Skip to content

Commit d060947

Browse files
huypubhuypub
authored
Merge pull request MicrosoftDocs#84168 from MicrosoftDocs/master
8/2 AM Publish
2 parents c662440 + 8d0e0dd commit d060947

File tree

61 files changed

+633
-432
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+633
-432
lines changed

‎articles/active-directory/devices/azureadjoin-plan.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,11 @@ A federated environment should have an identity provider that supports both WS-T
6666

6767
- **WS-Fed:** This protocol is required to join a device to Azure AD.
6868
- **WS-Trust:** This protocol is required to sign in to an Azure AD joined device.
69-
When you're using AD FS, you need to enable the following WS-Trust endpoints
70-
- /adfs/services/trust/2005/usernamemixed
71-
- /adfs/services/trust/13/usernamemixed
72-
- /adfs/services/trust/2005/certificatemixed
73-
- /adfs/services/trust/13/certificatemixed
69+
When you're using AD FS, you need to enable the following WS-Trust endpoints:
70+
`/adfs/services/trust/2005/usernamemixed`
71+
`/adfs/services/trust/13/usernamemixed`
72+
`/adfs/services/trust/2005/certificatemixed`
73+
`/adfs/services/trust/13/certificatemixed`
7474

7575
If your identity provider does not support these protocols, Azure AD join does not work natively. Beginning with Windows 10 1809, your users can sign in to an Azure AD joined device with a SAML-based identity provider through [web sign-in on Windows 10](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#web-sign-in-to-windows-10). Currently, web sign-in is a preview feature and is not recommended for production deployments.
7676

‎articles/active-directory/devices/hybrid-azuread-join-manual.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -174,12 +174,12 @@ In a federated Azure AD configuration, devices rely on AD FS or an on-premises
174174
Windows current devices authenticate by using Integrated Windows Authentication to an active WS-Trust endpoint (either 1.3 or 2005 versions) hosted by the on-premises federation service.
175175

176176
When you're using AD FS, you need to enable the following WS-Trust endpoints
177-
- /adfs/services/trust/2005/windowstransport
178-
- /adfs/services/trust/13/windowstransport
179-
- /adfs/services/trust/2005/usernamemixed
180-
- /adfs/services/trust/13/usernamemixed
181-
- /adfs/services/trust/2005/certificatemixed
182-
- /adfs/services/trust/13/certificatemixed
177+
- `/adfs/services/trust/2005/windowstransport`
178+
- `/adfs/services/trust/13/windowstransport`
179+
- `/adfs/services/trust/2005/usernamemixed`
180+
- `/adfs/services/trust/13/usernamemixed`
181+
- `/adfs/services/trust/2005/certificatemixed`
182+
- `/adfs/services/trust/13/certificatemixed`
183183

184184
> [!WARNING]
185185
> Both **adfs/services/trust/2005/windowstransport** or **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust WIndows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**.

‎articles/active-directory/devices/hybrid-azuread-join-plan.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -111,14 +111,14 @@ These scenarios don't require you to configure a federation server for authentic
111111
A federated environment should have an identity provider that supports the following requirements. If you have a federated environment using Active Directory Federation Services (AD FS), then the above requirements are already supported.
112112

113113
- **WIAORMULTIAUTHN claim:** This claim is required to do hybrid Azure AD join for Windows down-level devices.
114-
- **WS-Trust protocol:** This protocol is required to authenticate Windows current hybrid Azure AD joined devices with Azure AD.
115-
When you're using AD FS, you need to enable the following WS-Trust endpoints
116-
- /adfs/services/trust/2005/windowstransport
117-
- /adfs/services/trust/13/windowstransport
118-
- /adfs/services/trust/2005/usernamemixed
119-
- /adfs/services/trust/13/usernamemixed
120-
- /adfs/services/trust/2005/certificatemixed
121-
- /adfs/services/trust/13/certificatemixed
114+
- **WS-Trust protocol:** This protocol is required to authenticate Windows current hybrid Azure AD joined devices with Azure AD.
115+
When you're using AD FS, you need to enable the following WS-Trust endpoints:
116+
`/adfs/services/trust/2005/windowstransport`
117+
`/adfs/services/trust/13/windowstransport`
118+
`/adfs/services/trust/2005/usernamemixed`
119+
`/adfs/services/trust/13/usernamemixed`
120+
`/adfs/services/trust/2005/certificatemixed`
121+
`/adfs/services/trust/13/certificatemixed`
122122

123123
> [!WARNING]
124124
> Both **adfs/services/trust/2005/windowstransport** or **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust WIndows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**.

‎articles/active-directory/manage-apps/use-scim-to-provision-users-and-groups.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.workload: identity
1212
ms.tgt_pltfrm: na
1313
ms.devlang: na
1414
ms.topic: conceptual
15-
ms.date: 05/06/2019
15+
ms.date: 07/31/2019
1616
ms.author: mimart
1717
ms.reviewer: arvinh
1818
ms.custom: aaddev;it-pro;seohack1
@@ -70,7 +70,7 @@ Applications that support the SCIM profile described in this article can be conn
7070
![Example: An app's Provisioning page in the Azure portal][2]<br/>
7171
*Figure 3: Configuring provisioning in the Azure portal*
7272

73-
1. In the **Tenant URL** field, enter the URL of the application's SCIM endpoint. Example: https://api.contoso.com/scim/v2/
73+
1. In the **Tenant URL** field, enter the URL of the application's SCIM endpoint. Example: https://api.contoso.com/scim/
7474
1. If the SCIM endpoint requires an OAuth bearer token from an issuer other than Azure AD, then copy the required OAuth bearer token into the optional **Secret Token** field. If this field is left blank, Azure AD includes an OAuth bearer token issued from Azure AD with each request. Apps that use Azure AD as an identity provider can validate this Azure AD-issued token.
7575
1. Select **Test Connection** to have Azure Active Directory attempt to connect to the SCIM endpoint. If the attempt fails, error information is displayed.
7676

@@ -675,7 +675,7 @@ The easiest way to implement a SCIM endpoint that can accept provisioning reques
675675
1. Enter a name for your application, and select **Add** to create an app object. The application object created is intended to represent the target app you would be provisioning to and implementing single sign-on for, and not just the SCIM endpoint.
676676
1. In the app management screen, select **Provisioning** in the left panel.
677677
1. In the **Provisioning Mode** menu, select **Automatic**.
678-
1. In the **Tenant URL** field, enter the internet-exposed URL and port of your SCIM endpoint. The entry is something like http://testmachine.contoso.com:9000 or http://\<ip-address>:9000/, where \<ip-address> is the internet exposed IP address.
678+
1. In the **Tenant URL** field, enter the URL of the application's SCIM endpoint. Example: https://api.contoso.com/scim/
679679

680680
1. If the SCIM endpoint requires an OAuth bearer token from an issuer other than Azure AD, then copy the required OAuth bearer token into the optional **Secret Token** field. If this field is left blank, Azure AD includes an OAuth bearer token issued from Azure AD with each request. Apps that use Azure AD as an identity provider can validate this Azure AD-issued token.
681681
1. Select **Test Connection** to have Azure Active Directory attempt to connect to the SCIM endpoint. If the attempt fails, error information is displayed.

‎articles/active-directory/users-groups-roles/licensing-service-plan-reference.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ When managing licenses in [the Azure portal](https://portal.azure.com/#blade/Mic
101101
| SKYPE FOR BUSINESS PSTN CONFERENCING | MCOMEETADV | 0c266dff-15dd-4b49-8397-2bb16070ed52 | MCOMEETADV (3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40) | AUDIO CONFERENCING (3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40) |
102102
| SKYPE FOR BUSINESS PSTN DOMESTIC AND INTERNATIONAL CALLING | MCOPSTN2 | d3b4fe1f-9992-4930-8acb-ca6ec609365e | MCOPSTN2 (5a10155d-f5c1-411a-a8ec-e99aae125390) | DOMESTIC AND INTERNATIONAL CALLING PLAN (5a10155d-f5c1-411a-a8ec-e99aae125390) |
103103
| SKYPE FOR BUSINESS PSTN DOMESTIC CALLING | MCOPSTN1 | 0dab259f-bf13-4952-b7f8-7db8f131b28d | MCOPSTN1 (4ed3ff63-69d7-4fb7-b984-5aec7f605ca8) | DOMESTIC CALLING PLAN (4ed3ff63-69d7-4fb7-b984-5aec7f605ca8) |
104+
| SKYPE FOR BUSINESS PSTN DOMESTIC CALLING (120 Minutes)| MCOPSTN5 | 54a152dc-90de-4996-93d2-bc47e670fc06 | MCOPSTN5 (54a152dc-90de-4996-93d2-bc47e670fc06) | DOMESTIC CALLING PLAN (54a152dc-90de-4996-93d2-bc47e670fc06) |
104105
| VISIO ONLINE PLAN 1 | VISIOONLINE_PLAN1 | 4b244418-9658-4451-a2b8-b5e2b364e9bd | ONEDRIVE_BASIC (da792a53-cbc0-4184-a10d-e544dd34b3c1)<br/>VISIOONLINE (2bdbaf8f-738f-4ac7-9234-3c3ee2ce7d0f) | ONEDRIVE_BASIC (da792a53-cbc0-4184-a10d-e544dd34b3c1)<br/>VISIOONLINE (2bdbaf8f-738f-4ac7-9234-3c3ee2ce7d0f) |
105106
| VISIO Online Plan 2 | VISIOCLIENT | c5928f49-12ba-48f7-ada3-0d743a3601d5 | ONEDRIVE_BASIC (da792a53-cbc0-4184-a10d-e544dd34b3c1)<br/>VISIO_CLIENT_SUBSCRIPTION (663a804f-1c30-4ff0-9915-9db84f0d1cea)<br/>VISIOONLINE (2bdbaf8f-738f-4ac7-9234-3c3ee2ce7d0f) | ONEDRIVE_BASIC (da792a53-cbc0-4184-a10d-e544dd34b3c1)<br/>VISIO_CLIENT_SUBSCRIPTION (663a804f-1c30-4ff0-9915-9db84f0d1cea)<br/>VISIOONLINE (2bdbaf8f-738f-4ac7-9234-3c3ee2ce7d0f) |
106107
| WINDOWS 10 ENTERPRISE E3 | WIN10_PRO_ENT_SUB | cb10e6cd-9da4-4992-867b-67546b1db821 | WIN10_PRO_ENT_SUB (21b439ba-a0ca-424f-a6cc-52f954a5b111) | WINDOWS 10 ENTERPRISE (21b439ba-a0ca-424f-a6cc-52f954a5b111)

‎articles/aks/api-server-authorized-ip-ranges.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -216,13 +216,13 @@ To enable API server authorized IP ranges, you provide a list of authorized IP a
216216

217217
Use [az aks update][az-aks-update] command and specify the *--api-server-authorized-ip-ranges* to allow. These IP address ranges are usually address ranges used by your on-premises networks. Add the public IP address of your own Azure firewall obtained in the previous step, such as *20.42.25.196/32*.
218218

219-
The following example enables API server authorized IP ranges on the cluster named *myAKSCluster* in the resource group named *myResourceGroup*. The IP address ranges to authorize are *20.42.25.196/32* (the Azure firewall public IP address), then *172.0.0.10/16* and *168.10.0.10/18*:
219+
The following example enables API server authorized IP ranges on the cluster named *myAKSCluster* in the resource group named *myResourceGroup*. The IP address ranges to authorize are *20.42.25.196/32* (the Azure firewall public IP address), then *172.0.0.0/16* and *168.10.0.0/18*:
220220

221221
```azurecli-interactive
222222
az aks update \
223223
--resource-group myResourceGroup \
224224
--name myAKSCluster \
225-
--api-server-authorized-ip-ranges 20.42.25.196/32,172.0.0.10/16,168.10.0.10/18
225+
--api-server-authorized-ip-ranges 20.42.25.196/32,172.0.0.0/16,168.10.0.0/18
226226
```
227227

228228
## Update or disable authorized IP ranges

‎articles/aks/concepts-storage.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,9 @@ Applications often need to be able to store and retrieve data. As Kubernetes typ
3030
Traditional volumes to store and retrieve data are created as Kubernetes resources backed by Azure Storage. You can manually create these data volumes to be assigned to pods directly, or have Kubernetes automatically create them. These data volumes can use Azure Disks or Azure Files:
3131

3232
- *Azure Disks* can be used to create a Kubernetes *DataDisk* resource. Disks can use Azure Premium storage, backed by high-performance SSDs, or Azure Standard storage, backed by regular HDDs. For most production and development workloads, use Premium storage. Azure Disks are mounted as *ReadWriteOnce*, so are only available to a single node. For storage volumes that can be accessed by multiple nodes simultaneously, use Azure Files.
33-
- *Azure Files* can be used to mount an SMB 3.0 share backed by an Azure Storage account to pods. Files let you share data across multiple nodes and pods. Currently, Files can only use Azure Standard storage backed by regular HDDs.
33+
- *Azure Files* can be used to mount an SMB 3.0 share backed by an Azure Storage account to pods. Files let you share data across multiple nodes and pods. Files can use Azure Standard storage backed by regular HDDs, or Azure Premium storage, backed by high-performance SSDs.
34+
> [!NOTE]
35+
> Azure Files support premium storage in AKS clusters that run Kubernetes 1.13 or higher.
3436
3537
In Kubernetes, volumes can represent more than just a traditional disk where information can be stored and retrieved. Kubernetes volumes can also be used as a way to inject data into a pod for use by the containers. Common additional volume types in Kubernetes include:
3638

‎articles/aks/tutorial-kubernetes-prepare-app.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ Stop and remove the container instances and resources with the [docker-compose d
101101
docker-compose down
102102
```
103103

104-
When the local application has been removed, you have a Docker image that contains the Azure Vote application, *azure-front-front*, for use with the next tutorial.
104+
When the local application has been removed, you have a Docker image that contains the Azure Vote application, *azure-vote-front*, for use with the next tutorial.
105105

106106
## Next steps
107107

‎articles/app-service/web-sites-integrate-with-vnet.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,11 +131,10 @@ The Gateway required VNet Integration feature:
131131
* Enables up to five VNets to be integrated with in an App Service Plan
132132
* Allows the same VNet to be used by multiple apps in an App Service Plan without impacting the total number that can be used by an App Service plan. If you have 6 apps using the same VNet in the same App Service plan, that counts as 1 VNet being used.
133133
* Requires a Virtual Network Gateway that is configured with Point to Site VPN
134-
* Is not supported for use with Linux apps
135134
* Supports a 99.9% SLA due to the SLA on the gateway
136135

137136
This feature does not support:
138-
137+
* Use with Linux apps
139138
* Accessing resources across ExpressRoute
140139
* Accessing resources across Service Endpoints
141140

‎articles/application-gateway/application-gateway-faq.md

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ Yes. See [Modifications to a request](https://docs.microsoft.com/azure/applicati
9696

9797
New Application Gateway v1 SKU deployments can take up to 20 minutes to provision. Changes to instance size or count aren't disruptive, and the gateway remains active during this time.
9898

99-
Deployments that use the v2 SKU can take up to 6 minutes to provision.
99+
Most deployments that use the v2 SKU take around 6 minutes to provision. However it can take longer depending on the type of deployment. For example, deployments across multiple Availability Zones with many instances can take more than 6 minutes.
100100

101101
### Can I use Exchange Server as a backend with Application Gateway?
102102

@@ -319,10 +319,6 @@ Yes. You can enable DDoS protection on the virtual network where the application
319319

320320
Yes. For details see, [Migrate Azure Application Gateway and Web Application Firewall from v1 to v2](migrate-v1-v2.md).
321321

322-
### Does WAF support non UTF-8 encoding?
323-
324-
No. WAF currently supports only UTF-8 encoding.
325-
326322
## Diagnostics and logging
327323

328324
### What types of logs does Application Gateway provide?

‎articles/automation/automation-update-management.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ You can use the Update Management solution in Azure Automation to manage operati
1717
You can enable Update Management for virtual machines directly from your Azure Automation account. To learn how to enable Update Management for virtual machines from your Automation account, see [Manage updates for multiple virtual machines](manage-update-multi.md). You can also enable Update Management for a virtual machine from the virtual machine page in the Azure portal. This scenario is available for [Linux](../virtual-machines/linux/tutorial-monitoring.md#enable-update-management) and [Windows](../virtual-machines/windows/tutorial-monitoring.md#enable-update-management) virtual machines.
1818

1919
> [!NOTE]
20-
> The Update Management solution requires linking a Log Analytics workspace to your Automation account. For a definitive list of supported regions, see [https://docs.microsoft.com/en-us/azure/automation/how-to/region-mappings]. The region mappings do not affect the ability to manage virtual machines in a
20+
> The Update Management solution requires linking a Log Analytics workspace to your Automation account. For a definitive list of supported regions, see [Azure Workspace mappings](./how-to/region-mappings.md). The region mappings do not affect the ability to manage virtual machines in a
2121
> separate region than your Automation account.
2222
2323
[!INCLUDE [azure-monitor-log-analytics-rebrand](../../includes/azure-monitor-log-analytics-rebrand.md)]

‎articles/azure-functions/functions-bindings-signalr-service.md

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -276,14 +276,15 @@ The following example adds a user to a group.
276276
[FunctionName("addToGroup")]
277277
public static Task AddToGroup(
278278
[HttpTrigger(AuthorizationLevel.Anonymous, "post")]HttpRequest req,
279-
string userId,
279+
ClaimsPrincipal claimsPrincipal,
280280
[SignalR(HubName = "chat")]
281281
IAsyncCollector<SignalRGroupAction> signalRGroupActions)
282282
{
283+
var userIdClaim = claimsPrincipal.FindFirst(ClaimTypes.NameIdentifier);
283284
return signalRGroupActions.AddAsync(
284285
new SignalRGroupAction
285286
{
286-
UserId = userId,
287+
UserId = userIdClaim.Value,
287288
GroupName = "myGroup",
288289
Action = GroupAction.Add
289290
});
@@ -298,20 +299,24 @@ The following example removes a user from a group.
298299
[FunctionName("removeFromGroup")]
299300
public static Task RemoveFromGroup(
300301
[HttpTrigger(AuthorizationLevel.Anonymous, "post")]HttpRequest req,
301-
string userId,
302+
ClaimsPrincipal claimsPrincipal,
302303
[SignalR(HubName = "chat")]
303304
IAsyncCollector<SignalRGroupAction> signalRGroupActions)
304305
{
306+
var userIdClaim = claimsPrincipal.FindFirst(ClaimTypes.NameIdentifier);
305307
return signalRGroupActions.AddAsync(
306308
new SignalRGroupAction
307309
{
308-
UserId = userId,
310+
UserId = userIdClaim.Value,
309311
GroupName = "myGroup",
310312
Action = GroupAction.Remove
311313
});
312314
}
313315
```
314316

317+
> [!NOTE]
318+
> In order to get the `ClaimsPrincipal` correctly bound, you must have configured the authentication settings in Azure Functions.
319+
315320
### 2.x JavaScript send message output examples
316321

317322
#### Broadcast to all clients

0 commit comments

Comments
 (0)