number in the directory. Instead, users should populate their **Authentication Phone** at [My Sign-Ins](https://aka.ms/setupsecurityinfo). Administrators can see this information in the user's profile, but it's not published elsewhere. > [!NOTE] > Phone extensions are supported only for office phones. If you have problems with phone authentication for Azure AD, review the followin * Call forwarded to voicemail. * Ensure that the user has their phone turned on and that service is available in their area, or use alternate method. * User is blocked- * Have an Azure AD administrator unblock the user in the Azure portal. + * Have an Azure AD administrator unblock the user in the Microsoft Entra admin center. * Text messaging platforms like SMS, RCS, or WhatsApp aren't subscribed on the device. * Have the user change methods or activate a text messaging platform on the device. * Faulty telecom providers, such as when no phone input is detected, missing DTMF tones issues, blocked caller ID on multiple devices, or blocked text messages across multiple devices. |
| active-directory | Concept Authentication Security Questions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-security-questions.md | Security questions aren't used as an authentication method during a sign-in even When users register for SSPR, they're prompted to choose the authentication methods to use. If they choose to use security questions, they pick from a set of questions to prompt for and then provide their own answers. - + > [!NOTE] > Security questions are stored privately and securely on a user object in the directory and can only be answered by users during registration. There's no way for an administrator to read or modify a user's questions or answers. |
| active-directory | Concept Authentication Strengths | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-authentication-strengths.md | GET https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationSt In addition to the three built-in authentication strengths, administrators can create up to 15 of their own custom authentication strengths to exactly suit their requirements. A custom authentication strength can contain any of the supported combinations in the preceding table. -1. In the Azure portal, browse to **Azure Active Directory** > **Security** > **Authentication methods** > **Authentication strengths**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Authentication methods** > **Authentication strengths**. 1. Select **New authentication strength**. 1. Provide a descriptive **Name** for your new authentication strength. 1. Optionally provide a **Description**. The following authentication methods can't be registered as part of combined reg ### Federated user experience For federated domains, MFA may be enforced by Azure AD Conditional Access or by the on-premises federation provider by setting the federatedIdpMfaBehavior. If the federatedIdpMfaBehavior setting is set to enforceMfaByFederatedIdp, the user must authenticate on their federated IdP and can only satisfy the **Federated Multi-Factor** combination of the authentication strength requirement. For more information about the federation settings, see [Plan support for MFA](../hybrid/connect/migrate-from-federation-to-cloud-authentication.md#plan-support-for-mfa). -If a user from a federated domain has multifactor authentication settings in scope for Staged Rollout, the user can complete multifactor authentication in the cloud and satisfy any of the **Federated single-factor + something you have** combinations. For more information about staged rollout, see [Enable Staged Rollout using Azure portal](how-to-mfa-server-migration-utility.md#enable-staged-rollout-using-azure-portal). +If a user from a federated domain has multifactor authentication settings in scope for Staged Rollout, the user can complete multifactor authentication in the cloud and satisfy any of the **Federated single-factor + something you have** combinations. For more information about staged rollout, see [Enable Staged Rollout](how-to-mfa-server-migration-utility.md#enable-staged-rollout). ## External users |
| active-directory | Concept Certificate Based Authentication Certificateuserids | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-certificate-based-authentication-certificateuserids.md | For cloud-only users, only users with roles **Global Administrators**, **Privile >[!NOTE] >Active Directory Administrators (including accounts with delegated administrative privilege over synched user accounts as well as administrative rights over the Azure >AD Connect Servers) can make changes that impact the certificateUserIds value in Azure AD for any synched accounts. -## Update certificate user IDs in the Azure portal +## Update certificate user IDs -Tenant admins can use the following steps Azure portal to update certificate user IDs for a user account: +Tenant admins can use the following steps to update certificate user IDs for a user account: -1. In the Azure portal, click **All users (preview)**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](../roles/permissions-reference.md#user-administrator). Search for and select **All users**. :::image type="content" border="true" source="./media/concept-certificate-based-authentication-certificateuserids/user.png" alt-text="Screenshot of test user account."::: |
| active-directory | Concept Certificate Based Authentication Migration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-certificate-based-authentication-migration.md | This article explains how to migrate from running federated servers such as Acti To configure Staged Rollout, follow these steps: -1. Sign in to the [Azure portal](https://portal.azure.com) in the User Administrator role for the organization. -1. Search for and select **Azure Active Directory**. -1. From the left menu, select **Azure AD Connect**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [User Administrator](../roles/permissions-reference.md#user-administrator). +1. Search for and select **Azure AD Connect**. 1. On the Azure AD Connect page, under the Staged Rollout of cloud authentication, click **Enable Staged Rollout for managed user sign-in**. 1. On the **Enable Staged Rollout** feature page, click **On** for the option [Certificate-based authentication](./certificate-based-authentication-federation-get-started.md) 1. Click **Manage groups** and add groups you want to be part of cloud authentication. To avoid a time-out, ensure that the security groups contain no more than 200 members initially. |
| active-directory | Concept Certificate Based Authentication Technical Deep Dive | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-certificate-based-authentication-technical-deep-dive.md | Users need to have another way to get MFA and register passwordless sign-in or F For passwordless sign-in to work, users should disable legacy notification through mobile app. -1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). 1. Follow the steps at [Enable passwordless phone sign-in authentication](../authentication/howto-authentication-passwordless-phone.md#enable-passwordless-phone-sign-in-authentication-methods) >[!IMPORTANT] >In the above configuration under step 4, please choose **Passwordless** option. Change the mode for each groups added for PSI for **Authentication mode**, choose **Passwordless** for passwordless sign-in to work with CBA. If the admin configures "Any", CBA + PSI will not work. -1. Select **Azure Active Directory** > **Security** > **Multifactor authentication** > **Additional cloud-based multifactor authentication settings**. +1. Select **Protection** > **Multifactor authentication** > **Additional cloud-based multifactor authentication settings**. :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/configure.png" alt-text="Screenshot of how to configure multifactor authentication settings."::: For the first test scenario, configure the authentication policy where the Issue :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/single-factor.png" alt-text="Screenshot of the Authentication policy configuration showing single-factor authentication required." lightbox="./media/concept-certificate-based-authentication-technical-deep-dive/single-factor.png"::: -1. Sign in to the [Azure portal](https://portal.azure.com) as the test user by using CBA. The authentication policy is set where Issuer subject rule satisfies single-factor authentication. -1. After sign-in was succeeds, click **Azure Active Directory** > **Sign-in logs**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as the test user by using CBA. The authentication policy is set where Issuer subject rule satisfies single-factor authentication. +1. Search for and select **Sign-in logs**. Let's look closer at some of the entries you can find in the **Sign-in logs**. For the next test scenario, configure the authentication policy where the **poli :::image type="content" border="true" source="./media/concept-certificate-based-authentication-technical-deep-dive/multifactor.png" alt-text="Screenshot of the Authentication policy configuration showing multifactor authentication required." lightbox="./media/concept-certificate-based-authentication-technical-deep-dive/multifactor.png"::: -1. Sign in to the [Azure portal](https://portal.azure.com) using CBA. Since the policy was set to satisfy multifactor authentication, the user sign-in is successful without a second factor. -1. Click **Azure Active Directory** > **Sign-ins**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) using CBA. Since the policy was set to satisfy multifactor authentication, the user sign-in is successful without a second factor. +1. Search for and select **Sign-ins**. You'll see several entries in the Sign-in logs, including an entry with **Interrupted** status. |
| active-directory | Concept Mfa Authprovider | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-mfa-authprovider.md | If your MFA provider isn't linked to an Azure AD tenant, or you link the new MFA > [!CAUTION] > There is no confirmation when deleting an authentication provider. Selecting **Delete** is a permanent process. -Authentication providers can be found in the **Azure portal** > **Azure Active Directory** > **Security** > **MFA** > **Providers**. Click on listed providers to see details and configurations associated with that provider. +Authentication providers can be found in the [Microsoft Entra admin center](https://entra.microsoft.com). Sign in as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). Browse to **Protection** > **Multifactor authentication** > **Providers**. Click the listed providers to see details and configurations associated with that provider. Before removing an authentication provider, take note of any customized settings configured in your provider. Decide what settings need to be migrated to general MFA settings from your provider and complete the migration of those settings. -Azure MFA Servers linked to providers will need to be reactivated using credentials generated under **Azure portal** > **Azure Active Directory** > **Security** > **MFA** > **Server settings**. Before reactivating, the following files must be deleted from the `\Program Files\Multi-Factor Authentication Server\Data\` directory on Azure MFA Servers in your environment: +Azure MFA Servers linked to providers will need to be reactivated using credentials generated under **Server settings**. Before reactivating, the following files must be deleted from the `\Program Files\Multi-Factor Authentication Server\Data\` directory on Azure MFA Servers in your environment: - caCert - cert Azure MFA Servers linked to providers will need to be reactivated using credenti - licenseKey - pkey - + -After you confirm that all settings are migrated, you can browse to the **Azure portal** > **Azure Active Directory** > **Security** > **MFA** > **Providers** and select the ellipses **...** and select **Delete**. +After you confirm that all settings are migrated, browse to **Providers** and select the ellipses **...** and select **Delete**. > [!WARNING] > Deleting an authentication provider will delete any reporting information associated with that provider. You may want to save activity reports before deleting your provider. |
| active-directory | Concept Mfa Data Residency | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-mfa-data-residency.md | If you use MFA Server, the following personal data is stored. ## Organizational data stored by Azure AD multifactor authentication -Organizational data is tenant-level information that can expose configuration or environment setup. Tenant settings from the following Azure portal multifactor authentication pages might store organizational data such as lockout thresholds or caller ID information for incoming phone authentication requests: +Organizational data is tenant-level information that can expose configuration or environment setup. Tenant settings from the Multifactor authentication pages might store organizational data such as lockout thresholds or caller ID information for incoming phone authentication requests: * Account lockout * Fraud alert * Notifications * Phone call settings -For MFA Server, the following Azure portal pages might contain organizational data: +For MFA Server, the following pages might contain organizational data: * Server settings * One-time bypass |
| active-directory | Concept Registration Mfa Sspr Combined | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-registration-mfa-sspr-combined.md | To secure when and how users register for Azure AD Multi-Factor Authentication a An admin has enforced registration. -A user has not set up all required security info and goes to the Azure portal. After the user enters the user name and password, the user is prompted to set up security info. The user then follows the steps shown in the wizard to set up the required security info. If your settings allow it, the user can choose to set up methods other than those shown by default. After users complete the wizard, they review the methods they set up and their default method for multifactor authentication. To complete the setup process, the user confirms the info and continues to the Azure portal. +A user has not set up all required security info and goes to the Microsoft Entra admin center. After the user enters the user name and password, the user is prompted to set up security info. The user then follows the steps shown in the wizard to set up the required security info. If your settings allow it, the user can choose to set up methods other than those shown by default. After users complete the wizard, they review the methods they set up and their default method for multifactor authentication. To complete the setup process, the user confirms the info and continues to the Microsoft Entra admin center. ### Set up security info from My Account For example, a user sets Microsoft Authenticator app push notification as the pr This user is also configured with SMS/Text option on a resource tenant. If this user removes SMS/Text as one of the authentication options on their home tenant, they get confused when access to the resource tenant asks them to respond to SMS/Text message. -To switch the directory in the Azure portal, click the user account name in the upper right corner and click **Switch directory**. +To switch the directory in the Microsoft Entra admin center, click the user account name in the upper right corner and click **Switch directory**.  |
| active-directory | Concept Resilient Controls | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-resilient-controls.md | Mitigating an actual disruption must be an organizationΓÇÖs primary focus in dea ### Administrator lockout contingency -To unlock admin access to your tenant, you should create emergency access accounts. These emergency access accounts, also known as *break glass* accounts, allow access to manage Azure AD configuration when normal privileged account access procedures arenΓÇÖt available. At least two emergency access accounts should be created following the [emergency access account recommendations]( ../users-groups-roles/directory-emergency-access.md). +To unlock admin access to your tenant, you should create emergency access accounts. These emergency access accounts, also known as *break glass* accounts, allow access to manage Azure AD configuration when normal privileged account access procedures arenΓÇÖt available. At least two emergency access accounts should be created following the [emergency access account recommendations](../users-groups-roles/directory-emergency-access.md). ### Mitigating user lockout |
| active-directory | Concept Sspr Howitworks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-sspr-howitworks.md | To get started with SSPR, complete the following tutorial: You can enable the option to require a user to complete the SSPR registration if they use modern authentication or web browser to sign in to any applications using Azure AD. This workflow includes the following applications: * Microsoft 365-* Azure portal +* Microsoft Entra admin center * Access Panel * Federated applications * Custom applications using Azure AD When you don't require registration, users aren't prompted during sign-in, but they can manually register. Users can either visit [https://aka.ms/ssprsetup](https://aka.ms/ssprsetup) or select the **Register for password reset** link under the **Profile** tab in the Access Panel. -![Registration options for SSPR in the Azure portal][Registration] +![Registration options for SSPR in the Microsoft Entra admin center][Registration] > [!NOTE] > Users can dismiss the SSPR registration portal by selecting **cancel** or by closing the window. However, they're prompted to register each time they sign in until they complete their registration. Users can only reset their password if they have registered an authentication me > [!WARNING] > Accounts assigned Azure *administrator* roles are required to use methods as defined in the section [Administrator reset policy differences](concept-sspr-policy.md#administrator-reset-policy-differences). -![Authentication methods selection in the Azure portal][Authentication] +![Authentication methods selection in the Microsoft Entra admin center][Authentication] ### Number of authentication methods required If you have a hybrid environment, you can configure Azure AD Connect to write pa ![Validating password writeback is enabled and working][Writeback] -Azure AD checks your current hybrid connectivity and provides one of the following messages in the Azure portal: +Azure AD checks your current hybrid connectivity and provides one of the following messages in the Microsoft Entra admin center: * Your on-premises writeback client is up and running. * Azure AD is online and is connected to your on-premises writeback client. However, it looks like the installed version of Azure AD Connect is out-of-date. Consider [Upgrading Azure AD Connect](../hybrid/connect/how-to-upgrade-previous-version.md) to ensure that you have the latest connectivity features and important bug fixes. To get started with SSPR writeback, complete the following tutorial: ### Write back passwords to your on-premises directory -You can enable password writeback using the Azure portal. You can also temporarily disable password writeback without having to reconfigure Azure AD Connect. +You can enable password writeback using the Microsoft Entra admin center. You can also temporarily disable password writeback without having to reconfigure Azure AD Connect. * If the option is set to **Yes**, then writeback is enabled. Federated, pass-through authentication, or password hash synchronized users are able to reset their passwords. * If the option is set to **No**, then writeback is disabled. Federated, pass-through authentication, or password hash synchronized users aren't able to reset their passwords. |
| active-directory | Concept Sspr Writeback | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-sspr-writeback.md | Password writeback provides the following features: * **Enforcement of on-premises Active Directory Domain Services (AD DS) password policies**: When a user resets their password, it's checked to ensure it meets your on-premises AD DS policy before committing it to that directory. This review includes checking the history, complexity, age, password filters, and any other password restrictions that you define in AD DS. * **Zero-delay feedback**: Password writeback is a synchronous operation. Users are notified immediately if their password doesn't meet the policy or can't be reset or changed for any reason. * **Supports password changes from the access panel and Microsoft 365**: When federated or password hash synchronized users come to change their expired or non-expired passwords, those passwords are written back to AD DS.-* **Supports password writeback when an admin resets them from the Azure portal**: When an admin resets a user's password in the [Azure portal](https://portal.azure.com), if that user is federated or password hash synchronized, the password is written back to on-premises. This functionality is currently not supported in the Office admin portal. +* **Supports password writeback when an admin resets them from the Microsoft Entra admin center**: When an admin resets a user's password in the [Microsoft Entra admin center](https://entra.microsoft.com), if that user is federated or password hash synchronized, the password is written back to on-premises. This functionality is currently not supported in the Office admin portal. * **Doesn't require any inbound firewall rules**: Password writeback uses an Azure Service Bus relay as an underlying communication channel. All communication is outbound over port 443. * **Supports side-by-side domain-level deployment** using [Azure AD Connect](tutorial-enable-sspr-writeback.md) or [cloud sync](tutorial-enable-cloud-sync-sspr-writeback.md) to target different sets of users depending on their needs, including users who are in disconnected domains. Passwords are written back in all the following situations: * Any administrator self-service voluntary change password operation. * Any administrator self-service force change password operation, for example, password expiration. * Any administrator self-service password reset that originates from the [password reset portal](https://passwordreset.microsoftonline.com).- * Any administrator-initiated end-user password reset from the [Azure portal](https://portal.azure.com). + * Any administrator-initiated end-user password reset from the Microsoft Entra admin center. * Any administrator-initiated end-user password reset from the [Microsoft Graph API](/graph/api/passwordauthenticationmethod-resetpassword). ## Unsupported writeback operations |
| active-directory | Concept System Preferred Multifactor Authentication | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concept-system-preferred-multifactor-authentication.md | description: Learn how to use system-preferred multifactor authentication Previously updated : 06/28/2023 Last updated : 09/13/2023 After system-preferred MFA is enabled, the authentication system does all the wo >[!NOTE] >System-preferred MFA is an important security enhancement for users authenticating by using telecom transports. Starting July 07, 2023, the Microsoft managed value of system-preferred MFA will change from **Disabled** to **Enabled**. If you don't want to enable system-preferred MFA, change the state from **Default** to **Disabled**, or exclude users and groups from the policy. -## Enable system-preferred MFA in the Azure portal +## Enable system-preferred MFA in the Microsoft Entra admin center By default, system-preferred MFA is Microsoft managed and disabled for all users. -1. In the Azure portal, click **Security** > **Authentication methods** > **Settings**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Authentication methods** > **Settings**. 1. For **System-preferred multifactor authentication**, choose whether to explicitly enable or disable the feature, and include or exclude any users. Excluded groups take precedence over include groups. For example, the following screenshot shows how to make system-preferred MFA explicitly enabled for only the Engineering group. |
| active-directory | Concepts Azure Multi Factor Authentication Prompts Session Lifetime | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/concepts-azure-multi-factor-authentication-prompts-session-lifetime.md | Under each sign-in log, go to the **Authentication Details** tab and explore **S To configure or review the *Remain signed-in* option, complete the following steps: -1. In the Azure portal, search for and select *Azure Active Directory*. -1. Select **Company Branding**, then for each locale, choose **Show option to remain signed in**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../roles/permissions-reference.md#global-administrator). +1. Browse to **Identity** > **Company Branding**, then for each locale, choose **Show option to remain signed in**. 1. Choose *Yes*, then select **Save**. To remember multifactor authentication settings on trusted devices, complete the following steps: -1. In the Azure portal, search for and select *Azure Active Directory*. -1. Select **Security**, then **MFA**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > then **Multifactor authentication**. 1. Under **Configure**, select **Additional cloud-based MFA settings**. 1. In the *Multi-factor authentication service settings* page, scroll to **remember multi-factor authentication settings**. Disable the setting by unchecking the checkbox. To configure Conditional Access policies for sign-in frequency and persistent browser session, complete the following steps: -1. In the Azure portal, search for and select *Azure Active Directory*. -1. Select **Security**, then **Conditional Access**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access**. 1. Configure a policy using the recommended session management options detailed in this article. To review token lifetimes, [use Azure AD PowerShell to query any Azure AD policies](../develop/configure-token-lifetimes.md#get-started). Disable any policies that you have in place. |
| active-directory | How To Authentication Methods Manage | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/how-to-authentication-methods-manage.md | For each method, note whether or not it's enabled for the tenant. The following | Call to phone | Voice calls | | Text message to phone | SMS | | Notification through mobile app | Microsoft Authenticator |-| Verification code from mobile app or hardware token | Third party software OATH tokens<br>Hardware OATH tokens (not yet available)<br>Microsoft Authenticator | +| Verification code from mobile app or hardware token | Third party software OATH tokens<br>Hardware OATH tokens<br>Microsoft Authenticator | ### Review the legacy SSPR policy The Authentication methods policy has controls for **SMS** and **Voice calls**, The OATH token controls in the legacy MFA and SSPR policies were single controls that enabled the use of three different types of OATH tokens: the Microsoft Authenticator app, third-party software OATH TOTP code generator apps, and hardware OATH tokens. -The Authentication methods policy has granular control with separate controls for each type of OATH token. Use of OTP from Microsoft Authenticator is controlled by the **Allow use of Microsoft Authenticator OTP** control in the **Microsoft Authenticator** section of the policy. Third-party apps are controlled by the **Third party software OATH tokens** section of the policy. --Another control for **Hardware OATH tokens** is coming soon. If you're using hardware OATH tokens, now in public preview, you should hold off on migrating OATH tokens and don't complete the migration process. +The Authentication methods policy has granular control with separate controls for each type of OATH token. Use of OTP from Microsoft Authenticator is controlled by the **Allow use of Microsoft Authenticator OTP** control in the **Microsoft Authenticator** section of the policy. Third-party apps are controlled by the **Third party software OATH tokens** section of the policy. Hardware OATH tokens are controlled by the **Hardware OATH tokens** section of the policy. ### Security questions |
| active-directory | How To Authentication Two Way Sms Unsupported | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/how-to-authentication-two-way-sms-unsupported.md | -Email notifications and Azure portal Service Health notifications (portal toasts) were sent to affected admins on December 8, 2020 and January 28, 2021. The alerts went to the Owner, Co-Owner, Admin, and Service Admin RBAC roles tied to the subscriptions. If you've already completed the following steps, no action is necessary. +Email notifications and Service Health notifications (portal toasts) were sent to affected admins on December 8, 2020 and January 28, 2021. The alerts went to the Owner, Co-Owner, Admin, and Service Admin RBAC roles tied to the subscriptions. If you've already completed the following steps, no action is necessary. ## Required actions |
| active-directory | How To Mfa Server Migration Utility | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/how-to-mfa-server-migration-utility.md | Take a look at our video for an overview of the MFA Server Migration Utility and ||[Configure MFA Server Migration Utility](#configure-the-mfa-server-migration-utility) | |Migrations |[Migrate user data](#migrate-user-data)| ||[Validate and test](#validate-and-test)|-||[Staged Rollout](#enable-staged-rollout-using-azure-portal) | +||[Staged Rollout](#enable-staged-rollout) | ||[Educate users](#educate-users)| ||[Complete user migration](#complete-user-migration)| |Finalize |[Migrate MFA Server dependencies](#migrate-mfa-server-dependencies)| You'll also need access to the following URLs: - `https://graph.microsoft.com/*` (or `https://graph.microsoft.us/*` for government cloud customers) - `https://login.microsoftonline.com/*` (or `https://login.microsoftonline.us/*` for government cloud customers) -The script will instruct you to grant admin consent to the newly created application. Navigate to the URL provided, or within the Azure portal, click **Application Registrations**, find and select the **MFA Server Migration Utility** app, click on **API permissions** and then granting the appropriate permissions. +The script will instruct you to grant admin consent to the newly created application. Navigate to the URL provided, or within the Microsoft Entra admin center, click **Application Registrations**, find and select the **MFA Server Migration Utility** app, click on **API permissions** and then granting the appropriate permissions. :::image type="content" border="true" source="./media/how-to-mfa-server-migration-utility/permissions.png" alt-text="Screenshot of permissions."::: AuditLogs ### Validate and test -Once you've successfully migrated user data, you can validate the end-user experience using Staged Rollout before making the global tenant change. The following process will allow you to target specific Azure AD group(s) for Staged Rollout for MFA. Staged Rollout tells Azure AD to perform MFA by using Azure AD MFA for users in the targeted groups, rather than sending them on-premises to perform MFA. You can validate and testΓÇöwe recommend using the Azure portal, but if you prefer, you can also use Microsoft Graph. +Once you've successfully migrated user data, you can validate the end-user experience using Staged Rollout before making the global tenant change. The following process will allow you to target specific Azure AD group(s) for Staged Rollout for MFA. Staged Rollout tells Azure AD to perform MFA by using Azure AD MFA for users in the targeted groups, rather than sending them on-premises to perform MFA. You can validate and testΓÇöwe recommend using the Microsoft Entra admin center, but if you prefer, you can also use Microsoft Graph. -#### Enable Staged Rollout using Azure portal +#### Enable Staged Rollout -1. Navigate to the following url: [Enable staged rollout features - Microsoft Azure](https://portal.azure.com/?mfaUIEnabled=true%2F#view/Microsoft_AAD_IAM/StagedRolloutEnablementBladeV2). +1. Navigate to the following url: [Enable staged rollout features - Microsoft Azure](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/StagedRolloutEnablementBladeV2). 1. Change **Azure multifactor authentication** to **On**, and then click **Manage groups**. |
| active-directory | Howto Authentication Passwordless Faqs | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-authentication-passwordless-faqs.md | For a list of supported providers, see [FIDO2 security keys providers](concept-a ### What if I lose my security key? -You can remove keys in the Azure portal by navigating to the **Security info** page and removing the FIDO2 security key. +You can remove keys by navigating to the **Security info** page and removing the FIDO2 security key. ### How is the data protected on the FIDO2 security key? |
| active-directory | Howto Authentication Sms Signin | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-authentication-sms-signin.md | Here are some known issues: * SMS-based authentication isn't supported for B2B accounts. * Federated users won't authenticate in the home tenant. They only authenticate in the cloud. * If a user's default sign-in method is a text or call to your phone number, then the SMS code or voice call is sent automatically during multifactor authentication. As of June 2021, some apps will ask users to choose **Text** or **Call** first. This option prevents sending too many security codes for different apps. If the default sign-in method is the Microsoft Authenticator app ([which we highly recommend](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/it-s-time-to-hang-up-on-phone-transports-for-authentication/ba-p/1751752)), then the app notification is sent automatically.-* SMS-based authentication has reached general availability, and we're working to remove the **(Preview)** label in the Azure portal. ## Enable the SMS-based authentication method There are three main steps to enable and use SMS-based authentication in your or * Enable the authentication method policy. * Select users or groups that can use the SMS-based authentication method. * Assign a phone number for each user account.- * This phone number can be assigned in the Azure portal (which is shown in this article), and in *My Staff* or *My Account*. + * This phone number can be assigned in the Microsoft Entra admin center (which is shown in this article), and in *My Staff* or *My Account*. First, let's enable SMS-based authentication for your Azure AD tenant. Each user that's enabled in SMS authentication method policy must be licensed, e ## Set a phone number for user accounts -Users are now enabled for SMS-based authentication, but their phone number must be associated with the user profile in Azure AD before they can sign-in. The user can [set this phone number themselves](https://support.microsoft.com/account-billing/set-up-sms-sign-in-as-a-phone-verification-method-0aa5b3b3-a716-4ff2-b0d6-31d2bcfbac42) in *My Account*, or you can assign the phone number using the Azure portal. Phone numbers can be set by *global admins*, *authentication admins*, or *privileged authentication admins*. +Users are now enabled for SMS-based authentication, but their phone number must be associated with the user profile in Azure AD before they can sign-in. The user can [set this phone number themselves](https://support.microsoft.com/account-billing/set-up-sms-sign-in-as-a-phone-verification-method-0aa5b3b3-a716-4ff2-b0d6-31d2bcfbac42) in *My Account*, or you can assign the phone number using the Microsoft Entra admin center. Phone numbers can be set by *global admins*, *authentication admins*, or *privileged authentication admins*. When a phone number is set for SMS-based sign-in, it's also then available for use with [Azure AD Multi-Factor Authentication][tutorial-azure-mfa] and [self-service password reset][tutorial-sspr]. When a phone number is set for SMS-based sign-in, it's also then available for u 1. Select the user you enabled for SMS-based authentication in the previous section, such as *Contoso User*, then select **Authentication methods**. 1. Select **+ Add authentication method**, then in the *Choose method* drop-down menu, choose **Phone number**. - Enter the user's phone number, including the country code, such as *+1 xxxxxxxxx*. The Azure portal validates the phone number is in the correct format. + Enter the user's phone number, including the country code, such as *+1 xxxxxxxxx*. The Microsoft Entra admin center validates the phone number is in the correct format. Then, from the *Phone type* drop-down menu, select *Mobile*, *Alternate mobile*, or *Other* as needed. - :::image type="content" source="media/howto-authentication-sms-signin/set-user-phone-number.png" alt-text="Set a phone number for a user in the Azure portal to use with SMS-based authentication"::: + :::image type="content" source="media/howto-authentication-sms-signin/set-user-phone-number.png" alt-text="Set a phone number for a user in the Microsoft Entra admin center to use with SMS-based authentication"::: The phone number must be unique in your tenant. If you try to use the same phone number for multiple users, an error message is shown. For more information on the end-user experience, see [SMS sign-in user experienc ### Error when trying to set a phone number on a user's account -If you receive an error when you try to set a phone number for a user account in the Azure portal, review the following troubleshooting steps: +If you receive an error when you try to set a phone number for a user account in the Microsoft Entra admin center, review the following troubleshooting steps: 1. Make sure that you're enabled for the SMS-based sign-in. 1. Confirm that the user account is enabled in the **SMS** authentication method policy.-1. Make sure you set the phone number with the proper formatting, as validated in the Azure portal (such as *+1 4251234567*). +1. Make sure you set the phone number with the proper formatting, as validated in the Microsoft Entra admin center (such as *+1 4251234567*). 1. Make sure that the phone number isn't used elsewhere in your tenant. 1. Check there's no voice number set on the account. If a voice number is set, delete and try to the phone number again. |
| active-directory | Howto Authentication Temporary Access Pass | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-authentication-temporary-access-pass.md | A Temporary Access Pass is a time-limited passcode that can be configured for si A Temporary Access Pass also makes recovery easier when a user has lost or forgotten their strong authentication factor like a FIDO2 security key or Microsoft Authenticator app, but needs to sign in to register new strong authentication methods. -This article shows you how to enable and use a Temporary Access Pass in Azure AD using the the [Microsoft Entra admin center](https://entra.microsoft.com). +This article shows you how to enable and use a Temporary Access Pass using the the [Microsoft Entra admin center](https://entra.microsoft.com). You can also perform these actions using the REST APIs. ## Enable the Temporary Access Pass policy The most common use for a Temporary Access Pass is for a user to register authen 1. Open a web browser to [https://aka.ms/mysecurityinfo](https://aka.ms/mysecurityinfo). 1. Enter the UPN of the account you created the Temporary Access Pass for, such as *tapuser@contoso.com*. 1. If the user is included in the Temporary Access Pass policy, they see a screen to enter their Temporary Access Pass.-1. Enter the Temporary Access Pass that was displayed in the Azure portal. +1. Enter the Temporary Access Pass that was displayed in the Microsoft Entra admin center. :::image type="content" border="true" source="./media/how-to-authentication-temporary-access-pass/enter.png" alt-text="Screenshot of how to enter a Temporary Access Pass."::: The token lifetime (session token, refresh token, access token, and so on) obtai Under the **Authentication methods** for a user, the **Detail** column shows when the Temporary Access Pass expired. You can delete an expired Temporary Access Pass using the following steps: -1. In the Azure portal, browse to **Users**, select a user, such as *Tap User*, then choose **Authentication methods**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Identity** > **Users**, select a user, such as *Tap User*, then choose **Authentication methods**. 1. On the right-hand side of the **Temporary Access Pass** authentication method shown in the list, select **Delete**. You can also use PowerShell: |
| active-directory | Howto Mfa Getstarted | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-mfa-getstarted.md | Azure AD Multi-Factor Authentication is enforced with Conditional Access policie  -In the Azure portal, you configure Conditional Access policies under **Azure Active Directory** > **Security** > **Conditional Access**. +In the Microsoft Entra admin center, you configure Conditional Access policies under **Protection** > **Conditional Access**. -To learn more about creating Conditional Access policies, see [Conditional Access policy to prompt for Azure AD Multi-Factor Authentication when a user signs in to the Azure portal](tutorial-enable-azure-mfa.md). This helps you to: +To learn more about creating Conditional Access policies, see [Conditional Access policy to prompt for Azure AD Multi-Factor Authentication when a user signs in](tutorial-enable-azure-mfa.md). This helps you to: - Become familiar with the user interface - Get a first impression of how Conditional Access works As mentioned before, ensure users are registered for more than one MFA method, s If the user does not have a backup method available, you can: - Provide them a Temporary Access Pass so that they can manage their own authentication methods. You can also provide a Temporary Access Pass to enable temporary access to resources. -- Update their methods as an administrator. To do so, select the user in the Azure portal, then select Authentication methods and update their methods.+- Update their methods as an administrator. To do so, select the user in the Microsoft Entra admin center, then select **Protection** > **Authentication methods** and update their methods. ## Plan integration with on-premises systems |
| active-directory | Howto Mfa Mfasettings | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-mfa-mfasettings.md | The following Azure AD Multi-Factor Authentication settings are available: | [Phone call settings](#phone-call-settings) | Configure settings related to phone calls and greetings for cloud and on-premises environments. | | Providers | This will show any existing authentication providers that you've associated with your account. Adding new providers is disabled as of September 1, 2018. | - + ## Account lockout (MFA Server only) The following settings are available: To configure account lockout settings, complete these steps: -1. Sign in to the [Azure portal](https://portal.azure.com) as an administrator. -1. Go to **Azure Active Directory** > **Security** > **Multifactor authentication** > **Account lockout**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Multifactor authentication** > **Account lockout**. 1. Enter the values for your environment, and then select **Save**. -  +  ## Block and unblock users Users who report an MFA prompt as suspicious are set to **High User Risk**. Admi To enable **Report suspicious activity** from the Authentication methods **Settings**: -1. In the Azure portal, click **Azure Active Directory** > **Security** > **Authentication Methods** > **Settings**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Authentication Methods** > **Settings**. 1. Set **Report suspicious activity** to **Enabled**. The feature remains disabled if you choose **Microsoft managed**. For more information about Microsoft managed values, see [Protecting authentication methods in Azure Active Directory](concept-authentication-default-enablement.md). 1. Select **All users** or a specific group. 1. Select a **Reporting code**. Helga@contoso.com,1234567,1234567abcdef1234567abcdef,60,Contoso,HardwareKey > [!NOTE] > Be sure to include the header row in your CSV file. -An administrator can sign in to the Azure portal, go to **Azure Active Directory** > **Security** > **Multifactor authentication** > **OATH tokens**, and upload the CSV file. +An Authentication Policy Administrator can sign in to the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Protection** > **Multifactor authentication** > **OATH tokens**, and upload the CSV file. Depending on the size of the CSV file, it might take a few minutes to process. Select **Refresh** to get the status. If there are any errors in the file, you can download a CSV file that lists them. The field names in the downloaded CSV file are different from those in the uploaded version. To use your own custom messages, complete the following steps: ## MFA service settings -Settings for app passwords, trusted IPs, verification options, and remembering multi-factor authentication on trusted devices are available in the service settings. This is a legacy portal. It isn't part of the regular Azure portal. +Settings for app passwords, trusted IPs, verification options, and remembering multi-factor authentication on trusted devices are available in the service settings. This is a legacy portal. -You can access service settings from the Azure portal by going to **Azure Active Directory** > **Security** > **Multifactor authentication** > **Getting started** > **Configure** > **Additional cloud-based MFA settings**. A window or tab opens with additional service settings options. +You can access service settings from the [Microsoft Entra admin center](https://entra.microsoft.com) by going to **Protection** > **Multifactor authentication** > **Getting started** > **Configure** > **Additional cloud-based MFA settings**. A window or tab opens with additional service settings options. ### Trusted IPs Regardless of whether trusted IPs are defined, multi-factor authentication is re You can use Conditional Access rules to define named locations by using the following steps: -1. In the Azure portal, search for and select **Azure Active Directory**, and then go to **Security** > **Conditional Access** > **Named locations**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access** > **Named locations**. 1. Select **New location**. 1. Enter a name for the location. 1. Select **Mark as trusted location**. You can use Conditional Access rules to define named locations by using the foll To enable trusted IPs by using Conditional Access policies, complete the following steps: -1. In the Azure portal, search for and select **Azure Active Directory**, and then go to **Security** > **Conditional Access** > **Named locations**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access** > **Named locations**. 1. Select **Configure MFA trusted IPs**. 1. On the **Service Settings** page, under **Trusted IPs**, choose one of these options: To enable trusted IPs by using Conditional Access policies, complete the followi If you don't want to use Conditional Access policies to enable trusted IPs, you can configure the service settings for Azure AD Multi-Factor Authentication by using the following steps: -1. In the Azure portal, search for and select **Azure Active Directory**, and then select **Users**. -1. Select **Per-user MFA**. -1. Under **multi-factor authentication** at the top of the page, select **service settings**. -1. On the **service settings** page, under **Trusted IPs**, choose one or both of the following options: +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Multifactor authentication** > **Service settings**. +1. On the **Service settings** page, under **Trusted IPs**, choose one or both of the following options: * **For requests from federated users on my intranet**: To choose this option, select the checkbox. All federated users who sign in from the corporate network bypass multi-factor authentication by using a claim that's issued by AD FS. Ensure that AD FS has a rule to add the intranet claim to the appropriate traffic. If the rule doesn't exist, create the following rule in AD FS: For more information, see [What authentication and verification methods are avai To enable or disable verification methods, complete the following steps: -1. In the Azure portal, search for and select **Azure Active Directory**, and then select **Users**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Identity** > **Users**. 1. Select **Per-user MFA**.-1. Under **multi-factor authentication** at the top of the page, select **service settings**. -1. On the **service settings** page, under **verification options**, select or clear the appropriate checkboxes. +1. Under **Multifactor authentication** at the top of the page, select **Service settings**. +1. On the **Service settings** page, under **Verification options**, select or clear the appropriate checkboxes. 1. Select **Save**. ### Remember multi-factor authentication The feature reduces the number of authentications on web apps, which normally pr To enable and configure the option to allow users to remember their MFA status and bypass prompts, complete the following steps: -1. In the Azure portal, search for and select **Azure Active Directory**, and then select **Users**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Identity** > **Users**. 1. Select **Per-user MFA**.-1. Under **multi-factor authentication** at the top of the page, select **service settings**. +1. Under **Multifactor authentication** at the top of the page, select **service settings**. 1. On the **service settings** page, under **remember multi-factor authentication**, select **Allow users to remember multi-factor authentication on devices they trust**. 1. Set the number of days to allow trusted devices to bypass multi-factor authentications. For the optimal user experience, extend the duration to 90 or more days. 1. Select **Save**. |
| active-directory | Howto Mfa Reporting Datacollection | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-mfa-reporting-datacollection.md | From the command line of the MFA Server, run the following command changing the ## Gather data from NPS Extension -Use the [Microsoft Privacy Portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/UserPrivacyMenuBlade/Overview) to make a request for Export. +Use the Microsoft Privacy portal to make a request for Export. - MFA information is included in the export, which may take hours or days to complete. - Occurrences of the username in the AzureMfa/AuthN/AuthNOptCh, AzureMfa/AuthZ/AuthZAdminCh, and AzureMfa/AuthZ/AuthZOptCh event logs are considered operational and duplicative to the information provided in the export. ## Delete data from NPS Extension -Use the [Microsoft Privacy Portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/UserPrivacyMenuBlade/Overview) to make a request for Account Close to delete all MFA cloud service information collected for this user. +Use the Microsoft Privacy portal to make a request for Account Close to delete all MFA cloud service information collected for this user. - It may take up to 30 days for data to be fully removed. ## Gather data from Windows Server 2016 Azure AD MFA AD FS Adapter -Use the [Microsoft Privacy Portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/UserPrivacyMenuBlade/Overview) to make a request for Export. +Use the Microsoft Privacy portal to make a request for Export. - MFA information is included in the export, which may take hours or days to complete. - Occurrences of the username in the AD FS Tracing/Debug event logs (if enabled) are considered operational and duplicative to the information provided in the export. ## Delete data from Windows Server 2016 Azure AD MFA AD FS Adapter -Use the [Microsoft Privacy Portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/UserPrivacyMenuBlade/Overview) to make a request for Account Close to delete all MFA cloud service information collected for this user. +Use the Microsoft Privacy portal to make a request for Account Close to delete all MFA cloud service information collected for this user. - It may take up to 30 days for data to be fully removed. ## Gather data for Azure AD MFA -Use the [Microsoft Privacy Portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/UserPrivacyMenuBlade/Overview) to make a request for Export. +Use the Microsoft Privacy portal to make a request for Export. - MFA information is included in the export, which may take hours or days to complete. ## Delete data for Azure AD MFA -Use the [Microsoft Privacy Portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/UserPrivacyMenuBlade/Overview) to make a request for Account Close to delete all MFA cloud service information collected for this user. +Use the Microsoft Privacy portal to make a request for Account Close to delete all MFA cloud service information collected for this user. - It may take up to 30 days for data to be fully removed. |
| active-directory | Howto Mfa Reporting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-mfa-reporting.md | -This article shows you how to view the Azure AD sign-ins report in the Azure portal, and then the MSOnline V1 PowerShell module. - ## View the Azure AD sign-ins report [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] The sign-ins report provides you with information about the usage of managed app - How many users are unable to complete the MFA challenge? - What are the common MFA issues end users are running into? -To view the sign-in activity report in the [Azure portal](https://portal.azure.com), complete the following steps. You can also query data using the [reporting API](../reports-monitoring/howto-configure-prerequisites-for-reporting-api.md). +To view the sign-in activity report in the [Microsoft Entra admin center](https://entra.microsoft.com), complete the following steps. You can also query data using the [reporting API](../reports-monitoring/howto-configure-prerequisites-for-reporting-api.md). -1. Sign in to the [Azure portal](https://portal.azure.com) using an account with *global administrator* permissions. -1. Search for and select **Azure Active Directory**, then choose **Users** from the menu on the left-hand side. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Identity** > then choose **Users** from the menu on the left-hand side. 1. Under *Activity* from the menu on the left-hand side, select **Sign-ins**. 1. A list of sign-in events is shown, including the status. You can select an event to view more details. The **Conditional Access** tab of the event details shows you which policy triggered the MFA prompt. - [](media/howto-mfa-reporting/sign-in-report.png#lightbox) + [](media/howto-mfa-reporting/sign-in-report.png#lightbox) If available, the authentication is shown, such as text message, Microsoft Authenticator app notification, or phone call. |
| active-directory | Howto Mfaserver Adfs 2 | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-mfaserver-adfs-2.md | Title: Use Azure MFA Server with AD FS 2.0 -description: Describes how to get started with Azure MFA and AD FS 2.0. + Title: Use Azure Active Directory Multi-Factor Authentication Server with AD FS 2.0 +description: Describes how to get started with Azure Active Directory Multi-Factor Authentication and AD FS 2.0. Previously updated : 10/29/2022 Last updated : 09/13/2023 -+ This article is for organizations that are federated with Azure Active Directory This documentation covers using the Azure Multi-Factor Authentication Server with AD FS 2.0. For information about AD FS, see [Securing cloud and on-premises resources using Azure Multi-Factor Authentication Server with Windows Server](howto-mfaserver-adfs-windows-server.md). > [!IMPORTANT]-> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their usersΓÇÖ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure MFA service by using the latest Migration Utility included in the most recent [Azure MFA Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure MFA Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md). +> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their usersΓÇÖ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure Active Directory Multi-Factor Authentication service by using the latest Migration Utility included in the most recent [Azure Active Directory Multi-Factor Authentication Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure Active Directory Multi-Factor Authentication Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md). > > To get started with cloud-based MFA, see [Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication](tutorial-enable-azure-mfa.md). > You enabled IIS authentication, but to perform the pre-authentication to your Ac  3. Click **Edit**.-4. In the Edit LDAP Configuration dialog box, populate the fields with the information required to connect to the AD domain controller. Descriptions of the fields are included in the Azure Multi-Factor Authentication Server help file. +4. In the Edit LDAP Configuration dialog box, populate the fields with the information required to connect to the AD domain controller. 5. Test the LDAP connection by clicking the **Test** button.  You enabled IIS authentication, but to perform the pre-authentication to your Ac 1. Next, click the **Company Settings** icon and select the **Username Resolution** tab. 2. Select the **Use LDAP unique identifier attribute for matching usernames** radio button. 3. If users enter their username in "domain\username" format, the Server needs to be able to strip the domain off the username when it creates the LDAP query, which can be done through a registry setting.-4. Open the registry editor and go to HKEY_LOCAL_MACHINE/SOFTWARE/Wow6432Node/Positive Networks/PhoneFactor on a 64-bit server. If on a 32-bit server, take the "Wow6432Node" out of the path. Create a DWORD registry key called "UsernameCxz_stripPrefixDomain" and set the value to 1. Azure Multi-Factor Authentication is now securing the AD FS proxy. +4. Open the registry editor and go to HKEY_LOCAL_MACHINE/SOFTWARE/Wow6432Node/Positive Networks/PhoneFactor on a 64-bit server. If you use a 32-bit server, remove **/Wow6432Node** from the path. Create a DWORD registry key called "UsernameCxz_stripPrefixDomain" and set the value to 1. Azure Multi-Factor Authentication is now securing the AD FS proxy. Make sure users are imported from Active Directory into the Server. To allow users to skip two-step verification from internal IP addresses, see the [Trusted IPs](#trusted-ips). You can secure AD FS when the AD FS proxy isn't used. Install the Azure Multi-Fa Azure Multi-Factor Authentication is now securing AD FS. -Ensure that users have been imported from Active Directory into the Server. See the Trusted IPs section if you would like to allow internal IP addresses so that two-step verification isn't required when signing in to the website from those locations. +Ensure that users have been imported from Active Directory into the Server. See the next section if you would like to allow internal IP addresses so that two-step verification isn't required when signing in to the website from those locations. ## Trusted IPs |
| active-directory | Howto Mfaserver Deploy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-mfaserver-deploy.md | Title: Getting started Azure MFA Server -description: Step-by-step get started with Azure MFA Server on-premises + Title: Getting started Azure Active Directory Multi-Factor Authentication Server +description: Step-by-step get started with Azure Active Directory Multi-Factor Authentication Server on-premises Previously updated : 08/08/2023 Last updated : 09/13/2023 -> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their usersΓÇÖ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure MFA service by using the latest Migration Utility included in the most recent [Azure MFA Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure MFA Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md). +> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their usersΓÇÖ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure Active Directory Multi-Factor Authentication service by using the latest Migration Utility included in the most recent [Azure Active Directory Multi-Factor Authentication Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure Active Directory Multi-Factor Authentication Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md). > To get started with cloud-based MFA, see [Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication](tutorial-enable-azure-mfa.md). A good guideline for the amount of memory you need is the number of users you ex | 100,000-200,001 | 16 GB | | 200,001+ | 32 GB | -Do you need to set up multiple servers for high availability or load balancing? There are many ways to set up this configuration with Azure MFA Server. When you install your first Azure MFA Server, it becomes the master. Any other servers become subordinate, and automatically synchronize users and configuration with the master. Then, you can configure one primary server and have the rest act as backup, or you can set up load balancing among all the servers. +Do you need to set up multiple servers for high availability or load balancing? There are many ways to set up this configuration with Azure Active Directory Multi-Factor Authentication Server. When you install your first Azure Active Directory Multi-Factor Authentication Server, it becomes the master. Any other servers become subordinate, and automatically synchronize users and configuration with the master. Then, you can configure one primary server and have the rest act as backup, or you can set up load balancing among all the servers. -When a master Azure MFA Server goes offline, the subordinate servers can still process two-step verification requests. However, you can't add new users and existing users can't update their settings until the master is back online or a subordinate gets promoted. +When a master Azure Active Directory Multi-Factor Authentication Server goes offline, the subordinate servers can still process two-step verification requests. However, you can't add new users and existing users can't update their settings until the master is back online or a subordinate gets promoted. ### Prepare your environment Make sure the server that you're using for Azure Multi-Factor Authentication mee | Software |<li>Windows Server 2022<sup>1</sup><li>Windows Server 2019<sup>1</sup></li><li>Windows Server 2016</li><li>Windows Server 2012 R2</li><li>Windows Server 2012</li><li>Windows Server 2008/R2 (with [ESU](/lifecycle/faq/extended-security-updates) only)</li><li>Windows 10</li><li>Windows 8.1, all editions</li><li>Windows 8, all editions</li><li>Windows 7, all editions (with [ESU](/lifecycle/faq/extended-security-updates) only)</li><li>Microsoft .NET 4.0 Framework</li><li>IIS 7.0 or greater if installing the user portal or web service SDK</li> | | Permissions | Domain Administrator or Enterprise Administrator account to register with Active Directory | -<sup>1</sup>If Azure MFA Server fails to activate on an Azure VM that runs Windows Server 2019 or later, try using an earlier version of Windows Server. +<sup>1</sup>If Azure Active Directory Multi-Factor Authentication Server fails to activate on an Azure VM that runs Windows Server 2019 or later, try using an earlier version of Windows Server. -### Azure MFA Server Components +### Azure Active Directory Multi-Factor Authentication Server Components -There are three web components that make up Azure MFA Server: +There are three web components that make up Azure Active Directory Multi-Factor Authentication Server: -* Web Service SDK - Enables communication with the other components and is installed on the Azure MFA application server +* Web Service SDK - Enables communication with the other components and is installed on the Azure Active Directory Multi-Factor Authentication application server * User portal - An IIS web site that allows users to enroll in Azure Multi-Factor Authentication (MFA) and maintain their accounts. * Mobile App Web Service - Enables using a mobile app like the Microsoft Authenticator app for two-step verification. -All three components can be installed on the same server if the server is internet-facing. If breaking up the components, the Web Service SDK is installed on the Azure MFA application server and the User portal and Mobile App Web Service are installed on an internet-facing server. +All three components can be installed on the same server if the server is internet-facing. If breaking up the components, the Web Service SDK is installed on the Azure Active Directory Multi-Factor Authentication application server and the User portal and Mobile App Web Service are installed on an internet-facing server. ### Azure Multi-Factor Authentication Server firewall requirements If you aren't using the Event Confirmation feature, and your users aren't using [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -Follow these steps to download the Azure AD Multi-Factor Authentication Server from the Azure portal: +Follow these steps to download the Azure AD Multi-Factor Authentication Server: > [!IMPORTANT]-> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their usersΓÇÖ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure MFA service by using the latest Migration Utility included in the most recent [Azure MFA Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure MFA Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md). +> In September 2022, Microsoft announced deprecation of Azure Multi-Factor Authentication Server. Beginning September 30, 2024, Azure Multi-Factor Authentication Server deployments will no longer service multifactor authentication (MFA) requests, which could cause authentications to fail for your organization. To ensure uninterrupted authentication services and to remain in a supported state, organizations should [migrate their usersΓÇÖ authentication data](how-to-migrate-mfa-server-to-mfa-user-authentication.md) to the cloud-based Azure Active Directory Multi-Factor Authentication service by using the latest Migration Utility included in the most recent [Azure Active Directory Multi-Factor Authentication Server update](https://www.microsoft.com/download/details.aspx?id=55849). For more information, see [Azure Active Directory Multi-Factor Authentication Server Migration](how-to-migrate-mfa-server-to-azure-mfa.md). > > To get started with cloud-based MFA, see [Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication](tutorial-enable-azure-mfa.md). > > Existing customers that activated MFA Server before July 1, 2019 can download the latest version, future updates, and generate activation credentials as usual. The following steps only work if you were an existing MFA Server customer. -1. Sign in to the [Azure portal](https://portal.azure.com) as an administrator. -2. Search for and select *Azure Active Directory*. Select **Security** > **MFA**. -3. Under **Manager MFA Server**, select **Server settings**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../roles/permissions-reference.md#global-administrator). +1. Browse to **Protection** > **Multifactor authentication** > **Server settings**. 4. Select **Download** and follow the instructions on the download page to save the installer. -  +  5. Keep this page open as we will refer to it after running the installer. Now that you have downloaded the server you can install and configure it. Be sur * [Visual C++ Redistributable for Visual Studio 2017 (x64)](https://go.microsoft.com/fwlink/?LinkId=746572) * [Visual C++ Redistributable for Visual Studio 2017 (x86)](https://go.microsoft.com/fwlink/?LinkId=746571) 3. When the installation finishes, select **Finish**. The configuration wizard starts.-5. Back on the page that you downloaded the server from, click the **Generate Activation Credentials** button. Copy this information into the Azure MFA Server in the boxes provided and click **Activate**. +5. Back on the page that you downloaded the server from, click the **Generate Activation Credentials** button. Copy this information into the Azure Active Directory Multi-Factor Authentication Server in the boxes provided and click **Activate**. > [!NOTE]-> Only global administrators are able to generate activation credentials in the Azure portal. +> Only global administrators are able to generate activation credentials in the Microsoft Entra admin center. ## Send users an email Now that the server is installed you want to add users. You can choose to create ### Manual import from Active Directory -1. In the Azure MFA Server, on the left, select **Users**. +1. In the Azure Active Directory Multi-Factor Authentication Server, on the left, select **Users**. 2. At the bottom, select **Import from Active Directory**. 3. Now you can either search for individual users or search the AD directory for OUs with users in them. In this case, we specify the users OU. 4. Highlight all the users on the right and click **Import**. You should receive a pop-up telling you that you were successful. Close the import window. Now that the server is installed you want to add users. You can choose to create ### Automated synchronization with Active Directory -1. In the Azure MFA Server, on the left, select **Directory Integration**. +1. In the Azure Active Directory Multi-Factor Authentication Server, on the left, select **Directory Integration**. 2. Navigate to the **Synchronization** tab. 3. At the bottom, choose **Add** 4. In the **Add Synchronization Item** box that appears choose the Domain, OU **or** security group, Settings, Method Defaults, and Language Defaults for this synchronization task and click **Add**. Now that the server is installed you want to add users. You can choose to create ## How the Azure AD Multi-Factor Authentication Server handles user data -When you use the Multi-Factor Authentication (MFA) Server on-premises, a user's data is stored in the on-premises servers. No persistent user data is stored in the cloud. When the user performs a two-step verification, the MFA Server sends data to the Azure MFA cloud service to perform the verification. When these authentication requests are sent to the cloud service, the following fields are sent in the request and logs so that they are available in the customer's authentication/usage reports. Some of the fields are optional so they can be enabled or disabled within the Multi-Factor Authentication Server. The communication from the MFA Server to the MFA cloud service uses SSL/TLS over port 443 outbound. These fields are: +When you use the Multi-Factor Authentication (MFA) Server on-premises, a user's data is stored in the on-premises servers. No persistent user data is stored in the cloud. When the user performs a two-step verification, the MFA Server sends data to the Azure Active Directory Multi-Factor Authentication cloud service to perform the verification. When these authentication requests are sent to the cloud service, the following fields are sent in the request and logs so that they are available in the customer's authentication/usage reports. Some of the fields are optional so they can be enabled or disabled within the Multi-Factor Authentication Server. The communication from the MFA Server to the MFA cloud service uses SSL/TLS over port 443 outbound. These fields are: * Unique ID - either username or internal MFA server ID * First and last name (optional) In addition to the fields above, the verification result (success/denial) and re > [!IMPORTANT] > Starting in March of 2019 the phone call options will not be available to MFA Server users in free/trial Azure AD tenants. SMS messages are not impacted by this change. Phone call will continue to be available to users in paid Azure AD tenants. This change only impacts free/trial Azure AD tenants. -## Back up and restore Azure MFA Server +## Back up and restore Azure Active Directory Multi-Factor Authentication Server Making sure that you have a good backup is an important step to take with any system. -To back up Azure MFA Server, ensure that you have a copy of the **C:\Program Files\Multi-Factor Authentication Server\Data** folder including the **PhoneFactor.pfdata** file. +To back up Azure Active Directory Multi-Factor Authentication Server, ensure that you have a copy of the **C:\Program Files\Multi-Factor Authentication Server\Data** folder including the **PhoneFactor.pfdata** file. In case a restore is needed complete the following steps: -1. Reinstall Azure MFA Server on a new server. -2. Activate the new Azure MFA Server. +1. Reinstall Azure Active Directory Multi-Factor Authentication Server on a new server. +2. Activate the new Azure Active Directory Multi-Factor Authentication Server. 3. Stop the **MultiFactorAuth** service. 4. Overwrite the **PhoneFactor.pfdata** with the backed-up copy. 5. Start the **MultiFactorAuth** service. Once you have upgraded to or installed MFA Server version 8.x or higher, it is r ## Next steps - Set up and configure the [User portal](howto-mfaserver-deploy-userportal.md) for user self-service.-- Set up and configure the Azure MFA Server with [Active Directory Federation Service](multi-factor-authentication-get-started-adfs.md), [RADIUS Authentication](howto-mfaserver-dir-radius.md), or [LDAP Authentication](howto-mfaserver-dir-ldap.md).+- Set up and configure the Azure Active Directory Multi-Factor Authentication Server with [Active Directory Federation Service](multi-factor-authentication-get-started-adfs.md), [RADIUS Authentication](howto-mfaserver-dir-radius.md), or [LDAP Authentication](howto-mfaserver-dir-ldap.md). - Set up and configure [Remote Desktop Gateway and Azure Multi-Factor Authentication Server using RADIUS](howto-mfaserver-nps-rdg.md). - [Deploy the Azure Multi-Factor Authentication Server Mobile App Web Service](howto-mfaserver-deploy-mobileapp.md). - [Advanced scenarios with Azure Multi-Factor Authentication and third-party VPNs](howto-mfaserver-nps-vpn.md). |
| active-directory | Howto Password Ban Bad On Premises Deploy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-password-ban-bad-on-premises-deploy.md | -Users often create passwords that use common local words such as a school, sports team, or famous person. These passwords are easy to guess, and weak against dictionary-based attacks. To enforce strong passwords in your organization, Azure Active Directory (Azure AD) Password Protection provides a global and custom banned password list. A password change request fails if there's a match in these banned password list. +Users often create passwords that use common local words such as a school, sports team, or famous person. These passwords are easy to guess, and weak against dictionary-based attacks. To enforce strong passwords in your organization, Azure Active Directory (Azure AD) Password Protection provides a global and custom banned password list. A password change request fails if there's a match in this banned password list. To protect your on-premises Active Directory Domain Services (AD DS) environment, you can install and configure Azure AD Password Protection to work with your on-prem DC. This article shows you how to install and register the Azure AD Password Protection proxy service and Azure AD Password Protection DC agent in your on-premises environment. The following core requirements apply: > [!NOTE] > Some endpoints, such as the CRL endpoint, are not addressed in this article. For a list of all supported endpoints, see [Microsoft 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).->In addition, other endpoints are required for Azure portal authentication. For more information, see [Azure portal URLs for proxy bypass](/azure/azure-portal/azure-portal-safelist-urls?tabs=public-cloud#azure-portal-urls-for-proxy-bypass). +>In addition, other endpoints are required for Microsoft Entra admin center authentication. For more information, see [Microsoft Entra admin center URLs for proxy bypass](/azure/azure-portal/azure-portal-safelist-urls?tabs=public-cloud#azure-portal-urls-for-proxy-bypass). ### Azure AD Password Protection DC agent To install the Azure AD Password Protection proxy service, complete the followin > > You may also see MFA required if Azure Device Registration (which is used under the covers by Azure AD Password Protection) has been configured to globally require MFA. To workaround this requirement you may use a different account that supports MFA with one of the previous two authentication modes, or you may also temporarily relax the Azure Device Registration MFA requirement. >- > To make this change, search for and select **Azure Active Directory** in the Azure portal, then select **Devices > Device Settings**. Set **Require Multi-Factor Auth to join devices** to *No*. Be sure to reconfigure this setting back to *Yes* once registration is complete. + > To make this change, select **Identity** in the [Microsoft Entra admin center](https://entra.microsoft.com), then select **Devices** > **Device Settings**. Set **Require Multi-Factor Auth to join devices** to *No*. Be sure to reconfigure this setting back to *Yes* once registration is complete. > > We recommend that MFA requirements be bypassed for test purposes only. To install the Azure AD Password Protection proxy service, complete the followin > > You may also see MFA required if Azure Device Registration (which is used under the covers by Azure AD Password Protection) has been configured to globally require MFA. To workaround this requirement you may use a different account that supports MFA with one of the previous two authentication modes, or you may also temporarily relax the Azure Device Registration MFA requirement. >- > To make this change, search for and select **Azure Active Directory** in the Azure portal, then select **Devices > Device Settings**. Set **Require Multi-Factor Auth to join devices** to *No*. Be sure to reconfigure this setting back to *Yes* once registration is complete. + > To make this change, select **Identity** in the [Microsoft Entra admin center](https://entra.microsoft.com), then select **Devices** > **Device Settings**. Set **Require Multi-Factor Auth to join devices** to *No*. Be sure to reconfigure this setting back to *Yes* once registration is complete. > > We recommend that MFA requirements be bypassed for test purposes only. The software installation, or uninstallation, requires a restart. This requireme The installation of on-prem Azure AD Password Protection is complete after the DC agent software is installed on a domain controller, and that computer is rebooted. No other configuration is required or possible. Password change events against the on-prem DCs use the configured banned password lists from Azure AD. -To enable on-prem Azure AD Password Protection from the Azure portal or configure custom banned passwords, see [Enable on-premises Azure AD Password Protection](howto-password-ban-bad-on-premises-operations.md). +To enable on-prem Azure AD Password Protection or configure custom banned passwords, see [Enable on-premises Azure AD Password Protection](howto-password-ban-bad-on-premises-operations.md). > [!TIP] > You can install the Azure AD Password Protection DC agent on a machine that's not yet a domain controller. In this case, the service starts and runs but remain inactive until the machine is promoted to be a domain controller. The `Get-AzureADPasswordProtectionDCAgent` cmdlet may be used to query the softw ## Next steps -Now that you've installed the services that you need for Azure AD Password Protection on your on-premises servers, [enable on-prem Azure AD Password Protection in the Azure portal](howto-password-ban-bad-on-premises-operations.md) to complete your deployment. +Now that you've installed the services that you need for Azure AD Password Protection on your on-premises servers, [enable on-prem Azure AD Password Protection](howto-password-ban-bad-on-premises-operations.md) to complete your deployment. |
| active-directory | Howto Password Ban Bad On Premises Operations | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-password-ban-bad-on-premises-operations.md | -To protect your on-premises Active Directory Domain Services (AD DS) environment, you can install and configure Azure AD Password Protection to work with your on-prem DC. This article shows you how to enable Azure AD Password Protection for your on-premises environment. +To protect your on-premises Active Directory Domain Services (AD DS) environment, you can install and configure Azure AD Password Protection to work with your on-premises DC. This article shows you how to enable Azure AD Password Protection for your on-premises environment. For more information on how Azure AD Password Protection works in an on-premises environment, see [How to enforce Azure AD Password Protection for Windows Server Active Directory](concept-password-ban-bad-on-premises.md). This article shows you how to enable Azure AD Password Protection for your on-pr [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -1. Sign in to the [Azure portal](https://portal.azure.com) and browse to **Azure Active Directory** > **Security** > **Authentication methods** > **Password protection**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Administrator](../roles/permissions-reference.md#authentication-administrator). +1. Browse to **Protection** > **Authentication methods** > **Password protection**. 1. Set the option for **Enable password protection on Windows Server Active Directory** to *Yes*. When this setting is set to *No*, all deployed Azure AD Password Protection DC agents go into a quiescent mode where all passwords are accepted as-is. No validation activities are performed, and audit events aren't generated. This article shows you how to enable Azure AD Password Protection for your on-pr 1. It's recommended to initially set the **Mode** to *Audit*. After you're comfortable with the feature and the impact on users in your organization, you can switch the **Mode** to *Enforced*. For more information, see the following section on [modes of operation](#modes-of-operation). 1. When ready, select **Save**. - [](media/howto-password-ban-bad-on-premises-operations/enable-configure-custom-banned-passwords.png#lightbox) + [](media/howto-password-ban-bad-on-premises-operations/enable-configure-custom-banned-passwords.png#lightbox) ## Modes of operation Affected end users may need to work with their IT staff to understand the new re To customize the banned password list for your organization, see [Configure the Azure AD Password Protection custom banned password list](tutorial-configure-custom-password-protection.md). -To monitor on-prem events, see [Monitoring on-prem Azure AD Password Protection](howto-password-ban-bad-on-premises-monitor.md). +To monitor on-premises events, see [Monitoring on-premises Azure AD Password Protection](howto-password-ban-bad-on-premises-monitor.md). |
| active-directory | Howto Password Smart Lockout | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-password-smart-lockout.md | Based on your organizational requirements, you can customize the Azure AD smart To check or modify the smart lockout values for your organization, complete the following steps: -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/#home). -1. Search for and select *Azure Active Directory*, then select **Security** > **Authentication methods** > **Password protection**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Administrator](../roles/permissions-reference.md#authentication-administrator). +1. Browse to **Protection** > **Authentication methods** > **Password protection**. 1. Set the **Lockout threshold**, based on how many failed sign-ins are allowed on an account before its first lockout. The default is 10 for Azure Public tenants and 3 for Azure US Government tenants. To check or modify the smart lockout values for your organization, complete the > [!NOTE] > If the first sign-in after a lockout period has expired also fails, the account locks out again. If an account locks repeatedly, the lockout duration increases. - + ## Testing Smart lockout |
| active-directory | Howto Registration Mfa Sspr Combined | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-registration-mfa-sspr-combined.md | For more information about creating trusted locations in Conditional Access, see Complete the following steps to create a policy that applies to all selected users that attempt to register using the combined registration experience, and blocks access unless they are connecting from a location marked as trusted network: -1. In the **Azure portal**, browse to **Azure Active Directory** > **Security** > **Conditional Access**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access**. 1. Select **+ New policy**. 1. Enter a name for this policy, such as *Combined Security Info Registration on Trusted Networks*. 1. Under **Assignments**, select **Users**. Choose the users and groups you want this policy to apply to. |
| active-directory | Howto Sspr Authenticationdata | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-sspr-authenticationdata.md | After a user verifies their mobile phone number, the *Phone* field under **Authe ## Authentication contact info -On the **Authentication methods** page for an Azure AD user in the Azure portal, a Global Administrator can manually set the authentication contact information. You can review existing methods under the *Usable authentication methods* section, or **+Add authentication methods**, as shown in the following example screenshot: +On the **Authentication methods** page for an Azure AD user in the Microsoft Entra admin center, a Global Administrator can manually set the authentication contact information. You can review existing methods under the *Usable authentication methods* section, or **+Add authentication methods**, as shown in the following example screenshot: The following considerations apply for this authentication contact info: |
| active-directory | Howto Sspr Customization | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-sspr-customization.md | The graphics you choose are shown in the following circumstances: ### Directory name -To make things look more user-friendly, you can change organization name in the portal and in the automated communications. To change the directory name attribute in the Azure portal, browse to **Azure Active Directory** > **Properties**. This friendly organization name option is the most visible in automated emails, as in the following examples: +To make things look more user-friendly, you can change organization name in the portal and in the automated communications. To change the directory name attribute in the Microsoft Entra admin center, sign in as a Global Administrator and browse to **Identity** > **Overview** > **Properties**. This friendly organization name option is the most visible in automated emails, as in the following examples: * The friendly name in the email, for example "*Microsoft on behalf of CONTOSO demo*" * The subject line in the email, for example "*CONTOSO demo account email verification code*" |
| active-directory | Howto Sspr Deployment | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-sspr-deployment.md | You can also refer to [Complete out an Azure AD self-service password reset pilo ### Plan support -While SSPR does not typically create user issues, it is important to prepare support staff to deal with issues that may arise. While an administrator can reset the password for end users through the Azure portal, it is better to help resolve the issue via a self-service support process. --To enable your support team's success, you can create a FAQ based on questions you receive from your users. Here are a few examples: +While SSPR does not typically create user issues, it is important to prepare support staff to deal with issues that may arise. To enable your support team's success, you can create a FAQ based on questions you receive from your users. Here are a few examples: | Scenarios| Description | | - | - | Azure AD can provide additional information on your SSPR performance through aud ### Password management activity reports -You can use pre-built reports on Azure portal to measure the SSPR performance. If you're appropriately licensed, you can also create custom queries. For more information, see [Reporting options for Azure AD password management](./howto-sspr-reporting.md) +You can use pre-built reports on Microsoft Entra admin center to measure the SSPR performance. If you're appropriately licensed, you can also create custom queries. For more information, see [Reporting options for Azure AD password management](./howto-sspr-reporting.md) > [!NOTE]-> You must be [a global administrator](../roles/permissions-reference.md), and you must opt-in for this data to be gathered for your organization. To opt in, you must visit the Reporting tab or the audit logs on the Azure portal at least once. Until then, the data doesn't collect for your organization. +> You must be [a global administrator](../roles/permissions-reference.md), and you must opt-in for this data to be gathered for your organization. To opt in, you must visit the Reporting tab or the audit logs on the Microsoft Entra admin center at least once. Until then, the data doesn't collect for your organization. Audit logs for registration and password reset are available for 30 days. If security auditing within your corporation requires longer retention, the logs need to be exported and consumed into a SIEM tool such as [Microsoft Sentinel](../../sentinel/connect-azure-active-directory.md), Splunk, or ArcSight. |
| active-directory | Howto Sspr Reporting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-sspr-reporting.md | After deployment, many organizations want to know how or if self-service passwor ![Reporting on SSPR using the audit logs in Azure AD][Reporting] -The following questions can be answered by the reports that exist in the [Azure portal](https://portal.azure.com): +The following questions can be answered by the reports that exist in the [Microsoft Entra admin center](https://entra.microsoft.com): > [!NOTE]-> You must be [a global administrator](../roles/permissions-reference.md), and you must opt-in for this data to be gathered on behalf of your organization. To opt in, you must visit the **Reporting** tab or the audit logs at least once. Until then, data is not collected for your organization. +> You must be [a Global Administrator](../roles/permissions-reference.md), and you must opt-in for this data to be gathered on behalf of your organization. To opt in, you must visit the **Reporting** tab or the audit logs at least once. Until then, data is not collected for your organization. > * How many people have registered for password reset? The following questions can be answered by the reports that exist in the [Azure * What admins are resetting their own passwords frequently? * Is there any suspicious activity going on with password reset? -## How to view password management reports in the Azure portal +## How to view password management reports [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -In the Azure portal experience, we have improved the way that you can view password reset and password reset registration activity. Use the following the steps to find the password reset and password reset registration events: +Use the following the steps to find the password reset and password reset registration events: -1. Sign in to the [Azure portal](https://portal.azure.com). -2. Select **All services** in the left pane. -3. Search for **Azure Active Directory** in the list of services and select it. -4. Select **Users** from the Manage section. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Administrator](../roles/permissions-reference.md#global-administrator). +1. Browse to **Identity** > **Users**. 5. Select **Audit Logs** from the **Users** blade. This shows you all of the audit events that occurred against all the users in your directory. You can filter this view to see all the password-related events. 6. From the **Filter** menu at the top of the pane, select the **Service** drop-down list, and change it to the **Self-service Password Management** service type. 7. Optionally, further filter the list by choosing the specific **Activity** you're interested in. In the Azure portal experience, we have improved the way that you can view passw [Combined registration](./concept-registration-mfa-sspr-combined.md) security information registration and management events can be found in the audit logs under **Security** > **Authentication Methods**. -## Description of the report columns in the Azure portal +## Description of the report columns -The following list explains each of the report columns in the Azure portal in detail: +The following list explains each of the report columns in detail: * **User**: The user who attempted a password reset registration operation. * **Role**: The role of the user in the directory. * **Date and Time**: The date and time of the attempt. * **Data Registered**: The authentication data that the user provided during password reset registration. -## Description of the report values in the Azure portal +## Description of the report values -The following table describes the different values that are you can set for each column in the Azure portal: +The following table describes the different values that are you can set for each column: | Column | Permitted values and their meanings | | | | The following activity types appear in the **Self-Service Password Management** * [Blocked from self-service password reset](#activity-type-blocked-from-self-service-password-reset): Indicates that a user tried to reset a password, use a specific gate, or validate a phone number more than five total times in 24 hours. * [Change password (self-service)](#activity-type-change-password-self-service): Indicates that a user performed a voluntary, or forced (due to expiry) password change.-* [Reset password (by admin)](#activity-type-reset-password-by-admin): Indicates that an administrator performed a password reset on behalf of a user from the Azure portal. -* [Reset password (self-service)](#activity-type-reset-password-self-service): Indicates that a user successfully reset their password from the [Azure AD password reset portal](https://passwordreset.microsoftonline.com). +* [Reset password (by admin)](#activity-type-reset-password-by-admin): Indicates that an administrator performed a password reset on behalf of a user. +* [Reset password (self-service)](#activity-type-reset-password-self-service): Indicates that a user successfully reset their password from [Azure AD password reset](https://passwordreset.microsoftonline.com). * [Self-service password reset flow activity progress](#activity-type-self-serve-password-reset-flow-activity-progress): Indicates each specific step a user proceeds through, such as passing a specific password reset authentication gate, as part of the password reset process.-* [Unlock user account (self-service)](#activity-type-unlock-a-user-account-self-service)): Indicates that a user successfully unlocked their Active Directory account without resetting their password from the [Azure AD password reset portal](https://passwordreset.microsoftonline.com) by using the Active Directory feature of account unlock without reset. +* [Unlock user account (self-service)](#activity-type-unlock-a-user-account-self-service): Indicates that a user successfully unlocked their Active Directory account without resetting their password from [Azure AD password reset](https://passwordreset.microsoftonline.com) by using the Active Directory feature of account unlock without reset. * [User registered for self-service password reset](#activity-type-user-registered-for-self-service-password-reset): Indicates that a user has registered all the required information to be able to reset their password in accordance with the currently specified tenant password reset policy. ### Activity type: Blocked from self-service password reset The following list explains this activity in detail: The following list explains this activity in detail: -* **Activity description**: Indicates that an administrator performed a password reset on behalf of a user from the Azure portal. +* **Activity description**: Indicates that an administrator performed a password reset on behalf of a user. * **Activity actor**: The administrator who performed the password reset on behalf of another end user or administrator. Must be a password administrator, user administrator, or helpdesk administrator. * **Activity target**: The user whose password was reset. The user can be an end user or a different administrator. * **Activity statuses**: The following list explains this activity in detail: The following list explains this activity in detail: -* **Activity description**: Indicates that a user successfully reset their password from the [Azure AD password reset portal](https://passwordreset.microsoftonline.com). +* **Activity description**: Indicates that a user successfully reset their password from [Azure AD password reset](https://passwordreset.microsoftonline.com). * **Activity actor**: The user who reset their password. The user can be an end user or an administrator. * **Activity target**: The user who reset their password. The user can be an end user or an administrator. * **Activity statuses**: The following list explains this activity in detail: * _Success_: Indicates that a user successfully completed a specific step of the password reset flow. * _Failure_: Indicates that a specific step of the password reset flow failed. You can select the row to see the **Activity status reason** category to learn more about why the failure occurred. * **Activity status reasons**:- See the following table for [all the permissible reset activity status reasons](#description-of-the-report-columns-in-the-azure-portal). + See the following table for [all the permissible reset activity status reasons](#description-of-the-report-columns). ### Activity type: Unlock a user account (self-service) The following list explains this activity in detail: -* **Activity description**: Indicates that a user successfully unlocked their Active Directory account without resetting their password from the [Azure AD password reset portal](https://passwordreset.microsoftonline.com) by using the Active Directory feature of account unlock without reset. +* **Activity description**: Indicates that a user successfully unlocked their Active Directory account without resetting their password from [Azure AD password reset](https://passwordreset.microsoftonline.com) by using the Active Directory feature of account unlock without reset. * **Activity actor**: The user who unlocked their account without resetting their password. The user can be an end user or an administrator. * **Activity target**: The user who unlocked their account without resetting their password. The user can be an end user or an administrator. * **Allowed activity statuses**: |
| active-directory | Howto Sspr Windows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/howto-sspr-windows.md | The following limitations apply to using SSPR from the Windows sign-in screen: > These limitations also apply to Windows Hello for Business PIN reset from the device lock screen. > -## Windows 11 and 10 password reset +## Windows 11 and Windows 10 password reset -To configure a Windows 11 or 10 device for SSPR at the sign-in screen, review the following prerequisites and configuration steps. +To configure a Windows 11 or Windows 10 device for SSPR at the sign-in screen, review the following prerequisites and configuration steps. -### Windows 11 and 10 prerequisites +### Windows 11 and Windows 10 prerequisites -- An administrator [must enable Azure AD self-service password reset from the Azure portal](tutorial-enable-sspr.md).+- Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator) and [enable Azure AD self-service password reset](tutorial-enable-sspr.md). - Users must register for SSPR before using this feature at [https://aka.ms/ssprsetup](https://aka.ms/ssprsetup) - Not unique to using SSPR from the Windows sign-in screen, all users must provide the authentication contact information before they can reset their password. - Network proxy requirements: To configure a Windows 11 or 10 device for SSPR at the sign-in screen, review th - Azure AD joined - Hybrid Azure AD joined -### Enable for Windows 11 and 10 using Microsoft Intune +### Enable for Windows 11 and Windows 10 using Microsoft Intune Deploying the configuration change to enable SSPR from the login screen using Microsoft Intune is the most flexible method. Microsoft Intune allows you to deploy the configuration change to a specific group of machines you define. This method requires Microsoft Intune enrollment of the device. Deploying the configuration change to enable SSPR from the login screen using Mi 1. Configure applicability rules as desired for your environment, such as to *Assign profile if OS edition is Windows 10 Enterprise*, then select **Next**. 1. Review your profile, then select **Create**. -### Enable for Windows 11 and 10 using the Registry +### Enable for Windows 11 and Windows 10 using the Registry To enable SSPR at the sign-in screen using a registry key, complete the following steps: To enable SSPR at the sign-in screen using a registry key, complete the followin "AllowPasswordReset"=dword:00000001 ``` -### Troubleshooting Windows 11 and 10 password reset +### Troubleshooting Windows 11 and Windows 10 password reset If you have problems with using SSPR from the Windows sign-in screen, the Azure AD audit log includes information about the IP address and *ClientType* where the password reset occurred, as shown in the following example output: To configure a Windows 7, 8, or 8.1 device for SSPR at the sign-in screen, revie ### Windows 7, 8, and 8.1 prerequisites -- An administrator [must enable Azure AD self-service password reset from the Azure portal](tutorial-enable-sspr.md).+- Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator) and [enable Azure AD self-service password reset](tutorial-enable-sspr.md). - Users must register for SSPR before using this feature at [https://aka.ms/ssprsetup](https://aka.ms/ssprsetup) - Not unique to using SSPR from the Windows sign-in screen, all users must provide the authentication contact information before they can reset their password. - Network proxy requirements: |
| active-directory | Troubleshoot Sspr | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/troubleshoot-sspr.md | If you have problems with SSPR, the following troubleshooting steps and common e If you can't find the answer to your problem, [our support teams are always available](#contact-microsoft-support) to assist you further. -## SSPR configuration in the Azure portal +## SSPR configuration in the Microsoft Entra admin center -If you have problems seeing or configuring SSPR options in the Azure portal, review the following troubleshooting steps: +If you have problems seeing or configuring SSPR options in the Microsoft Entra admin center, review the following troubleshooting steps: -### I don't see the **Password reset** section under Azure AD in the Azure portal. +### I don't see the **Password reset** section under Azure AD in the Microsoft Entra admin center. -You won't see if **Password reset** menu option if you don't have an Azure AD license assigned to the administrator performing the operation. +You don't see if **Password reset** menu option if you don't have an Azure AD license assigned to the administrator performing the operation. To assign a license to the administrator account in question, follow the steps to [Assign, verify, and resolve problems with licenses](../enterprise-users/licensing-groups-assign.md#step-1-assign-the-required-licenses). For more information, see [Getting started with Azure AD Connect](../hybrid/conn ## SSPR reporting -If you have problems with SSPR reporting in the Azure portal, review the following troubleshooting steps: +If you have problems with SSPR reporting in the Microsoft Entra admin center, review the following troubleshooting steps: ### I see an authentication method that I have disabled in the Add method option in combined registration. If your users have problems registering for SSPR, review the following troublesh ### The directory isn't enabled for password reset. The user may see an error that reports, "Your administrator has not enabled you to use this feature." -You can enable SSPR for all users, no users, or for selected groups of users. Only one Azure AD group can currently be enabled for SSPR using the Azure portal. As part of a wider deployment of SSPR, nested groups are supported. Make sure that the users in the group(s) you choose have the appropriate licenses assigned. +You can enable SSPR for all users, no users, or for selected groups of users. Only one Azure AD group can currently be enabled for SSPR using the Microsoft Entra admin center. As part of a wider deployment of SSPR, nested groups are supported. Make sure that the users in the group(s) you choose have the appropriate licenses assigned. -In the Azure portal, change the **Self-service password reset enabled** configuration to *Selected* or *All* and then select **Save**. +In the Microsoft Entra admin center, change the **Self-service password reset enabled** configuration to *Selected* or *All* and then select **Save**. ### The user doesn't have an Azure AD license assigned. The user may see an error that reports, "Your administrator has not enabled you to use this feature." -Only one Azure AD group can currently be enabled for SSPR using the Azure portal. As part of a wider deployment of SSPR, nested groups are supported. Make sure that the users in the group(s) you choose have the appropriate licenses assigned. Review the previous troubleshooting step to enable SSPR as required. +Only one Azure AD group can currently be enabled for SSPR using the Microsoft Entra admin center. As part of a wider deployment of SSPR, nested groups are supported. Make sure that the users in the group(s) you choose have the appropriate licenses assigned. Review the previous troubleshooting step to enable SSPR as required. Also review troubleshooting steps to make sure that the administrator performing the configuration options has a license assigned. To assign a license to the administrator account in question, follow the steps to [Assign, verify, and resolve problems with licenses](../enterprise-users/licensing-groups-assign.md#step-1-assign-the-required-licenses). ### There's an error processing the request. -Generic SSPR registration errors can be caused by many issues, but generally this error is caused by either a service outage or a configuration issue. If you continue to see this generic error when you retry the SSPR registration process, [contact Microsoft support](#contact-microsoft-support) for additional assistance. +Generic SSPR registration errors can be caused by many issues, but generally this error is caused by either a service outage or a configuration issue. If you continue to see this generic error when you retry the SSPR registration process, [contact Microsoft support](#contact-microsoft-support) for help. ## SSPR usage If you or your users have problems using SSPR, review the following troubleshoot | Error | Solution | | | |-| The directory isn't enabled for password reset. | In the Azure portal, change the **Self-service password reset enabled** configuration to *Selected* or *All* and then select **Save**. | +| The directory isn't enabled for password reset. | In the Microsoft Entra admin center, change the **Self-service password reset enabled** configuration to *Selected* or *All* and then select **Save**. | | The user doesn't have an Azure AD license assigned. | This can happen if you don't have an Azure AD license assigned to the desired user. To assign a license to the administrator account in question, follow the steps to [Assign, verify, and resolve problems with licenses](../enterprise-users/licensing-groups-assign.md#step-1-assign-the-required-licenses). | | The directory is enabled for password reset, but the user has missing or malformed authentication information. | Make sure that user has properly formed contact data on file in the directory. For more information, see [Data used by Azure AD self-service password reset](howto-sspr-authenticationdata.md). | | The directory is enabled for password reset, but the user has only one piece of contact data on file when the policy is set to require two verification methods. | Make sure that the user has at least two properly configured contact methods. An example is having both a mobile phone number *and* an office phone number. | If you or your users have problems using SSPR, review the following troubleshoot | The user is prevented from attempting a password reset too many times in a day. | An automatic throttling mechanism is used to block users from attempting to reset their passwords too many times in a short period of time. Throttling occurs the following scenarios: <br><ul><li>The user attempts to validate a phone number five times in one hour.</li><li>The user attempts to use the security questions gate five times in one hour.</li><li>The user attempts to reset a password for the same user account five times in one hour.</li></ul>If a user encounters this problem, they must wait 24 hours after the last attempt. The user can then reset their password. | | The user sees an error when validating their phone number. | This error occurs when the phone number entered doesn't match the phone number on file. Make sure the user is entering the complete phone number, including the area and country code, when they attempt to use a phone-based method for password reset. | | The user sees an error when using their email address. | If the UPN differs from the primary ProxyAddress/SMTPAddress of the user, the [Sign-in to Azure AD with email as an alternate login ID](howto-authentication-use-email-signin.md) setting must be enabled for the tenant. |-| There's an error processing the request. | Generic SSPR registration errors can be caused by many issues, but generally this error is caused by either a service outage or a configuration issue. If you continue to see this generic error when you re-try the SSPR registration process, [contact Microsoft support](#contact-microsoft-support) for additional assistance. | +| There's an error processing the request. | Generic SSPR registration errors can be caused by many issues, but generally this error is caused by either a service outage or a configuration issue. If you continue to see this generic error when you re-try the SSPR registration process, [contact Microsoft support](#contact-microsoft-support) for help. | | On-premises policy violation | The password doesn't meet the on-premises Active Directory password policy. The user must define a password that meets the complexity or strength requirements. | | Password doesn't comply with fuzzy policy | The password that was used appears in the [banned password list](./concept-password-ban-bad.md#how-are-passwords-evaluated) and can't be used. The user must define a password that meets or exceeds the banned password list policy. | Use the following information to understand the problem and what needs to be cor | Error | Details | Technical details | | | | |-| TenantSSPRFlagDisabled = 9 | We're sorry, you can't reset your password at this time because your administrator has disabled password reset for your organization. There is no further action you can take to resolve this situation. Please contact your admin and ask them to enable this feature.<br /><br />To learn more, see [Help, I forgot my Azure AD password](https://support.microsoft.com/account-billing/reset-your-work-or-school-password-using-security-info-23dde81f-08bb-4776-ba72-e6b72b9dda9e#common-problems-and-their-solutions). | SSPR_0009: We've detected that password reset has not been enabled by your administrator. Please contact your admin and ask them to enable password reset for your organization. | -| WritebackNotEnabled = 10 |We're sorry, you can't reset your password at this time because your administrator has not enabled a necessary service for your organization. There is no further action you can take to resolve this situation. Please contact your admin and ask them to check your organization's configuration.<br /><br />To learn more about this necessary service, see [Configuring password writeback](./tutorial-enable-sspr-writeback.md). | SSPR_0010: We've detected that password writeback has not been enabled. Please contact your admin and ask them to enable password writeback. | -| SsprNotEnabledInUserPolicy = 11 | We're sorry, you can't reset your password at this time because your administrator has not configured password reset for your organization. There is no further action you can take to resolve this situation. Contact your admin and ask them to configure password reset.<br /><br />To learn more about password reset configuration, see [Quickstart: Azure AD self-service password reset](./tutorial-enable-sspr.md). | SSPR_0011: Your organization has not defined a password reset policy. Please contact your admin and ask them to define a password reset policy. | -| UserNotLicensed = 12 | We're sorry, you can't reset your password at this time because required licenses are missing from your organization. There is no further action you can take to resolve this situation. Please contact your admin and ask them to check your license assignment.<br /><br />To learn more about licensing, see [Licensing requirements for Azure AD self-service password reset](./concept-sspr-licensing.md). | SSPR_0012: Your organization does not have the required licenses necessary to perform password reset. Please contact your admin and ask them to review the license assignments. | -| UserNotMemberOfScopedAccessGroup = 13 | We're sorry, you can't reset your password at this time because your administrator has not configured your account to use password reset. There is no further action you can take to resolve this situation. Please contact your admin and ask them to configure your account for password reset.<br /><br />To learn more about account configuration for password reset, see [Roll out password reset for users](./howto-sspr-deployment.md). | SSPR_0013: You are not a member of a group enabled for password reset. Contact your admin and request to be added to the group. | -| UserNotProperlyConfigured = 14 | We're sorry, you can't reset your password at this time because necessary information is missing from your account. There is no further action you can take to resolve this situation. Please contact you admin and ask them to reset your password for you. After you have access to your account again, you need to register the necessary information.<br /><br />To register information, follow the steps in the [Register for self-service password reset](https://support.microsoft.com/account-billing/register-the-password-reset-verification-method-for-a-work-or-school-account-47a55d4a-05b0-4f67-9a63-f39a43dbe20a) article. | SSPR_0014: Additional security info is needed to reset your password. To proceed, contact your admin and ask them to reset your password. After you have access to your account, you can register additional security info at https://aka.ms/ssprsetup. Your admin can add additional security info to your account by following the steps in [Set and read authentication data for password reset](howto-sspr-authenticationdata.md). | -| OnPremisesAdminActionRequired = 29 | We're sorry, we can't reset your password at this time because of a problem with your organization's password reset configuration. There is no further action you can take to resolve this situation. Please contact your admin and ask them to investigate. <br /><br />Or<br /><br />We cannot reset your password at this time because of a problem with your organization's password reset configuration. There is no further action you can take to resolve this issue. Please contact your admin and ask them to investigate.<br /><br />To learn more about the potential problem, see [Troubleshoot password writeback](troubleshoot-sspr-writeback.md). | SSPR_0029: We are unable to reset your password due to an error in your on-premises configuration. Please contact your admin and ask them to investigate. | -| OnPremisesConnectivityError = 30 | We're sorry, we can't reset your password at this time because of connectivity issues to your organization. There is no action to take right now, but the problem might be resolved if you try again later. If the problem persists, please contact your admin and ask them to investigate.<br /><br />To learn more about connectivity issues, see [Troubleshoot password writeback connectivity](troubleshoot-sspr-writeback.md). | SSPR_0030: We can't reset your password due to a poor connection with your on-premises environment. Contact your admin and ask them to investigate.| +| TenantSSPRFlagDisabled = 9 | We're sorry, you can't reset your password at this time because your administrator has disabled password reset for your organization. There is no further action you can take to resolve this situation. Contact your admin and ask them to enable this feature.<br /><br />To learn more, see [Help, I forgot my Azure AD password](https://support.microsoft.com/account-billing/reset-your-work-or-school-password-using-security-info-23dde81f-08bb-4776-ba72-e6b72b9dda9e#common-problems-and-their-solutions). | SSPR_0009: We've detected that password reset has not been enabled by your administrator. Contact your admin and ask them to enable password reset for your organization. | +| WritebackNotEnabled = 10 |We're sorry, you can't reset your password at this time because your administrator has not enabled a necessary service for your organization. There is no further action you can take to resolve this situation. Contact your admin and ask them to check your organization's configuration.<br /><br />To learn more about this necessary service, see [Configuring password writeback](./tutorial-enable-sspr-writeback.md). | SSPR_0010: We've detected that password writeback has not been enabled. Contact your admin and ask them to enable password writeback. | +| SsprNotEnabledInUserPolicy = 11 | We're sorry, you can't reset your password at this time because your administrator has not configured password reset for your organization. There is no further action you can take to resolve this situation. Contact your admin and ask them to configure password reset.<br /><br />To learn more about password reset configuration, see [Quickstart: Azure AD self-service password reset](./tutorial-enable-sspr.md). | SSPR_0011: Your organization has not defined a password reset policy. Contact your admin and ask them to define a password reset policy. | +| UserNotLicensed = 12 | We're sorry, you can't reset your password at this time because required licenses are missing from your organization. There is no further action you can take to resolve this situation. Contact your admin and ask them to check your license assignment.<br /><br />To learn more about licensing, see [Licensing requirements for Azure AD self-service password reset](./concept-sspr-licensing.md). | SSPR_0012: Your organization does not have the required licenses necessary to perform password reset. Contact your admin and ask them to review the license assignments. | +| UserNotMemberOfScopedAccessGroup = 13 | We're sorry, you can't reset your password at this time because your administrator has not configured your account to use password reset. There is no further action you can take to resolve this situation. Contact your admin and ask them to configure your account for password reset.<br /><br />To learn more about account configuration for password reset, see [Roll out password reset for users](./howto-sspr-deployment.md). | SSPR_0013: You are not a member of a group enabled for password reset. Contact your admin and request to be added to the group. | +| UserNotProperlyConfigured = 14 | We're sorry, you can't reset your password at this time because necessary information is missing from your account. There is no further action you can take to resolve this situation. Contact you admin and ask them to reset your password for you. After you have access to your account again, you need to register the necessary information.<br /><br />To register information, follow the steps in the [Register for self-service password reset](https://support.microsoft.com/account-billing/register-the-password-reset-verification-method-for-a-work-or-school-account-47a55d4a-05b0-4f67-9a63-f39a43dbe20a) article. | SSPR_0014: Additional security info is needed to reset your password. To proceed, contact your admin and ask them to reset your password. After you have access to your account, you can register additional security info at https://aka.ms/ssprsetup. Your admin can add additional security info to your account by following the steps in [Set and read authentication data for password reset](howto-sspr-authenticationdata.md). | +| OnPremisesAdminActionRequired = 29 | We're sorry, we can't reset your password at this time because of a problem with your organization's password reset configuration. There is no further action you can take to resolve this situation. Contact your admin and ask them to investigate. <br /><br />Or<br /><br />We cannot reset your password at this time because of a problem with your organization's password reset configuration. There is no further action you can take to resolve this issue. Contact your admin and ask them to investigate.<br /><br />To learn more about the potential problem, see [Troubleshoot password writeback](troubleshoot-sspr-writeback.md). | SSPR_0029: We are unable to reset your password due to an error in your on-premises configuration. Contact your admin and ask them to investigate. | +| OnPremisesConnectivityError = 30 | We're sorry, we can't reset your password at this time because of connectivity issues to your organization. There is no action to take right now, but the problem might be resolved if you try again later. If the problem persists, contact your admin and ask them to investigate.<br /><br />To learn more about connectivity issues, see [Troubleshoot password writeback connectivity](troubleshoot-sspr-writeback.md). | SSPR_0030: We can't reset your password due to a poor connection with your on-premises environment. Contact your admin and ask them to investigate.| ## Azure AD forums |
| active-directory | Tutorial Configure Custom Password Protection | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/tutorial-configure-custom-password-protection.md | Let's enable the custom banned password list and add some entries. You can add a To enable the custom banned password list and add entries to it, complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com) using an account with *global administrator* permissions. -1. Search for and select **Azure Active Directory**, then choose **Security** from the menu on the left-hand side. -1. Under the **Manage** menu header, select **Authentication methods**, then **Password protection**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Authentication methods**, then **Password protection**. 1. Set the option for **Enforce custom list** to *Yes*. 1. Add strings to the **Custom banned password list**, one string per line. The following considerations and limitations apply to the custom banned password list: To enable the custom banned password list and add entries to it, complete the fo Specify your own custom passwords to ban, as shown in the following example - [  ](media/tutorial-configure-custom-password-protection/enable-configure-custom-banned-passwords.png#lightbox) + [  ](media/tutorial-configure-custom-password-protection/enable-configure-custom-banned-passwords.png#lightbox) 1. Leave the option for **Enable password protection on Windows Server Active Directory** to *No*. 1. To enable the custom banned passwords and your entries, select **Save**. To see the custom banned password list in action, try to change the password to If you no longer want to use the custom banned password list you have configured as part of this tutorial, complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. Search for and select **Azure Active Directory**, then choose **Security** from the menu on the left-hand side. -1. Under the **Manage** menu header, select **Authentication methods**, then **Password protection**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Authentication methods**, then **Password protection**. 1. Set the option for **Enforce custom list** to *No*. 1. To update the custom banned password configuration, select **Save**. |
| active-directory | Tutorial Enable Azure Mfa | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/tutorial-enable-azure-mfa.md | The recommended way to enable and use Azure AD Multi-Factor Authentication is wi Conditional Access policies can be applied to specific users, groups, and apps. The goal is to protect your organization while also providing the right levels of access to the users who need it. -In this tutorial, we create a basic Conditional Access policy to prompt for MFA when a user signs in to the Azure portal. In a later tutorial in this series, we configure Azure AD Multi-Factor Authentication by using a risk-based Conditional Access policy. +In this tutorial, we create a basic Conditional Access policy to prompt for MFA when a user signs in. In a later tutorial in this series, we configure Azure AD Multi-Factor Authentication by using a risk-based Conditional Access policy. First, create a Conditional Access policy and assign your test group of users as follows: -1. Sign in to the [Azure portal](https://portal.azure.com) by using an account with *global administrator* permissions. --1. Search for and select **Azure Active Directory**. Then select **Security** from the menu on the left-hand side. --1. Select **Conditional Access**, select **+ New policy**, and then select **Create new policy**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access**, select **+ New policy**, and then select **Create new policy**. :::image type="content" alt-text="A screenshot of the Conditional Access page, where you select 'New policy' and then select 'Create new policy'." source="media/tutorial-enable-azure-mfa/tutorial-enable-azure-mfa-conditional-access-menu-new-policy.png"::: Now that the Conditional Access policy is created and a test group of users is a ### Configure which apps require multi-factor authentication -For this tutorial, configure the Conditional Access policy to require multi-factor authentication when a user signs in to the Azure portal. +For this tutorial, configure the Conditional Access policy to require multi-factor authentication when a user signs in. 1. Select the current value under **Cloud apps or actions**, and then under **Select what this policy applies to**, verify that **Cloud apps** is selected. For this tutorial, configure the Conditional Access policy to require multi-fact > [!TIP] > You can choose to apply the Conditional Access policy to **All cloud apps** or **Select apps**. To provide flexibility, you can also exclude certain apps from the policy. -1. Browse the list of available sign-in events that can be used. For this tutorial, select **Microsoft Azure Management** so that the policy applies to sign-in events to the Azure portal. Then choose **Select**. +1. Browse the list of available sign-in events that can be used. For this tutorial, select **Microsoft Azure Management** so that the policy applies to sign-in events. Then choose **Select**. :::image type="content" alt-text="A screenshot of the Conditional Access page, where you select the app, Microsoft Azure Management, to which the new policy will apply." source="media/tutorial-enable-azure-mfa/tutorial-enable-azure-mfa-conditional-access-menu-select-apps.png"::: For this tutorial, configure the Conditional Access policy to require multi-fact Next, we configure access controls. Access controls let you define the requirements for a user to be granted access. They might be required to use an approved client app or a device that's hybrid-joined to Azure AD. -In this tutorial, configure the access controls to require multi-factor authentication during a sign-in event to the Azure portal. +In this tutorial, configure the access controls to require multi-factor authentication during a sign-in event. 1. Under **Access controls**, select the current value under **Grant**, and then select **Grant access**. First, sign in to a resource that doesn't require MFA: 1. Close the browser window. -You configured the Conditional Access policy to require additional authentication for the Azure portal. Because of that configuration, you're prompted to use Azure AD Multi-Factor Authentication or to configure a method if you haven't yet done so. Test this new requirement by signing in to the Azure portal: +You configured the Conditional Access policy to require additional authentication for sign in. Because of that configuration, you're prompted to use Azure AD Multi-Factor Authentication or to configure a method if you haven't yet done so. Test this new requirement by signing in to the Microsoft Entra admin center: -1. Open a new browser window in InPrivate or incognito mode and sign in to the [Azure portal](https://portal.azure.com). +1. Open a new browser window in InPrivate or incognito mode and sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 1. Sign in with your non-administrator test user, such as *testuser*. Be sure to include `@` and the domain name for the user account. You configured the Conditional Access policy to require additional authenticatio 1. Complete the instructions on the screen to configure the method of multi-factor authentication that you've selected. -1. Close the browser window, and sign in to the [Azure portal](https://portal.azure.com) again to test the authentication method that you configured. For example, if you configured a mobile app for authentication, you should see a prompt like the following. +1. Close the browser window, and sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) again to test the authentication method that you configured. For example, if you configured a mobile app for authentication, you should see a prompt like the following.  You configured the Conditional Access policy to require additional authenticatio If you no longer want to use the Conditional Access policy that you configured as part of this tutorial, delete the policy by using the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com). --1. Search for and select **Azure Active Directory**, and then select **Security** from the menu on the left-hand side. --1. Select **Conditional Access**, and then select the policy that you created, such as **MFA Pilot**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). +1. Browse to **Protection** > **Conditional Access**, and then select the policy that you created, such as **MFA Pilot**. 1. select **Delete**, and then confirm that you want to delete the policy. |
| active-directory | Tutorial Enable Cloud Sync Sspr Writeback | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/tutorial-enable-cloud-sync-sspr-writeback.md | Azure Active Directory Connect cloud sync can synchronize Azure AD password chan Permissions for cloud sync are configured by default. If permissions need to be reset, see [Troubleshooting](#troubleshooting) for more details about the specific permissions required for password writeback and how to set them by using PowerShell. ### Enable password writeback in SSPR-You can enable Azure AD connect cloud sync provisioning directly in Azure portal or through PowerShell. +You can enable Azure AD connect cloud sync provisioning directly in the Microsoft Entra admin center or through PowerShell. -#### Enable password writeback in Azure portal +#### Enable password writeback in the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] With password writeback enabled in Azure AD Connect cloud sync, now verify, and configure Azure AD self-service password reset (SSPR) for password writeback. When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well. To verify and enable password writeback in SSPR, complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com) using a Global Administrator account. -1. Search for and select **Azure Active Directory**, select **Password reset**, then choose **On-premises integration**. -1. Check the option for **Enable password write back for synced users** . +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset**, then choose **On-premises integration**. +1. Check the option for **Enable password write back for synced users**. 1. (optional) If Azure AD Connect provisioning agents are detected, you can additionally check the option for **Write back passwords with Azure AD Connect cloud sync**. 3. Check the option for **Allow users to unlock accounts without resetting their password** to *Yes*. Set-AADCloudSyncPasswordWritebackConfiguration -Enable $true -Credential $(Get-C If you no longer want to use the SSPR writeback functionality you have configured as part of this tutorial, complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. Search for and select **Azure Active Directory**, select **Password reset**, then choose **On-premises integration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset**, then choose **On-premises integration**. 1. Uncheck the option for **Enable password write back for synced users**. 1. Uncheck the option for **Write back passwords with Azure AD Connect cloud sync**. 1. Uncheck the option for **Allow users to unlock accounts without resetting their password**. If you no longer want to use the SSPR writeback functionality you have configure If you no longer want to use the Azure AD Connect cloud sync for SSPR writeback functionality but want to continue using Azure AD Connect sync agent for writebacks complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. Search for and select **Azure Active Directory**, select **Password reset**, then choose **On-premises integration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset**, then choose **On-premises integration**. 1. Uncheck the option for **Write back passwords with Azure AD Connect cloud sync**. 1. When ready, select **Save**. Passwords are written back in the following situations for end-users and adminis | Account | Supported operations | |-||-| End users | Any end-user self-service voluntary change password operation.<br>Any end-user self-service force change password operation, for example, password expiration.<br>Any end-user self-service password reset that originates from the password reset portal. | -| Administrators | Any administrator self-service voluntary change password operation.<br>Any administrator self-service force change password operation, for example, password expiration.<br>Any administrator self-service password reset that originates from the password reset portal.<br> Any administrator-initiated end-user password reset from the Azure portal.<br>Any administrator-initiated end-user password reset from the Microsoft Graph API. | +| End users | Any end-user self-service voluntary change password operation.<br>Any end-user self-service force change password operation, for example, password expiration.<br>Any end-user self-service password reset that originates from password reset. | +| Administrators | Any administrator self-service voluntary change password operation.<br>Any administrator self-service force change password operation, for example, password expiration.<br>Any administrator self-service password reset that originates from password reset.<br> Any administrator-initiated end-user password reset from the Microsoft Entra admin center.<br>Any administrator-initiated end-user password reset from the Microsoft Graph API. | ## Unsupported operations Try the following operations to validate scenarios using password writeback. All | Reset password from the login page | Have two users from disconnected domains and forests perform SSPR. You could also have Azure AD Connect and cloud sync deployed side-by-side and have one user in the scope of cloud sync configuration and another in scope of Azure AD Connect and have those users reset their password. | | Force expired password change | Have two users from disconnected domains and forests change expired passwords. You could also have Azure AD Connect and cloud sync deployed side-by-side and have one user in the scope of cloud sync configuration and another in scope of Azure AD Connect. | | Regular password change | Have two users from disconnected domains and forests perform routine password change. You could also have Azure AD Connect and cloud sync side by side and have one user in the scope of cloud sync config and another in scope of Azure AD Connect. |-| Admin reset user password | Have two users disconnected domains and forests reset their password from the Azure Admin Portal or Frontline worker portal. You could also have Azure AD Connect and cloud sync side by side and have one user in the scope of cloud sync config and another in scope of Azure AD Connect | +| Admin reset user password | Have two users disconnected domains and forests reset their password from the Microsoft Entra admin center or Frontline worker portal. You could also have Azure AD Connect and cloud sync side by side and have one user in the scope of cloud sync config and another in scope of Azure AD Connect | | Self-service account unlock | Have two users from disconnected domains and forests unlock accounts in the SSPR portal resetting the password. You could also have Azure AD Connect and cloud sync side by side and have one user in the scope of cloud sync config and another in scope of Azure AD Connect. | ## Troubleshooting |
| active-directory | Tutorial Enable Sspr Writeback | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/tutorial-enable-sspr-writeback.md | To enable SSPR writeback, first enable the writeback option in Azure AD Connect. [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -With password writeback enabled in Azure AD Connect, now configure Azure AD SSPR for writeback. SSPR can be configured to writeback through Azure AD Connect sync agents and Azure AD Connect provisioning agents (cloud sync). When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well. +With password writeback enabled in Azure AD Connect, now configure Azure AD SSPR for writeback. SSPR can be configured to writeback through Azure AD Connect sync agents and Azure AD Connect provisioning agents (cloud sync). When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well. To enable password writeback in SSPR, complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com) using a Hybrid Identity Administrator account. -1. Search for and select **Azure Active Directory**, select **Password reset**, then choose **On-premises integration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset**, then choose **On-premises integration**. 1. Check the option for **Write back passwords to your on-premises directory** . 1. (optional) If Azure AD Connect provisioning agents are detected, you can additionally check the option for **Write back passwords with Azure AD Connect cloud sync**. 3. Check the option for **Allow users to unlock accounts without resetting their password** to *Yes*. To enable password writeback in SSPR, complete the following steps: If you no longer want to use the SSPR writeback functionality you have configured as part of this tutorial, complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. Search for and select **Azure Active Directory**, select **Password reset**, then choose **On-premises integration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset**, then choose **On-premises integration**. 1. Uncheck the option for **Write back passwords to your on-premises directory**. 1. Uncheck the option for **Write back passwords with Azure AD Connect cloud sync**. 1. Uncheck the option for **Allow users to unlock accounts without resetting their password**. 1. When ready, select **Save**. If you no longer want to use the Azure AD Connect cloud sync for SSPR writeback functionality but want to continue using Azure AD Connect sync agent for writebacks complete the following steps:-1. Sign in to the [Azure portal](https://portal.azure.com). -1. Search for and select **Azure Active Directory**, select **Password reset**, then choose **On-premises integration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset**, then choose **On-premises integration**. 1. Uncheck the option for **Write back passwords with Azure AD Connect cloud sync**. 1. When ready, select **Save**. |
| active-directory | Tutorial Enable Sspr | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/tutorial-enable-sspr.md | To finish this tutorial, you need the following resources and privileges: Azure AD lets you enable SSPR for *None*, *Selected*, or *All* users. This granular ability lets you choose a subset of users to test the SSPR registration process and workflow. When you're comfortable with the process and the time is right to communicate the requirements with a broader set of users, you can select a group of users to enable for SSPR. Or, you can enable SSPR for everyone in the Azure AD tenant. > [!NOTE]-> Currently, you can only enable one Azure AD group for SSPR using the Azure portal. As part of a wider deployment of SSPR, Azure AD supports nested groups. +> Currently, you can only enable one Azure AD group for SSPR using the Microsoft Entra admin center. As part of a wider deployment of SSPR, Azure AD supports nested groups. In this tutorial, set up SSPR for a set of users in a test group. Use the *SSPR-Test-Group* and provide your own Azure AD group as needed: -1. Sign in to the [Azure portal](https://portal.azure.com) using an account with *global administrator* or *authentication policy administrator* permissions. -1. Search for and select **Azure Active Directory**, then select **Password reset** from the menu on the left side. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset** from the menu on the left side. 1. From the **Properties** page, under the option *Self service password reset enabled*, choose **Selected**. 1. If your group isn't visible, choose **No groups selected**, browse for and select your Azure AD group, like *SSPR-Test-Group*, and then choose *Select*. - [](media/tutorial-enable-sspr/enable-sspr-for-group.png#lightbox) + [](media/tutorial-enable-sspr/enable-sspr-for-group.png#lightbox) 1. To enable SSPR for the select users, select **Save**. In a later tutorial in this series, you'll set up password writeback. This featu If you no longer want to use the SSPR functionality you have set up as part of this tutorial, set the SSPR status to **None** using the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. Search for and select **Azure Active Directory**, then select **Password reset** from the menu on the left side. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Password reset**. 1. From the **Properties** page, under the option *Self service password reset enabled*, select **None**. 1. To apply the SSPR change, select **Save**. |
| active-directory | Tutorial Risk Based Sspr Mfa | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/authentication/tutorial-risk-based-sspr-mfa.md | Azure AD Identity Protection includes a default policy that can help get users r It's recommended to enable the MFA registration policy for users that are to be enabled for additional Azure AD Identity Protection policies. To enable this policy, complete the following steps: -1. Sign in to the [Azure portal](https://portal.azure.com) using a global administrator account. -1. Search for and select **Azure Active Directory**, select **Security**, then under the *Protect* menu heading choose **Identity Protection**. -1. Select the **MFA registration policy** from the menu on the left-hand side. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](../roles/permissions-reference.md#authentication-policy-administrator). +1. Browse to **Protection** > **Multifactor authentication** > **MFA registration policy**. 1. By default, the policy applies to *All users*. If desired, select **Assignments**, then choose the users or groups to apply the policy on. 1. Under *Controls*, select **Access**. Make sure the option for *Require Azure AD MFA registration* is checked, then choose **Select**. 1. Set **Enforce Policy** to *On*, then select **Save**. -  +  ## Enable user risk policy for password change To enable this policy, complete the following steps: 1. Under *Access*, select **Access**. Make sure the option for **Allow access** and *Require password change* is checked, then choose **Select**. 1. Set **Enforce Policy** to *On*, then select **Save**. -  +  ## Enable sign-in risk policy for MFA To enable this policy, complete the following steps: 1. Under *Access*, choose **Select a control**. Make sure the option for **Allow access** and *Require multi-factor authentication* is checked, then choose **Select**. 1. Set **Enforce Policy** to *On*, then select **Save**. -  +  ## Test risky sign events |
| active-directory | How To Add Remove Role Task | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/how-to-add-remove-role-task.md | This article describes how you can add and remove roles and tasks for Microsoft ## View permissions -1. On the Entra home page, select the **Remediation** tab, and then select the **Permissions** subtab. +1. On the Permissions Management home page, select the **Remediation** tab, and then select the **Permissions** subtab. 1. From the **Authorization System Type** dropdown, select **Azure** or **GCP**. 1. From the **Authorization System** dropdown, select the accounts you want to access. 1. From the **Search For** dropdown, select **Group**, **User**, or **APP**. This article describes how you can add and remove roles and tasks for Microsoft ## Add a role -1. On the Entra home page, select the **Remediation** tab, and then select the **Permissions** subtab. +1. On the Permissions Management home page, select the **Remediation** tab, and then select the **Permissions** subtab. 1. From the **Authorization System Type** dropdown, select **Azure** or **GCP**. 1. From the **Authorization System** dropdown, select the accounts you want to access. 1. From the **Search For** dropdown, select **Group**, **User**, or **APP/Service Account**, and then select **Apply**. This article describes how you can add and remove roles and tasks for Microsoft ## Remove a role -1. On the Entra home page, select the **Remediation** tab, and then select the **Permissions** subtab. +1. On the Permissions Management home page, select the **Remediation** tab, and then select the **Permissions** subtab. 1. From the **Authorization System Type** dropdown, select **Azure** or **GCP**. 1. From the **Authorization System** dropdown, select the accounts you want to access. 1. From the **Search For** dropdown, select **Group**, **User**, or **APP/Service Account**, and then select **Apply**. This article describes how you can add and remove roles and tasks for Microsoft ## Remove a task -1. On the Entra home page, select the **Remediation** tab, and then select the **Permissions** subtab. +1. On the Permissions Management home page, select the **Remediation** tab, and then select the **Permissions** subtab. 1. From the **Authorization System Type** dropdown, select **Azure** or **GCP**. 1. From the **Authorization System** dropdown, select the accounts you want to access. 1. From the **Search For** dropdown, select **Group**, **User**, or **APP/Service Account**, and then select **Apply**. This article describes how you can add and remove roles and tasks for Microsoft - For information on how to view existing roles/policies, requests, and permissions, see [View roles/policies, requests, and permission in the Remediation dashboard](ui-remediation.md).-- To view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md).-- For information on how to create a role/policy, see [Create a role/policy](how-to-create-role-policy.md).-- For information on how to clone a role/policy, see [Clone a role/policy](how-to-clone-role-policy.md).-- For information on how to delete a role/policy, see [Delete a role/policy](how-to-delete-role-policy.md).-- For information on how to modify a role/policy, see [Modify a role/policy](how-to-modify-role-policy.md).-- For information on how to attach and detach permissions for Amazon Web Services (AWS) identities, see [Attach and detach policies for AWS identities](how-to-attach-detach-permissions.md).+- To view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md). |
| active-directory | How To Add Remove User To Group | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/how-to-add-remove-user-to-group.md | This article describes how you can add or remove a new user for a group in Permi ## Add a user -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/#home). -1. From the Azure Active Directory tile, select **Go to Azure Active Directory**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/#home) as a Global Administrator. +1. Browse to **Microsoft Entra ID** > **Go to Azure Active Directory**. 1. From the navigation pane, select the **Groups** drop-down menu, then **All groups**. 1. Select the group name for the group you want to add the user to. 1. From the group's **Manage** menu, click **Members**. This article describes how you can add or remove a new user for a group in Permi ## Remove a user -1. Sign in to the Microsoft [Entra admin center](https://entra.microsoft.com/#home). -1. From the Azure Active Directory tile, select **Go to Azure Active Directory**. +1. Sign in to the Microsoft [Entra admin center](https://entra.microsoft.com/#home) as a Global Administrator. +1. Browse to **Microsoft Entra ID** > **Go to Azure Active Directory**. 1. From the navigation pane, select the **Groups** drop-down menu, then **All groups**. 1. Select the group name for the group you want to remove the user from. 1. From the groups **Manage** menu, click **Members**. |
| active-directory | How To Attach Detach Permissions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/how-to-attach-detach-permissions.md | This article describes how you can attach and detach permissions for users, role ## Next steps --- To view existing roles/policies, requests, and permissions, see [View roles/policies, requests, and permission in the Remediation dashboard](ui-remediation.md).-- To create a role/policy, see [Create a role/policy](how-to-create-role-policy.md).-- To clone a role/policy, see [Clone a role/policy](how-to-clone-role-policy.md).-- To delete a role/policy, see [Delete a role/policy](how-to-delete-role-policy.md).-- To modify a role/policy, see [Modify a role/policy](how-to-modify-role-policy.md).-- To view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md). - To revoke high-risk and unused tasks or assign read-only status for Microsoft Azure and Google Cloud Platform (GCP) identities, see [Revoke high-risk and unused tasks or assign read-only status for Azure and GCP identities](how-to-revoke-task-readonly-status.md) To create or approve a request for permissions, see [Create or approve a request for permissions](how-to-create-approve-privilege-request.md). |
| active-directory | How To Audit Trail Results | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/how-to-audit-trail-results.md | This article describes how you can generate an on-demand report from a query in ## Next steps -- For information on how to view how users access information, see [Use queries to see how users access information](ui-audit-trail.md).-- For information on how to filter and view user activity, see [Filter and query user activity](product-audit-trail.md).-- For information on how to create a query,see [Create a custom query](how-to-create-custom-queries.md).+- For information on how to view system reports, see [Generate and view a system report in Permissions Management](report-view-system-report.md) |
| active-directory | How To Clone Role Policy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/how-to-clone-role-policy.md | This article describes how you can use the **Remediation** dashboard in Microsof - To view existing roles/policies, requests, and permissions, see [View roles/policies, requests, and permission in the Remediation dashboard](ui-remediation.md).-- To create a role/policy, see [Create a role/policy](how-to-create-role-policy.md).-- To delete a role/policy, see [Delete a role/policy](how-to-delete-role-policy.md).-- To modify a role/policy, see [Modify a role/policy](how-to-modify-role-policy.md).-- To view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md).-- To attach and detach permissions for AWS identities, see [Attach and detach policies for AWS identities](how-to-attach-detach-permissions.md).-- To revoke high-risk and unused tasks or assign read-only status for Azure and GCP identities, see [Revoke high-risk and unused tasks or assign read-only status for Azure and GCP identities](how-to-revoke-task-readonly-status.md)-- To create or approve a request for permissions, see [Create or approve a request for permissions](how-to-create-approve-privilege-request.md). - To view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md) |
| active-directory | How To Create Alert Trigger | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/how-to-create-alert-trigger.md | This article describes how you can create and view activity alerts and alert tri - For an overview on activity triggers, see [View information about activity triggers](ui-triggers.md). - For information on rule-based anomalies and anomaly triggers, see [Create and view rule-based anomalies and anomaly triggers](product-rule-based-anomalies.md).-- For information on finding outliers in identity's behavior, see [Create and view statistical anomalies and anomaly triggers](product-statistical-anomalies.md).-- For information on permission analytics triggers, see [Create and view permission analytics triggers](product-permission-analytics.md). |
| active-directory | How To Create Approve Privilege Request | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/how-to-create-approve-privilege-request.md | The **Remediation** dashboard has two privilege-on-demand (POD) workflows you ca ## Next steps --- For information on how to view existing roles/policies, requests, and permissions, see [View roles/policies, requests, and permission in the Remediation dashboard](ui-remediation.md).-- For information on how to create a role/policy, see [Create a role/policy](how-to-create-role-policy.md).-- For information on how to clone a role/policy, see [Clone a role/policy](how-to-clone-role-policy.md).-- For information on how to delete a role/policy, see [Delete a role/policy](how-to-delete-role-policy.md).-- For information on how to modify a role/policy, see [Modify a role/policy](how-to-modify-role-policy.md).-- To view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md). - For information on how to attach and detach permissions for Amazon Web Services (AWS) identities, see [Attach and detach policies for AWS identities](how-to-attach-detach-permissions.md). - For information on how to add and remove roles and tasks for Microsoft Azure and Google Cloud Platform (GCP) identities, see [Add and remove roles and tasks for Azure and GCP identities](how-to-attach-detach-permissions.md). - For information on how to revoke high-risk and unused tasks or assign read-only status for Microsoft Azure and Google Cloud Platform (GCP) identities, see [Revoke high-risk and unused tasks or assign read-only status for Azure and GCP identities](how-to-revoke-task-readonly-status.md) |
| active-directory | Onboard Azure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/onboard-azure.md | To view status of onboarding after saving the configuration: ## Next steps -- For information on how to onboard an Amazon Web Services (AWS) account, see [Onboard an Amazon Web Services (AWS) account](onboard-aws.md).-- For information on how to onboard a Google Cloud Platform (GCP) project, see [Onboard a Google Cloud Platform (GCP) project](onboard-gcp.md).-- For information on how to enable or disable the controller after onboarding is complete, see [Enable or disable the controller](onboard-enable-controller-after-onboarding.md).-- For information on how to add an account/subscription/project after onboarding is complete, see [Add an account/subscription/project after onboarding is complete](onboard-add-account-after-onboarding.md).-- For an overview on Permissions Management, see [What's Microsoft Entra Permissions Management?](overview.md). - For information on how to start viewing information about your authorization system in Permissions Management, see [View key statistics and data about your authorization system](ui-dashboard.md). |
| active-directory | Onboard Enable Controller After Onboarding | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/onboard-enable-controller-after-onboarding.md | You can enable or disable the controller in Azure at the Subscription level of y ## Next steps -- For information on how to onboard an Amazon Web Services (AWS) account, see [Onboard an AWS account](onboard-aws.md).-- For information on how to onboard a Microsoft Azure subscription, see [Onboard a Microsoft Azure subscription](onboard-azure.md).-- For information on how to onboard a Google Cloud Platform (GCP) project, see [Onboard a GCP project](onboard-gcp.md). - For information on how to add an account/subscription/project after onboarding is complete, see [Add an account/subscription/project after onboarding is complete](onboard-add-account-after-onboarding.md). |
| active-directory | Onboard Enable Tenant | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/onboard-enable-tenant.md | Use the **Data Collectors** dashboard in Permissions Management to configure dat ## Next steps - For an overview of Permissions Management, see [What's Microsoft Entra Permissions Management?](overview.md)-- For a list of frequently asked questions (FAQs) about Permissions Management, see [FAQs](faqs.md).-- To start viewing information about your authorization system in Permissions Management, see [View key statistics and data about your authorization system](ui-dashboard.md). |
| active-directory | Onboard Gcp | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/onboard-gcp.md | -> A *global administrator* or *super admin* (an admin for all authorization system types) can perform the tasks in this article after the global administrator has initially completed the steps provided in [Enable Permissions Management on your Azure Active Directory tenant](onboard-enable-tenant.md). +> You must have the Global Administrator role assignment to perform the tasks in this article. ## Explanation The required commands to run in Google Cloud Shell are listed in the Manage Auth ## Next steps -- To onboard an Amazon Web Services (AWS) account, see [Onboard an Amazon Web Services (AWS) account](onboard-aws.md).-- To onboard a Microsoft Azure subscription, see [Onboard a Microsoft Azure subscription](onboard-azure.md). - To enable or disable the controller after onboarding is complete, see [Enable or disable the controller](onboard-enable-controller-after-onboarding.md). - To add an account/subscription/project after onboarding is complete, see [Add an account/subscription/project after onboarding is complete](onboard-add-account-after-onboarding.md). |
| active-directory | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/overview.md | Once your organization has explored and implemented the discover, remediation an ## Next steps -- Deepen your learning with the [Introduction to Microsoft Entra Permissions Management](https://go.microsoft.com/fwlink/?linkid=2240016) learn module. +- Deepen your learning with [Introduction to Microsoft Entra Permissions Management](https://go.microsoft.com/fwlink/?linkid=2240016) learn module. - Sign up for a [45-day free trial](https://aka.ms/TryPermissionsManagement) of Permissions Management. - For a list of frequently asked questions (FAQs) about Permissions Management, see [FAQs](faqs.md). |
| active-directory | Permissions Management Quickstart Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/permissions-management-quickstart-guide.md | If the above points are met, continue with: [Enable Microsoft Entra Permissions Management in your organization](onboard-enable-tenant.md) -Ensure you're a *Global Administrator*. Learn more about [Permissions Management roles and permissions](product-roles-permissions.md). +Ensure you're a Global Administrator. Learn more about [Permissions Management roles and permissions](product-roles-permissions.md). ## Step 2: Onboard your multicloud environment |
| active-directory | Permissions Management Trial User Guide | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide.md | Title: Trial User Guide - Microsoft Entra Permissions Management + Title: Trial User Guide - Microsoft Entra Permissions Management - OBSOLETE description: How to get started with your Microsoft Entra Permissions Management free trial |
| active-directory | Ui Remediation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/ui-remediation.md | The **Settings** subtab provides the following settings that you can use to make ## Next steps - - For information on how to view existing roles/policies, requests, and permissions, see [View roles/policies, requests, and permission in the Remediation dashboard](ui-remediation.md).-- For information on how to create a role/policy, see [Create a role/policy](how-to-create-role-policy.md).-- For information on how to clone a role/policy, see [Clone a role/policy](how-to-clone-role-policy.md).-- For information on how to delete a role/policy, see [Delete a role/policy](how-to-delete-role-policy.md).-- For information on how to modify a role/policy, see Modify a role/policy](how-to-modify-role-policy.md).-- To view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md).-- For information on how to attach and detach permissions for AWS identities, see [Attach and detach policies for AWS identities](how-to-attach-detach-permissions.md).-- For information on how to revoke high-risk and unused tasks or assign read-only status for Azure and GCP identities, see [Revoke high-risk and unused tasks or assign read-only status for Azure and GCP identities](how-to-revoke-task-readonly-status.md)-- For information on how to create or approve a request for permissions, see [Create or approve a request for permissions](how-to-create-approve-privilege-request.md).-- For information on how to view information about roles/policies, see [View information about roles/policies](how-to-view-role-policy.md)+- For information on how to create or approve a request for permissions, see [Create or approve a request for permissions](how-to-create-approve-privilege-request.md). |
| active-directory | Ui Triggers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/ui-triggers.md | The **Alert Triggers** subtab in the **Activity**, **Rule-Based Anomaly**, **Sta - **Modified By**: The name of the user who modified the alert. ---- ## Next steps - For information on activity alerts and alert triggers, see [Create and view activity alerts and alert triggers](how-to-create-alert-trigger.md). - For information on rule-based anomalies and anomaly triggers, see [Create and view rule-based anomalies and anomaly triggers](product-rule-based-anomalies.md).-- For information on finding outliers in identity's behavior, see [Create and view statistical anomalies and anomaly triggers](product-statistical-anomalies.md). - For information on permission analytics triggers, see [Create and view permission analytics triggers](product-permission-analytics.md). |
| active-directory | Ui User Management | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/ui-user-management.md | You can also select the following options: ## Next steps -- For information about how to view information about active and completed tasks, see [View information about active and completed tasks](ui-tasks.md). - For information about how to view personal and organization information, see [View personal and organization information](product-account-settings.md).-- For information about how to select group-based permissions settings, see [Select group-based permissions settings](how-to-create-group-based-permissions.md). |
| active-directory | Usage Analytics Access Keys | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/usage-analytics-access-keys.md | Filters can be applied in one, two, or all three categories depending on the typ Select **Reset Filter** to discard your changes. - ## Export the results of your query - To view a report of the results of your query as a comma-separated values (CSV) file, select **Export**, and then select **CSV** or **CSV (Detailed)**. Filters can be applied in one, two, or all three categories depending on the typ ## Next steps - To view active tasks, see [View usage analytics about active tasks](usage-analytics-active-tasks.md).-- To view assigned permissions and usage by users, see [View usage analytics about users](usage-analytics-users.md).-- To view assigned permissions and usage of the group and the group members, see [View usage analytics about groups](usage-analytics-groups.md). - To view active resources, see [View usage analytics about active resources](usage-analytics-active-resources.md).-- To view assigned permissions and usage of the serverless functions, see [View usage analytics about serverless functions](usage-analytics-serverless-functions.md). |
| active-directory | Usage Analytics Active Resources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/usage-analytics-active-resources.md | You can filter user details by type of user, user role, app, or service used, or ## Next steps -- To track active tasks, see [View usage analytics about active tasks](usage-analytics-active-tasks.md).-- To track assigned permissions and usage of users, see [View usage analytics about users](usage-analytics-users.md).-- To track assigned permissions and usage of the group and the group members, see [View usage analytics about groups](usage-analytics-groups.md). - To track the permission usage of access keys for a given user, see [View usage analytics about access keys](usage-analytics-access-keys.md). - To track assigned permissions and usage of the serverless functions, see [View usage analytics about serverless functions](usage-analytics-serverless-functions.md). |
| active-directory | Usage Analytics Active Tasks | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/usage-analytics-active-tasks.md | You can filter user details by type of user, user role, app, or service used, or ## Next steps -- To view assigned permissions and usage by users, see [View analytic information about users](usage-analytics-users.md).-- To view assigned permissions and usage of the group and the group members, see [View analytic information about groups](usage-analytics-groups.md). - To view active resources, see [View analytic information about active resources](usage-analytics-active-resources.md). - To view the permission usage of access keys for a given user, see [View analytic information about access keys](usage-analytics-access-keys.md).-- To view assigned permissions and usage of the serverless functions, see [View analytic information about serverless functions](usage-analytics-serverless-functions.md). |
| active-directory | Usage Analytics Groups | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/usage-analytics-groups.md | You can filter user details by type of user, user role, app, or service used, or - To view active tasks, see [View analytic information about active tasks](usage-analytics-active-tasks.md). - To view assigned permissions and usage by users, see [View analytic information about users](usage-analytics-users.md). - To view active resources, see [View analytic information about active resources](usage-analytics-active-resources.md).-- To view the permission usage of access keys for a given user, see [View analytic information about access keys](usage-analytics-access-keys.md).-- To view assigned permissions and usage of the serverless functions, see [View analytic information about serverless functions](usage-analytics-serverless-functions.md). |
| active-directory | Usage Analytics Home | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/usage-analytics-home.md | This article provides a brief overview of the Analytics dashboard in Permissions ## Next steps -- To view active tasks, see [View analytic information about active tasks](usage-analytics-active-tasks.md). - To view assigned permissions and usage by users, see [View analytic information about users](usage-analytics-users.md). - To view assigned permissions and usage of the group and the group members, see [View analytic information about groups](usage-analytics-groups.md).-- To view active resources, see [View analytic information about active resources](usage-analytics-active-resources.md).-- To view the permission usage of access keys for a given user, see [View analytic information about access keys](usage-analytics-access-keys.md).-- To view assigned permissions and usage of the serverless functions, see [View analytic information about serverless functions](usage-analytics-serverless-functions.md).+- To view active resources, see [View analytic information about active resources](usage-analytics-active-resources.md). |
| active-directory | Usage Analytics Serverless Functions | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/usage-analytics-serverless-functions.md | You can filter the **Serverless Functions** results by **Authorization System Ty ## Next steps -- To view active tasks, see [View usage analytics about active tasks](usage-analytics-active-tasks.md).-- To view assigned permissions and usage by users, see [View analytic information about users](usage-analytics-users.md).-- To view assigned permissions and usage of the group and the group members, see [View analytic information about groups](usage-analytics-groups.md). - To view active resources, see [View analytic information about active resources](usage-analytics-active-resources.md). - To view the permission usage of access keys for a given user, see [View analytic information about access keys](usage-analytics-access-keys.md). |
| active-directory | Usage Analytics Users | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/cloud-infrastructure-entitlement-management/usage-analytics-users.md | You can filter user details by type of user, user role, app, or service used, or ## Next steps -- To view active tasks, see [View analytic information about active tasks](usage-analytics-active-tasks.md).-- To view assigned permissions and usage of the group and the group members, see [View analytic information about groups](usage-analytics-groups.md).-- To view active resources, see [View analytic information about active resources](usage-analytics-active-resources.md). - To view the permission usage of access keys for a given user, see [View analytic information about access keys](usage-analytics-access-keys.md). - To view assigned permissions and usage of the serverless functions, see [View analytic information about serverless functions](usage-analytics-serverless-functions.md). |
| active-directory | Terms Of Use | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/conditional-access/terms-of-use.md | You can edit some details of terms of use policies, but you can't modify an exis If there are other settings you would like to change, such as PDF document, require users to consent on every device, expire consents, duration before reacceptance, or Conditional Access policy, you must create a new ToU policy. -  +  1. Once you're done, select **Save** to save your changes. |
| active-directory | Certificate Credentials | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/certificate-credentials.md | Gh95kHCOEGq5E_ArMBbDXhwKR577scxYaoJ1P{a lot of characters here}KKJDEg" ## Register your certificate with Microsoft identity platform -You can associate the certificate credential with the client application in the Microsoft identity platform through the Azure portal using any of the following methods: +You can associate the certificate credential with the client application in the Microsoft identity platform through the Microsoft Entra admin center using any of the following methods: ### Uploading the certificate file |
| active-directory | How Applications Are Added | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/how-applications-are-added.md | There are two representations of applications in Azure Active Directory (Azure A ## What are application objects and where do they come from? -You can manage [application objects](app-objects-and-service-principals.md#application-object) in the Azure portal through the [App registrations](https://aka.ms/appregistrations) experience. Application objects describe the application to Azure AD and can be considered the definition of the application, allowing the service to know how to issue tokens to the application based on its settings. The application object will only exist in its home directory, even if it's a multi-tenant application supporting service principals in other directories. The application object may include (but not limited to) any of the following: +You can manage [application objects](app-objects-and-service-principals.md#application-object) in the Microsoft Entra admin center through the [App registrations](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) experience. Application objects describe the application to Azure AD and can be considered the definition of the application, allowing the service to know how to issue tokens to the application based on its settings. The application object will only exist in its home directory, even if it's a multi-tenant application supporting service principals in other directories. The application object may include (but not limited to) any of the following: - Name, logo, and publisher - Redirect URIs You can manage [application objects](app-objects-and-service-principals.md#appli Application objects can be created through multiple pathways, including: -- Application registrations in the Azure portal+- Application registrations in the Microsoft Entra admin center - Creating a new application using Visual Studio and configuring it to use Azure AD authentication - When an admin adds an application from the app gallery (which will also create a service principal) - Using the Microsoft Graph API or PowerShell to create a new application Application objects can be created through multiple pathways, including: ## What are service principals and where do they come from? -You can manage [service principals](app-objects-and-service-principals.md#service-principal-object) in the Azure portal through the [Enterprise Applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AllApps/menuId/) experience. Service principals are what govern an application connecting to Azure AD and can be considered the instance of the application in your directory. For any given application, it can have at most one application object (which is registered in a "home" directory), and one or more service principal objects representing instances of the application in every directory in which it acts. +You can manage [service principals](app-objects-and-service-principals.md#service-principal-object) in the Microsoft Entra admin center through the [Enterprise Applications](https://entra.microsoft.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AllApps/menuId/) experience. Service principals are what govern an application connecting to Azure AD and can be considered the instance of the application in your directory. For any given application, it can have at most one application object (which is registered in a "home" directory), and one or more service principal objects representing instances of the application in every directory in which it acts. The service principal can include: Allowing users to register and consent to applications might initially sound con - Users signing in to applications using their organization accounts for business purposes is a good thing. If they subsequently leave the organization they'll automatically lose access to their account in the application they were using. - Having a record of what data was shared with which application is a good thing. Data is more transportable than ever and it's useful to have a clear record of who shared what data with which applications. - API owners who use Azure AD for OAuth decide exactly what permissions users are able to grant to applications and which permissions require an admin to agree to. Only admins can consent to larger scopes and more significant permissions, while user consent is scoped to the users' own data and capabilities.-- When a user adds or allows an application to access their data, the event can be audited so you can view the Audit Reports within the Azure portal to determine how an application was added to the directory.+- When a user adds or allows an application to access their data, the event can be audited so you can view the Audit Reports within the Microsoft Entra admin center to determine how an application was added to the directory. If you still want to prevent users in your directory from registering applications and from signing in to applications without administrator approval, there are two settings that you can change to turn off those capabilities: - To change the user consent settings in your organization, see [Configure how users consent to applications](../manage-apps/configure-user-consent.md). - To prevent users from registering their own applications:- 1. In the Azure portal, go to the [User settings](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/UserSettings) section under **App registrations** + 1. In the Microsoft Entra admin center, browse to **Identity** > **Users** > **User settings**. 2. Change **Users can register applications** to **No**. <!--Image references--> |
| active-directory | Howto Add App Roles In Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/howto-add-app-roles-in-apps.md | Another approach is to use Azure Active Directory (Azure AD) groups and group cl ## Declare roles for an application -You define app roles by using the [Azure portal](https://portal.azure.com) during the [app registration process](quickstart-register-app.md). App roles are defined on an application registration representing a service, app or API. When a user signs in to the application, Azure AD emits a `roles` claim for each role that the user or service principal has been granted. This can be used to implement [claim-based authorization](./claims-validation.md). App roles can be assigned [to a user or a group of users](../manage-apps/add-application-portal-assign-users.md). App roles can also be assigned to the service principal for another application, or [to the service principal for a managed identity](../managed-identities-azure-resources/how-to-assign-app-role-managed-identity-powershell.md). +You define app roles by using the [Microsoft Entra admin center](https://entra.microsoft.com) during the [app registration process](quickstart-register-app.md). App roles are defined on an application registration representing a service, app or API. When a user signs in to the application, Azure AD emits a `roles` claim for each role that the user or service principal has been granted. This can be used to implement [claim-based authorization](./claims-validation.md). App roles can be assigned [to a user or a group of users](../manage-apps/add-application-portal-assign-users.md). App roles can also be assigned to the service principal for another application, or [to the service principal for a managed identity](../managed-identities-azure-resources/how-to-assign-app-role-managed-identity-powershell.md). Currently, if you add a service principal to a group, and then assign an app role to that group, Azure AD doesn't add the `roles` claim to tokens it issues. -App roles are declared using App roles UI in the Azure portal: +App roles are declared using App roles UI in the Microsoft Entra admin center: The number of roles you add counts toward application manifest limits enforced by Azure AD. For information about these limits, see the [Manifest limits](./reference-app-manifest.md#manifest-limits) section of [Azure Active Directory app manifest reference](reference-app-manifest.md). The number of roles you add counts toward application manifest limits enforced b [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -To create an app role by using the Azure portal's user interface: +To create an app role by using the Microsoft Entra admin center's user interface: -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant that contains the app registration to which you want to add an app role.-1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations**, and then select the application you want to define app roles in. -1. Select **App roles**, and then select **Create app role**. +1. Browse to **Identity** > **Applications** > **App registrations** and then select the application you want to define app roles in. +1. Under manage select **App roles**, and then select **Create app role**. :::image type="content" source="media/howto-add-app-roles-in-apps/app-roles-overview-pane.png" alt-text="An app registration's app roles pane in the Azure portal"::: If you have not already done so, you'll need to assign yourself as the applicati Once you've added app roles in your application, you can assign users and groups to the roles. Assignment of users and groups to roles can be done through the portal's UI, or programmatically using [Microsoft Graph](/graph/api/user-post-approleassignments). When the users assigned to the various app roles sign in to the application, their tokens will have their assigned roles in the `roles` claim. -To assign users and groups to roles by using the Azure portal: +To assign users and groups to roles by using the Microsoft Entra admin center: -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>. -1. In **Azure Active Directory**, select **Enterprise applications** in the left-hand navigation menu. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant that contains the app registration to which you want to add an app role. +1. Browse to **Identity** > **Applications** > **Enterprise applications**. 1. Select **All applications** to view a list of all your applications. If your application doesn't appear in the list, use the filters at the top of the **All applications** list to restrict the list, or scroll down the list to locate your application. 1. Select the application in which you want to assign users or security group to roles. 1. Under **Manage**, select **Users and groups**. Confirm that the users and groups you added appear in the **Users and groups** l ## Assign app roles to applications -Once you've added app roles in your application, you can assign an app role to a client app by using the Azure portal or programmatically by using [Microsoft Graph](/graph/api/user-post-approleassignments). +Once you've added app roles in your application, you can assign an app role to a client app by using the Microsoft Entra admin center or programmatically by using [Microsoft Graph](/graph/api/user-post-approleassignments). When you assign app roles to an application, you create _application permissions_. Application permissions are typically used by daemon apps or back-end services that need to authenticate and make authorized API call as themselves, without the interaction of a user. -To assign app roles to an application by using the Azure portal: +To assign app roles to an application by using the Microsoft Entra admin center: -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>. -1. In **Azure Active Directory**, select **App registrations** in the left-hand navigation menu. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. Browse to **Identity** > **Applications** > **App registrations** and then select **All applications**. 1. Select **All applications** to view a list of all your applications. If your application doesn't appear in the list, use the filters at the top of the **All applications** list to restrict the list, or scroll down the list to locate your application. 1. Select the application to which you want to assign an app role. 1. Select **API permissions** > **Add a permission**. |
| active-directory | Howto Configure Publisher Domain | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/howto-configure-publisher-domain.md | If your multitenant was registered *after November 30, 2020*: If your app was registered *before May 21, 2019*, your app's consent prompt shows *unverified*, even if you haven't set a publisher domain. We recommend that you set the publisher domain value so that users can see this information in your app's consent prompt. -## Set a publisher domain in the Azure portal +## Set a publisher domain in the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -To set a publisher domain for your app by using the Azure portal: +To set a publisher domain for your app by using the Microsoft Entra admin center: -1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 1. If you have access to multiple tenants, use the **Directory + subscription** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the portal global menu to select the tenant where the app is registered.-1. In Azure Active Directory, go to [App registrations](https://go.microsoft.com/fwlink/?linkid=2083908). Search for and select the app you want to configure. +1. In Azure Microsoft Entra admin center browse to **Identity** > **Applications** > **App registrations**. +1. Search for and select the app you want to configure. 1. In **Overview**, in the resource menu under **Manage**, select **Branding**. 1. In **Publisher domain**, select one of the following options: |
| active-directory | Howto Modify Supported Accounts | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/howto-modify-supported-accounts.md | |
| active-directory | Howto Remove App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/howto-remove-app.md | In the following sections, you learn how to: ## Prerequisites -- One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal. - An [application registered in your Azure AD tenant](quickstart-register-app.md) ## Remove an application authored by you or your organization Applications that you or your organization have registered are represented by bo > [!NOTE] > Deleting an application will also delete its service principal object in the application's home directory. For multi-tenant applications, service principal objects in other directories will not be deleted. -To delete an application, be listed as an owner of the application or have admin privileges. --1. Sign in to the [Azure portal](https://portal.azure.com) and sign in using one of the roles listed in the prerequisites. -1. If you have access to multiple tenants, use the **Directory + subscription** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant in which the app is registered. -1. Search and select the **Azure Active Directory**. -1. Under **Manage**, select **App registrations** and select the application that you want to configure. Once you've selected the app, you see the application's **Overview** page. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant that contains the app registration to which you want to add an app role. +1. Browse to **Identity** > **Applications** > **App registrations** and then select the application that you want to configure. Once you've selected the app, you see the application's **Overview** page. 1. From the **Overview** page, select **Delete**. 1. Read the deletion consequences. Check the box if one appears at the bottom of the pane. 1. Select **Delete** to confirm that you want to delete the app. |
| active-directory | Howto Restore App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/howto-restore-app.md | -You can view your deleted applications, restore a deleted application, or permanently delete an application using the **App registrations** experience under Azure Active Directory (Azure AD) in the Azure portal. +You can view your deleted applications, restore a deleted application, or permanently delete an application using the **App registrations** experience under Azure Active Directory (Azure AD) in the Microsoft Entra admin center. Neither you nor Microsoft customer support can restore a permanently deleted application or an application deleted more than 30 days ago. You can see all the applications in a soft deleted state. Only applications del To view your restorable applications: -1. Sign in to the [Azure portal](https://portal.azure.com) and sign in using one of the roles listed in the prerequisites. -1. Search and select **Azure Active Directory**, select **App registrations**, and then select the **Deleted applications** tab. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) using one of the roles listed in the prerequisites. +1. Browse to **Identity** > **Applications** > **App registrations**, and then select the **Deleted applications** tab. Review the list of applications. Only applications that have been deleted in the past 30 days are available to restore. If using the App registrations search preview, you can filter by the 'Deleted date' column to see only these applications. |
| active-directory | Howto Restrict Your App To A Set Of Users | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/howto-restrict-your-app-to-a-set-of-users.md | The option to restrict an app to a specific set of users, apps or security group [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -To update an application to require user assignment, you must be owner of the application under Enterprise apps, or be assigned one of **Global administrator**, **Application administrator**, or **Cloud application administrator** directory roles. +To update an application to require user assignment, you must be owner of the application under Enterprise apps, or be at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). -1. Sign in to the [Azure portal](https://portal.azure.com) -1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch the tenant in which you want to register an application. -1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **Enterprise Applications** then select **All applications**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant that contains the app registration to which you want to add an app role. +1. Browse to **Identity** > **Applications** > **Enterprise applications**, then select **All applications**. 1. Select the application you want to configure to require assignment. Use the filters at the top of the window to search for a specific application. 1. On the application's **Overview** page, under **Manage**, select **Properties**. 1. Locate the setting **Assignment required?** and set it to **Yes**. When this option is set to **Yes**, users and services attempting to access the application or services must first be assigned for this application, or they won't be able to sign-in or obtain an access token. |
| active-directory | Migrate Objc Adal Msal | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/migrate-objc-adal-msal.md | ADAL and MSAL coexistence between multiple applications is fully supported. You don't need to change your existing Azure AD application to switch to MSAL and enable Azure AD accounts. However, if your ADAL-based application doesn't support brokered authentication, you'll need to register a new redirect URI for the application before you can switch to MSAL. -The redirect URI should be in this format: `msauth.<app.bundle.id>://auth`. Replace `<app.bundle.id>` with your application's bundle ID. Specify the redirect URI in the [Azure portal](https://aka.ms/MobileAppReg). +The redirect URI should be in this format: `msauth.<app.bundle.id>://auth`. Replace `<app.bundle.id>` with your application's bundle ID. Specify the redirect URI in the [Microsoft Entra admin center](https://entra.microsoft.com/?feature.broker=true#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade). -For iOS only, to support cert-based authentication, an additional redirect URI needs to be registered in your application and the Azure portal in the following format: `msauth://code/<broker-redirect-uri-in-url-encoded-form>`. For example, `msauth://code/msauth.com.microsoft.mybundleId%3A%2F%2Fauth` +For iOS only, to support cert-based authentication, an additional redirect URI needs to be registered in your application and the Microsoft Entra admin center in the following format: `msauth://code/<broker-redirect-uri-in-url-encoded-form>`. For example, `msauth://code/msauth.com.microsoft.mybundleId%3A%2F%2Fauth` We recommend all apps register both redirect URIs. |
| active-directory | Migrate Spa Implicit To Auth Code | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/migrate-spa-implicit-to-auth-code.md | The following sections describe each step in additional detail. [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -If you'd like to continue using your existing app registration for your applications, use the Azure portal to update the registration's redirect URIs to the SPA platform. Doing so enables the authorization code flow with PKCE and CORS support for apps that use the registration (you still need to update your application's code to MSAL.js v2.x). +If you'd like to continue using your existing app registration for your applications, use the Microsoft Entra admin center to update the registration's redirect URIs to the SPA platform. Doing so enables the authorization code flow with PKCE and CORS support for apps that use the registration (you still need to update your application's code to MSAL.js v2.x). Follow these steps for app registrations that are currently configured with **Web** platform redirect URIs: -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a> and select your **Azure Active Directory** tenant. -1. In **App registrations**, select your application, and then **Authentication**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). +1. Browse to **Identity** > **Applications** > **App registrations**, select your application, and then **Authentication**. 1. In the **Web** platform tile under **Redirect URIs**, select the warning banner indicating that you should migrate your URIs. :::image type="content" source="media/migrate-spa-implicit-to-auth-code/portal-01-implicit-warning-banner.png" alt-text="Implicit flow warning banner on web app tile in Azure portal"::: |
| active-directory | Mobile App Quickstart Portal Android | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/mobile-app-quickstart-portal-android.md | -> See [Understand the Android MSAL configuration file ](msal-configuration.md) for an explanation of these fields. +> See [Understand the Android MSAL configuration file](msal-configuration.md) for an explanation of these fields. > > Note the presence of `"account_mode" : "SINGLE"`, which configures this app to use a single account. > -> See [Understand the Android MSAL configuration file ](msal-configuration.md) for an explanation of the various fields. +> See [Understand the Android MSAL configuration file](msal-configuration.md) for an explanation of the various fields. > > Unlike the [auth_config_single_account.json](#auth_config_single_accountjson) configuration file, this config file has `"account_mode" : "MULTIPLE"` instead of `"account_mode" : "SINGLE"` because this is a multiple account app. > |
| active-directory | Msal Js Avoid Page Reloads | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/msal-js-avoid-page-reloads.md | To avoid the entire app reloading again or other errors caused due to this, plea ## Specify different HTML for the iframe -Set the `redirect_uri` property on config to a simple page, that does not require authentication. You have to make sure that it matches with the `redirect_uri` registered in Azure portal. This will not affect user's login experience as MSAL saves the start page when user begins the login process and redirects back to the exact location after login is completed. +Set the `redirect_uri` property on config to a simple page, that does not require authentication. You have to make sure that it matches with the `redirect_uri` registered in Microsoft Entra admin center. This will not affect user's login experience as MSAL saves the start page when user begins the login process and redirects back to the exact location after login is completed. ## Initialization in your main app file |
| active-directory | Msal Js Initializing Client Applications | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/msal-js-initializing-client-applications.md | To learn more about the client application types and application configuration o ## Prerequisites -Before initializing an application, you first need to [register it with the Azure portal](scenario-spa-app-registration.md), establishing a trust relationship between your application and the Microsoft identity platform. +Before initializing an application, you first need to [register it in the Microsoft Entra admin center](scenario-spa-app-registration.md), establishing a trust relationship between your application and the Microsoft identity platform. -After registering your app, you'll need some or all of the following values that can be found in the Azure portal. +After registering your app, you'll need some or all of the following values that can be found in the Microsoft Entra admin center. | Value | Required | Description | | :- | :: | :- | After registering your app, you'll need some or all of the following values that ## Initialize MSAL.js 2.x apps -Initialize the MSAL.js authentication context by instantiating a [PublicClientApplication][msal-js-publicclientapplication] with a [Configuration][msal-js-configuration] object. The minimum required configuration property is the `clientID` of the application, shown as **Application (client) ID** on the **Overview** page of the app registration in the Azure portal. +Initialize the MSAL.js authentication context by instantiating a [PublicClientApplication][msal-js-publicclientapplication] with a [Configuration][msal-js-configuration] object. The minimum required configuration property is the `clientID` of the application, shown as **Application (client) ID** on the **Overview** page of the app registration in the Microsoft Entra admin center. Here's an example configuration object and instantiation of a `PublicClientApplication`: Three outcomes are possible from the promise: ## Initialize MSAL.js 1.x apps -Initialize the MSAL 1.x authentication context by instantiating a UserAgentApplication with a configuration object. The minimum required configuration property is the `clientID` of your application, shown as **Application (client) ID** on the **Overview** page of the app registration in the Azure portal. +Initialize the MSAL 1.x authentication context by instantiating a UserAgentApplication with a configuration object. The minimum required configuration property is the `clientID` of your application, shown as **Application (client) ID** on the **Overview** page of the app registration in the Microsoft Entra admin center. For authentication methods with redirect flows (loginRedirect and acquireTokenRedirect) in MSAL.js 1.2.x or earlier, you must explicitly register a callback for success or error through the `handleRedirectCallback()` method. Explicitly registering the callback is required in MSAL.js 1.2.x and earlier because redirect flows don't return promises like the methods with a pop-up experience do. Registering the callback is _optional_ in MSAL.js version 1.3.x and later. |
| active-directory | Msal Net Migration Android Broker | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/msal-net-migration-android-broker.md | -If you have a Xamarin Android app currently using the Azure Active Directory Authentication Library for .NET (ADAL.NET) and an [authentication broker](msal-android-single-sign-on.md), it's time to migrate to the [Microsoft Authentication Library for .NET ](msal-overview.md) (MSAL.NET). +If you have a Xamarin Android app currently using the Azure Active Directory Authentication Library for .NET (ADAL.NET) and an [authentication broker](msal-android-single-sign-on.md), it's time to migrate to the [Microsoft Authentication Library for .NET](msal-overview.md) (MSAL.NET). ## Prerequisites result = await app.AcquireTokenInteractive(scopes) ## Next steps -For more information about Android-specific considerations when using MSAL.NET with Xamarin, see [Configuration requirements and troubleshooting tips for Xamarin Android with MSAL.NET](msal-net-xamarin-android-considerations.md). +For more information about Android-specific considerations when using MSAL.NET with Xamarin, see [Configuration requirements and troubleshooting tips for Xamarin Android with MSAL.NET](msal-net-xamarin-android-considerations.md). |
| active-directory | Multi Service Web App Access Microsoft Graph As App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/multi-service-web-app-access-microsoft-graph-as-app.md | Take note of the **Object ID** value, which you'll need in the next step. ## Grant access to Microsoft Graph -When accessing the Microsoft Graph, the managed identity needs to have proper permissions for the operation it wants to perform. Currently, there's no option to assign such permissions through the Azure portal. The following script will add the requested Microsoft Graph API permissions to the managed identity service principal object. +When accessing the Microsoft Graph, the managed identity needs to have proper permissions for the operation it wants to perform. Currently, there's no option to assign such permissions through the Microsoft Entra admin center. The following script will add the requested Microsoft Graph API permissions to the managed identity service principal object. # [PowerShell](#tab/azure-powershell) az rest --method post --uri $uri --body $body --headers "Content-Type=applicatio -After executing the script, you can verify in the [Azure portal](https://portal.azure.com) that the requested API permissions are assigned to the managed identity. +After executing the script, you can verify in the [Microsoft Entra admin center](https://entra.microsoft.com) that the requested API permissions are assigned to the managed identity. -Go to **Azure Active Directory**, and then select **Enterprise applications**. This pane displays all the service principals in your tenant. In **Managed Identities**, select the service principal for the managed identity. +Go to **Applications**, and then select **Enterprise applications**. This pane displays all the service principals in your tenant. **Add a filter** for "Application type == Managed Identities" and select the service principal for the managed identity. If you're following this tutorial, there are two service principals with the same display name (SecureWebApp2020094113531, for example). The service principal that has a **Homepage URL** represents the web app in your tenant. The service principal that appears in **Managed Identities** should *not* have a **Homepage URL** listed and the **Object ID** should match the object ID value of the managed identity in the [previous step](#enable-managed-identity-on-app). |
| active-directory | Multi Service Web App Access Microsoft Graph As User | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/multi-service-web-app-access-microsoft-graph-as-user.md | In this tutorial, you learn how to: Now that you've enabled authentication and authorization on your web app, the web app is registered with the Microsoft identity platform and is backed by an Azure AD application. In this step, you give the web app permissions to access Microsoft Graph for the user. (Technically, you give the web app's Azure AD application the permissions to access the Microsoft Graph Azure AD application for the user.) -In the [Azure portal](https://portal.azure.com) menu, select **Azure Active Directory** or search for and select **Azure Active Directory** from any page. +In the [Microsoft Entra admin center](https://entra.microsoft.com) menu, select **Applications**. Select **App registrations** > **Owned applications** > **View all applications in this directory**. Select your web app name, and then select **API permissions**. public class Startup ### appsettings.json -*AzureAd* specifies the configuration for the Microsoft.Identity.Web library. In the [Azure portal](https://portal.azure.com), select **Azure Active Directory** from the portal menu and then select **App registrations**. Select the app registration created when you enabled the App Service authentication/authorization module. (The app registration should have the same name as your web app.) You can find the tenant ID and client ID in the app registration overview page. The domain name can be found in the Azure AD overview page for your tenant. +*AzureAd* specifies the configuration for the Microsoft.Identity.Web library. In the [Microsoft Entra admin center](https://entra.microsoft.com), select **Applications** from the portal menu and then select **App registrations**. Select the app registration created when you enabled the App Service authentication/authorization module. (The app registration should have the same name as your web app.) You can find the tenant ID and client ID in the app registration overview page. The domain name can be found in the Azure AD overview page for your tenant. *Graph* specifies the Microsoft Graph endpoint and the initial scopes needed by the app. public class Startup "AzureAd": { "Instance": "https://login.microsoftonline.com/", "Domain": "[Enter the domain of your tenant, e.g. contoso.onmicrosoft.com]",- "TenantId": "[Enter 'common', or 'organizations' or the Tenant Id (Obtained from the Azure portal. Select 'Endpoints' from the 'App registrations' blade and use the GUID in any of the URLs), e.g. da41245a5-11b3-996c-00a8-4d99re19f292]", - "ClientId": "[Enter the Client Id (Application ID obtained from the Azure portal), e.g. ba74781c2-53c2-442a-97c2-3d60re42f403]", - "ClientSecret": "[Copy the client secret added to the app from the Azure portal]", + "TenantId": "[Enter 'common', or 'organizations' or the Tenant Id (Obtained from the Entra admin center. Select 'Endpoints' from the 'App registrations' blade and use the GUID in any of the URLs), e.g. da41245a5-11b3-996c-00a8-4d99re19f292]", + "ClientId": "[Enter the Client Id (Application ID obtained from the Microsoft Entra admin center), e.g. ba74781c2-53c2-442a-97c2-3d60re42f403]", + "ClientSecret": "[Copy the client secret added to the app from the Microsoft Entra admin center]", "ClientCertificates": [ ], // the following is required to handle Continuous Access Evaluation challenges |
| active-directory | Quickstart Configure App Access Web Apis | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-configure-app-access-web-apis.md | This diagram shows how the two app registrations relate to one another. In this Once you've registered both your client app and web API and you've exposed the API by creating scopes, you can configure the client's permissions to the API by following these steps: -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration.-1. Select **Azure Active Directory** > **App registrations**, and then select your client application (*not* your web API). +1. Browse to **Identity** > **Applications** > **App registrations**, and then select your client application (*not* your web API). 1. Select **API permissions** > **Add a permission** > **My APIs**. 1. Select the web API you registered as part of the prerequisites. In addition to accessing your own web API on behalf of the signed-in user, your Configure delegated permission to Microsoft Graph to enable your client application to perform operations on behalf of the logged-in user, for example reading their email or modifying their profile. By default, users of your client app are asked when they sign in to consent to the delegated permissions you've configured for it. -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration.-1. Select **Azure Active Directory** > **App registrations**, and then select your client application. +1. Browse to **Identity** > **Applications** > **App registrations**, and then select your client application. 1. Select **API permissions** > **Add a permission** > **Microsoft Graph** 1. Select **Delegated permissions**. Microsoft Graph exposes many permissions, with the most commonly used shown at the top of the list. 1. Under **Select permissions**, select the following permissions: Configure application permissions for an application that needs to authenticate In the following steps, you grant permission to Microsoft Graph's *Files.Read.All* permission as an example. -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration.-1. Select **Azure Active Directory** > **App registrations**, and then select your client application. +1. Browse to **Identity** > **Applications** > **App registrations**, and then select your client application. 1. Select **API permissions** > **Add a permission** > **Microsoft Graph** > **Application permissions**. 1. All permissions exposed by Microsoft Graph are shown under **Select permissions**. 1. Select the permission or permissions you want to grant your application. As an example, you might have a daemon app that scans files in your organization, alerting on a specific file type or name. |
| active-directory | Quickstart Console App Netcore Acquire Token | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-console-app-netcore-acquire-token.md | The application can be built using either an automatic or manual configuration. To register and automatically configure the app and then download the code sample, follow these steps: -1. Go to the [Azure portal page for app registration](https://portal.azure.com/?Microsoft_AAD_RegisteredApps=true#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/DotNetCoreDaemonQuickstartPage/sourceType/docs). ++1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. Enter a name for your application and select **Register**. 1. Follow the instructions to download and automatically configure your new application in one click. To manually configure your application and code sample, use the following proced To register the application and add the registration information to the solution manually, follow these steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which to register the application. -1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. For **Name**, enter a name for the application. For example, enter **Daemon-console**. Users of the app will see this name, and can be changed later. 1. Select **Register** to create the application. 1. Under **Manage**, select **Certificates & secrets**. This project can be run in either Visual Studio or Visual Studio for Mac and can 1. Extract the *.zip* file to a local folder that's close to the root of the disk to avoid errors caused by path length limitations on Windows. For example, extract to *C:\Azure-Samples*. 1. Open the solution in Visual Studio: *1-Call-MSGraph\daemon-console.sln* (optional).-1. In *appsettings.json*, replace the values of `Tenant`, `ClientId`, and `ClientSecret`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Azure portal. +1. In *appsettings.json*, replace the values of `Tenant`, `ClientId`, and `ClientSecret`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Microsoft Entra admin center. ```json "TenantId": "Enter_the_Tenant_Id_Here", Running the application now results in the output `HTTP 403 - Forbidden* error: ##### Global tenant administrator -For a global tenant administrator, go to **Enterprise applications** in the Azure portal. Select the app registration, and select **Permissions** from the **Security** section of the left pane. Then select the large button labeled **Grant admin consent for {Tenant Name}** (where **{Tenant Name}** is the name of the directory). +For a global tenant administrator, go to **Enterprise applications** in the Microsoft Entra admin center. Select the app registration, and select **Permissions** from the **Security** section of the left pane. Then select the large button labeled **Grant admin consent for {Tenant Name}** (where **{Tenant Name}** is the name of the directory). ##### Standard user This code uses the configuration defined in the appsettings.json file: | Element | Description | |||- | `ClientSecret` | The client secret created for the application in the Azure portal. | - | `ClientId` | The application (client) ID for the application registered in the Azure portal. This value can be found on the app's **Overview** page in the Azure portal. | + | `ClientSecret` | The client secret created for the application in the Microsoft Entra admin center. | + | `ClientId` | The application (client) ID for the application registered in the Microsoft Entra admin center. This value can be found on the app's **Overview** page in the Microsoft Entra admin center. | | `Instance` | (Optional) The security token service (STS) could instance endpoint for the app to authenticate. It's usually `https://login.microsoftonline.com/` for the public cloud.| | `TenantId` | Name of the tenant or the tenant ID.| |
| active-directory | Quickstart Daemon App Python Acquire Token | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-daemon-app-python-acquire-token.md | To run this sample, you need: To register your application and add the app's registration information to your solution manually, follow these steps: -1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.-1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Browse to **Identity** > **Applications** > **App registrations**, select **New registration**. 1. Enter a **Name** for your application, for example `Daemon-console`. Users of your app might see this name, and you can change it later. 1. Select **Register**. 1. Under **Manage**, select **Certificates & secrets**. To register your application and add the app's registration information to your - `Enter_the_Client_Secret_Here` - replace this value with the client secret created on step 1. > [!TIP]-> To find the values of **Application (client) ID**, **Directory (tenant) ID**, go to the app's **Overview** page in the Azure portal. To generate a new key, go to **Certificates & secrets** page. +> To find the values of **Application (client) ID**, **Directory (tenant) ID**, go to the app's **Overview** page in the Microsoft Entra admin center. To generate a new key, go to **Certificates & secrets** page. #### Step 4: Admin consent If you try to run the application at this point, you'll receive *HTTP 403 - Forb ##### Global tenant administrator -If you're a global tenant administrator, go to **API Permissions** page in **App registrations** in the Azure portal and select **Grant admin consent for {Tenant Name}** (Where {Tenant Name} is the name of your directory). +If you're a global tenant administrator, go to **API Permissions** page in **App registrations** in the Microsoft Entra admin center and select **Grant admin consent for {Tenant Name}** (Where {Tenant Name} is the name of your directory). ##### Standard user app = msal.ConfidentialClientApplication( | Where: |Description | |||-| `config["secret"]` | Is the client secret created for the application in Azure portal. | -| `config["client_id"]` | Is the **Application (client) ID** for the application registered in the Azure portal. You can find this value in the app's **Overview** page in the Azure portal. | +| `config["secret"]` | Is the client secret created for the application in Microsoft Entra admin center. | +| `config["client_id"]` | Is the **Application (client) ID** for the application registered in the Microsoft Entra admin center. You can find this value in the app's **Overview** page in the Microsoft Entra admin center. | | `config["authority"]` | The STS endpoint for user to authenticate. Usually `https://login.microsoftonline.com/{tenant}` for public cloud, where {tenant} is the name of your tenant or your tenant ID.| For more information, please see the [reference documentation for `ConfidentialClientApplication`](https://msal-python.readthedocs.io/en/latest/#confidentialclientapplication). if not result: |Where:| Description | |||-| `config["scope"]` | Contains the scopes requested. For confidential clients, this should use the format similar to `{Application ID URI}/.default` to indicate that the scopes being requested are the ones statically defined in the app object set in the Azure portal (for Microsoft Graph, `{Application ID URI}` points to `https://graph.microsoft.com`). For custom web APIs, `{Application ID URI}` is defined under the **Expose an API** section in **App registrations** in the Azure portal.| +| `config["scope"]` | Contains the scopes requested. For confidential clients, this should use the format similar to `{Application ID URI}/.default` to indicate that the scopes being requested are the ones statically defined in the app object set in the Microsoft Entra admin center (for Microsoft Graph, `{Application ID URI}` points to `https://graph.microsoft.com`). For custom web APIs, `{Application ID URI}` is defined under the **Expose an API** section in **App registrations** in the Microsoft Entra admin center.| For more information, please see the [reference documentation for `AcquireTokenForClient`](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.acquire_token_for_client). |
| active-directory | Quickstart Desktop App Nodejs Electron Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-desktop-app-nodejs-electron-sign-in.md | Follow the steps below to get started. To register your application and add the app's registration information to your solution manually, follow these steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application. -1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. Enter a **Name** for your application, for example `msal-node-desktop`. Users of your app might see this name, and you can change it later. 1. Select **Register** to create the application. 1. Under **Manage**, select **Authentication**. |
| active-directory | Quickstart Desktop App Uwp Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-desktop-app-uwp-sign-in.md | You have two options to start your quickstart application: ### Option 1: Register and auto configure your app and then download your code sample -1. Go to the [Azure portal - App registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/UwpQuickstartPage/sourceType/docs) quickstart experience. +1. Go to the [AMicrosoft Entra admin center - App registrations](https://entra.microsoft.com/#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/UwpQuickstartPage/sourceType/docs) quickstart experience. 1. Enter a name for your application and select **Register**. 1. Follow the instructions to download and automatically configure your new application. You have two options to start your quickstart application: [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] To register your application and add the app's registration information to your solution, follow these steps:-1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.-1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Browse to **Identity** > **Applications** > **App registrations**, select **New registration**. 1. Enter a **Name** for your application, for example `UWP-App-calling-MsGraph`. Users of your app might see this name, and you can change it later. 1. In the **Supported account types** section, select **Accounts in any organizational directory and personal Microsoft accounts (for example, Skype, Xbox, Outlook.com)**. 1. Select **Register** to create the application, and then record the **Application (client) ID** for use in a later step. To register your application and add the app's registration information to your private const string ClientId = "Enter_the_Application_Id_here"; ``` - You can find the **Application (client) ID** on the app's **Overview** pane in the Azure portal (**Azure Active Directory** > **App registrations** > *{Your app registration}*). + You can find the **Application (client) ID** on the app's **Overview** pane in the Microsoft Entra admin center (**Identity** > **Applications** > **App registrations** > *{Your app registration}*). 1. Create and then select a new self-signed test certificate for the package: 1. In the **Solution Explorer**, double-click the *Package.appxmanifest* file. 1. Select **Packaging** > **Choose Certificate...** > **Create...**. PublicClientApp = PublicClientApplicationBuilder.Create(ClientId) .Build(); ``` -The value of `ClientId` is the **Application (client) ID** of the app you registered in the Azure portal. You can find this value in the app's **Overview** page in the Azure portal. +The value of `ClientId` is the **Application (client) ID** of the app you registered in the Microsoft Entra admin center. You can find this value in the app's **Overview** page in the Microsoft Entra admin center. ### Requesting tokens |
| active-directory | Quickstart Desktop App Wpf Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-desktop-app-wpf-sign-in.md | You have two options to start your quickstart application: ### Option 1: Register and auto configure your app and then download your code sample -1. Go to the [Azure portal - App registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/WinDesktopQuickstartPage/sourceType/docs)quickstart experience. +1. Go to the [Microsoft Entra admin center - App registrations](https://entra.microsoft.com/#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/WinDesktopQuickstartPage/sourceType/docs)quickstart experience. 1. Enter a name for your application and select **Register**. 1. Follow the instructions to download and automatically configure your new application with just one click. You have two options to start your quickstart application: To register your application and add the app's registration information to your solution manually, follow these steps: -1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.-1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Browse to **Identity** > **Applications** > **App registrations**, select **New registration**. 1. Enter a **Name** for your application, for example `Win-App-calling-MsGraph`. Users of your app might see this name, and you can change it later. 1. In the **Supported account types** section, select **Accounts in any organizational directory and personal Microsoft accounts (for example, Skype, Xbox, Outlook.com)**. 1. Select **Register** to create the application. To register your application and add the app's registration information to your Where: - `Enter_the_Application_Id_here` - is the **Application (client) ID** for the application you registered. - To find the value of **Application (client) ID**, go to the app's **Overview** page in the Azure portal. + To find the value of **Application (client) ID**, go to the app's **Overview** page in the Microsoft Entra admin center. - `Enter_the_Tenant_Info_Here` - is set to one of the following options: - If your application supports **Accounts in this organizational directory**, replace this value with the **Tenant Id** or **Tenant name** (for example, contoso.microsoft.com) - If your application supports **Accounts in any organizational directory**, replace this value with `organizations` - If your application supports **Accounts in any organizational directory and personal Microsoft accounts**, replace this value with `common`. - To find the values of **Directory (tenant) ID** and **Supported account types**, go to the app's **Overview** page in the Azure portal. + To find the values of **Directory (tenant) ID** and **Supported account types**, go to the app's **Overview** page in the Microsoft Entra admin center. #### Step 4: Run the application IPublicClientApplication publicClientApp = PublicClientApplicationBuilder.Create |Where: | Description | |||-| `ClientId` | Is the **Application (client) ID** for the application registered in the Azure portal. You can find this value in the app's **Overview** page in the Azure portal. | +| `ClientId` | Is the **Application (client) ID** for the application registered in the Microsoft Entra admin center. You can find this value in the app's **Overview** page in the Microsoft Entra admin center. | ### Requesting tokens |
| active-directory | Quickstart Mobile App Android Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-mobile-app-android-sign-in.md | private void callGraphAPI(final IAuthenticationResult authenticationResult) { This is the configuration file for a MSAL app that uses a single account. -See [Understand the Android MSAL configuration file ](msal-configuration.md) for an explanation of these fields. +See [Understand the Android MSAL configuration file](msal-configuration.md) for an explanation of these fields. Note the presence of `"account_mode" : "SINGLE"`, which configures this app to use a single account. mMultipleAccountApp.removeAccount(accountList.get(accountListSpinner.getSelected This is the configuration file for a MSAL app that uses multiple accounts. -See [Understand the Android MSAL configuration file ](msal-configuration.md) for an explanation of the various fields. +See [Understand the Android MSAL configuration file](msal-configuration.md) for an explanation of the various fields. Unlike the [auth_config_single_account.json](#auth_config_single_accountjson) configuration file, this config file has `"account_mode" : "MULTIPLE"` instead of `"account_mode" : "SINGLE"` because this is a multiple account app. |
| active-directory | Quickstart V2 Android | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-v2-android.md | -> See [Understand the Android MSAL configuration file ](msal-configuration.md) for an explanation of these fields. +> See [Understand the Android MSAL configuration file](msal-configuration.md) for an explanation of these fields. > > Note the presence of `"account_mode" : "SINGLE"`, which configures this app to use a single account. > -> See [Understand the Android MSAL configuration file ](msal-configuration.md) for an explanation of the various fields. +> See [Understand the Android MSAL configuration file](msal-configuration.md) for an explanation of the various fields. > > Unlike the [auth_config_single_account.json](#auth_config_single_accountjson) configuration file, this config file has `"account_mode" : "MULTIPLE"` instead of `"account_mode" : "SINGLE"` because this is a multiple account app. > |
| active-directory | Quickstart Web Api Aspnet Core Protect Api | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-web-api-aspnet-core-protect-api.md | The following quickstart uses a ASP.NET Core web API code sample to demonstrate First, register the web API in your Azure AD tenant and add a scope by following these steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which to register the application. -1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. For **Name**, enter a name for the application. For example, enter **AspNetCoreWebApi-Quickstart**. Users of the app will see this name, and can be changed later. 1. Select **Register**. 1. Under **Manage**, select **Expose an API** > **Add a scope**. For **Application ID URI**, accept the default by selecting **Save and continue**, and then enter the following details: In this step, the sample code will be configured to work with the app registrati 1. Extract the *.zip* file to a local folder that's close to the root of the disk to avoid errors caused by path length limitations on Windows. For example, extract to *C:\Azure-Samples*. 1. Open the solution in the *webapp* folder in your code editor.-1. In *appsettings.json*, replace the values of `ClientId`, and `TenantId`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Azure portal. +1. In *appsettings.json*, replace the values of `ClientId`, and `TenantId`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Microsoft Entra admin center. ```json "ClientId": "Enter_the_Application_Id_here", The line that contains `.AddMicrosoftIdentityWebApi` adds the Microsoft identity | *appsettings.json* key | Description | ||-|-| `ClientId` | Application (client) ID of the application registered in the Azure portal. | +| `ClientId` | Application (client) ID of the application registered in the Microsoft Entra admin center. | | `Instance` | Security token service (STS) endpoint for the user to authenticate. This value is typically `https://login.microsoftonline.com/`, indicating the Azure public cloud. | | `TenantId` | Name of the tenant or its tenant ID (a GUID), or `common` to sign in users with work or school accounts or Microsoft personal accounts. | |
| active-directory | Quickstart Web Api Aspnet Protect Api | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-web-api-aspnet-protect-api.md | The code sample can be obtained in two ways: Register your web API in **App registrations** in the Azure portal. -1. Sign in to the [Azure portal](https://portal.azure.com). -1. If you have access to multiple tenants, use the **Directory + subscription** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant in which you want to register an application. -1. Find and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. Enter a **Name** for your application, for example `AppModelv2-NativeClient-DotNet-TodoListService`. Users of your app might see this name, and you can change it later. 1. For **Supported account types**, select **Accounts in any organizational directory**. 1. Select **Register** to create the application. Register your TodoListClient app in **App registrations** in the Azure portal, a To register the TodoListClient app, follow these steps: -1. Go to the Microsoft identity platform for developers [App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) portal. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. Select **New registration**. 1. When the **Register an application page** opens, enter your application's registration information: |
| active-directory | Quickstart Web App Aspnet Core Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-web-app-aspnet-core-sign-in.md | In this article you register a web application in the Microsoft Entra admin cent ## Register the application in the Microsoft Entra admin center ++1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. +1. For **Name**, enter a name for the application. For example, enter **AspNetCore-Quickstart**. Users of the app will see this name, and can be changed later. +1. Set the **Redirect URI** type to **Web** and value to `https://localhost:44321/signin-oidc`. +1. Select **Register**. +1. Under **Manage**, select **Authentication**. +1. For **Front-channel logout URL**, enter **https://localhost:44321/signout-oidc**. +1. Under **Implicit grant and hybrid flows**, select **ID tokens**. +1. Select **Save**. +1. Under **Manage**, select **Certificates & secrets** > **Client secrets** > **New client secret**. +1. Enter a **Description**, for example `clientsecret1`. +1. Select **In 1 year** for the secret's expiration. +1. Select **Add** and immediately record the secret's **Value** for use in a later step. The secret value is *never displayed again* and is irretrievable by any other means. Record it in a secure location as you would any password. ++### Download the ASP.NET Core project ++[Download the ASP.NET Core solution](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/archive/aspnetcore3-1-callsgraph.zip) ++### Configure your ASP.NET Core project ++1. Extract the *.zip* file to a local folder that's close to the root of the disk to avoid errors caused by path length limitations on Windows. For example, extract to *C:\Azure-Samples*. +1. Open the solution in the chosen code editor. +1. In *appsettings.json*, replace the values of `ClientId`, and `TenantId`. The value for the application (client) ID and the directory (tenant) ID, can be found in the app's **Overview** page on the Microsoft Entra admin center. ++ ```json + "Domain": "[Enter the domain of your tenant, e.g. contoso.onmicrosoft.com]", + "ClientId": "Enter_the_Application_Id_here", + "TenantId": "common", + ``` ++ - `Enter_the_Application_Id_Here` is the application (client) ID for the registered application. + - Replace `Enter_the_Tenant_Info_Here` with one of the following: + - If the application supports **Accounts in this organizational directory only**, replace this value with the directory (tenant) ID (a GUID) or tenant name (for example, `contoso.onmicrosoft.com`). The directory (tenant) ID can be found on the app's **Overview** page. + - If the application supports **Accounts in any organizational directory**, replace this value with `organizations`. + - If the application supports **All Microsoft account users**, leave this value as `common`. + - Replace `Enter_the_Client_Secret_Here` with the **Client secret** that was created and recorded in an earlier step. ++For this quickstart, don't change any other values in the *appsettings.json* file. + +### Build and run the application + 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least an [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). 1. Browse to **Identity** > **Applications** > **App registrations**. 1. On the page that appears, select **+ New registration**. To obtain the sample application, you can either clone it from GitHub or downloa dotnet dev-certs https -ep ./certificate.crt --trust ``` ++ | *appsettings.json* key | Description | + ||-| + | `ClientId` | Application (client) ID of the application registered in the Microsoft Entra admin center. | + | `Instance` | Security token service (STS) endpoint for the user to authenticate. This value is typically `https://login.microsoftonline.com/`, indicating the Azure public cloud. | + | `TenantId` | Name of your tenant or the tenant ID (a GUID), or `common` to sign in users with work or school accounts or Microsoft personal accounts. | + 1. Return to the Microsoft Entra admin center, and under **Manage**, select **Certificates & secrets** > **Upload certificate**. 1. Select the **Certificates (0)** tab, then select **Upload certificate**. 1. An **Upload certificate** pane appears. Use the icon to navigate to the certificate file you created in the previous step, and select **Open**. 1. Enter a description for the certificate, for example *Certificate for aspnet-web-app*, and select **Add**. 1. Record the **Thumbprint** value for use in the next step. + ## Configure the project 1. In your IDE, open the project folder, *ms-identity-docs-code-dotnet\web-app-aspnet*, containing the sample. |
| active-directory | Quickstart Web App Aspnet Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-web-app-aspnet-sign-in.md | You have two options to start building your application: automatic or manual con If you want to automatically configure your app and then download the code sample, follow these steps: -1. Go to the [Azure portal - App registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade/quickStartType/AngularSpaQuickstartPage/sourceType/docs) quickstart experience. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade/quickStartType/AngularSpaQuickstartPage/sourceType/docs) quickstart experience as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). 1. Enter a name for your application and select **Register**. 1. Follow the instructions to download and automatically configure your new application in one click. If you want to manually configure your application and code sample, use the foll #### Step 1: Register your application -1. Sign in to the [Azure portal](https://portal.azure.com). -1. If you have access to multiple tenants, use the **Directory + subscription** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application. -1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. For **Name**, enter a name for your application. For example, enter **ASPNET-Quickstart**. Users of your app will see this name, and you can change it later. 1. Set the **Redirect URI** type to **Web** and value to `https://localhost:44368/`. 1. Select **Register**. If you want to manually configure your application and code sample, use the foll ``` In that code: - - `Enter_the_Application_Id_here` is the application (client) ID of the app registration that you created earlier. Find the application (client) ID on the app's **Overview** page in **App registrations** in the Azure portal. + - `Enter_the_Application_Id_here` is the application (client) ID of the app registration that you created earlier. Find the application (client) ID on the app's **Overview** page in **App registrations** in the Microsoft Entra admin center. - `Enter_the_Tenant_Info_Here` is one of the following options:- - If your application supports **My organization only**, replace this value with the directory (tenant) ID or tenant name (for example, `contoso.onmicrosoft.com`). Find the directory (tenant) ID on the app's **Overview** page in **App registrations** in the Azure portal. + - If your application supports **My organization only**, replace this value with the directory (tenant) ID or tenant name (for example, `contoso.onmicrosoft.com`). Find the directory (tenant) ID on the app's **Overview** page in **App registrations** in the Microsoft Entra admin center. - If your application supports **Accounts in any organizational directory**, replace this value with `organizations`. - If your application supports **All Microsoft account users**, replace this value with `common`.- - `redirectUri` is the **Redirect URI** you entered earlier in **App registrations** in the Azure portal. + - `redirectUri` is the **Redirect URI** you entered earlier in **App registrations** in the Microsoft Entra admin center. ## More information |
| active-directory | Quickstart Web App Java Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-web-app-java-sign-in.md | There are two ways to start your quickstart application: express (option 1) and ### Option 1: Register and automatically configure your app, and then download the code sample -1. Go to the [Azure portal - App registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade/quickStartType/AngularSpaQuickstartPage/sourceType/docs) quickstart experience. +1. Go to the [Microsoft Entra admin center - App registrations](https://entra.microsoft.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade/quickStartType/AngularSpaQuickstartPage/sourceType/docs) quickstart experience as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). 1. Enter a name for your application, and then select **Register**. 1. Follow the instructions in the portal's quickstart experience to download the automatically configured application code. There are two ways to start your quickstart application: express (option 1) and To register your application and manually add the app's registration information to it, follow these steps: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application. -1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations**. -1. Select **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. Enter a **Name** for your application, for example **java-webapp**. Users of your app might see this name. You can change it later. 1. Select **Register**. 1. On the **Overview** page, note the **Application (client) ID** and the **Directory (tenant) ID**. You'll need these values later. |
| active-directory | Quickstart Web App Nodejs Msal Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-web-app-nodejs-msal-sign-in.md | This quickstart uses the Microsoft Authentication Library for Node.js (MSAL Node [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -1. Sign in to the [Azure portal](https://portal.azure.com/). -1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. Enter a **Name** for your application. Users of your app might see this name, and you can change it later. 1. Under **Supported account types**, select **Accounts in this organizational directory only**. 1. Set the **Redirect URI** type to **Web** and value to `http://localhost:3000/auth/redirect`. |
| active-directory | Quickstart Web App Python Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/quickstart-web-app-python-sign-in.md | The following diagram displays how the sample app works: [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -Follow these steps to register your application in the Azure portal: +Follow these steps to register your application in the Microsoft Entra admin center: -1. Sign in to the [Azure portal](https://portal.azure.com/). -1. If you have access to multiple tenants, use the **Directory + subscription** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant in which you want to register an application. -1. Navigate to the portal's [App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page, and select **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/quickstart-configure-app-access-web-apis/portal-01-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant containing your client app's registration. +1. Browse to **Identity** > **Applications** > **App registrations** and select **New registration**. 1. Enter a **Name** for your application, for example *python-webapp*. 1. Under **Supported account types**, select **Accounts in any organizational directory and personal Microsoft accounts**. 1. Under **Redirect URIs**, select **Web** for the platform. |
| active-directory | Reference Error Codes | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/reference-error-codes.md | The `error` field has several possible values - review the protocol documentatio | AADSTS16000 | SelectUserAccount - This is an interrupt thrown by Azure AD, which results in UI that allows the user to select from among multiple valid SSO sessions. This error is fairly common and may be returned to the application if `prompt=none` is specified. | | AADSTS16001 | UserAccountSelectionInvalid - You'll see this error if the user selects on a tile that the session select logic has rejected. When triggered, this error allows the user to recover by picking from an updated list of tiles/sessions, or by choosing another account. This error can occur because of a code defect or race condition. | | AADSTS16002 | AppSessionSelectionInvalid - The app-specified SID requirement wasn't met. |+| AADSTS160021| AppSessionSelectionInvalidSessionNotExist - Application requested a user session which does not exist. | | AADSTS16003 | SsoUserAccountNotFoundInResourceTenant - Indicates that the user hasn't been explicitly added to the tenant. | | AADSTS17003 | CredentialKeyProvisioningFailed - Azure AD can't provision the user key. | | AADSTS20001 | WsFedSignInResponseError - There's an issue with your federated Identity Provider. Contact your IDP to resolve this issue. | |
| active-directory | Saml Protocol Reference | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/saml-protocol-reference.md | The SAML protocol requires the identity provider (Microsoft identity platform) a When an application is registered with Azure AD, the app developer registers federation-related information with Azure AD. This information includes the **Redirect URI** and **Metadata URI** of the application. -The Microsoft identity platform uses the cloud service's **Metadata URI** to retrieve the signing key and the logout URI. This way the Microsoft identity platform can send the response to the correct URL. In the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>; +The Microsoft identity platform uses the cloud service's **Metadata URI** to retrieve the signing key and the logout URI. This way the Microsoft identity platform can send the response to the correct URL. In the <a href="https://entra.microsoft.com/" target="_blank">Microsoft Entra admin center</a>; - Open the app in **Azure Active Directory** and select **App registrations** - Under **Manage**, select **Authentication**. From there you can update the Logout URL. |
| active-directory | Scenario Daemon App Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/scenario-daemon-app-configuration.md | When you build a confidential client with certificates, the [parameters.json](ht } ``` -# [.NET (low level) ](#tab/dotnet) +# [.NET (low level)](#tab/dotnet) Here's an example of defining the configuration in an [*appsettings.json*](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2/blob/master/1-Call-MSGraph/daemon-console/appsettings.json) file. This example is taken from the [.NET Core console daemon](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2) code sample on GitHub. |
| active-directory | Scenario Desktop App Registration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/scenario-desktop-app-registration.md | If your desktop application uses interactive authentication, you can sign in use The redirect URIs to use in a desktop application depend on the flow you want to use. -Specify the redirect URI for your app by [configuring the platform settings](quickstart-register-app.md#add-a-redirect-uri) for the app in **App registrations** in the Azure portal. +Specify the redirect URI for your app by [configuring the platform settings](quickstart-register-app.md#add-a-redirect-uri) for the app in **App registrations** in the Microsoft Entra admin center. - For apps that use [Web Authentication Manager (WAM)](scenario-desktop-acquire-token-wam.md), redirect URIs need not be configured in MSAL, but they must be configured in the [app registration](scenario-desktop-acquire-token-wam.md#redirect-uri). Specify the redirect URI for your app by [configuring the platform settings](qui - If your app uses only integrated Windows authentication or a username and a password, you don't need to register a redirect URI for your application. These flows do a round trip to the Microsoft identity platform v2.0 endpoint. Your application won't be called back on any specific URI. - To distinguish [device code flow](scenario-desktop-acquire-token-device-code-flow.md), [integrated Windows authentication](scenario-desktop-acquire-token-integrated-windows-authentication.md), and a [username and a password](scenario-desktop-acquire-token-username-password.md) from a confidential client application using a client credential flow used in [daemon applications](scenario-daemon-overview.md), none of which requires a redirect URI, configure it as a public client application. To achieve this configuration: - 1. In the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>, select your app in **App registrations**, and then select **Authentication**. + 1. In the <a href="https://entra.microsoft.com/" target="_blank">Microsoft Entra admin center</a>, select your app in **App registrations**, and then select **Authentication**. 1. In **Advanced settings** > **Allow public client flows** > **Enable the following mobile and desktop flows:**, select **Yes**. :::image type="content" source="media/scenarios/default-client-type.png" alt-text="Enable public client setting on Authentication pane in Azure portal"::: |
| active-directory | Scenario Spa App Registration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/scenario-spa-app-registration.md | To register a single-page application (SPA) in the Microsoft identity platform, For both MSAL.js 1.0- and 2.0-based applications, start by completing the following steps to create the initial app registration. -1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>. -1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to select the tenant in which you want to register an application. -1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations** > **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). +1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which to register the application. +1. Browse to **Identity** > **Applications** > **App registrations**, select **New registration**. 1. Enter a **Name** for your application. Users of your app might see this name, and you can change it later. 1. Choose the **Supported account types** for the application. Do **NOT** enter a **Redirect URI**. For a description of the different account types, see the [Register an application](quickstart-register-app.md). 1. Select **Register** to create the app registration. Next, configure the app registration with a **Redirect URI** to specify where th Follow these steps to add a redirect URI for an app that uses MSAL.js 2.0 or later. MSAL.js 2.0+ supports the authorization code flow with PKCE and CORS in response to [browser third party cookie restrictions](reference-third-party-cookies-spas.md). The implicit grant flow is not supported in MSAL.js 2.0+. -1. In the Azure portal, select the app registration you created earlier in [Create the app registration](#create-the-app-registration). +1. In the Microsoft Entra admin center, select the app registration you created earlier in [Create the app registration](#create-the-app-registration). 1. Under **Manage**, select **Authentication** > **Add a platform**. 1. Under **Web applications**, select the **Single-page application** tile. 1. Under **Redirect URIs**, enter a [redirect URI](reply-url.md). Do **NOT** select either checkbox under **Implicit grant and hybrid flows**. Follow the [tutorial](tutorial-v2-javascript-auth-code.md) for further guidance. Follow these steps to add a redirect URI for a single-page app that uses MSAL.js 1.3 or earlier and the implicit grant flow. Applications that use MSAL.js 1.3 or earlier do not support the auth code flow. -1. In the Azure portal, select the app registration you created earlier in [Create the app registration](#create-the-app-registration). +1. In the Microsoft Entra admin center, select the app registration you created earlier in [Create the app registration](#create-the-app-registration). 1. Under **Manage**, select **Authentication** > **Add a platform**. 1. Under **Web applications**, select **Single-page application** tile. 1. Under **Redirect URIs**, enter a [redirect URI](reply-url.md). By default, an app registration created by using single-page application platfor As mentioned previously, single-page applications using MSAL.js 1.3 are restricted to the implicit grant flow. Current [OAuth 2.0 best practices](v2-oauth2-auth-code-flow.md) recommend using the authorization code flow rather than the implicit flow for SPAs. Having limited-lifetime refresh tokens also helps your application adapt to [modern browser cookie privacy limitations](reference-third-party-cookies-spas.md), like Safari ITP. -When all your production single-page applications represented by an app registration are using MSAL.js 2.0 and the authorization code flow, uncheck the implicit grant settings on the app registration's **Authentication** pane in the Azure portal. Applications using MSAL.js 1.x and the implicit flow can continue to function, however, if you leave the implicit flow enabled (checked). +When all your production single-page applications represented by an app registration are using MSAL.js 2.0 and the authorization code flow, uncheck the implicit grant settings on the app registration's **Authentication** pane in the Microsoft Entra admin center. Applications using MSAL.js 1.x and the implicit flow can continue to function, however, if you leave the implicit flow enabled (checked). ## Next steps |
| active-directory | Single Page App Tutorial 01 Register App | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/single-page-app-tutorial-01-register-app.md | Last updated 02/27/2023 # Tutorial: Register a Single-page application with the Microsoft identity platform -To interact with the Microsoft identity platform, Azure Active Directory (Azure AD) must be made aware of the application you create. This tutorial shows you how to register a single-page application (SPA) in a tenant on the Azure portal. +To interact with the Microsoft identity platform, Azure Active Directory (Azure AD) must be made aware of the application you create. This tutorial shows you how to register a single-page application (SPA) in a tenant on the Microsoft Entra admin center. In this tutorial: In this tutorial: To complete registration, provide the application a name, specify the supported account types, and add a redirect URI. Once registered, the application **Overview** pane displays the identifiers needed in the application source code. -1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which to register the application.-1. Search for and select **Azure Active Directory**. -1. Under **Manage**, select **App registrations > New registration**. +1. Browse to **Identity** > **Applications** > **App registrations**, select **New registration**. 1. Enter a **Name** for the application, such as *NewSPA1*. 1. For **Supported account types**, select **Accounts in this organizational directory only**. For information on different account types, select the **Help me choose** option. 1. Under **Redirect URI (optional)**, use the drop-down menu to select **Single-page-application (SPA)** and enter `http://localhost:3000` into the text box. |
| active-directory | Single Page App Tutorial 02 Prepare Spa | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/single-page-app-tutorial-02-prepare-spa.md | To learn more about these packages refer to the documentation in [msal-browser]( :::code language="javascript" source="~/ms-identity-docs-code-javascript/react-spa/src/authConfig.js" ::: -1. Replace the following values with the values from the Azure portal. +1. Replace the following values with the values from the Microsoft Entra admin center. - `clientId` - The identifier of the application, also referred to as the client. Replace `Enter_the_Application_Id_Here` with the **Application (client) ID** value that was recorded earlier from the overview page of the registered application. - `authority` - This is composed of two parts: - The *Instance* is endpoint of the cloud provider. Check with the different available endpoints in [National clouds](authentication-national-cloud.md#azure-ad-authentication-endpoints). To learn more about these packages refer to the documentation in [msal-browser]( :::code language="javascript" source="~/ms-identity-docs-code-javascript/react-spa/src/authConfig.js" ::: -1. Replace the following values with the values from the Azure portal. +1. Replace the following values with the values from the Microsoft Entra admin center. - `clientId` - The identifier of the application, also referred to as the client. Replace `Enter_the_Application_Id_Here` with the **Application (client) ID** value that was recorded earlier from the overview page of the registered application. - `authority` - This is composed of two parts: - The *Instance* is endpoint of the cloud provider. Check with the different available endpoints in [National clouds](authentication-national-cloud.md#azure-ad-authentication-endpoints). |
| active-directory | Test Automate Integration Testing | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/test-automate-integration-testing.md | We recommend you securely store the test usernames and passwords as [secrets](.. Create some test users in your tenant for testing. Since the test users are not actual humans, we recommend you assign complex passwords and securely store these passwords as [secrets](../../key-vault/secrets/about-secrets.md) in Azure Key Vault. -1. Sign in to the [Azure portal](https://portal.azure.com), then select **Azure Active Directory**. -1. Go to **Users**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. Browse to **Identity** > **Users** > **All users**. 1. Select **New user** and create one or more test user accounts in your directory. 1. The example test later in this article uses a single test user. [Add the test username and password as secrets](../../key-vault/secrets/quick-create-portal.md) in the key vault you created previously. Add the username as a secret named "TestUserName" and the password as a secret named "TestPassword". Take note of the **Application (client) ID**, which is used in the example test ### Enable your app for public client flows -ROPC is a public client flow, so you need to enable your app for public client flows. From your app registration in the [Azure portal](https://portal.azure.com), go to **Authentication** > **Advanced settings** > **Allow public client flows**. Set the toggle to **Yes**. +ROPC is a public client flow, so you need to enable your app for public client flows. From your app registration in the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Authentication** > **Advanced settings** > **Allow public client flows**. Set the toggle to **Yes**. ### Consent to the permissions you want to use while testing Since ROPC is not an interactive flow, you won't be prompted with a consent scre Add the permissions to your app. Do not add any sensitive or high-privilege permissions to the app, we recommend you scope your testing scenarios to basic integration scenarios around integrating with Azure AD. -From your app registration in the [Azure portal](https://portal.azure.com), go to **API Permissions** > **Add a permission**. Add the permissions you need to call the APIs you'll be using. A test example further in this article uses the `https://graph.microsoft.com/User.Read` and `https://graph.microsoft.com/User.ReadBasic.All` permissions. +From your app registration in the [Microsoft Entra admin center](https://entra.microsoft.com), go to **API Permissions** > **Add a permission**. Add the permissions you need to call the APIs you'll be using. A test example further in this article uses the `https://graph.microsoft.com/User.Read` and `https://graph.microsoft.com/User.ReadBasic.All` permissions. Once the permissions are added, you'll need to consent to them. The way you consent to the permissions depends on if your test app is in the same tenant as the app registration and whether you're an admin in the tenant. #### App and app registration are in the same tenant and you're an admin-If you plan on testing your app in the same tenant you registered it in and you are an administrator in that tenant, you can consent to the permissions from the [Azure portal](https://portal.azure.com). In your app registration in the Azure portal, go to **API Permissions** and select the **Grant admin consent for <your_tenant_name>** button next to the **Add a permission** button and then **Yes** to confirm. +If you plan on testing your app in the same tenant you registered it in and you are an administrator in that tenant, you can consent to the permissions from the [Microsoft Entra admin center](https://entra.microsoft.com). In your app registration in the Azure portal, go to **API Permissions** and select the **Grant admin consent for <your_tenant_name>** button next to the **Add a permission** button and then **Yes** to confirm. #### App and app registration are in different tenants, or you're not an admin-If you do not plan on testing your app in the same tenant you registered it in, or you are not an administrator in your tenant, you cannot consent to the permissions from the [Azure portal](https://portal.azure.com). You can still consent to some permissions, however, by triggering a sign-in prompt in a web browser. +If you do not plan on testing your app in the same tenant you registered it in, or you are not an administrator in your tenant, you cannot consent to the permissions from the [Microsoft Entra admin center](https://entra.microsoft.com). You can still consent to some permissions, however, by triggering a sign-in prompt in a web browser. -In your app registration in the [Azure portal](https://portal.azure.com), go to **Authentication** > **Platform configurations** > **Add a platform** > **Web**. Add the redirect URI "https://localhost" and select **Configure**. +In your app registration in the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Authentication** > **Platform configurations** > **Add a platform** > **Web**. Add the redirect URI "https://localhost" and select **Configure**. There is no way for non-admin users to pre-consent through the Azure portal, so send the following request in a browser. When you are prompted with the login screen, sign in with a test account you created in a previous step. Consent to the permissions you are prompted with. You may need to repeat this step for each API you want to call and test user you want to use. Replace *{tenant}* with your tenant ID, *{your_client_ID}* with the client ID of Your tenant likely has a Conditional Access policy that [requires multifactor authentication (MFA) for all users](../conditional-access/howto-conditional-access-policy-all-users-mfa.md), as recommended by Microsoft. MFA won't work with ROPC, so you'll need to exempt your test applications and test users from this requirement. To exclude user accounts:-1. Sign in to the [Azure portal](https://portal.azure.com) to access your tenant. Select **Azure Active Directory**. Select **Security** in the left navigation pane and then select **Conditional Access**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Cloud Application Administrator](../roles/permissions-reference.md#cloud-application-administrator). +1. Browse to **Identity** > **Security Center** in the left navigation pane and then select **Conditional Access**. 1. In **Policies**, select the Conditional Access policy that requires MFA. 1. Select **Users or workload identities**. 1. Select the **Exclude** tab and then the **Users and groups** checkbox. |
| active-directory | Troubleshoot Publisher Verification | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/troubleshoot-publisher-verification.md | Below are some common issues that may occur during the process. - **I am getting an error saying that my Partner One ID is invalid or that I do not have access to it.** Follow the [remediation guidance](#mpnaccountnotfoundornoaccess). -- **When I sign in to the Azure portal, I do not see any apps registered. Why?** +- **When I sign in to the Microsoft Entra admin center, I do not see any apps registered. Why?** Your app registrations may have been created using a different user account in this tenant, a personal/consumer account, or in a different tenant. Ensure you're signed in with the correct account in the tenant where your app registrations were created. - **I'm getting an error related to multi-factor authentication. What should I do?** The target application (`AppId`) must have a Publisher Domain set. Set a Publish Occurs when a [Publisher Domain](howto-configure-publisher-domain.md) isn't configured on the app. **Remediation Steps**-Follow the directions [here](./howto-configure-publisher-domain.md#set-a-publisher-domain-in-the-azure-portal) to set a Publisher Domain. +Follow the directions [here](./howto-configure-publisher-domain.md) to set a Publisher Domain. ### PublisherDomainMismatch If you've reviewed all of the previous information and are still receiving an er - TenantId where app is registered - Partner One ID - REST request being made -- Error code and message being returned+- Error code and message being returned |
| active-directory | Tutorial V2 Javascript Auth Code | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/tutorial-v2-javascript-auth-code.md | After you sign in, select **See Profile** to view the user profile information r ### More information about scopes and delegated permissions -The Microsoft Graph API requires the *user.read* scope to read a user's profile. By default, this scope is automatically added in every application that's registered in the Azure portal. Other APIs for Microsoft Graph, as well as custom APIs for your back-end server, might require additional scopes. For example, the Microsoft Graph API requires the *Mail.Read* scope in order to list the user's email. +The Microsoft Graph API requires the *user.read* scope to read a user's profile. By default, this scope is automatically added in every application that's registered in the Microsoft Entra admin center. Other APIs for Microsoft Graph, as well as custom APIs for your back-end server, might require additional scopes. For example, the Microsoft Graph API requires the *Mail.Read* scope in order to list the user's email. As you add scopes, your users might be prompted to provide additional consent for the added scopes. |
| active-directory | Tutorial V2 Javascript Spa | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/tutorial-v2-javascript-spa.md | In this tutorial: > [!div class="checklist"] > * Create a JavaScript project with `npm`-> * Register the application in the Azure portal +> * Register the application in the Microsoft Entra admin center > * Add code to support user sign-in and sign-out > * Add code to call the Microsoft Graph API > * Test the app In the next steps, you'll create a new folder for the JavaScript SPA and set up Before you proceed with authentication, register the application on Azure AD: -1. Sign in to the [Azure portal](https://portal.azure.com). -1. Go to **Azure Active Directory**. -1. On the left panel, under **Manage**, select **App registrations**. Then, on the top menu bar, select **New registration**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](../roles/permissions-reference.md#application-developer). +1. If access to multiple tenants is available, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application. +1. Browse to **Identity** > **Applications** > **App registrations**, select **New registration**. 1. For **Name**, enter a name for the application (for example, **sampleApp**). You can change the name later if necessary. 1. Under **Supported account types**, select **Accounts in this organizational directory only**. 1. In the **Redirect URI** section, select the **Web** platform from the dropdown list. |
| active-directory | Userinfo | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/userinfo.md | The claims shown in the response are all those that the UserInfo endpoint can re You can't add to or customize the information returned by the UserInfo endpoint. -To customize the information returned by the identity platform during authentication and authorization, use [claims mapping]( active-directory-claims-mapping.md) and [optional claims]( active-directory-optional-claims.md) to modify security token configuration. +To customize the information returned by the identity platform during authentication and authorization, use [claims mapping](active-directory-claims-mapping.md) and [optional claims](active-directory-optional-claims.md) to modify security token configuration. ## Next steps |
| active-directory | V2 Admin Consent | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-admin-consent.md | https://login.microsoftonline.com/{tenant}/v2.0/adminconsent | Parameter | Condition | Description | | : | : | : | | `tenant` | Required | The directory tenant that you want to request permission from. Can be provided in GUID or friendly name format OR generically referenced with `organizations` as seen in the example. Do not use 'common', as personal accounts cannot provide admin consent except in the context of a tenant. To ensure best compatibility with personal accounts that manage tenants, use the tenant ID when possible. |-| `client_id` | Required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | +| `client_id` | Required | The **Application (client) ID** that the [Microsoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | | `redirect_uri` | Required |The redirect URI where you want the response to be sent for your app to handle. It must exactly match one of the redirect URIs that you registered in the app registration portal. | | `state` | Recommended | A value included in the request that will also be returned in the token response. It can be a string of any content you want. Use the state to encode information about the user's state in the app before the authentication request occurred, such as the page or view they were on. | |`scope` | Required | Defines the set of permissions being requested by the application. This can be either static (using `/.default`) or dynamic scopes. This can include the OIDC scopes (`openid`, `profile`, `email`). | |
| active-directory | V2 Oauth Ropc | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-oauth-ropc.md | client_id=6731de76-14a6-49ae-97bc-6eba6914391e | Parameter | Condition | Description | | | | | | `tenant` | Required | The directory tenant that you want to log the user into. The tenant can be in GUID or friendly name format. However, its parameter can't be set to `common` or `consumers`, but may be set to `organizations`. |-| `client_id` | Required | The Application (client) ID that the [Azure portal - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | +| `client_id` | Required | The Application (client) ID that the [Microsoft Entra admin center - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | | `grant_type` | Required | Must be set to `password`. | | `username` | Required | The user's email address. | | `password` | Required | The user's password. | |
| active-directory | V2 Oauth2 Auth Code Flow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-oauth2-auth-code-flow.md | This diagram shows a high-level view of the authentication flow: Redirect URIs for SPAs that use the auth code flow require special configuration. - **Add a redirect URI** that supports auth code flow with PKCE and cross-origin resource sharing (CORS): Follow the steps in [Redirect URI: MSAL.js 2.0 with auth code flow](scenario-spa-app-registration.md#redirect-uri-msaljs-20-with-auth-code-flow).-- **Update a redirect URI**: Set the redirect URI's `type` to `spa` by using the [application manifest editor](reference-app-manifest.md) in the Azure portal.+- **Update a redirect URI**: Set the redirect URI's `type` to `spa` by using the [application manifest editor](reference-app-manifest.md) in the Microsoft Entra admin center. The `spa` redirect type is backward-compatible with the implicit flow. Apps currently using the implicit flow to get tokens can move to the `spa` redirect URI type without issues and continue using the implicit flow. client_id=6731de76-14a6-49ae-97bc-6eba6914391e | Parameter | Required/optional | Description | |--|-|--| | `tenant` | required | The `{tenant}` value in the path of the request can be used to control who can sign into the application. Valid values are `common`, `organizations`, `consumers`, and tenant identifiers. For guest scenarios where you sign a user from one tenant into another tenant, you *must* provide the tenant identifier to sign them into the resource tenant. For more information, see [Endpoints](./v2-protocols.md#endpoints). |-| `client_id` | required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | +| `client_id` | required | The **Application (client) ID** that the [Microsoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | | `response_type` | required | Must include `code` for the authorization code flow. Can also include `id_token` or `token` if using the [hybrid flow](#request-an-id-token-as-well-or-hybrid-flow). | | `redirect_uri` | required | The `redirect_uri` of your app, where authentication responses can be sent and received by your app. It must exactly match one of the redirect URIs you registered in the portal, except it must be URL-encoded. For native and mobile apps, use one of the recommended values: `https://login.microsoftonline.com/common/oauth2/nativeclient` for apps using embedded browsers or `http://localhost` for apps that use system browsers. | | `scope` | required | A space-separated list of [scopes](./permissions-consent-overview.md) that you want the user to consent to. For the `/authorize` leg of the request, this parameter can cover multiple resources. This value allows your app to get consent for multiple web APIs you want to call. | client_id=6731de76-14a6-49ae-97bc-6eba6914391e | Parameter | Required/optional | Description | ||-|-| | `tenant` | required | The `{tenant}` value in the path of the request can be used to control who can sign into the application. Valid values are `common`, `organizations`, `consumers`, and tenant identifiers. For more information, see [Endpoints](./v2-protocols.md#endpoints). |-| `client_id` | required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | +| `client_id` | required | The **Application (client) ID** that the [Microsoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | | `scope` | optional | A space-separated list of scopes. The scopes must all be from a single resource, along with OIDC scopes (`profile`, `openid`, `email`). For more information, see [Permissions and consent in the Microsoft identity platform](./permissions-consent-overview.md). This parameter is a Microsoft extension to the authorization code flow, intended to allow apps to declare the resource they want the token for during token redemption.| | `code` | required | The `authorization_code` that you acquired in the first leg of the flow. | | `redirect_uri` | required | The same `redirect_uri` value that was used to acquire the `authorization_code`. | client_id=6731de76-14a6-49ae-97bc-6eba6914391e | Parameter | Required/optional | Description | ||-|-| | `tenant` | required | The `{tenant}` value in the path of the request can be used to control who can sign into the application. Valid values are `common`, `organizations`, `consumers`, and tenant identifiers. For more detail, see [Endpoints](./v2-protocols.md#endpoints). |-| `client_id` | required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | +| `client_id` | required | The **Application (client) ID** that the [Microsoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | | `scope` | optional | A space-separated list of scopes. The scopes must all be from a single resource, along with OIDC scopes (`profile`, `openid`, `email`). For more information, see [permissions, consent, and scopes](./permissions-consent-overview.md). This parameter is a Microsoft extension to the authorization code flow. This extension allows apps to declare the resource they want the token for during token redemption.| | `code` | required | The `authorization_code` that you acquired in the first leg of the flow. | | `redirect_uri` | required | The same `redirect_uri` value that was used to acquire the `authorization_code`. | client_id=535fb089-9ff3-47b6-9bfb-4f1264799865 | Parameter | Type | Description | ||-|--| | `tenant` | required | The `{tenant}` value in the path of the request can be used to control who can sign into the application. Valid values are `common`, `organizations`, `consumers`, and tenant identifiers. For more information, see [Endpoints](./v2-protocols.md#endpoints). |-| `client_id` | required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | +| `client_id` | required | The **Application (client) ID** that the [Microsoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | | `grant_type` | required | Must be `refresh_token` for this leg of the authorization code flow. | | `scope` | optional | A space-separated list of scopes. The scopes requested in this leg must be equivalent to or a subset of the scopes requested in the original `authorization_code` request leg. If the scopes specified in this request span multiple resource server, then the Microsoft identity platform returns a token for the resource specified in the first scope. For more information, see [Permissions and consent in the Microsoft identity platform](./permissions-consent-overview.md). | | `refresh_token` | required | The `refresh_token` that you acquired in the second leg of the flow. | |
| active-directory | V2 Oauth2 Client Creds Grant Flow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-oauth2-client-creds-grant-flow.md | Instead of using ACLs, you can use APIs to expose a set of **application permiss * Send mail as any user * Read directory data -To use app roles (application permissions) with your own API (as opposed to Microsoft Graph), you must first [expose the app roles](./howto-add-app-roles-in-apps.md) in the API's app registration in the Azure portal. Then, [configure the required app roles](./howto-add-app-roles-in-apps.md#assign-app-roles-to-applications) by selecting those permissions in your client application's app registration. If you haven't exposed any app roles in your API's app registration, you won't be able to specify application permissions to that API in your client application's app registration in the Azure portal. +To use app roles (application permissions) with your own API (as opposed to Microsoft Graph), you must first [expose the app roles](./howto-add-app-roles-in-apps.md) in the API's app registration in the Microsoft Entra admin center. Then, [configure the required app roles](./howto-add-app-roles-in-apps.md#assign-app-roles-to-applications) by selecting those permissions in your client application's app registration. If you haven't exposed any app roles in your API's app registration, you won't be able to specify application permissions to that API in your client application's app registration in the Microsoft Entra admin center. When authenticating as an application (as opposed to with a user), you can't use *delegated permissions* because there is no user for your app to act on behalf of. You must use application permissions, also known as app roles, that are granted by an admin or by the API's owner. https://login.microsoftonline.com/common/adminconsent?client_id=6731de76-14a6-49 | Parameter | Condition | Description | | -- | -- | -- | | `tenant` | Required | The directory tenant that you want to request permission from. This can be in GUID or friendly name format. If you don't know which tenant the user belongs to and you want to let them sign in with any tenant, use `common`. |-| `client_id` | Required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | +| `client_id` | Required | The **Application (client) ID** that the [Microsoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | | `redirect_uri` | Required | The redirect URI where you want the response to be sent for your app to handle. It must exactly match one of the redirect URIs that you registered in the portal, except that it must be URL-encoded, and it can have additional path segments. | | `state` | Recommended | A value that's included in the request that's also returned in the token response. It can be a string of any content that you want. The state is used to encode information about the user's state in the app before the authentication request occurred, such as the page or view they were on. | |
| active-directory | V2 Oauth2 Device Code | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-oauth2-device-code.md | client_id=6731de76-14a6-49ae-97bc-6eba6914391e | Parameter | Condition | Description | | | | | | `tenant` | Required | Can be `/common`, `/consumers`, or `/organizations`. It can also be the directory tenant that you want to request permission from in GUID or friendly name format. |-| `client_id` | Required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | +| `client_id` | Required | The **Application (client) ID** that the [Microsoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | | `scope` | Required | A space-separated list of [scopes](./permissions-consent-overview.md) that you want the user to consent to. | ### Device authorization response |
| active-directory | V2 Oauth2 Implicit Grant Flow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-oauth2-implicit-grant-flow.md | The following diagram shows what the entire implicit sign-in flow looks like and To initially sign the user into your app, you can send an [OpenID Connect](v2-protocols-oidc.md) authentication request and get an `id_token` from the Microsoft identity platform. > [!IMPORTANT]-> To successfully request an ID token and/or an access token, the app registration in the [Azure portal - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page must have the corresponding implicit grant flow enabled, by selecting **ID tokens** and **access tokens** in the **Implicit grant and hybrid flows** section. If it's not enabled, an `unsupported_response` error will be returned: +> To successfully request an ID token and/or an access token, the app registration in the [Microsoft Entra admin center - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page must have the corresponding implicit grant flow enabled, by selecting **ID tokens** and **access tokens** in the **Implicit grant and hybrid flows** section. If it's not enabled, an `unsupported_response` error will be returned: > > `The provided value for the input parameter 'response_type' is not allowed for this client. Expected value is 'code'` client_id=6731de76-14a6-49ae-97bc-6eba6914391e | Parameter | Type | Description | | | | | | `tenant` | required |The `{tenant}` value in the path of the request can be used to control who can sign into the application. The allowed values are `common`, `organizations`, `consumers`, and tenant identifiers. For more detail, see [protocol basics](./v2-protocols.md#endpoints).Critically, for guest scenarios where you sign a user from one tenant into another tenant, you *must* provide the tenant identifier to correctly sign them into the resource tenant.|-| `client_id` | required | The Application (client) ID that the [Azure portal - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | +| `client_id` | required | The Application (client) ID that the [Microsoft Entra admin center - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page assigned to your app. | | `response_type` | required | Must include `id_token` for OpenID Connect sign-in. It may also include the `response_type`, `token`. Using `token` here will allow your app to receive an access token immediately from the authorize endpoint without having to make a second request to the authorize endpoint. If you use the `token` response_type, the `scope` parameter must contain a scope indicating which resource to issue the token for (for example, `user.read` on Microsoft Graph). It can also contain `code` in place of `token` to provide an authorization code, for use in the [authorization code flow](v2-oauth2-auth-code-flow.md). This `id_token`+`code` response is sometimes called the hybrid flow. | | `redirect_uri` | recommended |The redirect URI of your app, where authentication responses can be sent and received by your app. It must exactly match one of the redirect URIs you registered in the portal, except it must be URL-encoded. | | `scope` | required |A space-separated list of [scopes](./permissions-consent-overview.md). For OpenID Connect (`id_tokens`), it must include the scope `openid`, which translates to the "Sign you in" permission in the consent UI. Optionally you may also want to include the `email` and `profile` scopes for gaining access to additional user data. You may also include other scopes in this request for requesting consent to various resources, if an access token is requested. | |
| active-directory | V2 Oauth2 On Behalf Of Flow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-oauth2-on-behalf-of-flow.md | When using a shared secret, a service-to-service access token request contains t | Parameter | Type | Description | | | | | | `grant_type` | Required | The type of token request. For a request using a JWT, the value must be `urn:ietf:params:oauth:grant-type:jwt-bearer`. |-| `client_id` | Required | The application (client) ID that [the Azure portal - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page has assigned to your app. | -| `client_secret` | Required | The client secret that you generated for your app in the Azure portal - App registrations page. The Basic auth pattern of instead providing credentials in the Authorization header, per [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) is also supported. | +| `client_id` | Required | The application (client) ID that [the Microsoft Entra admin center - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page has assigned to your app. | +| `client_secret` | Required | The client secret that you generated for your app in the Microsoft Entra admin center - App registrations page. The Basic auth pattern of instead providing credentials in the Authorization header, per [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) is also supported. | | `assertion` | Required | The access token that was sent to the middle-tier API. This token must have an audience (`aud`) claim of the app making this OBO request (the app denoted by the `client-id` field). Applications can't redeem a token for a different app (for example, if a client sends an API a token meant for Microsoft Graph, the API can't redeem it using OBO. It should instead reject the token). | | `scope` | Required | A space separated list of scopes for the token request. For more information, see [scopes](./permissions-consent-overview.md). | | `requested_token_use` | Required | Specifies how the request should be processed. In the OBO flow, the value must be set to `on_behalf_of`. | A service-to-service access token request with a certificate contains the follow | Parameter | Type | Description | | | | | | `grant_type` | Required | The type of the token request. For a request using a JWT, the value must be `urn:ietf:params:oauth:grant-type:jwt-bearer`. |-| `client_id` | Required | The application (client) ID that [the Azure portal - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page has assigned to your app. | +| `client_id` | Required | The application (client) ID that [the Microsoft Entra admin center - App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page has assigned to your app. | | `client_assertion_type` | Required | The value must be `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. | | `client_assertion` | Required | An assertion (a JSON web token) that you need to create and sign with the certificate you registered as credentials for your application. To learn how to register your certificate and the format of the assertion, see [certificate credentials](./certificate-credentials.md). | | `assertion` | Required | The access token that was sent to the middle-tier API. This token must have an audience (`aud`) claim of the app making this OBO request (the app denoted by the `client-id` field). Applications can't redeem a token for a different app (for example, if a client sends an API a token meant for MS Graph, the API can't redeem it using OBO. It should instead reject the token). | A service-to-service request for a SAML assertion contains the following paramet | | | | | grant_type |required | The type of the token request. For a request that uses a JWT, the value must be `urn:ietf:params:oauth:grant-type:jwt-bearer`. | | assertion |required | The value of the access token used in the request.|-| client_id |required | The app ID assigned to the calling service during registration with Azure AD. To find the app ID in the Azure portal, select **Active Directory**, choose the directory, and then select the application name. | +| client_id |required | The app ID assigned to the calling service during registration with Azure AD. To find the app ID in the Microsoft Entra admin center, browse to **Identity** > **Applications** > **App registrations** and then select the application name. | | client_secret |required | The key registered for the calling service in Azure AD. This value should have been noted at the time of registration. The Basic auth pattern of instead providing credentials in the Authorization header, per [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) is also supported. | | scope |required | A space-separated list of scopes for the token request. For more information, see [scopes](./permissions-consent-overview.md). SAML itself doesn't have a concept of scopes, but is used to identify the target SAML application for which you want to receive a token. For this OBO flow, the scope value must always be the SAML Entity ID with `/.default` appended. For example, in case the SAML application's Entity ID is `https://testapp.contoso.com`, then the requested scope should be `https://testapp.contoso.com/.default`. In case the Entity ID doesn't start with a URI scheme such as `https:`, Azure AD prefixes the Entity ID with `spn:`. In that case you must request the scope `spn:<EntityID>/.default`, for example `spn:testapp/.default` in case the Entity ID is `testapp`. The scope value you request here determines the resulting `Audience` element in the SAML token, which may be important to the SAML application receiving the token. | | requested_token_use |required | Specifies how the request should be processed. In the On-Behalf-Of flow, the value must be `on_behalf_of`. | |
| active-directory | V2 Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-overview.md | There are several components that make up the Microsoft identity platform: - Personal Microsoft accounts (Skype, Xbox, Outlook.com) - Social or local accounts, by using Azure AD B2C - **Open-source libraries**: Microsoft Authentication Library (MSAL) and support for other standards-compliant libraries.-- **Application management portal**: A registration and configuration experience in the Azure portal, along with the other Azure management capabilities.+- **Application management portal**: A registration and configuration experience in the Microsoft Entra admin center, along with the other Azure management capabilities. - **Application configuration API and PowerShell**: Programmatic configuration of your applications through the Microsoft Graph API and PowerShell so you can automate your DevOps tasks. - **Developer content**: Technical documentation including quickstarts, tutorials, how-to guides, and code samples. |
| active-directory | V2 Protocols Oidc | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-protocols-oidc.md | The *ID token* introduced by OpenID Connect is issued by the authorization serve ID tokens aren't issued by default for an application registered with the Microsoft identity platform. ID tokens for an application are enabled by using one of the following methods: -1. Sign in to the [Azure portal](https://portal.azure.com) and select **Azure Active Directory** > **App registrations** > *\<your application\>* > **Authentication**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). +1. Browse to **Identity** > **Applications** > **App registrations** > *\<your application\>* > **Authentication**. 1. Under **Platform configurations**, select **Add a platform**. 1. In the pane that opens, select the appropriate platform for your application. For example, select **Web** for a web application. 1. Under Redirect URIs, add the redirect URI of your application. For example, `https://localhost:8080/`. The value of `{tenant}` varies based on the application's sign-in audience as sh > [!TIP] > Note that when using the `common` or `consumers` authority for personal Microsoft accounts, the consuming resource application must be configured to support such type of accounts in accordance with [signInAudience](./supported-accounts-validation.md). -To find the OIDC configuration document in the Azure portal, sign in to the [Azure portal](https://portal.azure.com) and then: +To find the OIDC configuration document in the Microsoft Entra admin center, sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) and then: -1. Select **Azure Active Directory** > **App registrations** > *\<your application\>* > **Endpoints**. +1. Browse to **Identity** > **Applications** > **App registrations** > *\<your application\>* > **Endpoints**. 1. Locate the URI under **OpenID Connect metadata document**. ### Sample request client_id=6731de76-14a6-49ae-97bc-6eba6914391e | Parameter | Condition | Description | | | | | | `tenant` | Required | You can use the `{tenant}` value in the path of the request to control who can sign in to the application. The allowed values are `common`, `organizations`, `consumers`, and tenant identifiers. For more information, see [protocol basics](./v2-protocols.md#endpoints). Critically, for guest scenarios where you sign a user from one tenant into another tenant, you *must* provide the tenant identifier to correctly sign them into the resource tenant.|-| `client_id` | Required | The **Application (client) ID** that the [Azure portal ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | +| `client_id` | Required | The **Application (client) ID** that the [Mcirosoft Entra admin center ΓÇô App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. | | `response_type` | Required | Must include `id_token` for OpenID Connect sign-in. | | `redirect_uri` | Recommended | The redirect URI of your app, where authentication responses can be sent and received by your app. It must exactly match one of the redirect URIs you registered in the portal, except that it must be URL-encoded. If not present, the endpoint will pick one registered `redirect_uri` at random to send the user back to. | | `scope` | Required | A space-separated list of scopes. For OpenID Connect, it must include the scope `openid`, which translates to the **Sign you in** permission in the consent UI. You might also include other scopes in this request for requesting consent. | |
| active-directory | V2 Protocols | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-protocols.md | -Knowing about OAuth or OpenID Connect (OIDC) at the protocol level isn't required to use the Microsoft identity platform. However, you'll encounter protocol terms and concepts as you use the identity platform to add authentication to your apps. As you work with the Azure portal, our documentation, and authentication libraries, knowing some fundamentals can assist your integration and overall experience. +Knowing about OAuth or OpenID Connect (OIDC) at the protocol level isn't required to use the Microsoft identity platform. However, you'll encounter protocol terms and concepts as you use the identity platform to add authentication to your apps. As you work with the Microsoft Entra admin center, our documentation, and authentication libraries, knowing some fundamentals can assist your integration and overall experience. ## Roles in OAuth 2.0 https://login.microsoftonline.com/<issuer>/oauth2/v2.0/token # and **tenant identifiers** such as the tenant ID or domain name. ``` -To find the endpoints for an application you've registered, in the [Azure portal](https://portal.azure.com) navigate to: +To find the endpoints for an application you've registered, in the [Microsoft Entra admin center](https://entra.microsoft.com) navigate to: **Azure Active Directory** > **App registrations** > \<YOUR-APPLICATION\> > **Endpoints** |
| active-directory | V2 Saml Bearer Assertion | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/develop/v2-saml-bearer-assertion.md | The SAML assertion is posted to the OAuth token endpoint. The endpoint processes Start by registering the application in the [portal](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade): -1. Sign in to the [app registration page of the portal](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) (Please note that we are using the v2.0 endpoints for Graph API and hence need to register the application in Azure portal. Otherwise we could have used the registrations in Azure AD). +1. Sign in to the [app registration page of the portal](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) (Please note that we are using the v2.0 endpoints for Graph API and hence need to register the application in Microsoft Entra admin center. Otherwise we could have used the registrations in Azure AD). 1. Select **New registration**. 1. When the **Register an application** page appears, enter your application's registration information: 1. **Name** - Enter a meaningful application name that will be displayed to users of the app. |
| active-directory | Groups Dynamic Rule Member Of | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/enterprise-users/groups-dynamic-rule-member-of.md | This feature can be used in the Azure portal, Microsoft Graph, and in PowerShell ### Steps to create a memberOf dynamic group -1. Sign in to the [Azure portal](https://portal.azure.com) with an account that has Global Administrator, Intune Administrator, or User Administrator role permissions. -1. Select **Azure Active Directory** > **Groups**, and then select **New group**. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](../roles/permissions-reference.md#user-administrator). +1. Browse to **Identity** > **Groups** > **All groups**. +1. Select **New group**. 1. Fill in group details. The group type can be Security or Microsoft 365, and the membership type can be set to **Dynamic User** or **Dynamic Device**. 1. Select **Add dynamic query**. 1. MemberOf isn't yet supported in the rule builder. Select **Edit** to write the rule in the **Rule syntax** box. |
| active-directory | Signin Account Support | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/enterprise-users/signin-account-support.md | You can tell if the sign-in page your organization uses supports Microsoft accou ## Next steps -[Customize your sign-in branding](../fundamentals/add-custom-domain.md) +[Customize your sign-in branding](../fundamentals/add-custom-domain.md) |
| active-directory | Add Users Administrator | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/external-identities/add-users-administrator.md | If you need to manually add B2B collaboration users to a group after the user wa 4. Select a group (or select **New group** to create a new one). It's a good idea to include in the group description that the group contains B2B guest users. 5. Under **Manage**, select **Members**. 6. Select **Add members**.-7. Complete one of the following set of steps: +7. Complete the following set of steps: - *If the guest user is already in the directory:* If you need to manually add B2B collaboration users to a group after the user wa b. In the search results, choose the user, and then choose **Select**. - - *If the guest user isn't currently in the directory:* - - a. On the **Add members** page, type the user's full email address in the search box, type a **Personal message** (optional), and then choose **Invite** to send an invitation. - - b. Choose **Select**. - - c. Now add the user to the group: On the **Members** page, choose **Add members**. Type the user's name or email address in the search box, choose the user in the results, and then choose **Select**. - You can also use dynamic groups with Azure AD B2B collaboration. For more information, see [Dynamic groups and Azure Active Directory B2B collaboration](use-dynamic-groups.md). ## Add guest users to an application To add B2B collaboration users to an application, follow these steps: 5. Under **Manage**, select **Users and groups**. 6. Select **Add user/group**. 7. On the **Add Assignment** page, select the link under **Users**.-8. Complete one of the following set of steps: +8. Complete the following set of steps: - *If the guest user is already in the directory:* To add B2B collaboration users to an application, follow these steps: c. On the **Add Assignment** page, choose **Assign** to add the user to the app. - - *If the guest user isn't currently in the directory:* - - a. On the **Users** page, type the user's full email address in the search box, type a **Personal message** (optional), and then choose **Invite**. - - b. Choose **Select**. - - c. Now add the invited user to the application: On the **Add Assignment** page, choose the link under **Users**. Type the invited user's name or email address in the search box, choose the user in the results, and then choose **Select**. - - d. On the **Add Assignment** page, choose **Assign**. - 9. The guest user appears in the application's **Users and groups** list with the assigned role of **Default Access**. If the application provides different roles and you want to change the user's role, do the following: a. Select the check box next to the guest user, and then select the **Edit** button. |
| active-directory | How To User Flow Sign Up Sign In Customers | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/external-identities/customers/how-to-user-flow-sign-up-sign-in-customers.md | Follow these steps to create a user flow a customer can use to sign in or sign u 1. Select **Create** to create the user flow. -### To select the layout of the attribute collection page (optional) --You can choose the order in which the attributes are displayed on the sign-up page. --1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). --1. Browse to **Identity** > **External Identities** > **User flows**. --1. From the list, select your user flow. --1. Under **Customize**, select **Page layouts**. -- The attributes you chose to collect are listed. You can change the attribute label, type, and whether itΓÇÖs required. You can also change the order of display by selecting an attribute, and then select **Move up**, **Move down**, **Move to the top**, or **Move to the bottom**. -- :::image type="content" source="media/how-to-user-flow-sign-up-sign-in-customers/page-layouts.png" alt-text="Screenshot of page layout options for a user flow."::: --1. Select **Save**. - ## Disable sign-up in a sign-up and sign-in user flow If you want your customer users to only sign in and not sign up, you can disable sign-up experience in your user flow by using [Microsoft Graph API](microsoft-graph-operations.md). You need to know the ID of the user flow that you want whose sign-up you want to disable. You can't read the user flow ID from the Microsoft Entra Admin center, but you can retrieve it via Microsoft Graph API if you know the app associated with it. If you want your customer users to only sign in and not sign up, you can disable ## Next steps -- [Add your application to the user flow](how-to-user-flow-add-application.md)+- [Add your application to the user flow](how-to-user-flow-add-application.md) +- [Create custom user attributes and customize the order of the attributes on the sign-up page](how-to-define-custom-attributes.md). |
| active-directory | External Collaboration Settings Configure | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/external-identities/external-collaboration-settings-configure.md | External collaboration settings let you specify what roles in your organization For B2B collaboration with other Azure AD organizations, you should also review your [cross-tenant access settings](cross-tenant-access-settings-b2b-collaboration.md) to ensure your inbound and outbound B2B collaboration and scope access to specific users, groups, and applications. +For B2B collaboration end-users who perform cross-tenant sign-ins, their home tenant branding appears, even if there isn't custom branding specified. In the following example, the company branding for Woodgrove Groceries appears on the left. The example on the right displays the default branding for the user's home tenant. ++ ## Configure settings in the portal [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] |
| active-directory | External Identities Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/external-identities/external-identities-overview.md | Microsoft Azure cloud services are available in separate national clouds, which - Microsoft Azure global cloud and Microsoft Azure operated by 21Vianet To set up B2B collaboration between tenants in different clouds, both tenants need to configure their Microsoft cloud settings to enable collaboration with the other cloud. Then each tenant must configure inbound and outbound cross-tenant access with the tenant in the other cloud. See [Microsoft cloud settings](cross-cloud-settings.md) for details.+ ### External collaboration settings External collaboration settings determine whether your users can send B2B collaboration invitations to external users and the level of access guest users have to your directory. With these settings, you can: External collaboration settings determine whether your users can send B2B collab - **Allow or block domains**. Choose whether to allow or deny invitations to the domains you specify. For details, see [Allow or block domains](allow-deny-list.md). For more information, see how to [configure B2B external collaboration settings](external-collaboration-settings-configure.md).+ ### How external collaboration and cross-tenant access settings work together External collaboration settings work at the invitation level, whereas cross-tenant access settings work at the authentication level. When you're considering B2B collaboration with a specific external Azure AD orga - **Example 2**: You allow B2B collaboration with Fabrikam in your cross-tenant access settings, but then you add `fabrikam.com` to your blocked domains in your external collaboration settings. Your users won't be able to invite new Fabrikam guest users, but existing Fabrikam guests will be able to continue using B2B collaboration. +For B2B collaboration end-users who perform cross-tenant sign-ins, their home tenant branding appears, even if there isn't custom branding specified. In the following example, the company branding for Woodgrove Groceries appears on the left. The example on the right displays the default branding for the user's home tenant. ++ ### Azure Active Directory B2C management Azure AD B2C is a separate consumer-based directory that you manage in the Azure portal through the Azure AD B2C service. Each Azure AD B2C tenant is separate and distinct from other Azure Active Directory and Azure AD B2C tenants. The Azure AD B2C portal experience is similar to Azure AD, but there are key differences, such as the ability to customize your user journeys using the Identity Experience Framework. |
| active-directory | User Flow Customize Language | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/external-identities/user-flow-customize-language.md | By default, language customization is enabled for users signing up to ensure a c Language customization enables you to customize any string in your user flow. -1. Sign in to the [Azure portal](https://portal.azure.com) as an Azure AD administrator. -2. Under **Azure services**, select **Azure Active Directory**. -3. In the left menu, select **External Identities**. -4. Select **User flows**. -3. Select the user flow that you want to enable for translations. -4. Select **Languages**. -5. On the **Languages** page for the user flow, select the language that you want to customize. -6. Expand **Attribute collection page**. -7. Select **Download defaults** (or **Download overrides** if you've previously edited this language). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [External ID User Flow Administrator](../roles/permissions-reference.md#external-id-user-flow-administrator). +1. Browse to **Identity** > **External Identities** > **User flows**. +1. Select the user flow that you want to enable for translations. +1. Select **Languages**. +1. On the **Languages** page for the user flow, select the language that you want to customize. +1. Expand the **Attribute collection page**. +1. Select **Download defaults** (or **Download overrides** if you've previously edited this language). These steps give you a JSON file that you can use to start editing your strings. |
| active-directory | Add Custom Domain | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/add-custom-domain.md | For more information about subscription roles, see [Azure roles](../../role-base After you create your directory, you can add your custom domain name. +> [!IMPORTANT] +> When updating domain information, you may be unable to complete the process and encounter a HTTP 500 Internal Server Error message. Under some conditions, this error may be expected. This message may appear if you try to use a protected DNS suffix. Protected DNS suffixes may only be used by Microsoft. If you believe that this operation should have been completed successfully, please contact your Microsoft representative for assistance. + 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Domain Name Administrator](../roles/permissions-reference.md#domain-name-administrator). 1. Browse to **Identity** > **Settings** > **Domain names** > **Add custom domain**. |
| active-directory | Create New Tenant | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/create-new-tenant.md | After you sign in to the [Azure portal](https://portal.azure.com), you can creat 1. On the Configuration tab, enter the following information: -  +  - Type your desired Organization name (for example _Contoso Organization_) into the **Organization name** box. - Type your desired Initial domain name (for example _Contosoorg_) into the **Initial domain name** box. |
| active-directory | How To Rename Azure Ad | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/how-to-rename-azure-ad.md | + + Title: How to rename Azure Active Directory (Azure AD) +description: Learn about best practices and tips on how customers and organizations can update their documentation or content to use the Microsoft Entra ID product name and icon. +++++++ Last updated : 09/15/2023++++# Customer intent: As a content creator, employee of an organization with internal documentation for IT or identity security admins, developer of Azure AD-enabled apps, ISV, or Microsoft partner, I want to learn how to correctly update our documentation or content to use the new name for Azure AD. ++# How to: Rename Azure AD ++Azure Active Directory (Azure AD) is being renamed to Microsoft Entra ID to better communicate the multicloud, multiplatform functionality of the product and unify the naming of the Microsoft Entra product family. ++This article provides best practices and support for customers and organizations who wish to update their documentation or content with the new product name and icon. ++## Prerequisites ++Before changing instances of Azure AD in your documentation or content, familiarize yourself with the guidance in [New name for Azure AD](new-name.md) to: ++- Understand the product name and why we made the change +- Download the new product icon +- Get a list of names that aren't changing +- Get answers to the more frequently asked questions and more ++## Assess and scope renaming updates for your content ++Audit your experiences to find references to Azure AD and its icons. ++**Scan your content** to identify references to Azure AD and its synonyms. Compile a detailed list of all instances. ++- Search for the following terms: "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD" +- Search for graphics with the Azure AD icon ( ) to replace with the Microsoft Entra ID icon () ++You can download the Microsoft Entra ID icon here: [Microsoft Entra architecture icons](../architecture/architecture-icons.md) ++**Identify exceptions in your list**: ++- Don't make breaking changes. +- Review the [What names aren't changing?](new-name.md#what-names-arent-changing) section in the naming guidance and note which Azure AD terminology isn't changing. +- Don’t change instances of 'Active Directory.' Only 'Azure Active Directory' is being renamed, not 'Active Directory,'which is the shortened name of a different product, Windows Server Active Directory. ++**Evaluate and prioritize based on future usage**. Consider which content needs to be updated based on whether it's user-facing or has broad visibility within your organization, audience, or customer base. You may decide that some code or content doesn't need to be updated if it has limited exposure to your end-users. ++Decide whether existing dated content such as videos or blogs are worth updating for future viewers. It's okay to not rename old content. To help end-users, you may want to add a disclaimer such as "Azure AD is now Microsoft Entra ID." ++## Update the naming in your content ++Update your organization's content and experiences using the relevant tools. ++### How to use "find and replace" for text-based content ++1. Almost all editing tools offer "search and replace" or "find and replace" functionality, either natively or using plug-ins. Use your preferred app. +1. Use "find and replace" to find the strings "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD." +1. Don't replace all instances with Microsoft Entra ID. +1. Review whether each instance refers to the product or a feature of the product. ++ - Azure AD as the product name alone should be replaced by Microsoft Entra ID. + - Azure AD features or functionality become Microsoft Entra features or functionality. For example, Azure AD Conditional Access becomes Microsoft Entra Conditional Access. ++### Automate bulk editing using custom code ++Use the following criteria to determine what change(s) you need to make to instances of "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD." ++1. If the text string is found in the naming dictionary of previous terms, change it to the new term. +1. If a punctuation mark follows "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD," replace with 'Microsoft Entra ID' because that's the product name. +1. If "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD" is followed by "for, Premium, Plan, P1, or P2", replace with 'Microsoft Entra ID' because it refers to a SKU name or Service Plan. +1. If an article (a, an, the) or possessive (your, your organization’s) precedes ("Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD"), then replace with 'Microsoft Entra' because it's a feature name. For example: + 1. 'an Azure AD tenant' becomes 'a Microsoft Entra tenant' + 1. 'your organization's Azure AD tenant' becomes 'your Microsoft Entra tenant' ++1. If "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD" is followed by an adjective or noun not listed above, then replace with 'Microsoft Entra' because it's a feature name. For example,'Azure AD Conditional Access' becomes 'Microsoft Entra Conditional Access,' while 'Azure AD tenant' becomes 'Microsoft Entra tenant.' +1. Otherwise, replace "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD" with 'Microsoft Entra ID' ++See the section [Glossary of updated terminology](new-name.md#glossary-of-updated-terminology) to further refine your custom logic. ++### Update graphics and icons ++1. Replace the Azure AD icon with the Microsoft Entra ID icon. +1. Replace titles or text containing "Azure Active Directory (Azure AD), Azure Active Directory, Azure AD, AAD" with 'Microsoft Entra ID.' ++## Communicate the change to your customers ++To help your customers with the transition, it's helpful to add a note: "Azure Active Directory is now Microsoft Entra ID" or follow the new name with "formerly Azure Active Directory" for the first year. ++## Next steps ++- [Stay up-to-date with what's new in Azure AD/Microsoft Entra ID](whats-new.md) +- [Get started using Microsoft Entra ID at the Microsoft Entra admin center](https://entra.microsoft.com/) +- [Learn more about Microsoft Entra with content from Microsoft Learn](/entra) |
| active-directory | New Name | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/new-name.md | -To communicate the multicloud, multiplatform functionality of the products, alleviate confusion with Windows Server Active Directory, and unify the [Microsoft Entra](/entra) product family, we're renaming Azure Active Directory (Azure AD) to Microsoft Entra ID. +To communicate the multicloud, multiplatform functionality of the products, alleviate confusion with Windows Server Active Directory, and unify the [Microsoft Entra](/entra) product family, the new name for Azure Active Directory (Azure AD) is Microsoft Entra ID. ## No interruptions to usage or service -If you're using Azure AD today or are currently deploying Azure AD in your organizations, you can continue to use the service without interruption. All existing deployments, configurations, and integrations will continue to function as they do today without any action from you. +If you're using Azure AD today or are currently deploying Azure AD in your organizations, you can continue to use the service without interruption. All existing deployments, configurations, and integrations continue to function as they do today without any action from you. You can continue to use familiar Azure AD capabilities that you can access through the Azure portal, Microsoft 365 admin center, and the [Microsoft Entra admin center](https://entra.microsoft.com). All features and capabilities are still available in the product. Licensing, ter To make the transition seamless, all existing login URLs, APIs, PowerShell cmdlets, and Microsoft Authentication Libraries (MSAL) stay the same, as do developer experiences and tooling. -Service plan display names will change on October 1, 2023. Microsoft Entra ID Free, Microsoft Entra ID P1, and Microsoft Entra ID P2 will be the new names of standalone offers, and all capabilities included in the current Azure AD plans remain the same. Microsoft Entra ID ΓÇô currently known as Azure AD ΓÇô will continue to be included in Microsoft 365 licensing plans, including Microsoft 365 E3 and Microsoft 365 E5. Details on pricing and whatΓÇÖs included are available on the [pricing and free trials page](https://aka.ms/PricingEntra). +Service plan display names will change on October 1, 2023. Microsoft Entra ID Free, Microsoft Entra ID P1, and Microsoft Entra ID P2 will be the new names of standalone offers, and all capabilities included in the current Azure AD plans remain the same. Microsoft Entra ID ΓÇô currently known as Azure AD ΓÇô continues to be included in Microsoft 365 licensing plans, including Microsoft 365 E3 and Microsoft 365 E5. Details on pricing and whatΓÇÖs included are available on the [pricing and free trials page](https://aka.ms/PricingEntra). :::image type="content" source="./media/new-name/azure-ad-new-name.png" alt-text="Diagram showing the new name for Azure AD and Azure AD External Identities." border="false" lightbox="./media/new-name/azure-ad-new-name-high-res.png"::: During 2023, you may see both the current Azure AD name and the new Microsoft Entra ID name in support area paths. For self-service support, look for the topic path of "Microsoft Entra" or "Azure Active Directory/Microsoft Entra ID." -## Guide to Azure AD name changes and exceptions +The product name and icons are changing, and features are now branded as Microsoft Entra instead of Azure AD. If you're updating the name to Microsoft Entra ID in your own content or experiences, see [How to: Rename Azure AD](how-to-rename-azure-ad.md). -We encourage content creators, organizations with internal documentation for IT or identity security admins, developers of Azure AD-enabled apps, independent software vendors, or partners of Microsoft to update your experiences and use the new name by the end of 2023. We recommend changing the name in customer-facing experiences, prioritizing highly visible surfaces. +## Naming changes and exceptions ### Product name -Microsoft Entra ID is the new name for Azure AD. Please replace the product names Azure Active Directory, Azure AD, and AAD with Microsoft Entra ID. +Microsoft Entra ID is the new name for Azure AD. The names Azure Active Directory, Azure AD, and AAD are replaced with Microsoft Entra ID. - Microsoft Entra is the name for the product family of identity and network access solutions. - Microsoft Entra ID is one of the products within that family.-- Acronym usage is not encouraged, but if you must replace AAD with an acronym due to space limitations, please use ME-ID.+- Acronym usage is not encouraged, but if you must replace AAD with an acronym due to space limitations, use ME-ID. ### Logo/icon -Please change the Azure AD product icon in your experiences. The Azure AD icons are now at end-of-life. +Azure AD product icons are replaced with the Microsoft Entra ID product icon. | **Azure AD product icons** | **Microsoft Entra ID product icon** | |:--:|:--:| |   |  | -You can download the new Microsoft Entra ID icon here: [Microsoft Entra architecture icons](../architecture/architecture-icons.md) +You can download the Microsoft Entra ID icon here: [Microsoft Entra architecture icons](../architecture/architecture-icons.md) ### Feature names -Capabilities or services formerly known as "Azure Active Directory <feature name>" or "Azure AD <feature name>" will be branded as Microsoft Entra product family features. This is done across our portfolio to avoid naming length and complexity, and because many features work across all the products. For example: +Capabilities or services formerly known as "Azure Active Directory <feature name>" or "Azure AD <feature name>" are branded as Microsoft Entra product family features. This change is done across our portfolio to avoid naming length and complexity, and because many features work across all the products. For example: - "Azure AD Conditional Access" is now "Microsoft Entra Conditional Access" - "Azure AD single sign-on" is now "Microsoft Entra single sign-on" -See the [Glossary of updated terminology](#glossary-of-updated-terminology) later in this article for more examples. --### Exceptions and clarifications to the Azure AD name change --Names aren't changing for Active Directory, developer tools, Azure AD B2C, nor deprecated or retired functionality, features, or services. +For a detailed list, see the [Glossary of updated terminology](#glossary-of-updated-terminology). -Don't rename the following features, functionality, or services. +### What names aren't changing? -#### Azure AD renaming exceptions and clarifications +The following table lists terminology that is not impacted by the Azure AD rename. Names aren't changing for Active Directory, developer tools, Azure AD B2C, nor deprecated or retired functionality, features, or services. | **Correct terminology** | **Details** | |-|-| | Active Directory <br/><br/>• Windows Server Active Directory <br/>• Active Directory Federation Services (AD FS) <br/>• Active Directory Domain Services (AD DS) <br/>• Active Directory <br/>• Any Active Directory feature(s) | Windows Server Active Directory, commonly known as Active Directory, and related features and services associated with Active Directory aren't branded with Microsoft Entra. |-| Authentication library <br/><br/>• Azure AD Authentication Library (ADAL) <br/>• Microsoft Authentication Library (MSAL) | Azure Active Directory Authentication Library (ADAL) is deprecated. While existing apps that use ADAL will continue to work, Microsoft will no longer release security fixes on ADAL. Migrate applications to the Microsoft Authentication Library (MSAL) to avoid putting your app's security at risk. <br/><br/>[Microsoft Authentication Library (MSAL)](../develop/msal-overview.md) - Provides security tokens from the Microsoft identity platform to authenticate users and access secured web APIs to provide secure access to Microsoft Graph, other Microsoft APIs, third-party web APIs, or your own web API. | -| B2C <br/><br/>• Azure Active Directory B2C <br/>• Azure AD B2C | [Azure Active Directory B2C](/azure/active-directory-b2c) isn't being renamed. Microsoft Entra External ID for customers is Microsoft's new customer identity and access management (CIAM) solution. | -| Graph <br/><br/>• Azure Active Directory Graph <br/>• Azure AD Graph <br/>• Microsoft Graph | Azure Active Directory (Azure AD) Graph is deprecated. Going forward, we will make no further investment in Azure AD Graph, and Azure AD Graph APIs have no SLA or maintenance commitment beyond security-related fixes. Investments in new features and functionalities will only be made in Microsoft Graph.<br/><br/>[Microsoft Graph](/graph) - Grants programmatic access to organization, user, and application data stored in Microsoft Entra ID. | +| Authentication library <br/><br/>• Azure AD Authentication Library (ADAL) <br/>• Microsoft Authentication Library (MSAL) | Azure Active Directory Authentication Library (ADAL) is deprecated. While existing apps that use ADAL continue to work, Microsoft will no longer release security fixes on ADAL. Migrate applications to the Microsoft Authentication Library (MSAL) to avoid putting your app's security at risk. <br/><br/>[Microsoft Authentication Library (MSAL)](../develop/msal-overview.md) - Provides security tokens from the Microsoft identity platform to authenticate users and access secured web APIs to provide secure access to Microsoft Graph, other Microsoft APIs, third-party web APIs, or your own web API. | +| B2C <br/><br/>• Azure Active Directory B2C <br/>• Azure AD B2C | [Azure Active Directory B2C](/azure/active-directory-b2c) isn't being renamed. We're continuing to invest in security, availability, and reliability in Azure AD B2C and our next-generation solution for external identities, [Microsoft Entra External ID](/azure/active-directory/external-identities). | +| Graph <br/><br/>• Azure Active Directory Graph <br/>• Azure AD Graph <br/>• Microsoft Graph | Azure Active Directory (Azure AD) Graph is deprecated. Going forward, further investment in Azure AD Graph won't be made, and Azure AD Graph APIs have no SLA or maintenance commitment beyond security-related fixes. Investments in new features and functionalities will only be made in Microsoft Graph.<br/><br/>[Microsoft Graph](/graph) - Grants programmatic access to organization, user, and application data stored in Microsoft Entra ID. | | PowerShell <br/><br/>• Azure Active Directory PowerShell <br/>• Azure AD PowerShell <br/>• Microsoft Graph PowerShell | Azure AD PowerShell for Graph is planned for deprecation on March 30, 2024. For more info on the deprecation plans, see the deprecation update. We encourage you to migrate to Microsoft Graph PowerShell, which is the recommended module for interacting with Azure AD. <br/><br/>[Microsoft Graph PowerShell](/powershell/microsoftgraph/overview) - Acts as an API wrapper for the Microsoft Graph APIs and helps administer every Microsoft Entra ID feature that has an API in Microsoft Graph. | | Accounts <br/><br/>• Microsoft account <br/>• Work or school account | For end user sign-ins and account experiences, follow guidance for work and school accounts in [Sign in with Microsoft branding guidelines](../develop/howto-add-branding-in-apps.md). |-| Microsoft identity platform | The Microsoft identity platform encompasses all our identity and access developer assets. It will continue to provide the resources to help you build applications that your users and customers can sign in to using their Microsoft identities or social accounts. | +| Microsoft identity platform | The Microsoft identity platform encompasses all our identity and access developer assets. It continues to provide the resources to help you build applications that your users and customers can sign in to using their Microsoft identities or social accounts. | | <br/>• Azure AD Sync <br/>• DirSync | DirSync and Azure AD Sync aren't supported and no longer work. If you're still using DirSync or Azure AD Sync, you must upgrade to Microsoft Entra Connect to resume your sync process. For more info, see [Microsoft Entra Connect](/azure/active-directory/hybrid/connect/how-to-dirsync-upgrade-get-started). | -## Glossary of updated terminology --Features of the identity and network access products are attributed to Microsoft EntraΓÇöthe product family, not the individual product name. --You're not required to use the Microsoft Entra attribution with features. Only use if needed to clarify whether you're talking about a concept versus the feature in a specific product, or when comparing a Microsoft Entra feature with a competing feature. --Only official product names are capitalized, plus Conditional Access and My * apps. --| **Category** | **Old terminology** | **Correct name as of July 2023** | -|-||-| -| **Microsoft Entra product family** | Microsoft Azure Active Directory<br/> Azure Active Directory<br/> Azure Active Directory (Azure AD)<br/> Azure AD<br/> AAD | Microsoft Entra ID<br/> (Second use: Microsoft Entra ID is preferred, ID is acceptable in product/UI experiences, ME-ID if abbreviation is necessary) | -| | Azure Active Directory External Identities<br/> Azure AD External Identities | Microsoft Entra External ID<br/> (Second use: External ID) | -| | Azure Active Directory Identity Governance<br/> Azure AD Identity Governance<br/> Microsoft Entra Identity Governance | Microsoft Entra ID Governance<br/> (Second use: ID Governance) | -| | *New* | Microsoft Entra Internet Access<br/> (Second use: Internet Access) | -| | Cloud Knox | Microsoft Entra Permissions Management<br/> (Second use: Permissions Management) | -| | *New* | Microsoft Entra Private Access<br/> (Second use: Private Access) | -| | Azure Active Directory Verifiable Credentials<br/> Azure AD Verifiable Credentials | Microsoft Entra Verified ID<br/> (Second use: Verified ID) | -| | Azure Active Directory Workload Identities<br/> Azure AD Workload Identities | Microsoft Entra Workload ID<br/> (Second use: Workload ID) | -| | Azure Active Directory Domain Services<br/> Azure AD Domain Services | Microsoft Entra Domain Services<br/> (Second use: Domain Services) | -| **Microsoft Entra ID SKUs** | Azure Active Directory Premium P1 | Microsoft Entra ID P1 | -| | Azure Active Directory Premium P1 for faculty | Microsoft Entra ID P1 for faculty | -| | Azure Active Directory Premium P1 for students | Microsoft Entra ID P1 for students | -| | Azure Active Directory Premium P1 for government | Microsoft Entra ID P1 for government | -| | Azure Active Directory Premium P2 | Microsoft Entra ID P2 | -| | Azure Active Directory Premium P2 for faculty | Microsoft Entra ID P2 for faculty | -| | Azure Active Directory Premium P2 for students | Microsoft Entra ID P2 for students | -| | Azure Active Directory Premium P2 for government | Microsoft Entra ID P2 for government | -| | Azure Active Directory Premium F2 | Microsoft Entra ID F2 | -| **Microsoft Entra ID service plans** | Azure Active Directory Free | Microsoft Entra ID Free | -| | Azure Active Directory Premium P1 | Microsoft Entra ID P1 | -| | Azure Active Directory Premium P2 | Microsoft Entra ID P2 | -| | Azure Active Directory for education | Microsoft Entra ID for education | -| **Features and functionality** | Azure AD access token authentication<br/> Azure Active Directory access token authentication | Microsoft Entra access token authenticationΓÇ»| -| | Azure AD account<br/> Azure Active Directory account | Microsoft Entra account<br/><br/> This terminology is only used with IT admins and developers. End users authenticate with a work or school account. | -| | Azure AD activity logs | Microsoft Entra activity logs | -| | Azure AD admin<br/> Azure Active Directory admin | Microsoft Entra admin | -| | Azure AD admin center<br/> Azure Active Directory admin center | Replace with Microsoft Entra admin center and update link to entra.microsoft.com | -| | Azure AD application proxy<br/> Azure Active Directory application proxy | Microsoft Entra application proxy | -| | Azure AD audit log | Microsoft Entra audit log | -| | Azure AD authentication<br/> authenticate with an Azure AD identity<br/> authenticate with Azure AD<br/> authentication to Azure AD | Microsoft Entra authentication<br/> authenticate with a Microsoft Entra identity<br/> authenticate with Microsoft Entra<br/> authentication to Microsoft Entra<br/><br/> This terminology is only used with administrators. End users authenticate with a work or school account. | -| | Azure AD B2B<br/> Azure Active Directory B2B | Microsoft Entra B2B | -| | Azure AD built-in roles<br/> Azure Active Directory built-in roles | Microsoft Entra built-in roles | -| | Azure AD Conditional Access<br/> Azure Active Directory Conditional Access | Microsoft Entra Conditional Access<br/> (Second use: Conditional Access) | -| | Azure AD cloud-only identities<br/> Azure Active Directory cloud-only identities | Microsoft Entra cloud-only identities | -| | Azure AD Connect<br/> Azure Active Directory Connect | Microsoft Entra Connect | -| | Azure AD Connect Sync<br/> Azure Active Directory Connect Sync | Microsoft Entra Connect Sync | -| | Azure AD domain<br/> Azure Active Directory domain | Microsoft Entra domain | -| | Azure AD Domain Services<br/> Azure Active Directory Domain Services | Microsoft Entra Domain Services | -| | Azure AD enterprise application<br/> Azure Active Directory enterprise application | Microsoft Entra enterprise application | -| | Azure AD federation services<br/> Azure Active Directory federation services | Active Directory Federation Services | -| | Azure AD groups<br/> Azure Active Directory groups | Microsoft Entra groups | -| | Azure AD hybrid identities<br/> Azure Active Directory hybrid identities | Microsoft Entra hybrid identities | -| | Azure AD identities<br/> Azure Active Directory identities | Microsoft Entra identities | -| | Azure AD identity protection<br/> Azure Active Directory identity protection | Microsoft Entra ID Protection | -| | Azure AD integrated authentication<br/> Azure Active Directory integrated authentication | Microsoft Entra integrated authentication | -| | Azure AD join<br/> Azure AD joined<br/> Azure Active Directory join<br/> Azure Active Directory joined | Microsoft Entra join<br/> Microsoft Entra joined | -| | Azure AD login<br/> Azure Active Directory login | Microsoft Entra login | -| | Azure AD managed identities<br/> Azure Active Directory managed identities | Microsoft Entra managed identities | -| | Azure AD multifactor authentication (MFA)<br/> Azure Active Directory multifactor authentication (MFA) | Microsoft Entra multifactor authentication (MFA)<br/> (Second use: MFA) | -| | Azure AD OAuth and OpenID Connect<br/> Azure Active Directory OAuth and OpenID Connect | Microsoft Entra ID OAuth and OpenID Connect | -| | Azure AD object<br/> Azure Active Directory object | Microsoft Entra object | -| | Azure Active Directory-only authentication<br/> Azure AD-only authentication | Microsoft Entra-only authentication | -| | Azure AD pass-through authentication (PTA)<br/> Azure Active Directory pass-through authentication (PTA) | Microsoft Entra pass-through authentication | -| | Azure AD password authentication<br/> Azure Active Directory password authentication | Microsoft Entra password authentication | -| | Azure AD password hash synchronization (PHS)<br/> Azure Active Directory password hash synchronization (PHS) | Microsoft Entra password hash synchronization | -| | Azure AD password protection<br/> Azure Active Directory password protection | Microsoft Entra password protection | -| | Azure AD principal ID<br/> Azure Active Directory principal ID | Microsoft Entra principal ID | -| | Azure AD Privileged Identity Management (PIM)<br/> Azure Active Directory Privileged Identity Management (PIM) | Microsoft Entra Privileged Identity Management (PIM) | -| | Azure AD registered<br/> Azure Active Directory registered | Microsoft Entra registered | -| | Azure AD reporting and monitoring<br/> Azure Active Directory reporting and monitoring | Microsoft Entra reporting and monitoring | -| | Azure AD role<br/> Azure Active Directory role | Microsoft Entra role | -| | Azure AD schema<br/> Azure Active Directory schema | Microsoft Entra schema | -| | Azure AD Seamless single sign-on (SSO)<br/> Azure Active Directory Seamless single sign-on (SSO) | Microsoft Entra seamless single sign-on (SSO)<br/> (Second use: SSO) | -| | Azure AD self-service password reset (SSPR)<br/> Azure Active Directory self-service password reset (SSPR) | Microsoft Entra self-service password reset (SSPR) | -| | Azure AD service principal<br/> Azure Active Directory service principal | Microsoft Entra service principal | -| | Azure AD tenant<br/> Azure Active Directory tenant | Microsoft Entra tenant | -| | Create a user in Azure AD<br/> Create a user in Azure Active Directory | Create a user in Microsoft Entra | -| | Federated with Azure AD<br/> Federated with Azure Active Directory | Federated with Microsoft Entra | -| | Hybrid Azure AD Join<br/> Hybrid Azure AD Joined | Microsoft Entra hybrid join<br/> Microsoft Entra hybrid joined | -| | Managed identities in Azure AD for Azure SQL | Managed identities in Microsoft Entra for Azure SQL | -| **Acronym usage** | AAD | ME-ID<br/><br/> Note that this isn't an official abbreviation for the product but may be used in code or when absolute shortest form is required. | - ## Frequently asked questions ### When is the name change happening? The name change will appear across Microsoft experiences starting August 15, 202 As part of our ongoing commitment to simplify secure access experiences for everyone, the renaming of Azure AD to Microsoft Entra ID is designed to make it easier to use and navigate the unified and expanded Microsoft Entra product family. +The Microsoft Entra ID name more accurately represents the multicloud and multiplatform functionality of the product, alleviates confusion with the on-premises identity solution (Active Directory), and creates a path to deliver a simpler way to protect every identity and secure every access point as we expand the Microsoft Entra identity and network access portfolio. + ### What is Microsoft Entra? Microsoft Entra helps you protect all identities and secure network access everywhere. The expanded product family includes: Licensing, pricing, and functionality aren't changing. Display names will be upd No, only the name Azure AD is going away. Capabilities remain the same. +### Does Microsoft still support on-premises identity management? ++We continue to support and enhance Windows Server Active Directory for on-premises identity and access management and the connection to Azure and other clouds, as many organizations continue to rely on this solution. ++The name for Active Directory remains unchanged. Based on extensive feedback we've received about Microsoft Entra ID as the new name for Azure Active Directory, for many customers the rename helps to better differentiate between the on-premises (Active Directory) and multicloud identity (Microsoft Entra ID) solutions. + ### What will happen to the Azure AD capabilities and features like App Gallery or Conditional Access? All features and capabilities remain unchanged aside from the name. Customers can continue to use all features without any interruption. The naming of features changes to Microsoft Entra. For example: - Azure AD tenant -> Microsoft Entra tenant - Azure AD account -> Microsoft Entra account -See the [Glossary of updated terminology](#glossary-of-updated-terminology) for more examples. +For more examples, see the glossary of feature name updates in [How to: Rename Azure AD](how-to-rename-azure-ad.md). ### Are licenses changing? Are there any changes to pricing? No. Prices, terms and service level agreements (SLAs) remain the same. Pricing d ### Will Microsoft Entra ID be available as a free service with an Azure subscription? -Customers currently using Azure AD Free as part of their Azure, Microsoft 365, Dynamics 365, Teams, or Intune subscription will continue to have access to the same capabilities. It will be called Microsoft Entra ID Free. Get the free version at <https://www.microsoft.com/security/business/microsoft-entra-pricing>. +Customers currently using Azure AD Free as part of their Azure, Microsoft 365, Dynamics 365, Teams, or Intune subscription continue to have access to the same capabilities. It will be called Microsoft Entra ID Free. Get the free version at <https://www.microsoft.com/security/business/microsoft-entra-pricing>. ### What's changing for Microsoft 365 or Azure AD for Office 365? -Microsoft Entra ID ΓÇô currently known as Azure AD ΓÇô will continue to be available within Microsoft 365 enterprise and business premium offers. Office 365 was renamed Microsoft 365 in 2022. Unique capabilities in the Azure AD for Office 365 apps (such as company branding and self-service sign-in activity search) will now be available to all Microsoft customers in Microsoft Entra ID Free. +Microsoft Entra ID ΓÇô currently known as Azure AD ΓÇô continues to be available within Microsoft 365 enterprise and business premium offers. Office 365 was renamed Microsoft 365 in 2022. Unique capabilities in the Azure AD for Office 365 apps (such as company branding and self-service sign-in activity search) are now be available to all Microsoft customers in Microsoft Entra ID Free. ### What's changing for Microsoft 365 E3? There are no changes to the identity features and functionality available in Mic ### What's changing for Microsoft 365 E5? -In addition to the capabilities they already have, Microsoft 365 E5 customers will also get access to new identity protection capabilities like token protection, Conditional Access based on GPS-based location and step-up authentication for the most sensitive actions. Microsoft 365 E5 includes Microsoft Entra P2, currently known as Azure AD Premium P2. +In addition to the capabilities they already have, Microsoft 365 E5 customers also get access to new identity protection capabilities like token protection, Conditional Access based on GPS-based location and step-up authentication for the most sensitive actions. Microsoft 365 E5 includes Microsoft Entra P2, currently known as Azure AD Premium P2. ### What's changing for identity developer and devops experience? Identity developer and devops experiences aren't being renamed. To make the tran Many technical components either have low visibility to customers (for example, sign-in URLs), or usually aren't branded, like APIs. -Microsoft identity platform encompasses all our identity and access developer assets. It will continue to provide the resources to help you build applications that your users and customers can sign in to using their Microsoft identities or social accounts. +Microsoft identity platform encompasses all our identity and access developer assets. It continues to provide the resources to help you build applications that your users and customers can sign in to using their Microsoft identities or social accounts. Naming is also not changing for: Naming is also not changing for: - [Microsoft Graph PowerShell](/powershell/microsoftgraph/overview) ΓÇô Acts as an API wrapper for the Microsoft Graph APIs; helps administer every Microsoft Entra ID feature that has an API in Microsoft Graph. - [Windows Server Active Directory](/troubleshoot/windows-server/identity/active-directory-overview), commonly known as ΓÇ£Active DirectoryΓÇ¥, and all related Windows Server identity services, associated with Active Directory. - [Active Directory Federation Services (AD FS)](/windows-server/identity/active-directory-federation-services) nor [Active Directory Domain Services (AD DS)](/windows-server/identity/ad-ds/active-directory-domain-services) nor the product name ΓÇ£Active DirectoryΓÇ¥ or any corresponding features.-- [Azure Active Directory B2C](/azure/active-directory-b2c) will continue to be available as an Azure service.+- [Azure Active Directory B2C](/azure/active-directory-b2c) continues to be available as an Azure service. The name Azure AD B2C is not changing nor is our commitment to the service and our customers. The service level agreement for Azure AD B2C remains unchanged and we'll continue investments to ensure security, availability, and reliability in both Azure AD B2C as well as our next generation solution for external identities, Microsoft Entra External ID, which is now in public preview. - Any deprecated or retired functionality, feature, or service of Azure Active Directory. +### Are PowerShell cmdlets being renamed? ++No. Today, we offer two PowerShell modules for administering identity tasks: the Azure AD PowerShell module, which is planned for deprecation in March 2024, and the Microsoft Graph PowerShell module. ++In the Azure AD PowerShell for Graph module, "AzureAD" is in the name of almost all the cmdlets. These won't change, and you can continue to use these same cmdlets now that the official product name is Microsoft Entra ID. ++Microsoft Graph PowerShell cmdlets aren't branded with Azure AD. We encourage you to plan your migration from Azure AD PowerShell to Microsoft Graph PowerShell, which is the recommended module for interacting with Microsoft Entra ID in the future. + ### How and when are customers being notified? The name changes were publicly announced on July 11, 2023. Banners, alerts, and message center posts notified users of the name change. The ### What if I use the Azure AD name in my content or app? -We'd like your help spreading the word about the name change and implementing it in your own experiences. If you're a content creator, author of internal documentation for IT or identity security admins, developer of Azure ADΓÇôenabled apps, independent software vendor, or Microsoft partner, we hope you use the naming guidance outlined in the ([Glossary of updated terminology](#glossary-of-updated-terminology)) to make the name change in your content and product experiences by the end of 2023. +We'd like your help spreading the word about the name change and implementing it in your own experiences. If you're a content creator, author of internal documentation for IT or identity security admins, developer of Azure ADΓÇôenabled apps, independent software vendor, or Microsoft partner, we hope you use the naming guidance outlined in [How to: Rename Azure AD](how-to-rename-azure-ad.md) to make the name change in your content and product experiences by the end of 2023. ++## Glossary of updated terminology ++Features of the identity and network access products are attributed to Microsoft EntraΓÇöthe product family, not the individual product name. ++You're not required to use the Microsoft Entra attribution with features. Only use if needed to clarify whether you're talking about a concept versus the feature in a specific product, or when comparing a Microsoft Entra feature with a competing feature. ++Only official product names are capitalized, plus Conditional Access and My * apps. ++| **Category** | **Old terminology** | **Correct name as of July 2023** | +|-||-| +| **Microsoft Entra product family** | Microsoft Azure Active Directory<br/> Azure Active Directory<br/> Azure Active Directory (Azure AD)<br/> Azure AD<br/> AAD | Microsoft Entra ID<br/> (Second use: Microsoft Entra ID is preferred, ID is acceptable in product/UI experiences, ME-ID if abbreviation is necessary) | +| | Azure Active Directory External Identities<br/> Azure AD External Identities | Microsoft Entra External ID<br/> (Second use: External ID) | +| | Azure Active Directory Identity Governance<br/> Azure AD Identity Governance<br/> Microsoft Entra Identity Governance | Microsoft Entra ID Governance<br/> (Second use: ID Governance) | +| | *New* | Microsoft Entra Internet Access<br/> (Second use: Internet Access) | +| | Cloud Knox | Microsoft Entra Permissions Management<br/> (Second use: Permissions Management) | +| | *New* | Microsoft Entra Private Access<br/> (Second use: Private Access) | +| | Azure Active Directory Verifiable Credentials<br/> Azure AD Verifiable Credentials | Microsoft Entra Verified ID<br/> (Second use: Verified ID) | +| | Azure Active Directory Workload Identities<br/> Azure AD Workload Identities | Microsoft Entra Workload ID<br/> (Second use: Workload ID) | +| | Azure Active Directory Domain Services<br/> Azure AD Domain Services | Microsoft Entra Domain Services<br/> (Second use: Domain Services) | +| **Microsoft Entra ID SKUs** | Azure Active Directory Premium P1 | Microsoft Entra ID P1 | +| | Azure Active Directory Premium P1 for faculty | Microsoft Entra ID P1 for faculty | +| | Azure Active Directory Premium P1 for students | Microsoft Entra ID P1 for students | +| | Azure Active Directory Premium P1 for government | Microsoft Entra ID P1 for government | +| | Azure Active Directory Premium P2 | Microsoft Entra ID P2 | +| | Azure Active Directory Premium P2 for faculty | Microsoft Entra ID P2 for faculty | +| | Azure Active Directory Premium P2 for students | Microsoft Entra ID P2 for students | +| | Azure Active Directory Premium P2 for government | Microsoft Entra ID P2 for government | +| | Azure Active Directory Premium F2 | Microsoft Entra ID F2 | +| **Microsoft Entra ID service plans** | Azure Active Directory Free | Microsoft Entra ID Free | +| | Azure Active Directory Premium P1 | Microsoft Entra ID P1 | +| | Azure Active Directory Premium P2 | Microsoft Entra ID P2 | +| | Azure Active Directory for education | Microsoft Entra ID for education | +| **Features and functionality** | Azure AD access token authentication<br/> Azure Active Directory access token authentication | Microsoft Entra access token authenticationΓÇ»| +| | Azure AD account<br/> Azure Active Directory account | Microsoft Entra account<br/><br/> This terminology is only used with IT admins and developers. End users authenticate with a work or school account. | +| | Azure AD activity logs | Microsoft Entra activity logs | +| | Azure AD admin<br/> Azure Active Directory admin | Microsoft Entra admin | +| | Azure AD admin center<br/> Azure Active Directory admin center | Replace with Microsoft Entra admin center and update link to entra.microsoft.com | +| | Azure AD application proxy<br/> Azure Active Directory application proxy | Microsoft Entra application proxy | +| | Azure AD audit log | Microsoft Entra audit log | +| | Azure AD authentication<br/> authenticate with an Azure AD identity<br/> authenticate with Azure AD<br/> authentication to Azure AD | Microsoft Entra authentication<br/> authenticate with a Microsoft Entra identity<br/> authenticate with Microsoft Entra<br/> authentication to Microsoft Entra<br/><br/> This terminology is only used with administrators. End users authenticate with a work or school account. | +| | Azure AD B2B<br/> Azure Active Directory B2B | Microsoft Entra B2B | +| | Azure AD built-in roles<br/> Azure Active Directory built-in roles | Microsoft Entra built-in roles | +| | Azure AD Conditional Access<br/> Azure Active Directory Conditional Access | Microsoft Entra Conditional Access<br/> (Second use: Conditional Access) | +| | Azure AD cloud-only identities<br/> Azure Active Directory cloud-only identities | Microsoft Entra cloud-only identities | +| | Azure AD Connect<br/> Azure Active Directory Connect | Microsoft Entra Connect | +| | Azure AD Connect Sync<br/> Azure Active Directory Connect Sync | Microsoft Entra Connect Sync | +| | Azure AD domain<br/> Azure Active Directory domain | Microsoft Entra domain | +| | Azure AD Domain Services<br/> Azure Active Directory Domain Services | Microsoft Entra Domain Services | +| | Azure AD enterprise application<br/> Azure Active Directory enterprise application | Microsoft Entra enterprise application | +| | Azure AD federation services<br/> Azure Active Directory federation services | Active Directory Federation Services | +| | Azure AD groups<br/> Azure Active Directory groups | Microsoft Entra groups | +| | Azure AD hybrid identities<br/> Azure Active Directory hybrid identities | Microsoft Entra hybrid identities | +| | Azure AD identities<br/> Azure Active Directory identities | Microsoft Entra identities | +| | Azure AD identity protection<br/> Azure Active Directory identity protection | Microsoft Entra ID Protection | +| | Azure AD integrated authentication<br/> Azure Active Directory integrated authentication | Microsoft Entra integrated authentication | +| | Azure AD join<br/> Azure AD joined<br/> Azure Active Directory join<br/> Azure Active Directory joined | Microsoft Entra join<br/> Microsoft Entra joined | +| | Azure AD login<br/> Azure Active Directory login | Microsoft Entra login | +| | Azure AD managed identities<br/> Azure Active Directory managed identities | Microsoft Entra managed identities | +| | Azure AD multifactor authentication (MFA)<br/> Azure Active Directory multifactor authentication (MFA) | Microsoft Entra multifactor authentication (MFA)<br/> (Second use: MFA) | +| | Azure AD OAuth and OpenID Connect<br/> Azure Active Directory OAuth and OpenID Connect | Microsoft Entra ID OAuth and OpenID Connect | +| | Azure AD object<br/> Azure Active Directory object | Microsoft Entra object | +| | Azure Active Directory-only authentication<br/> Azure AD-only authentication | Microsoft Entra-only authentication | +| | Azure AD pass-through authentication (PTA)<br/> Azure Active Directory pass-through authentication (PTA) | Microsoft Entra pass-through authentication | +| | Azure AD password authentication<br/> Azure Active Directory password authentication | Microsoft Entra password authentication | +| | Azure AD password hash synchronization (PHS)<br/> Azure Active Directory password hash synchronization (PHS) | Microsoft Entra password hash synchronization | +| | Azure AD password protection<br/> Azure Active Directory password protection | Microsoft Entra password protection | +| | Azure AD principal ID<br/> Azure Active Directory principal ID | Microsoft Entra principal ID | +| | Azure AD Privileged Identity Management (PIM)<br/> Azure Active Directory Privileged Identity Management (PIM) | Microsoft Entra Privileged Identity Management (PIM) | +| | Azure AD registered<br/> Azure Active Directory registered | Microsoft Entra registered | +| | Azure AD reporting and monitoring<br/> Azure Active Directory reporting and monitoring | Microsoft Entra reporting and monitoring | +| | Azure AD role<br/> Azure Active Directory role | Microsoft Entra role | +| | Azure AD schema<br/> Azure Active Directory schema | Microsoft Entra schema | +| | Azure AD Seamless single sign-on (SSO)<br/> Azure Active Directory Seamless single sign-on (SSO) | Microsoft Entra seamless single sign-on (SSO)<br/> (Second use: SSO) | +| | Azure AD self-service password reset (SSPR)<br/> Azure Active Directory self-service password reset (SSPR) | Microsoft Entra self-service password reset (SSPR) | +| | Azure AD service principal<br/> Azure Active Directory service principal | Microsoft Entra service principal | +| | Azure AD tenant<br/> Azure Active Directory tenant | Microsoft Entra tenant | +| | Create a user in Azure AD<br/> Create a user in Azure Active Directory | Create a user in Microsoft Entra | +| | Federated with Azure AD<br/> Federated with Azure Active Directory | Federated with Microsoft Entra | +| | Hybrid Azure AD Join<br/> Hybrid Azure AD Joined | Microsoft Entra hybrid join<br/> Microsoft Entra hybrid joined | +| | Managed identities in Azure AD for Azure SQL | Managed identities in Microsoft Entra for Azure SQL | +| **Acronym usage** | AAD | ME-ID<br/><br/> Note that this isn't an official abbreviation for the product but may be used in code or when absolute shortest form is required. | ## Revision history | Date | Change description | ||--|-| August 29, 2023 | <br/>• In the [glossary](#glossary-of-updated-terminology), corrected the entry for "Azure AD activity logs" to separate "Azure AD audit log", which is a distinct type of activity log. <br/>• Added Azure AD Sync and DirSync to the [Azure AD renaming exceptions and clarifications](#azure-ad-renaming-exceptions-and-clarifications) section. | +| September 15, 2023 | Added a link to the new article, [How to: Rename Azure AD](how-to-rename-azure-ad.md), updated the description for Azure AD B2C, and added more info about why the name Azure AD is changing. | +| August 29, 2023 | <br/>• In the [glossary](#glossary-of-updated-terminology), corrected the entry for "Azure AD activity logs" to separate "Azure AD audit log", which is a distinct type of activity log. <br/>• Added Azure AD Sync and DirSync to the [What names aren't changing](#what-names-arent-changing) section. | | August 18, 2023 | <br/>• Updated the article to include a new section [Glossary of updated terminology](#glossary-of-updated-terminology), which includes the old and new terminology.<br/>• Updated info and added link to usage of the Microsoft Entra ID icon, and updates to verbiage in some sections. | | July 11, 2023 | Published the original guidance as part of the [Microsoft Entra moment and related announcement](https://www.microsoft.com/security/blog/2023/07/11/microsoft-entra-expands-into-security-service-edge-and-azure-ad-becomes-microsoft-entra-id/?culture=en-us&country=us). | ## Next steps +- [How to: Rename Azure AD](how-to-rename-azure-ad.md) - [Stay up-to-date with what's new in Azure AD/Microsoft Entra ID](whats-new.md) - [Get started using Microsoft Entra ID at the Microsoft Entra admin center](https://entra.microsoft.com/) - [Learn more about Microsoft Entra with content from Microsoft Learn](/entra) |
| active-directory | Whats New Archive | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/whats-new-archive.md | The What's new in Azure Active Directory? release notes provide information abou +## March 2023 +++### Public Preview - New provisioning connectors in the Azure AD Application Gallery - March 2023 ++**Type:** New feature +**Service category:** App Provisioning +**Product capability:** 3rd Party Integration + ++We've added the following new applications in our App gallery with Provisioning support. You can now automate creating, updating, and deleting of user accounts for these newly integrated apps: ++- [Acunetix 360](../saas-apps/acunetix-360-provisioning-tutorial.md) +- [Akamai Enterprise Application Access](../saas-apps/akamai-enterprise-application-access-provisioning-tutorial.md) +- [Ardoq](../saas-apps/ardoq-provisioning-tutorial.md) +- [Torii](../saas-apps/torii-provisioning-tutorial.md) +++For more information about how to better secure your organization by using automated user account provisioning, see: [Automate user provisioning to SaaS applications with Azure AD](../app-provisioning/user-provisioning.md). +++++### General Availability - Workload identity Federation for Managed Identities ++**Type:** New feature +**Service category:** Managed identities for Azure resources +**Product capability:** Developer Experience ++Workload Identity Federation enables developers to use managed identities for their software workloads running anywhere and access Azure resources without needing secrets. Key scenarios include: +- Accessing Azure resources from Kubernetes pods running in any cloud or on-premises +- GitHub workflows to deploy to Azure, no secrets necessary +- Accessing Azure resources from other cloud platforms that support OIDC, such as Google Cloud Platform. ++For more information, see: +- [Workload identity federation](../workload-identities/workload-identity-federation.md). +- [Configure a user-assigned managed identity to trust an external identity provider (preview)](../workload-identities/workload-identity-federation-create-trust-user-assigned-managed-identity.md) +- [Use Azure AD workload identity with Azure Kubernetes Service (AKS)](../../aks/workload-identity-overview.md) ++++### Public Preview - New My Groups Experience ++**Type:** Changed feature +**Service category:** Group Management +**Product capability:** End User Experiences ++A new and improved My Groups experience is now available at `https://www.myaccount.microsoft.com/groups`. My Groups enables end users to easily manage groups, such as finding groups to join, managing groups they own, and managing existing group memberships. Based on customer feedback, the new My Groups support sorting and filtering on lists of groups and group members, a full list of group members in large groups, and an actionable overview page for membership requests. +This experience replaces the existing My Groups experience at `https://www.mygroups.microsoft.com` in May. +++For more information, see: [Update your Groups info in the My Apps portal](https://support.microsoft.com/account-billing/update-your-groups-info-in-the-my-apps-portal-bc0ca998-6d3a-42ac-acb8-e900fb1174a4). ++++### Public preview - Customize tokens with Custom Claims Providers ++**Type:** New feature +**Service category:** Authentications (Logins) +**Product capability:** Extensibility ++A custom claims provider lets you call an API and map custom claims into the token during the authentication flow. The API call is made after the user has completed all their authentication challenges, and a token is about to be issued to the app. For more information, see: [Custom authentication extensions (preview)](../develop/custom-claims-provider-overview.md). ++++### General Availability - Converged Authentication Methods ++**Type:** New feature +**Service category:** MFA +**Product capability:** User Authentication ++The Converged Authentication Methods Policy enables you to manage all authentication methods used for MFA and SSPR in one policy, migrate off the legacy MFA and SSPR policies, and target authentication methods to groups of users instead of enabling them for all users in your tenant. For more information, see: [Manage authentication methods](../authentication/concept-authentication-methods-manage.md). ++++### General Availability - Provisioning Insights Workbook ++**Type:** New feature +**Service category:** Provisioning +**Product capability:** Monitoring & Reporting ++This new workbook makes it easier to investigate and gain insights into your provisioning workflows in a given tenant. This includes HR-driven provisioning, cloud sync, app provisioning, and cross-tenant sync. ++Some key questions this workbook can help answer are: ++- How many identities have been synced in a given time range? +- How many create, delete, update, or other operations were performed? +- How many operations were successful, skipped, or failed? +- What specific identities failed? And what step did they fail on? +- For any given user, what tenants / applications were they provisioned or deprovisioned to? ++For more information, see: [Provisioning insights workbook](../app-provisioning/provisioning-workbook.md). ++++### General Availability - Number Matching for Microsoft Authenticator notifications ++**Type:** Plan for Change +**Service category:** Microsoft Authenticator App +**Product capability:** User Authentication ++Microsoft Authenticator appΓÇÖs number matching feature has been Generally Available since Nov 2022! If you haven't already used the rollout controls (via Azure portal Admin UX and MSGraph APIs) to smoothly deploy number matching for users of Microsoft Authenticator push notifications, we highly encourage you to do so. We previously announced that we'll remove the admin controls and enforce the number match experience tenant-wide for all users of Microsoft Authenticator push notifications starting February 27, 2023. After listening to customers, we'll extend the availability of the rollout controls for a few more weeks. Organizations can continue to use the existing rollout controls until May 8, 2023, to deploy number matching in their organizations. Microsoft services will start enforcing the number matching experience for all users of Microsoft Authenticator push notifications after May 8, 2023. We'll also remove the rollout controls for number matching after that date. ++If customers donΓÇÖt enable number match for all Microsoft Authenticator push notifications prior to May 8, 2023, Authenticator users may experience inconsistent sign-ins while the services are rolling out this change. To ensure consistent behavior for all users, we highly recommend you enable number match for Microsoft Authenticator push notifications in advance. ++For more information, see: [How to use number matching in multifactor authentication (MFA) notifications - Authentication methods policy](../authentication/how-to-mfa-number-match.md) ++++### Public Preview - IPv6 coming to Azure AD ++**Type:** Plan for Change +**Service category:** Identity Protection +**Product capability:** Platform ++Earlier, we announced our plan to bring IPv6 support to Microsoft Azure Active Directory (Azure AD), enabling our customers to reach the Azure AD services over IPv4, IPv6 or dual stack endpoints. This is just a reminder that we have started introducing IPv6 support into Azure AD services in a phased approach in late March 2023. + +If you utilize Conditional Access or Identity Protection, and have IPv6 enabled on any of your devices, you likely must take action to avoid impacting your users. For most customers, IPv4 won't completely disappear from their digital landscape, so we aren't planning to require IPv6 or to deprioritize IPv4 in any Azure AD features or services. We continue to share additional guidance on IPv6 enablement in Azure AD at this link: [IPv6 support in Azure Active Directory](/troubleshoot/azure/active-directory/azure-ad-ipv6-support). ++++### General Availability - Microsoft cloud settings for Azure AD B2B ++**Type:** New feature +**Service category:** B2B +**Product capability:** B2B/B2C ++Microsoft cloud settings let you collaborate with organizations from different Microsoft Azure clouds. With Microsoft cloud settings, you can establish mutual B2B collaboration between the following clouds: ++- Microsoft Azure commercial and Microsoft Azure Government +- Microsoft Azure commercial and Microsoft Azure operated by 21Vianet ++For more information about Microsoft cloud settings for B2B collaboration, see [Microsoft cloud settings](../external-identities/cross-tenant-access-overview.md#microsoft-cloud-settings). ++++### Modernizing Terms of Use Experiences ++**Type:** Plan for Change +**Service category:** Terms of use +**Product capability:** AuthZ/Access Delegation ++Starting July 2023, we're modernizing the following Terms of Use end user experiences with an updated PDF viewer, and moving the experiences from https://account.activedirectory.windowsazure.com to https://myaccount.microsoft.com: +- View previously accepted terms of use. +- Accept or decline terms of use as part of the sign-in flow. ++No functionalities are removed. The new PDF viewer adds functionality and the limited visual changes in the end-user experiences will be communicated in a future update. If your organization has allow-listed only certain domains, you must ensure your allowlist includes the domains ΓÇÿmyaccount.microsoft.comΓÇÖ and ΓÇÿ*.myaccount.microsoft.comΓÇÖ for Terms of Use to continue working as expected. ++++ ## February 2023 ### General Availability - Expanding Privileged Identity Management Role Activation across the Azure portal Smart Lockout now synchronizes the lockout state across Azure AD data centers, s - --## April 2022 ---### General Availability - Entitlement management separation of duties checks for incompatible access packages --**Type:** Changed feature -**Service category:** Other -**Product capability:** Identity Governance --In Azure AD entitlement management, an administrator can now configure the incompatible access packages and groups of an access package in the Azure portal. This prevents a user who already has one of those incompatible access rights from being able to request further access. For more information, see: [Configure separation of duties checks for an access package in Azure AD entitlement management](../governance/entitlement-management-access-package-incompatible.md). -----### General Availability - Microsoft Defender for Endpoint Signal in Identity Protection --**Type:** New feature -**Service category:** Identity Protection -**Product capability:** Identity Security & Protection - --Identity Protection now integrates a signal from Microsoft Defender for Endpoint (MDE) that will protect against PRT theft detection. To learn more, see: [What is risk? Azure AD Identity Protection](../identity-protection/concept-identity-protection-risks.md). - ----### General Availability - Entitlement management 3 stages of approval --**Type:** Changed feature -**Service category:** Other -**Product capability:** Entitlement Management -- --This update extends the Azure AD entitlement management access package policy to allow a third approval stage. This is able to be configured via the Azure portal or Microsoft Graph. For more information, see: [Change approval and requestor information settings for an access package in Azure AD entitlement management](../governance/entitlement-management-access-package-approval-policy.md). - ----### General Availability - Improvements to Azure AD Smart Lockout --**Type:** Changed feature -**Service category:** Identity Protection -**Product capability:** User Management -- --With a recent improvement, Smart Lockout now synchronizes the lockout state across Azure AD data centers, so the total number of failed sign-in attempts allowed before an account is locked out will match the configured lockout threshold. For more information, see: [Protect user accounts from attacks with Azure Active Directory smart lockout](../authentication/howto-password-smart-lockout.md). - -----### Public Preview - Integration of Microsoft 365 App Certification details into Azure Active Directory UX and Consent Experiences --**Type:** New feature -**Service category:** User Access Management -**Product capability:** AuthZ/Access Delegation ---Microsoft 365 Certification status for an app is now available in Azure AD consent UX, and custom app consent policies. The status will later be displayed in several other Identity-owned interfaces such as enterprise apps. For more information, see: [Understanding Azure AD application consent experiences](../develop/application-consent-experience.md). -----### Public preview - Use Azure AD access reviews to review access of B2B direct connect users in Teams shared channels --**Type:** New feature -**Service category:** Access Reviews -**Product capability:** Identity Governance --Use Azure AD access reviews to review access of B2B direct connect users in Teams shared channels. For more information, see: [Include B2B direct connect users and teams accessing Teams Shared Channels in access reviews (preview)](../governance/create-access-review.md#include-b2b-direct-connect-users-and-teams-accessing-teams-shared-channels-in-access-reviews). ----### Public Preview - New MS Graph APIs to configure federated settings when federated with Azure AD --**Type:** New feature -**Service category:** MS Graph -**Product capability:** Identity Security & Protection ---We're announcing the public preview of following MS Graph APIs and PowerShell cmdlets for configuring federated settings when federated with Azure AD: --|Action |MS Graph API |PowerShell cmdlet | -|||| -|Get federation settings for a federated domain | [Get internalDomainFederation](/graph/api/internaldomainfederation-get?view=graph-rest-beta&preserve-view=true) | [Get-MgDomainFederationConfiguration](/powershell/module/microsoft.graph.identity.directorymanagement/get-mgdomainfederationconfiguration?view=graph-powershell-beta&preserve-view=true) | -|Create federation settings for a federated domain | [Create internalDomainFederation](/graph/api/domain-post-federationconfiguration?view=graph-rest-beta&preserve-view=true) | [New-MgDomainFederationConfiguration](/powershell/module/microsoft.graph.identity.directorymanagement/new-mgdomainfederationconfiguration?view=graph-powershell-beta&preserve-view=true) | -|Remove federation settings for a federated domain | [Delete internalDomainFederation](/graph/api/internaldomainfederation-delete?view=graph-rest-beta&preserve-view=true) | [Remove-MgDomainFederationConfiguration](/powershell/module/microsoft.graph.identity.directorymanagement/remove-mgdomainfederationconfiguration?view=graph-powershell-beta&preserve-view=true) | -|Update federation settings for a federated domain | [Update internalDomainFederation](/graph/api/internaldomainfederation-update?view=graph-rest-beta&preserve-view=true) | [Update-MgDomainFederationConfiguration](/powershell/module/microsoft.graph.identity.directorymanagement/update-mgdomainfederationconfiguration?view=graph-powershell-beta&preserve-view=true) | ---For more information, see [internalDomainFederation resource type - Microsoft Graph beta](/graph/api/resources/internaldomainfederation?view=graph-rest-beta&preserve-view=true). ----### Public Preview ΓÇô Ability to force reauthentication on Intune enrollment, risky sign-ins, and risky users --**Type:** New feature -**Service category:** RBAC role -**Product capability:** AuthZ/Access Delegation ---Added functionality to session controls allowing admins to reauthenticate a user on every sign-in if a user or particular sign-in event is deemed risky, or when enrolling a device in Intune. For more information, see [Configure authentication session management with conditional Access](../conditional-access/howto-conditional-access-session-lifetime.md). ----### Public Preview ΓÇô Protect against by-passing of cloud Azure AD Multi-Factor Authentication when federated with Azure AD --**Type:** New feature -**Service category:** MS Graph -**Product capability:** Identity Security & Protection ---We're delighted to announce a new security protection that prevents bypassing of cloud Azure AD Multi-Factor Authentication when federated with Azure AD. When enabled for a federated domain in your Azure AD tenant, it ensures that a compromised federated account can't bypass Azure AD Multi-Factor Authentication by imitating that a multi factor authentication has already been performed by the identity provider. The protection can be enabled via new security setting, [federatedIdpMfaBehavior](/graph/api/resources/internaldomainfederation?view=graph-rest-beta#federatedidpmfabehavior-values&preserve-view=true). --We highly recommend enabling this new protection when using Azure AD Multi-Factor Authentication as your multi factor authentication for your federated users. To learn more about the protection and how to enable it, visit [Enable protection to prevent by-passing of cloud Azure AD Multi-Factor Authentication when federated with Azure AD](/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#enable-protection-to-prevent-by-passing-of-cloud-azure-ad-multi-factor-authentication-when-federated-with-azure-ad). ----### New Federated Apps available in Azure AD Application gallery - April 2022 --**Type:** New feature -**Service category:** Enterprise Apps -**Product capability:** Third Party Integration --In April 2022 we added the following 24 new applications in our App gallery with Federation support: -[X-1FBO](https://www.x1fbo.com/), [select Armor](https://app.clickarmor.c) --You can also find the documentation of all the applications from here https://aka.ms/AppsTutorial. --For listing your application in the Azure AD app gallery, please read the details here https://aka.ms/AzureADAppRequest ----### General Availability - Customer data storage for Japan customers in Japanese data centers --**Type:** New feature -**Service category:** App Provisioning -**Product capability:** GoLocal --From April 15, 2022, Microsoft began storing Azure ADΓÇÖs Customer Data for new tenants with a Japan billing address within the Japanese data centers. For more information, see: [Customer data storage for Japan customers in Azure Active Directory](./data-storage-japan.md). -----### Public Preview - New provisioning connectors in the Azure AD Application Gallery - April 2022 --**Type:** New feature -**Service category:** App Provisioning -**Product capability:** Third Party Integration --You can now automate creating, updating, and deleting user accounts for these newly integrated apps: -- [Adobe Identity Management (OIDC)](../saas-apps/adobe-identity-management-provisioning-oidc-tutorial.md)-- [embed signage](../saas-apps/embed-signage-provisioning-tutorial.md)-- [KnowBe4 Security Awareness Training](../saas-apps/knowbe4-security-awareness-training-provisioning-tutorial.md)-- [NordPass](../saas-apps/nordpass-provisioning-tutorial.md)--For more information about how to better secure your organization by using automated user account provisioning, see: [Automate user provisioning to SaaS applications with Azure AD](../app-provisioning/user-provisioning.md) --+ |
| active-directory | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/fundamentals/whats-new.md | The Azure Mobile app now includes a section for Azure Active Directory. Within A **Service category:** Terms of Use **Product capability:** AuthZ/Access Delegation -Recently we [announced](../fundamentals/whats-new.md#modernizing-terms-of-use-experiences) the modernization of terms of use end-user experiences as part of ongoing service improvements. As previously communicated the end user experiences will be updated with a new PDF viewer and are moving from https://account.activedirectory.windowsazure.com to https://myaccount.microsoft.com. +Recently we announced the modernization of terms of use end-user experiences as part of ongoing service improvements. As previously communicated the end user experiences will be updated with a new PDF viewer and are moving from https://account.activedirectory.windowsazure.com to https://myaccount.microsoft.com. Starting today the modernized experience for viewing previously accepted terms of use is available via https://myaccount.microsoft.com/termsofuse/myacceptances. We encourage you to check out the modernized experience, which follows the same updated design pattern as the upcoming modernization of accepting or declining terms of use as part of the sign-in flow. We would appreciate your [feedback](https://forms.microsoft.com/r/NV0msbrqtF) before we begin to modernize the sign-in flow. For more information, see: - [Create a role-assignable group in Azure Active Directory](../roles/groups-create-eligible.md) ---## March 2023 ---### Public Preview - New provisioning connectors in the Azure AD Application Gallery - March 2023 --**Type:** New feature -**Service category:** App Provisioning -**Product capability:** 3rd Party Integration - --We've added the following new applications in our App gallery with Provisioning support. You can now automate creating, updating, and deleting of user accounts for these newly integrated apps: --- [Acunetix 360](../saas-apps/acunetix-360-provisioning-tutorial.md)-- [Akamai Enterprise Application Access](../saas-apps/akamai-enterprise-application-access-provisioning-tutorial.md)-- [Ardoq](../saas-apps/ardoq-provisioning-tutorial.md)-- [Torii](../saas-apps/torii-provisioning-tutorial.md)---For more information about how to better secure your organization by using automated user account provisioning, see: [Automate user provisioning to SaaS applications with Azure AD](../app-provisioning/user-provisioning.md). -----### General Availability - Workload identity Federation for Managed Identities --**Type:** New feature -**Service category:** Managed identities for Azure resources -**Product capability:** Developer Experience --Workload Identity Federation enables developers to use managed identities for their software workloads running anywhere and access Azure resources without needing secrets. Key scenarios include: -- Accessing Azure resources from Kubernetes pods running in any cloud or on-premises-- GitHub workflows to deploy to Azure, no secrets necessary-- Accessing Azure resources from other cloud platforms that support OIDC, such as Google Cloud Platform.--For more information, see: -- [Workload identity federation](../workload-identities/workload-identity-federation.md).-- [Configure a user-assigned managed identity to trust an external identity provider (preview)](../workload-identities/workload-identity-federation-create-trust-user-assigned-managed-identity.md)-- [Use Azure AD workload identity with Azure Kubernetes Service (AKS)](../../aks/workload-identity-overview.md)----### Public Preview - New My Groups Experience --**Type:** Changed feature -**Service category:** Group Management -**Product capability:** End User Experiences --A new and improved My Groups experience is now available at `https://www.myaccount.microsoft.com/groups`. My Groups enables end users to easily manage groups, such as finding groups to join, managing groups they own, and managing existing group memberships. Based on customer feedback, the new My Groups support sorting and filtering on lists of groups and group members, a full list of group members in large groups, and an actionable overview page for membership requests. -This experience replaces the existing My Groups experience at `https://www.mygroups.microsoft.com` in May. ---For more information, see: [Update your Groups info in the My Apps portal](https://support.microsoft.com/account-billing/update-your-groups-info-in-the-my-apps-portal-bc0ca998-6d3a-42ac-acb8-e900fb1174a4). ----### Public preview - Customize tokens with Custom Claims Providers --**Type:** New feature -**Service category:** Authentications (Logins) -**Product capability:** Extensibility --A custom claims provider lets you call an API and map custom claims into the token during the authentication flow. The API call is made after the user has completed all their authentication challenges, and a token is about to be issued to the app. For more information, see: [Custom authentication extensions (preview)](../develop/custom-claims-provider-overview.md). ----### General Availability - Converged Authentication Methods --**Type:** New feature -**Service category:** MFA -**Product capability:** User Authentication --The Converged Authentication Methods Policy enables you to manage all authentication methods used for MFA and SSPR in one policy, migrate off the legacy MFA and SSPR policies, and target authentication methods to groups of users instead of enabling them for all users in your tenant. For more information, see: [Manage authentication methods](../authentication/concept-authentication-methods-manage.md). ----### General Availability - Provisioning Insights Workbook --**Type:** New feature -**Service category:** Provisioning -**Product capability:** Monitoring & Reporting --This new workbook makes it easier to investigate and gain insights into your provisioning workflows in a given tenant. This includes HR-driven provisioning, cloud sync, app provisioning, and cross-tenant sync. --Some key questions this workbook can help answer are: --- How many identities have been synced in a given time range?-- How many create, delete, update, or other operations were performed?-- How many operations were successful, skipped, or failed?-- What specific identities failed? And what step did they fail on?-- For any given user, what tenants / applications were they provisioned or deprovisioned to?--For more information, see: [Provisioning insights workbook](../app-provisioning/provisioning-workbook.md). ----### General Availability - Number Matching for Microsoft Authenticator notifications --**Type:** Plan for Change -**Service category:** Microsoft Authenticator App -**Product capability:** User Authentication --Microsoft Authenticator appΓÇÖs number matching feature has been Generally Available since Nov 2022! If you haven't already used the rollout controls (via Azure portal Admin UX and MSGraph APIs) to smoothly deploy number matching for users of Microsoft Authenticator push notifications, we highly encourage you to do so. We previously announced that we'll remove the admin controls and enforce the number match experience tenant-wide for all users of Microsoft Authenticator push notifications starting February 27, 2023. After listening to customers, we'll extend the availability of the rollout controls for a few more weeks. Organizations can continue to use the existing rollout controls until May 8, 2023, to deploy number matching in their organizations. Microsoft services will start enforcing the number matching experience for all users of Microsoft Authenticator push notifications after May 8, 2023. We'll also remove the rollout controls for number matching after that date. --If customers donΓÇÖt enable number match for all Microsoft Authenticator push notifications prior to May 8, 2023, Authenticator users may experience inconsistent sign-ins while the services are rolling out this change. To ensure consistent behavior for all users, we highly recommend you enable number match for Microsoft Authenticator push notifications in advance. --For more information, see: [How to use number matching in multifactor authentication (MFA) notifications - Authentication methods policy](../authentication/how-to-mfa-number-match.md) ----### Public Preview - IPv6 coming to Azure AD --**Type:** Plan for Change -**Service category:** Identity Protection -**Product capability:** Platform --Earlier, we announced our plan to bring IPv6 support to Microsoft Azure Active Directory (Azure AD), enabling our customers to reach the Azure AD services over IPv4, IPv6 or dual stack endpoints. This is just a reminder that we have started introducing IPv6 support into Azure AD services in a phased approach in late March 2023. - -If you utilize Conditional Access or Identity Protection, and have IPv6 enabled on any of your devices, you likely must take action to avoid impacting your users. For most customers, IPv4 won't completely disappear from their digital landscape, so we aren't planning to require IPv6 or to deprioritize IPv4 in any Azure AD features or services. We continue to share additional guidance on IPv6 enablement in Azure AD at this link: [IPv6 support in Azure Active Directory](/troubleshoot/azure/active-directory/azure-ad-ipv6-support). ----### General Availability - Microsoft cloud settings for Azure AD B2B --**Type:** New feature -**Service category:** B2B -**Product capability:** B2B/B2C --Microsoft cloud settings let you collaborate with organizations from different Microsoft Azure clouds. With Microsoft cloud settings, you can establish mutual B2B collaboration between the following clouds: --- Microsoft Azure commercial and Microsoft Azure Government-- Microsoft Azure commercial and Microsoft Azure operated by 21Vianet--For more information about Microsoft cloud settings for B2B collaboration, see [Microsoft cloud settings](../external-identities/cross-tenant-access-overview.md#microsoft-cloud-settings). ----### Modernizing Terms of Use Experiences --**Type:** Plan for Change -**Service category:** Terms of use -**Product capability:** AuthZ/Access Delegation --Starting July 2023, we're modernizing the following Terms of Use end user experiences with an updated PDF viewer, and moving the experiences from https://account.activedirectory.windowsazure.com to https://myaccount.microsoft.com: -- View previously accepted terms of use.-- Accept or decline terms of use as part of the sign-in flow.--No functionalities are removed. The new PDF viewer adds functionality and the limited visual changes in the end-user experiences will be communicated in a future update. If your organization has allow-listed only certain domains, you must ensure your allowlist includes the domains ΓÇÿmyaccount.microsoft.comΓÇÖ and ΓÇÿ*.myaccount.microsoft.comΓÇÖ for Terms of Use to continue working as expected. -- |
| active-directory | Access Reviews Application Preparation | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/access-reviews-application-preparation.md | In order to permit a wide variety of applications and IT requirements to be addr The integration patterns listed above are applicable to third party SaaS applications, or applications that have been developed by or for your organization. * Some Microsoft Online Services, such as Exchange Online, use licenses. While user's licenses can't be reviewed directly, if you're using group-based license assignments, with groups with assigned users, you can review the memberships of those groups instead.-* Some applications may use delegated user consent to control access to Microsoft Graph or other resources. As consents by each user aren't controlled by an approval process, consents aren't reviewable in Azure AD. Instead, you can review who is able to connect to the application through Conditional Access policies, that could be based on application role assignments or group memberships. +* Some applications may use delegated user consent to control access to Microsoft Graph or other resources. As consents by each user aren't controlled by an approval process, consents aren't reviewable in. Instead, you can review who is able to connect to the application through Conditional Access policies, that could be based on application role assignments or group memberships. * If the application doesn't support federation or provisioning protocols, then you'll need a process for manually applying the results when a review completes. For an application that only supports password SSO integration, if an application assignment is removed when a review completes, then the application won't show up on the *myapps* page for the user, but it won't prevent a user who already knows the password from being able to continue to sign into the application. For your on-premises applications, see [govern the users of an application that does not support provisioning](identity-governance-applications-not-provisioned-users.md). For SaaS applications, please [ask the SaaS vendor to onboard to the app gallery](../manage-apps/v2-howto-app-gallery-listing.md) for federation or provisioning by updating their application to support a standard protocol. ## Check the application is ready for the review -Now that you have identified the integration pattern for the application, check the application as represented in Azure AD is ready for review. +Now that you have identified the integration pattern for the application, check the application as represented in Microsoft Entra ID is ready for review. -1. In the Azure portal, click **Azure Active Directory**, click **Enterprise Applications**, and check whether your application is on the [list of enterprise applications](../manage-apps/view-applications-portal.md) in your Azure AD tenant. +1. Sign in to the [Microsoft Entra admin Center](https://entra.microsoft.com) as at least a [Identity Governance Administrator](../roles/permissions-reference.md#identity-governance-administrator). +1. Browse to > **Identity** > **Applications** > **Enterprise Applications**. +1. Here you can check to see whether your application is on the [list of enterprise applications](../manage-apps/view-applications-portal.md) in your tenant. 1. If the application is not already listed, then check if the application is available the [application gallery](../manage-apps/overview-application-gallery.md) for applications that can be integrated for federated SSO or provisioning. If it is in the gallery, then use the [tutorials](../saas-apps/tutorial-list.md) to configure the application for federation, and if it supports provisioning, also [configure the application](../app-provisioning/configure-automatic-user-provisioning-portal.md) for provisioning. 1. If the application is not already listed, but uses AD security groups and is a web application, [add the application for remote access through Application Proxy](../app-proxy/application-proxy-add-on-premises-application.md) and [configure group writeback to AD](../hybrid/connect/how-to-connect-group-writeback-v2.md). 1. If the application is not already listed, uses AD security groups and is not a web application, then [configure group writeback to AD](../hybrid/connect/how-to-connect-group-writeback-v2.md) and continue at the next section. Now that you have identified the integration pattern for the application, check Next, if the application integration also requires one or more groups to be reviewed, as described in pattern B, then check each group is ready for review. -1. In the Azure portal experience for Azure AD, click **Groups**, and then search for and select each group from the list. +1. Sign in to the [Microsoft Entra admin Center](https://entra.microsoft.com) as at least a [Identity Governance Administrator](../roles/permissions-reference.md#identity-governance-administrator). +1. Browse to > **Groups**. +1. Search for and select each group from the list. 1. On the **Overview** tab, verify that the **Membership type** is **Assigned**, and the **Source** is **Cloud**. If the application uses a dynamic group, or a group synchronized from on-premises, then those group memberships can't be changed in Azure AD. We recommend converting the application to groups created in Azure AD with assigned memberships, then copy the member users to that new group. 1. Change to the **Roles and administrators** tab. This tab displays the administrative roles, that give rights to control the representation of the group in Azure AD, not the access rights in the application. For each administrative role that allows changing group membership and has users in that administrative role, ensure that only authorized users are in that role. 1. Change to the **Members** tab. Verify that the members of the group are users, and that there are no non-user members or nested groups. If there are no members of a group when the review starts, the review of that group will complete immediately. |
| active-directory | Access Reviews Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/access-reviews-overview.md | Depending on what you want to review, you'll either create your access review in | | | | | | Security group members</br>Office group members | Specified reviewers</br>Group owners</br>Self-review | access reviews</br>Azure AD groups | Access panel | | Assigned to a connected app | Specified reviewers</br>Self-review | access reviews</br>Azure AD enterprise apps (in preview) | Access panel |-| Azure AD role | Specified reviewers</br>Self-review | [PIM](../privileged-identity-management/pim-create-roles-and-resource-roles-review.md?toc=/azure/active-directory/governance/toc.json) | Azure portal | -| Azure resource role | Specified reviewers</br>Self-review | [PIM](../privileged-identity-management/pim-create-roles-and-resource-roles-review.md?toc=/azure/active-directory/governance/toc.json) | Azure portal | +| Azure AD role | Specified reviewers</br>Self-review | [PIM](../privileged-identity-management/pim-create-roles-and-resource-roles-review.md?toc=/azure/active-directory/governance/toc.json) | Microsoft Entra Admin Center | +| Azure resource role | Specified reviewers</br>Self-review | [PIM](../privileged-identity-management/pim-create-roles-and-resource-roles-review.md?toc=/azure/active-directory/governance/toc.json) | Microsoft Entra Admin Center | | Access package assignments | Specified reviewers</br>Group members</br>Self-review | entitlement management | Access panel | ## License requirements |
| active-directory | Apps | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/apps.md | Microsoft Entra identity governance can be integrated with many other applicatio | [SAP HANA](../../active-directory/saas-apps/saphana-tutorial.md) | ΓùÅ | ΓùÅ | | [SAP SuccessFactors to Active Directory](../../active-directory/saas-apps/sap-successfactors-inbound-provisioning-tutorial.md) | ΓùÅ | ΓùÅ | | [SAP SuccessFactors to Azure Active Directory](../../active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial.md) | ΓùÅ | ΓùÅ |-| [SAP SuccessFactors Writeback ](../../active-directory/saas-apps/sap-successfactors-writeback-tutorial.md) | ΓùÅ | ΓùÅ | +| [SAP SuccessFactors Writeback](../../active-directory/saas-apps/sap-successfactors-writeback-tutorial.md) | ΓùÅ | ΓùÅ | | [SchoolStream ASA](../../active-directory/saas-apps/schoolstream-asa-provisioning-tutorial.md) | ΓùÅ | ΓùÅ | | [SCIM-based apps in the cloud](../app-provisioning/use-scim-to-provision-users-and-groups.md) | ΓùÅ | | | [SCIM-based apps on-premises](../app-provisioning/on-premises-scim-provisioning.md) | ΓùÅ | | |
| active-directory | Check Status Workflow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/check-status-workflow.md | -## Run workflow history using the Azure portal +## Run workflow history using the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -You're able to retrieve run information of a workflow using Lifecycle Workflows. To check the runs of a workflow using the Azure portal, you would do the following steps: +You're able to retrieve run information of a workflow using Lifecycle Workflows. To check the runs of a workflow using the Microsoft Entra Admin center, you would do the following steps: 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Lifecycle Workflows Administrator](../roles/permissions-reference.md#lifecycle-workflows-administrator). You're able to retrieve run information of a workflow using Lifecycle Workflows. :::image type="content" source="media/check-status-workflow/run-list.png" alt-text="Screenshot of a workflow Runs list."::: 1. The runs summary cards include the total number of processed runs, the number of successful runs, the number of failed runs, and the total number of failed tasks. -## User workflow history using the Azure portal --To get further information than just the runs summary for a workflow, you're also able to get information about users processed by a workflow. To check the status of users a workflow has processed using the Azure portal, you would do the following steps: +## User workflow history using the Microsoft Entra admin center +To get further information than just the runs summary for a workflow, you're also able to get information about users processed by a workflow. To check the status of users a workflow has processed using the Microsoft Entra admin center, you would do the following steps: 1. In the left menu, select **Lifecycle Workflows**. |
| active-directory | Check Workflow Execution Scope | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/check-workflow-execution-scope.md | -## Check execution user scope of a workflow using the Azure portal +## Check execution user scope of a workflow using the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] |
| active-directory | Conditional Access Exclusion | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/conditional-access-exclusion.md | Follow these steps to create a new Azure AD group and a Conditional Access polic ### Create an exclusion group -1. Sign in to the [Azure portal](https://portal.azure.com). +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [User Administrator](../roles/permissions-reference.md#user-administrator). -2. In the left navigation, select **Azure Active Directory** and then select **Groups**. +1. Browse to **Identity** > **Groups** > **All groups**. -3. On the top menu, select **New Group** to open the group pane. +1. Select **New group**. -4. In the **Group type** list, select **Security**. Specify a name and description. +1. In the **Group type** list, select **Security**. Specify a name and description. -5. Make sure to set the **Membership** type to **Assigned**. +1. Make sure to set the **Membership** type to **Assigned**. -6. Select the users that should be part of this exclusion group and then select **Create**. +1. Select the users that should be part of this exclusion group and then select **Create**.  Follow these steps to create a new Azure AD group and a Conditional Access polic Now you can create a Conditional Access policy that uses this exclusion group. -1. In the left navigation, select **Azure Active Directory** and then select **Conditional Access** to open the **Policies** blade. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../roles/permissions-reference.md#conditional-access-administrator). -2. Select **New policy** to open the **New** pane. +1. Browse to **Protection** > **Conditional Access**. -3. Specify a name. +1. Select **Create new policy**. -4. Under Assignments select **Users and groups**. +1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies. -5. On the **Include** tab, select **All Users**. +1. Under Assignments select **Users and groups**. -6. On the **Exclude** tab, add a checkmark to **Users and groups** and then - select **Select excluded users**. +1. On the **Include** tab, select **All Users**. -7. Select the exclusion group you created. +1. Under **Exclude**, select **Users and groups** and choose the exclusion group you created. - > [!NOTE] + > [!NOTE] > As a best practice, it is recommended to exclude at least one administrator account from the policy when testing to make sure you are not locked out of your tenant. -8. Continue with setting up the Conditional Access policy based on your organizational requirements. +1. Continue with setting up the Conditional Access policy based on your organizational requirements.  Let's cover two examples where you can use access reviews to manage exclusions i Let's say you have a Conditional Access policy that blocks access from certain countries/regions. It includes a group that is excluded from the policy. Here's a recommended access review where members of the group are reviewed. + + > [!NOTE] -> A Global administrator or User administrator role is required to create access reviews. +> A Global administrator or User administrator role is required to create access reviews. For a step by step guide on creating an access review, see: [Create an access review of groups and applications](create-access-review.md). 1. The review will happen every week. -2. Will never end in order to make sure you're keeping this exclusion group the most up to date. +1. Will never end in order to make sure you're keeping this exclusion group the most up to date. -3. All members of this group will be in scope for the review. +1. All members of this group will be in scope for the review. -4. Each user will need to self-attest that they still need access from these blocked countries/regions, therefore they still need to be a member of the +1. Each user will need to self-attest that they still need access from these blocked countries/regions, therefore they still need to be a member of the group. -5. If the user doesn't respond to the review request, they'll be automatically removed from the group, and they'll no longer have access to the tenant while traveling to these countries/regions. +1. If the user doesn't respond to the review request, they'll be automatically removed from the group, and they'll no longer have access to the tenant while traveling to these countries/regions. -6. Enable email notifications to let users know about the start and completion of the access review. +1. Enable email notifications to let users know about the start and completion of the access review. -  ## Example 2: Access review for users accessing with legacy authentication Let's say you have a Conditional Access policy that blocks access for users using legacy authentication and older client versions and it includes a group that is excluded from the policy. Here is a recommended access review where members of the group are reviewed. -1. This review would need to be a recurring review. + -2. Everyone in the group would need to be reviewed. +1. This review would need to be a recurring review. -3. It could be configured to list the business unit owners as the selected reviewers. +1. Everyone in the group would need to be reviewed. -4. Auto-apply the results and remove users that have not been approved to continue using legacy authentication methods. +1. It could be configured to list the business unit owners as the selected reviewers. -5. It might be beneficial to enable recommendations so reviewers of large groups can easily make their decisions. +1. Auto-apply the results and remove users that have not been approved to continue using legacy authentication methods. -6. Enable mail notifications so users are notified about the start and completion of the access review. +1. It might be beneficial to enable recommendations so reviewers of large groups can easily make their decisions. -  +1. Enable mail notifications so users are notified about the start and completion of the access review. >[!IMPORTANT] >If you have many exclusion groups and therefore need to create multiple access reviews, we now have an API in the Microsoft Graph beta endpoint that allows you to create and manage them programmatically. To get started, see the [access reviews API reference](/graph/api/resources/accessreviewsv2-overview) and [Example of retrieving access reviews via Microsoft Graph](https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Example-of-retrieving-Azure-AD-access-reviews-via-Microsoft/td-p/236096). that is excluded from the policy. Here is a recommended access review where memb Now that you have everything in place, group, Conditional Access policy, and access reviews, it's time to monitor and track the results of these reviews. -1. In the Azure portal, open the **Access reviews** blade. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../roles/permissions-reference.md#identity-governance-administrator). ++1. Browse to **Identity governance** > **Access reviews**. -2. Open the control and program you have created for managing the exclusion group. +1. Select the Access review you are using with the group you created an exclusion policy for. -3. Select **Results** to see who was approved to stay on the list and who was removed. +1. Select **Results** to see who was approved to stay on the list and who was removed.  -4. Then select **Audit logs** to see the actions that were taken during this review. +1. Select **Audit logs** to see the actions that were taken during this review.  |
| active-directory | Configure Logic App Lifecycle Workflows | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/configure-logic-app-lifecycle-workflows.md | To configure those you follow these steps: ## Configure authorization policy for custom task extension with POP security token type If the security token type is **Proof of Possession (POP)** for your custom task extension, you'd set the authorization policy by following these steps: -1. For Logic Apps authorization policy, we need the managed identities **Application ID**. Since the Azure portal only shows the Object ID, we need to look up the Application ID. You can search for the managed identity by Object ID under **Enterprise Applications in the Azure AD Portal** to find the required Application ID. +1. For Logic Apps authorization policy, we need the managed identities **Application ID**. Since the Microsoft Entra admin center only shows the Object ID, we need to look up the Application ID. You can search for the managed identity by Object ID under **Enterprise Applications in the Azure AD Portal** to find the required Application ID. 1. Go back to the logic app you created, and select **Authorization**. If the security token type is **Proof of Possession (POP)** for your custom task If the security token type is **Normal** for your custom task extension, you'd set the authorization policy by following these steps: -1. For Logic Apps authorization policy, we need the managed identities **Application ID**. Since the Azure portal only shows the Object ID, we need to look up the Application ID. You can search for the managed identity by Object ID under **Enterprise Applications in the Azure AD Portal** to find the required Application ID. +1. For Logic Apps authorization policy, we need the managed identities **Application ID**. Since the Microsoft Entra admin center only shows the Object ID, we need to look up the Application ID. You can search for the managed identity by Object ID under **Enterprise Applications in the Azure AD Portal** to find the required Application ID. 1. Go back to the logic app you created, and select **Authorization**. |
| active-directory | Customize Workflow Email | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/customize-workflow-email.md | For more information on these customizable parameters, see [Common email task pa [!INCLUDE [Microsoft Entra ID Governance license](../../../includes/active-directory-entra-governance-license.md)] -## Customize email by using the Azure portal +## Customize email by using the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -When you're customizing an email sent via lifecycle workflows, you can choose to customize either a new task or an existing task. You do these customizations the same way whether the task is new or existing, but the following steps walk you through updating an existing task. To customize emails sent from tasks within workflows by using the Azure portal: +When you're customizing an email sent via lifecycle workflows, you can choose to customize either a new task or an existing task. You do these customizations the same way whether the task is new or existing, but the following steps walk you through updating an existing task. To customize emails sent from tasks within workflows by using the Microsoft Entra admin center: 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Lifecycle Workflows Administrator](../roles/permissions-reference.md#lifecycle-workflows-administrator). |
| active-directory | Customize Workflow Schedule | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/customize-workflow-schedule.md | -## Customize the schedule of workflows by using the Azure portal +## Customize the schedule of workflows by using the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] |
| active-directory | Delete Lifecycle Workflow | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/delete-lifecycle-workflow.md | When a workflow is deleted, it enters a soft-delete state. During this period, y [!INCLUDE [Microsoft Entra ID Governance license](../../../includes/active-directory-entra-governance-license.md)] -## Delete a workflow by using the Azure portal +## Delete a workflow by using the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] When a workflow is deleted, it enters a soft-delete state. During this period, y :::image type="content" source="media/delete-lifecycle-workflow/delete-workflow.png" alt-text="Screenshot of confirming the deletion of a workflow."::: -## View deleted workflows in the Azure portal +## View deleted workflows in the Microsoft Entra admin center After you delete workflows, you can view them on the **Deleted workflows** page. |
| active-directory | Deploy Access Reviews | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/deploy-access-reviews.md | The administrative role required to create, manage, or read an access review dep | Resource type| Create and manage access reviews (creators)| Read access review results | | - | - | -|-| Group or application| Global administrator <p>User administrator<p>Identity Governance administrator<p>Privileged Role administrator (only does reviews for Azure AD role-assignable groups)<p>Group owner ([if enabled by an admin]( create-access-review.md#allow-group-owners-to-create-and-manage-access-reviews-of-their-groups))| Global administrator<p>Global reader<p>User administrator<p>Identity Governance administrator<p>Privileged Role administrator<p>Security reader<p>Group owner ([if enabled by an admin]( create-access-review.md#allow-group-owners-to-create-and-manage-access-reviews-of-their-groups)) | +| Group or application| Global administrator <p>User administrator<p>Identity Governance administrator<p>Privileged Role administrator (only does reviews for Azure AD role-assignable groups)<p>Group owner ([if enabled by an admin](create-access-review.md#allow-group-owners-to-create-and-manage-access-reviews-of-their-groups))| Global administrator<p>Global reader<p>User administrator<p>Identity Governance administrator<p>Privileged Role administrator<p>Security reader<p>Group owner ([if enabled by an admin](create-access-review.md#allow-group-owners-to-create-and-manage-access-reviews-of-their-groups)) | |Azure AD roles| Global administrator <p>Privileged Role administrator| Global administrator<p>Global reader<p>User administrator<p>Privileged Role administrator<p> <p>Security reader | | Azure resource roles| User Access Administrator (for the resource)<p>Resource owner| User Access Administrator (for the resource)<p>Resource owner<p>Reader (for the resource) | | Access package| Global administrator<p>User administrator<p>Identity Governance administrator<p>Catalog owner (for the access package)<p>Access package manager (for the access package)| Global administrator<p>Global reader<p>User administrator<p>Identity Governance administrator<p>Catalog owner (for the access package)<p>Access package manager (for the access package)<p>Security reader | Group owners review membership because they're best qualified to know who needs For example, Microsoft Teams uses Microsoft 365 Groups as the underlying authorization model to grant users access to resources that are in SharePoint, Exchange, OneNote, or other Microsoft 365 services. The creator of the team automatically becomes an owner and should be responsible for attesting to the membership of that group. -* Groups created manually in the Azure portal or via scripting through Microsoft Graph might not necessarily have owners defined. Define them either through the Azure portal in the group's **Owners** section or via Microsoft Graph. +* Groups created manually in the Microsoft Entra admin center or via scripting through Microsoft Graph might not necessarily have owners defined. Define them either through the Microsoft Entra admin center in the group's **Owners** section or via Microsoft Graph. * Groups that are synchronized from on-premises Active Directory can't have an owner in Azure AD. When you create an access review for them, select individuals who are best suited to decide on membership in them. |
| active-directory | Entitlement Management Access Package Manage Lifecycle | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-access-package-manage-lifecycle.md | Entitlement management allows you to gain visibility into the state of a guest u You can directly convert ungoverned users to be governed by using the **Mark Guests as Governed (preview)** functionality in the top menu bar. -## Manage guest user lifecycle in the Azure portal +## Manage guest user lifecycle in the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] |
| active-directory | Entitlement Management Access Package Resources | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-access-package-resources.md | Once an application role is part of an access package: Here are some considerations when selecting an application: - Applications may also have groups assigned to their app roles as well. You can choose to add a group in place of an application role in an access package, however then the application won't be visible to the user as part of the access package in the My Access portal.-- Azure portal may also show service principals for services that can't be selected as applications. In particular, **Exchange Online** and **SharePoint Online** are services, not applications that have resource roles in the directory, so they can't be included in an access package. Instead, use group-based licensing to establish an appropriate license for a user who needs access to those services.+- Microsoft Entra admin center may also show service principals for services that can't be selected as applications. In particular, **Exchange Online** and **SharePoint Online** are services, not applications that have resource roles in the directory, so they can't be included in an access package. Instead, use group-based licensing to establish an appropriate license for a user who needs access to those services. - Applications that only support Personal Microsoft Account users for authentication, and don't support organizational accounts in your directory, don't have application roles and can't be added to access package catalogs. 1. On the **Add resource roles to access package** page, select **Applications** to open the Select applications pane. When you remove a member of a team, they're removed from the Microsoft 365 Group When a resource role is added to an access package by an admin, users who are in that resource role, but don't have assignments to the access package, will remain in the resource role, but won't be assigned to the access package. For example, if a user is a member of a group and then an access package is created and that group's member role is added to an access package, the user won't automatically receive an assignment to the access package. -If you want the users to also be assigned to the access package, you can [directly assign users](entitlement-management-access-package-assignments.md#directly-assign-a-user) to an access package using the Azure portal, or in bulk via Graph or PowerShell. The users will then also receive access to the other resource roles in the access package. However, as those users already have access prior to being added to the access package, when their access package assignment is removed, they remain in the resource role. For example, if a user was a member of a group, and was assigned to an access package that included group membership for that group as a resource role, and then that user's access package assignment was removed, the user would retain their group membership. +If you want the users to also be assigned to the access package, you can [directly assign users](entitlement-management-access-package-assignments.md#directly-assign-a-user) to an access package using the Microsoft Entra admin center, or in bulk via Graph or PowerShell. The users will then also receive access to the other resource roles in the access package. However, as those users already have access prior to being added to the access package, when their access package assignment is removed, they remain in the resource role. For example, if a user was a member of a group, and was assigned to an access package that included group membership for that group as a resource role, and then that user's access package assignment was removed, the user would retain their group membership. ## Next steps |
| active-directory | Entitlement Management Logic Apps Integration | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-logic-apps-integration.md | For newly created Logic Apps linked to custom extensions, these Logic Apps begin 1. Select the Logic App under the Logic app column for the associated custom extension row. This allows you to edit or create the workflow in Logic App designer. -For more information on creating logic app workflows, see [Quickstart: Create an example Consumption workflow in multi-tenant Azure Logic Apps with the Azure portal](../../logic-apps/quickstart-create-example-consumption-workflow.md). +For more information on creating logic app workflows, see [Quickstart: Create an example Consumption workflow in multi-tenant Azure Logic Apps](../../logic-apps/quickstart-create-example-consumption-workflow.md). ## Configuring custom extensions that pause entitlement management processes |
| active-directory | Entitlement Management Logs And Reporting | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-logs-and-reporting.md | Archiving Azure AD audit logs requires you to have Azure Monitor in an Azure sub **Prerequisite role**: Global Administrator -1. Sign in to the [Microsoft Entra admin center](https://portal.azure.com) as a Global Administrator. Make sure you have access to the resource group containing the Azure Monitor workspace. +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a Global Administrator. Make sure you have access to the resource group containing the Azure Monitor workspace. 1. Browse to **Identity** > **Monitoring & health** > **Diagnostic settings**. Make sure you, the user or service principal that will authenticate to Azure AD, To set the role assignment and create a query, do the following steps: -1. In the Azure portal, locate the [Log Analytics workspace](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fworkspaces). +1. In the Microsoft Entra admin center, locate the [Log Analytics workspace](https://entra.microsoft.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fworkspaces). 1. Select **Access Control (IAM)**. $subs | ft You can reauthenticate and associate your PowerShell session to that subscription using a command such as `Connect-AzAccount ΓÇôSubscription $subs[0].id`. To learn more about how to authenticate to Azure from PowerShell, including non-interactively, see [Sign in with Azure PowerShell](/powershell/azure/authenticate-azureps). -If you have multiple Log Analytics workspaces in that subscription, then the cmdlet [Get-AzOperationalInsightsWorkspace](/powershell/module/Az.OperationalInsights/Get-AzOperationalInsightsWorkspace) returns the list of workspaces. Then you can find the one that has the Azure AD logs. The `CustomerId` field returned by this cmdlet is the same as the value of the "Workspace ID" displayed in the Azure portal in the Log Analytics workspace overview. +If you have multiple Log Analytics workspaces in that subscription, then the cmdlet [Get-AzOperationalInsightsWorkspace](/powershell/module/Az.OperationalInsights/Get-AzOperationalInsightsWorkspace) returns the list of workspaces. Then you can find the one that has the Azure AD logs. The `CustomerId` field returned by this cmdlet is the same as the value of the "Workspace ID" displayed in the Microsoft Entra admin center in the Log Analytics workspace overview. ```powershell $wks = Get-AzOperationalInsightsWorkspace |
| active-directory | Entitlement Management Organization | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-organization.md | To add an external Azure AD directory or domain as a connected organization, fol 1. Select the **Sponsors** tab, and then add optional sponsors for this connected organization. - Sponsors are internal or external users already in your directory that are the point of contact for the relationship with this connected organization. Internal sponsors are member users in your directory. External sponsors are guest users from the connected organization that were previously invited and are already in your directory. Sponsors can be utilized as approvers when users in this connected organization request access to this access package. For information about how to invite a guest user to your directory, see [Add Azure Active Directory B2B collaboration users in the Azure portal](../external-identities/add-users-administrator.md). + Sponsors are internal or external users already in your directory that are the point of contact for the relationship with this connected organization. Internal sponsors are member users in your directory. External sponsors are guest users from the connected organization that were previously invited and are already in your directory. Sponsors can be utilized as approvers when users in this connected organization request access to this access package. For information about how to invite a guest user to your directory, see [Add Azure Active Directory B2B collaboration users](../external-identities/add-users-administrator.md). When you select **Add/Remove**, a pane opens in which you can choose internal or external sponsors. The pane displays an unfiltered list of users and groups in your directory. foreach ($c in $co) { There are two different states for connected organizations in entitlement management, configured and proposed: -- A **configured** connected organization is a fully functional connected organization that allows users within that organization access to access packages. When an admin creates a new connected organization in the Azure portal, it will be in the **configured** state by default since the administrator created and wants to use this connected organization. Additionally, when a connected org is created programmatically via the API, the default state should be **configured** unless set to another state explicitly.+- A **configured** connected organization is a fully functional connected organization that allows users within that organization access to access packages. When an admin creates a new connected organization in the Microsoft Entra admin center, it will be in the **configured** state by default since the administrator created and wants to use this connected organization. Additionally, when a connected org is created programmatically via the API, the default state should be **configured** unless set to another state explicitly. Configured connected organizations will show up in the pickers for connected organizations and will be in scope for any policies that target ΓÇ£all configured connected organizationsΓÇ¥. |
| active-directory | Entitlement Management Overview | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-overview.md | To better understand entitlement management and its documentation, you can refer ## Next steps -- If you're interested in using the Azure portal to manage access to resources, see [Tutorial: Manage access to resources - Azure portal](entitlement-management-access-package-first.md).+- If you're interested in using the Microsoft Entra admin center to manage access to resources, see [Tutorial: Manage access to resources - Microsoft Entra](entitlement-management-access-package-first.md). - if you're interested in using Microsoft Graph to manage access to resources, see [Tutorial: manage access to resources - Microsoft Graph](/graph/tutorial-access-package-api?toc=/azure/active-directory/governance/toc.json&bc=/azure/active-directory/governance/breadcrumb/toc.json) - [Common scenarios](entitlement-management-scenarios.md) |
| active-directory | Entitlement Management Reports | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-reports.md | To get additional details on how a user requested and received access to an acce 1. To download the logs, select **Download**. -When Azure AD receives a new request, it writes an audit record, in which the **Category** is `EntitlementManagement` and the **Activity** is typically `User requests access package assignment`. In the case of a direct assignment created in the Azure portal, the **Activity** field of the audit record is `Administrator directly assigns user to access package`, and the user performing the assignment is identified by the **ActorUserPrincipalName**. +When Azure AD receives a new request, it writes an audit record, in which the **Category** is `EntitlementManagement` and the **Activity** is typically `User requests access package assignment`. In the case of a direct assignment created in the Microsoft Entra admin center, the **Activity** field of the audit record is `Administrator directly assigns user to access package`, and the user performing the assignment is identified by the **ActorUserPrincipalName**. Azure AD writes additional audit records while the request is in progress, including: |
| active-directory | Entitlement Management Reprocess Access Package Assignments | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-reprocess-access-package-assignments.md | If you have users who are in the "Delivered" state but don't have access to reso 1. Underneath **Manage** on the left side, select **Assignments**. -  +  1. Select all users whose assignments you wish to reprocess. |
| active-directory | Entitlement Management Ticketed Provisioning | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/entitlement-management-ticketed-provisioning.md | After setting up custom extensibility in the catalog, administrators can create -## Register an application with secrets in Azure portal +## Register an application with secrets in the Microsoft Entra admin center [!INCLUDE [portal updates](~/articles/active-directory/includes/portal-update.md)] -With Azure, you're able to use [Azure Key Vault](/azure/key-vault/secrets/about-secrets) to store application secrets such as passwords. To register an application with secrets within the Azure portal, follow these steps: +With Azure, you're able to use [Azure Key Vault](/azure/key-vault/secrets/about-secrets) to store application secrets such as passwords. To register an application with secrets within the Microsoft Entra admin center, follow these steps: 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../roles/permissions-reference.md#identity-governance-administrator). With Azure, you're able to use [Azure Key Vault](/azure/key-vault/secrets/about- After registering your application, you must add a client secret by following these steps: -1. In the Azure portal, in App registrations, select your application. +1. Browse to **Identity** > **Applications** > **App registrations**. ++1. select your application. 1. Select Certificates & secrets > Client secrets > New client secret. |
| active-directory | How To Lifecycle Workflow Sync Attributes | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/how-to-lifecycle-workflow-sync-attributes.md | Get-MgUser -UserId "44198096-38ea-440d-9497-bb6b06bcaf9b" | Select-Object Displa ## Next steps - [What are lifecycle workflows?](what-are-lifecycle-workflows.md)-- [Create a custom workflow using the Azure portal](tutorial-onboard-custom-workflow-portal.md)+- [Create a custom workflow using the Microsoft Entra admin center](tutorial-onboard-custom-workflow-portal.md) - [Create a Lifecycle workflow](create-lifecycle-workflow.md) |
| active-directory | Identity Governance Applications Deploy | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/identity-governance-applications-deploy.md | In this section, you configure Azure AD entitlement management so users can requ 1. **Populate the catalog with necessary resources.** Add the application, and any Azure AD groups that the application relies upon, [as resources in that catalog](../governance/entitlement-management-catalog-create.md). 1. **Create an access package for each role or group which users can request.** For each of the applications, and for each of their application roles or groups, [create an access package](../governance/entitlement-management-access-package-create.md) that includes that role or group as its resource. At this stage of configuring that access package, configure the access package assignment policy for direct assignment, so that only administrators can create assignments. In that policy, set the access review requirements for existing users, if any, so that they don't keep access indefinitely. 1. **Configure access packages to enforce separation of duties requirements.** If you have [separation of duties](entitlement-management-access-package-incompatible.md) requirements, then configure the incompatible access packages or existing groups for your access package. If your scenario requires the ability to override a separation of duties check, then you can also [set up additional access packages for those override scenarios](entitlement-management-access-package-incompatible.md#configuring-multiple-access-packages-for-override-scenarios).-1. **Add assignments of existing users, who already have access to the application, to the access packages.** For each access package, assign existing users of the application in that role, or members of that group, to the access package. You can [directly assign a user](entitlement-management-access-package-assignments.md) to an access package using the Azure portal, or in bulk via Graph or PowerShell. +1. **Add assignments of existing users, who already have access to the application, to the access packages.** For each access package, assign existing users of the application in that role, or members of that group, to the access package. You can [directly assign a user](entitlement-management-access-package-assignments.md) to an access package using the Microsoft Entra admin center, or in bulk via Graph or PowerShell. 1. **Create policies for users to request access.** In each access package, [create additional access package assignment policies](../governance/entitlement-management-access-package-request-policy.md#open-an-existing-access-package-and-add-a-new-policy-with-different-request-settings) for users to request access. Configure the approval and recurring access review requirements in that policy. 1. **Create recurring access reviews for other groups used by the application.** If there are groups that are used by the application but aren't resource roles for an access package, then [create access reviews](create-access-review.md) for the membership of those groups. In this section, you configure Azure AD entitlement management so users can requ Azure AD, with Azure Monitor, provides several reports to help you understand who has access to an application and if they're using that access. -* An administrator, or a catalog owner, can [retrieve the list of users who have access package assignments](entitlement-management-access-package-assignments.md), via the Azure portal, Graph or PowerShell. -* You can also send the audit logs to Azure Monitor and view a history of [changes to the access package](entitlement-management-logs-and-reporting.md#view-events-for-an-access-package), in the Azure portal, or via PowerShell. -* You can view the last 30 days of sign-ins to an application in the [sign-ins report](../reports-monitoring/reference-basic-info-sign-in-logs.md) in the Azure portal, or via [Graph](/graph/api/signin-list?view=graph-rest-1.0&tabs=http&preserve-view=true). +* An administrator, or a catalog owner, can [retrieve the list of users who have access package assignments](entitlement-management-access-package-assignments.md), via the Microsoft Entra admin center, Graph or PowerShell. +* You can also send the audit logs to Azure Monitor and view a history of [changes to the access package](entitlement-management-logs-and-reporting.md#view-events-for-an-access-package), in the Microsoft Entra admin center, or via PowerShell. +* You can view the last 30 days of sign-ins to an application in the [sign-ins report](../reports-monitoring/reference-basic-info-sign-in-logs.md) in the Microsoft Entra admin center, or via [Graph](/graph/api/signin-list?view=graph-rest-1.0&tabs=http&preserve-view=true). * You can also send the [sign in logs to Azure Monitor](../reports-monitoring/concept-activity-logs-azure-monitor.md) to archive sign in activity for up to two years. ## Monitor to adjust entitlement management policies and access as needed -At regular intervals, such as weekly, monthly or quarterly, based on the volume of application access assignment changes for your application, use the Azure portal to ensure that access is being granted in accordance with the policies. You can also ensure that the identified users for approval and review are still the correct individuals for these tasks. +At regular intervals, such as weekly, monthly or quarterly, based on the volume of application access assignment changes for your application, use the Microsoft Entra admin center to ensure that access is being granted in accordance with the policies. You can also ensure that the identified users for approval and review are still the correct individuals for these tasks. * **Watch for application role assignments and group membership changes.** If you have Azure AD configured to send its audit log to Azure Monitor, use the `Application role assignment activity` in Azure Monitor to [monitor and report on any application role assignments that weren't made through entitlement management](../governance/entitlement-management-access-package-incompatible.md#monitor-and-report-on-access-assignments). If there are role assignments that were created by an application owner directly, you should contact that application owner to determine if that assignment was authorized. In addition, if the application relies upon Azure AD security groups, also monitor for changes to those groups as well. |
| active-directory | Identity Governance Applications Existing Users | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/identity-governance-applications-existing-users.md | If the application does not support provisioning, then If you don't see users being provisioned, check the [troubleshooting guide for no users being provisioned](../app-provisioning/application-provisioning-config-problem-no-users-provisioned.md). If you see an error in the provisioning status and are provisioning to an on-premises application, check the [troubleshooting guide for on-premises application provisioning](../app-provisioning/on-premises-ecma-troubleshoot.md). -1. Check the provisioning log through the [Azure portal](../reports-monitoring/concept-provisioning-logs.md) or [Graph APIs](../app-provisioning/application-provisioning-configuration-api.md#monitor-provisioning-events-using-the-provisioning-logs). Filter the log to the status **Failure**. If there are failures with an ErrorCode of **DuplicateTargetEntries**, this indicates an ambiguity in your provisioning matching rules, and you'll need to update the Azure AD users or the mappings that are used for matching to ensure each Azure AD user matches one application user. Then filter the log to the action **Create** and status **Skipped**. If users were skipped with the SkipReason code of **NotEffectivelyEntitled**, this may indicate that the user accounts in Azure AD were not matched because the user account status was **Disabled**. +1. Check the provisioning log through the [Microsoft Entra admin center](../reports-monitoring/concept-provisioning-logs.md) or [Graph APIs](../app-provisioning/application-provisioning-configuration-api.md#monitor-provisioning-events-using-the-provisioning-logs). Filter the log to the status **Failure**. If there are failures with an ErrorCode of **DuplicateTargetEntries**, this indicates an ambiguity in your provisioning matching rules, and you'll need to update the Azure AD users or the mappings that are used for matching to ensure each Azure AD user matches one application user. Then filter the log to the action **Create** and status **Skipped**. If users were skipped with the SkipReason code of **NotEffectivelyEntitled**, this may indicate that the user accounts in Azure AD were not matched because the user account status was **Disabled**. After the Azure AD provisioning service has matched the users based on the application role assignments you've created, subsequent changes to those users will be sent to the application. |
| active-directory | Identity Governance Applications Prepare | https://github.com/MicrosoftDocs/azure-docs/commits/main/articles/active-directory/governance/identity-governance-applications-prepare.md | Before you begin the process of governing application access from Azure AD, you * **If you will be governing guest's access to the application, link your Azure AD tenant to a subscription for MAU billing**. This step is necessary prior to having a guest request or review their access. For more information, see [billing model for Azure AD External Identities](../external-identities/external-identities-pricing.md). -* **Check that Azure AD is already sending its audit log, and optionally other logs, to Azure Monitor.** Azure Monitor is optional, but useful for governing access to apps, as Azure AD only stores audit events for up to 30 days in its audit log. You can keep the audit data for longer than the default retention period, outlined in [How long does Azure AD store reporting data?](../reports-monitoring/reference-reports-data-retention.md), and use Azure Monitor workbooks and custom queries and reports on historical audit data. You can check the Azure AD configuration to see if it's using Azure Monitor, in **Azure Active Directory** in the Azure portal, by clicking on **Workbooks**. If this integration isn't configured, and you have an Azure subscription and are in the `Global Administrator` or `Security Administrator` roles, you can [configure Azure AD to use Azure Monitor](../governance/entitlement-management-logs-and-reporting.md). +* **Check that Azure AD is already sending its audit log, and optionally other logs, to Azure Monitor.** Azure Monitor is optional, but useful for governing access to apps, as Azure AD only stores audit events for up to 30 days in its audit log. You can keep the audit data for longer than the default retention period, outlined in [How long does Azure AD store reporting data?](../reports-monitoring/reference-reports-data-retention.md), and use Azure Monitor workbooks and custom queries and reports on historical audit data. You can check the Azure AD configuration to see if it's using Azure Monitor, in **Azure Active Directory** in the Microsoft Entra admin center, by clicking on **Workbooks**. If this integration isn't configured, and you have an Azure subscription and are in the `Global Administrator` or `Security Administrator` roles, you can [configure Azure AD to use Azure Monitor](../governance/entitlement-management-logs-and-reporting.md). * **Make sure only authorized users are in the highly privileged administrative roles in your Azure AD tenant.** Administrators in the *Global Administrator*, *Identity Governance Administrator*, *User Administrator*, *Application Administrator*, *Cloud Application Administrator* and *Privileged Role Administrator* can make changes to users and their application role assignments. If the me |