Skip to content

Commit 1f79227

Browse files
dlepowdlepow
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into acrpurge
2 parents 459817d + 119d6c0 commit 1f79227

File tree

333 files changed

+5162
-3892
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

333 files changed

+5162
-3892
lines changed

‎.openpublishing.redirection.json

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@
1515
"redirect_url": "/azure/machine-learning/service/how-to-manage-workspace",
1616
"redirect_document_id": true
1717
},
18+
{
19+
"source_path": "articles/machine-learning/service/concept-accelerate-with-fpgas.md",
20+
"redirect_url": "/azure/machine-learning/service/how-to-deploy-fpga-web-service",
21+
"redirect_document_id": false
22+
},
1823
{
1924
"source_path": "articles/machine-learning/service/quickstart-run-local-notebook.md",
2025
"redirect_url": "/azure/machine-learning/service/how-to-configure-environment#local",
@@ -1240,6 +1245,16 @@
12401245
"redirect_url": "/azure/cognitive-services/Speech-Service/speech-devices-sdk-android-quickstart",
12411246
"redirect_document_id": true
12421247
},
1248+
{
1249+
"source_path": "articles/cognitive-services/immersive-reader/ios-picture-immersive-reader-tutorial.md",
1250+
"redirect_url": "/azure/cognitive-services/immersive-reader/tutorial-ios-picture-immersive-reader",
1251+
"redirect_document_id": true
1252+
},
1253+
{
1254+
"source_path": "articles/cognitive-services/immersive-reader/tutorial.md",
1255+
"redirect_url": "/azure/cognitive-services/immersive-reader/tutorial-nodejs",
1256+
"redirect_document_id": true
1257+
},
12431258
{
12441259
"source_path": "articles/active-directory/active-directory-licensing-ps-examples.md",
12451260
"redirect_url": "/azure/active-directory/users-groups-roles/licensing-ps-examples",
@@ -7479,6 +7494,11 @@
74797494
"source_path": "articles/active-directory/active-directory-saas-cisco-spark-provisioning-tutorial.md",
74807495
"redirect_url": "/azure/active-directory/saas-apps/cisco-spark-provisioning-tutorial",
74817496
"redirect_document_id": true
7497+
},
7498+
{
7499+
"source_path": "articles/active-directory/saas-apps/cisco-spark-provisioning-tutorial.md",
7500+
"redirect_url": "/azure/active-directory/saas-apps/cisco-webex-provisioning-tutorial",
7501+
"redirect_document_id": false
74827502
},
74837503
{
74847504
"source_path": "articles/active-directory/active-directory-saas-cisco-webex-tutorial.md",
@@ -23742,6 +23762,11 @@
2374223762
{
2374323763
"source_path": "articles/storage/storage-dotnet-shared-access-signature-part-1.md",
2374423764
"redirect_url": "/azure/storage/common/storage-dotnet-shared-access-signature-part-1",
23765+
"redirect_document_id": false
23766+
},
23767+
{
23768+
"source_path": "articles/storage/common/storage-dotnet-shared-access-signature-part-1.md",
23769+
"redirect_url": "/azure/storage/common/storage-sas-overview",
2374523770
"redirect_document_id": true
2374623771
},
2374723772
{
@@ -30994,6 +31019,16 @@
3099431019
"redirect_url": "https://github.com/AzureADQuickStarts/AppModelv2-WebApp-OpenIDConnect-nodejs",
3099531020
"redirect_document_id": false
3099631021
},
31022+
{
31023+
"source_path": "articles/cognitive-services/QnAMaker/Quickstarts/publish-kb-nodejs.md",
31024+
"redirect_url": "/azure/cognitive-services/QnAMaker/Quickstarts/create-knowledge-rest-api-nodejs#publish-a-knowledge-base",
31025+
"redirect_document_id": false
31026+
},
31027+
{
31028+
"source_path": "articles/cognitive-services/QnAMaker/Quickstarts/create-new-kb-nodejs.md",
31029+
"redirect_url": "/azure/cognitive-services/QnAMaker/Quickstarts/create-knowledge-rest-api-nodejs",
31030+
"redirect_document_id": false
31031+
},
3099731032
{
3099831033
"source_path": "articles/cognitive-services/QnAMaker/faqs.md",
3099931034
"redirect_url": "/azure/cognitive-services/QnAMaker/troubleshooting",

‎articles/active-directory-b2c/active-directory-b2c-reference-language-customization.md

Lines changed: 117 additions & 78 deletions
Large diffs are not rendered by default.

‎articles/active-directory-domain-services/active-directory-ds-ldaps-bind-lockdown.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ First, open LDP and connect to the managed domain. Click **Connection** and clic
3232
Next, bind to the managed domain. Click **Connection** and click **Bind...** in the menu. Provide the credentials of a user account belonging to the 'AAD DC Administrators' group.
3333

3434
> [!IMPORTANT]
35-
> Users (and service accounts) cannot perform LDAP simple binds if you have disabled NTLM password hash synchronization on your Azure AD Domain Services instance. For more information on disabling NTLM password hash synchronization, read [Secure your Azure AD DOmain Services managed domain](secure-your-domain.md).
35+
> Users (and service accounts) cannot perform LDAP simple binds if you have disabled NTLM password hash synchronization on your Azure AD Domain Services instance. For more information on disabling NTLM password hash synchronization, read [Secure your Azure AD Domain Services managed domain](secure-your-domain.md).
3636
>
3737
>
3838

‎articles/active-directory/authentication/howto-mfaserver-deploy-upgrade.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ If you have the User Portal on multiple servers, repeat the installation on all
6363
## Upgrade the Mobile App Web Service
6464

6565
> [!NOTE]
66-
> When upgrading from a version of Azure MFA Server older than 8.0 to 8.0+ that the mobile app web service can be uninstalled after the upgrade
66+
> When upgrading from a version of Azure MFA Server older than 8.0 to 8.0+ then the mobile app web service can be uninstalled after the upgrade
6767
6868
## Upgrade the AD FS Adapters
6969

‎articles/active-directory/develop/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,8 @@
295295
href: v2-oauth2-device-code.md
296296
- name: OAuth 2.0 resource owner password credentials grant
297297
href: v2-oauth-ropc.md
298+
- name: OAuth 2.0 SAML bearer assertion flow
299+
href: v2-saml-bearer-assertion.md
298300
- name: Signing key rollover
299301
href: active-directory-signing-key-rollover.md
300302
- name: ID tokens

‎articles/active-directory/develop/active-directory-v2-registration-portal.md

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,24 @@ ms.workload: identity
1414
ms.tgt_pltfrm: na
1515
ms.devlang: na
1616
ms.topic: conceptual
17-
ms.date: 08/28/2018
17+
ms.date: 08/13/2019
1818
ms.author: ryanwi
1919
ms.reviewer: lenalepa
2020
ms.custom: aaddev
2121
ms.collection: M365-identity-device-management
2222
---
2323

2424
# App registration reference
25-
This document provides context and descriptions of various features found in the [Application Registration Portal](https://apps.dev.microsoft.com/?referrer=https://azure.microsoft.com/).
26-
27-
> [!NOTE]
28-
> We will no longer support registering and managing converged and Azure AD applications in the [Application Registration Portal](https://apps.dev.microsoft.com/?referrer=https://azure.microsoft.com/) starting May 2019. We recommend that you manage your existing applications and register new applications by using the [App registrations](https://aka.ms/appregistrations) experience in the Azure portal.
25+
This document provides context and descriptions of various features found in the [App registrations](https://aka.ms/appregistrations) experience in the Azure portal.
2926

3027
## My Applications or Converged applications
31-
This list contains all of your applications registered for use with the Azure AD v2.0 endpoint. These applications have the ability to sign in users with both personal Microsoft accounts and work/school accounts from Azure Active Directory. To learn more about the Azure AD v2.0 endpoint, see the [v2.0 overview](active-directory-appmodel-v2-overview.md). These applications can also be used to integrate with the Microsoft account authentication endpoint, `https://login.live.com`.
28+
This list contains all of your applications registered for use with the Microsoft identity platform (v2.0) endpoint. These applications have the ability to sign in users with both personal Microsoft accounts and work/school accounts from Azure Active Directory. To learn more about the identity platform endpoint, see the [v2.0 overview](active-directory-appmodel-v2-overview.md). These applications can also be used to integrate with the Microsoft account authentication endpoint, `https://login.live.com`.
3229

3330
## Azure AD only applications
34-
This list contains all of your applications registered for use with the Azure AD v1.0 endpoint. These applications only have the ability to sign in users with work/school accounts from Azure Active Directory. This list includes applications that were registered using the **App registrations** experience in the [Azure Portal](https://portal.azure.com).
31+
This list contains all of your applications registered for use with the Azure AD v1.0 endpoint. These applications only have the ability to sign in users with work/school accounts from Azure Active Directory. This list includes applications that were registered using the **App registrations** experience in the [Azure portal](https://portal.azure.com).
3532

3633
## Live SDK Applications
37-
This list contains all of your applications registered for use solely with Microsoft account. They are not enabled for use with Azure Active Directory. This is where you find any applications that were previously registered with the MSA developer portal at `https://account.live.com/developers/applications`. All functions that you previously performed at `https://account.live.com/developers/applications` can now be performed in this new portal, `https://apps.dev.microsoft.com`.
34+
This list contains all of your applications registered for use solely with Microsoft account. They are not enabled for use with Azure Active Directory. This is where you find any applications that were previously registered with the MSA developer portal at `https://account.live.com/developers/applications`. All functions that you previously performed at `https://account.live.com/developers/applications` can now be performed in [App registrations](https://aka.ms/appregistrations).
3835

3936
## Application Secrets
4037
Application secrets are credentials that allow your application to perform reliable [client authentication](https://tools.ietf.org/html/rfc6749#section-2.3) with Azure AD. In OAuth & OpenID Connect, an application secret is commonly referred to as a `client_secret`. In the v2.0 protocol, any application that receives a security token at a web addressable location (using an `https` scheme) must use an application secret to identify itself to Azure AD upon redemption of that security token. Furthermore, any native client that receives tokens on a device will be forbidden from using an application secret to perform client authentication. This discourages the storage of secrets in insecure environments.
@@ -48,9 +45,9 @@ You are required to upload a certificate that contains a public key.
4845
The profile section of the app registration portal can be used to customize the sign-in page for your application. At this time you can alter the sign-in page's application logo, terms of service URL, and privacy statement URL. The logo must be a transparent 48 x 48 or 50 x 50 pixel image in a GIF, PNG or JPEG file that is 15 KB or smaller. Try changing the values and viewing the resulting sign-in page!
4946

5047
## Live SDK Support
51-
When you enable "Live SDK Support", any application secrets you create will be provisioned into both the Azure AD and Microsoft Account data stores. This allows your application to integrate directly with the Microsoft Account service (login.live.com). If you wish to build an app using Microsoft Account directly (as opposed to using the Azure AD v2.0 endpoint), you should make sure Live SDK Support is enabled.
48+
When you enable "Live SDK Support", any application secrets you create will be provisioned into both the Azure AD and Microsoft Account data stores. This allows your application to integrate directly with the Microsoft Account service (login.live.com). If you wish to build an app using Microsoft Account directly (as opposed to using the v2.0 endpoint), you should make sure Live SDK Support is enabled.
5249

5350
Disabling Live SDK support ensures that the application secret is only written into the Azure AD data store. The Azure AD data store incorporates enterprise-grade regulations that allow it to meet certain standards, such as FISMA compliance. If you enable Live SDK support, your application may not achieve compliance with some of these standards.
5451

55-
If you only ever plan to use the Azure AD v2.0 endpoint, you can safely disable Live SDK support.
52+
If you only ever plan to use the v2.0 endpoint, you can safely disable Live SDK support.
5653

‎articles/active-directory/develop/media/v2-saml-bearer-assertion/1.png

98.6 KB
Loading

‎articles/active-directory/develop/media/v2-saml-bearer-assertion/2.png

17.3 KB
Loading

‎articles/active-directory/develop/media/v2-saml-bearer-assertion/3.png

28.3 KB
Loading

‎articles/active-directory/develop/media/v2-saml-bearer-assertion/4.png

70 KB
Loading

‎articles/active-directory/develop/media/v2-saml-bearer-assertion/5.png

19.5 KB
Loading

‎articles/active-directory/develop/media/v2-saml-bearer-assertion/6.png

27 KB
Loading

‎articles/active-directory/develop/media/v2-saml-bearer-assertion/7.png

21 KB
Loading

‎articles/active-directory/develop/quickstart-configure-app-expose-web-apis.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.devlang: na
1313
ms.topic: quickstart
1414
ms.tgt_pltfrm: na
1515
ms.workload: identity
16-
ms.date: 05/08/2019
16+
ms.date: 08/14/2019
1717
ms.author: ryanwi
1818
ms.custom: aaddev
1919
ms.reviewer: aragra, lenalepa, sureshja
@@ -113,8 +113,9 @@ To expose a new scope through the application manifest:
113113
## Verify the web API is exposed to other applications
114114

115115
1. Go back to your Azure AD tenant, select **App registrations**, find and select the client application you want to configure.
116-
1. Repeat the steps outlined in Configure a client application to access web APIs.
117-
1. When you get to the **Select an API** step, select your resource. You should see the new scope, available for client permission requests.
116+
1. Repeat the steps outlined in [Configure a client application to access web APIs](quickstart-configure-app-access-web-apis.md).
117+
1. When you get to the step to [select an API](quickstart-configure-app-access-web-apis.md#add-permissions-to-access-web-apis
118+
), select your resource. You should see the new scope, available for client permission requests.
118119

119120
## More on the application manifest
120121

‎articles/active-directory/develop/v2-saml-bearer-assertion.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
title: Microsoft identity platform and SAML bearer assertion flow | Azure
3+
description: Learn how to fetch data from Microsoft Graph without prompting the user for credentials using the SAML bearer assertion flow.
4+
services: active-directory
5+
documentationcenter: ''
6+
author: umeshbarapatre
7+
manager: CelesteDG
8+
editor: ''
9+
10+
ms.assetid:
11+
ms.service: active-directory
12+
ms.subservice: develop
13+
ms.workload: identity
14+
ms.tgt_pltfrm: na
15+
ms.devlang: na
16+
ms.topic: conceptual
17+
ms.date: 08/05/2019
18+
ms.author: ryanwi
19+
ms.reviewer: hirsin
20+
ms.custom: aaddev
21+
ms.collection: M365-identity-device-management
22+
---
23+
24+
# Microsoft identity platform and OAuth 2.0 SAML bearer assertion flow
25+
The OAuth 2.0 SAML bearer assertion flow allows you to request an OAuth access token using a SAML assertion when a client needs to use an existing trust relationship. The signature applied to the SAML assertion provides authentication of the authorized app. A SAML assertion is an XML security token issued by an identity provider and consumed by a service provider. The service provider relies on its content to identify the assertion’s subject for security-related purposes.
26+
27+
The SAML assertion is posted to the OAuth token endpoint. The endpoint processes the assertion and issues an access token based on prior approval of the app. The client isn’t required to have or store a refresh token, nor is the client secret required to be passed to the token endpoint.
28+
29+
SAML Bearer Assertion flow is useful when fetching data from Microsoft Graph APIs (which only support delegated permissions) without prompting the user for credentials. In this scenario the client credentials grant, which is preferred for background processes, does not work.
30+
31+
For applications that do interactive browser-based sign-in to get a SAML assertion and then want to add access to an OAuth protected API (such as Microsoft Graph), you can make an OAuth request to get an access token for the API. When the browser is redirected to Azure AD to authenticate the user, the browser will pick up the session from the SAML sign-in and the user doesn't need to enter their credentials.
32+
33+
The OAuth SAML Bearer Assertion flow is also supported for users authenticating with identity providers such as Active Directory Federation Services (ADFS) federated to Azure Active Directory. The SAML assertion obtained from ADFS can be used in an OAuth flow to authenticate the user.
34+
35+
![OAuth flow](./media/v2-saml-bearer-assertion/1.png)
36+
37+
## Call Graph using SAML bearer assertion
38+
Now let us understand on how we can actually fetch SAML assertion programatically. This approach is tested with ADFS. However, this works with any identity provider that supports the return of SAML assertion programatically. The basic process is: get a SAML assertion, get an access token, and access Microsoft Graph.
39+
40+
### Prerequisites
41+
42+
Establish a trust relationship between the authorization server/environment (Microsoft 365) and the identity provider, or issuer of the SAML 2.0 bearer assertion (ADFS). To configure ADFS for single sign-on and as an identity provider you may refer to [this article](https://blogs.technet.microsoft.com/canitpro/2015/09/11/step-by-step-setting-up-ad-fs-and-enabling-single-sign-on-to-office-365/).
43+
44+
Register the application in the [portal](https://ms.portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade):
45+
1. Sign in to the [app registration blade of the portal](https://ms.portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) (Please note that we are using the v2.0 endpoints for Graph API and hence need to register the application in this portal. Otherwise we could have used the registrations in Azure active directory).
46+
1. Select **New registration**.
47+
1. When the **Register an application** page appears, enter your application's registration information:
48+
1. **Name** - Enter a meaningful application name that will be displayed to users of the app.
49+
1. **Supported account types** - Select which accounts you would like your application to support.
50+
1. **Redirect URI (optional)** - Select the type of app you're building, Web, or Public client (mobile & desktop), and then enter the redirect URI (or reply URL) for your application.
51+
1. When finished, select **Register**.
52+
1. Make a note of the application (client) ID.
53+
1. In the left pane, select **Certificates & secrets**. Click **New client secret** in the **Client secrets** section. Copy the new client secret, you won't be able to retrieve when you leave the blade.
54+
1. In the left pane, select **API permissions** and then **Add a permission**. Select **Microsoft Graph**, then **delegated permissions**, and then select **Tasks.read** since we intend to use the Outlook Graph API.
55+
56+
Install [Postman](https://www.getpostman.com/), a tool required to test the sample requests. Later, you can convert the requests to code.
57+
58+
### Get the SAML assertion from ADFS
59+
Create a POST request to the ADFS endpoint using SOAP envelope to fetch the SAML assertion:
60+
61+
![Get SAML assertion](./media/v2-saml-bearer-assertion/2.png)
62+
63+
Header values:
64+
65+
![Header values](./media/v2-saml-bearer-assertion/3.png)
66+
67+
ADFS request body:
68+
69+
![ADFS request body](./media/v2-saml-bearer-assertion/4.png)
70+
71+
Once this request is posted successfully, you should receive a SAML assertion from ADFS. Only the **SAML:Assertion** tag data is required, convert it to base64 encoding to use in further requests.
72+
73+
### Get the OAuth2 token using the SAML assertion
74+
In this step, fetch an OAuth2 token using the ADFS assertion response.
75+
76+
1. Create a POST request as shown below with the header values:
77+
78+
![POST request](./media/v2-saml-bearer-assertion/5.png)
79+
1. In the body of the request, replace **client_id**, **client_secret**, and **assertion** (the base64 encoded SAML assertion obtained the previous step):
80+
81+
![Request body](./media/v2-saml-bearer-assertion/6.png)
82+
1. Upon successful request, you will receive an access token from Azure active directory.
83+
84+
### Get the data with the Oauth token
85+
86+
After receiving the access token, call the Graph APIs (Outlook tasks in this example).
87+
88+
1. Create a GET request with the access token fetched in the previous step:
89+
90+
![GET request](./media/v2-saml-bearer-assertion/7.png)
91+
92+
1. Upon successful request, you will receive a JSON response.
93+
94+
## Next steps
95+
96+
Learn about the different [authentication flows and application scenarios](authentication-flows-app-scenarios.md).

‎articles/active-directory/devices/hybrid-azuread-join-plan.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ Organizations may want to do a controlled validation of hybrid Azure AD join bef
9898

9999
## Select your scenario based on your identity infrastructure
100100

101-
Hybrid Azure AD join works with both, managed and federated environments.
101+
Hybrid Azure AD join works with both, managed and federated environments depending on whether the UPN is routable or non-routable. See bottom of the page for table on supported scenarios.
102102

103103
### Managed environment
104104

‎articles/active-directory/devices/troubleshoot-device-dsregcmd.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,9 @@ This section displays the output of sanity checks performed on a device joined t
293293

294294
This section performs the perquisite checks for the provisioning of an NGC key.
295295

296+
> [!NOTE]
297+
> You may not see NGC pre-requisite check details in dsregcmd /status if the user already successfully configured NGC credentials.
298+
296299
### Sample NGC prerequisite check output
297300

298301
```

0 commit comments

Comments
 (0)