You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-infrastructure-entitlement-management/cloudknox-product-account-explorer.md
+24-37Lines changed: 24 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.author: v-ydequadros
16
16
> CloudKnox Permissions Management (CloudKnox) is currently in PREVIEW.
17
17
> Some information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
18
18
19
-
You can view information about users, groups, and resources that can access account information from an external account in CloudKnox Permissions Management (CloudKnox).
19
+
You can view information about users, groups, and resources that can access account information from an external account in CloudKnox Permissions Management (CloudKnox).
20
20
21
21
## Display information about users, groups, or tasks
22
22
@@ -31,61 +31,48 @@ You can view information about users, groups, and resources that can access acc
31
31
32
32
1. To choose an account from your authorization system, select the lock icon in the left panel.
33
33
1. In the **Authorization systems** pane, select an account, then select **Apply**.
34
-
35
34
1. To choose a user, role, or group, select the person icon.
36
35
1. Select a user or group, then select **Apply**.
37
-
38
-
1.To choose a task, select the clipboard icon.
39
-
1. In the **Task**pane, select **All** or **High-risk tasks**, then select **Apply**.
36
+
1. To choose an account from your authorization system, select it from the Authorization Systems menu.
37
+
1.In the user type filter, user, role, or group.
38
+
1. In the **Task**filter, select **All** or **High-risk tasks**, then select **Apply**.
40
39
1. To delete a task, select **Delete**, then select **Apply**.
41
40
42
-
43
41
## Export information about users, groups, or tasks
44
42
45
-
-To export the data in comma-separated values (CSV) file format, in the **User analytics**dashboard, Click **Export** and selet **CSV**.
43
+
To export the data in comma-separated values (CSV) file format, select **Export**from the top-right hand corner of the table.
46
44
47
45
## View users and roles
48
-
49
46
1. To view users and roles, select the lock icon, and then select the person icon to open the **Users** pane.
47
+
1. To view the **Role summary**, select the "eye" icon to the right of the role name.
50
48
51
-
1. To view the **Role summary**, select the "eye" icon to the right of the role name.
52
-
53
-
The following details display:
54
-
55
-
-**Policies**: A list of all the policies attached to the role.
56
-
-**Trusted entities**: The identities from external accounts that can assume this role.
49
+
The following details display:
50
+
-**Policies**: A list of all the policies attached to the role.
51
+
-**Trusted entities**: The identities from external accounts that can assume this role.
57
52
58
53
1. To view all the identities from various accounts that can assume this role, select the down arrow to the left of the role name.
54
+
1. To view a graph of all the identities that can access the specified account and through which role(s), select the role name.
59
55
60
-
1. To view a graph of all the identities that can access the specified account and through which role(s), select the role name.
61
-
62
-
If CloudKnox is monitoring the external account, it lists specific identities from the accounts that can assume this role. Otherwise, it lists the identities declared in the **Trusted entity** section.
56
+
If CloudKnox is monitoring the external account, it lists specific identities from the accounts that can assume this role. Otherwise, it lists the identities declared in the **Trusted entity** section.
63
57
64
-
-**Connecting roles**: Lists the following roles for each account:
65
-
66
-
- *Direct roles* that are trusted by the account role.
67
-
- *Intermediary roles* that aren't directly trusted by the account role but are assumable by identities through role-chaining.
58
+
**Connecting roles**: Lists the following roles for each account:
59
+
-*Direct roles* that are trusted by the account role.
60
+
-*Intermediary roles* that aren't directly trusted by the account role but are assumable by identities through role-chaining.
68
61
69
62
1. To view all the roles from that account that are used to access the specified account, select the down arrow to the left of the account name.
63
+
1. To view the trusted identities declared by the role, select the down arrow to the left of the role name.
70
64
71
-
1. To view the trusted identities declared by the role, select the down arrow to the left of the role name.
72
-
73
-
The trusted identities for the role are listed only if the account is being monitored by CloudKnox.
74
-
75
-
1. To view the role definition, select the "eye" icon to the right of the role name.
76
-
77
-
When you select the down arrow and expand details, a search box is displayed. Enter your criteria in this box to search for specific roles.
78
-
79
-
-**Identities with access**: Lists the identities that come from external accounts:
80
-
81
-
- To view all the identities from that account can access the specified account, select the down arrow to the left of the account name.
82
-
- To view the **Role summary** for EC2 instances and Lambda functions, select the "eye" icon to the right of the identity name.
83
-
- To view a graph of how the identity can access the specified account and through which role(s), select the identity name.
65
+
The trusted identities for the role are listed only if the account is being monitored by CloudKnox.
84
66
85
-
1.The **Info** tab displays the **Privilege creep index** and **Service control policy (SCP)** information about the account.
67
+
1.To view the role definition, select the "eye" icon to the right of the role name.
86
68
87
-
For more information about the **Privilege creep index** and SCP information, see [View key statistics and data about your authorization system](cloudknox-ui-dashboard.md).
69
+
When you select the down arrow and expand details, a search box is displayed. Enter your criteria in this box to search for specific roles.
88
70
89
-
<!---## Next steps--->
71
+
**Identities with access**: Lists the identities that come from external accounts:
72
+
- To view all the identities from that account can access the specified account, select the down arrow to the left of the account name.
73
+
- To view the **Role summary** for EC2 instances and Lambda functions, select the "eye" icon to the right of the identity name.
74
+
- To view a graph of how the identity can access the specified account and through which role(s), select the identity name.
90
75
76
+
1. The **Info** tab displays the **Privilege creep index** and **Service control policy (SCP)** information about the account.
91
77
78
+
For more information about the **Privilege creep index** and SCP information, see [View key statistics and data about your authorization system](cloudknox-ui-dashboard.md).
Copy file name to clipboardExpand all lines: articles/active-directory/cloud-infrastructure-entitlement-management/cloudknox-product-rule-based-anomalies.md
- To view the specific identity, resource, and task names that occurred during the alert collection period, select the **Alert Name**.
32
+
- To view the specific identity, resource, and task names that occurred during the alert collection period, select the **Alert Name**.
33
33
34
34
-**Anomaly alert rule**: Displays the name of the rule select when creating the alert.
35
35
-**# of occurrences**: How many times the alert trigger has occurred.
36
-
-**Task**: How many tasks are affected by the alert.
37
-
-**Resources**: How many resources are affected by the alert.
38
-
-**Identity**: How many identities are affected by the alert.
36
+
-**Task**: How many tasks performed are triggered by the alert.
37
+
-**Resources**: How many resources accessed are triggered by the alert.
38
+
-**Identity**: How many identities performing unusual behavior are triggered by the alert.
39
39
-**Authorization system**: Displays which authorization systems the alert applies to, Amazon Web Services (**AWS**), Microsoft **Azure**, or Google Cloud Platform (**GCP**).
40
40
-**Date/Time**: Lists the date and time of the alert.
41
41
-**Date/Time (UTC)**: Lists the date and time of the alert in Coordinated Universal Time (UTC).
42
-
-**View trigger**: Displays the current trigger settings and applicable authorization system details.
43
-
-**Activity**: Displays details about the **Identity Name**, **Resource Name**, **Task Name**, **Date**, and **IP Address**.
42
+
44
43
45
44
1. To filter alerts:
46
45
47
46
- From the **Alert Name** dropdown, select **All** or the appropriate alert name.
48
47
- From the **Date** dropdown menu, select **Last 24 Hours**, **Last 2 Days**, **Last Week**, or **Custom Range**, and select **Apply**.
49
48
50
-
- If you select **Custom Range**, also enter **From** and **To** duration settings.
49
+
- If you select **Custom Range**, also enter **From** and **To** duration settings.
51
50
1. To view details that match the alert criteria, select the ellipses (**...**).
52
51
53
-
For example, **Authorization System Type**, **Authorization Systems**, **Resources**, **Tasks**, and **Identities**.
52
+
-**View Trigger**: Displays the current trigger settings and applicable authorization system details
53
+
-**Details**: Displays details about **Authorization System Type**, **Authorization Systems**, **Resources**, **Tasks**, **Identities**, and **Activity**
54
+
-**Activity**: Displays details about the **Identity Name**, **Resource Name**, **Task Name**, **Date/Time**, **Inactive For**, and **IP Address**. Selecting the "eye" icon displays the **Raw Events Summary**
-**Any Resource Accessed for the First Time**: The identity accesses a resource for the first time during the specified time interval.
65
66
-**Identity Performs a Particular Task for the First Time**: The identity does a specific task for the first time during the specified time interval.
66
-
-**Inactive Identity Becomes Active**: An identity that hasn't been active for 90 days becomes active and does any task in the selected time interval.
67
+
-**Identity Performs a Task for the First Time**: The identity performs any task for the first time during the specified time interval
67
68
1. Select **Next**.
68
-
1. On the **Authorization systems** tab, select the available authorization systems accounts and folders, or select **All**.
69
+
1. On the **Authorization Systems** tab, select the available authorization systems and folders, or select **All**.
69
70
70
-
This screen defaults to **List** view, but you can change it to **Folder** view. You can select the applicable folder instead of individually by system.
71
+
This screen defaults to **List** view, but you can change it to **Folders** view. You can select the applicable folder instead of individually selecting by authorization system.
71
72
72
73
- The **Status** column displays if the authorization system is online or offline.
73
74
- The **Controller** column displays if the controller is enabled or disabled.
Only the user who created the alert can edit the trigger screen, rename an alert, deactivate an alert, and delete an alert. Changes made by other users aren't saved.
101
101
102
-
-**Duplicate**: Create a duplicate of the alert called "**Copy of XXX**".
102
+
-**Duplicate**: Create a duplicate copy of the selected alert trigger.
103
103
-**Rename**: Enter the new name of the query, and then select **Save.**
104
104
-**Deactivate**: The alert will still be listed, but will no longer send emails to subscribed users.
105
105
-**Activate**: Activate the alert trigger and start sending emails to subscribed users.
106
-
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger and their **User status**.
106
+
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger.
107
107
-**Delete**: Delete the alert.
108
108
109
109
If the **Subscription** is **Off**, the following options are available:
110
110
-**View**: View details of the alert trigger.
111
-
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger and their **User status**.
111
+
-**Notification settings**: View the **Email** of users who are subscribed to the alert trigger.
112
112
-**Duplicate**: Create a duplicate copy of the selected alert trigger.
113
113
114
114
1. To filter by **Activated** or **Deactivated**, in the **Status** section, select **All**, **Activated**, or **Deactivated**, and then select **Apply**.
- For an overview on activity triggers, see [View information about activity triggers](cloudknox-ui-triggers.md).
121
121
- For information on activity alerts and alert triggers, see [Create and view activity alerts and alert triggers](cloudknox-howto-create-alert-trigger.md).
122
122
- For information on finding outliers in identity's behavior, see [Create and view statistical anomalies and anomaly triggers](cloudknox-product-statistical-anomalies.md).
123
-
- For information on permission analytics triggers, see [Create and view permission analytics triggers](cloudknox-product-permission-analytics.md).
123
+
- For information on permission analytics triggers, see [Create and view permission analytics triggers](cloudknox-product-permission-analytics.md).
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/cross-tenant-access-overview.md
+11-6Lines changed: 11 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: active-directory
5
5
ms.service: active-directory
6
6
ms.subservice: B2B
7
7
ms.topic: how-to
8
-
ms.date: 02/07/2022
8
+
ms.date: 02/23/2022
9
9
10
10
ms.author: mimart
11
11
author: msmimart
@@ -94,11 +94,16 @@ The output is a summary of all available sign-in events for inbound and outbound
94
94
To determine your users' access to external Azure AD organizations, you can use the [Get-MgAuditLogSignIn](/powershell/module/microsoft.graph.reports/get-mgauditlogsignin) cmdlet in the Microsoft Graph PowerShell SDK to view data from your sign-in logs for the last 30 days. For example, run the following command:
95
95
96
96
```powershell
97
-
Get-MgAuditLogSignIn `
98
-
-Filter “ResourceTenantID ne ‘your tenant id’” `
99
-
-all:$True| `
100
-
group ResourceTenantId,AppDisplayName,UserPrincipalName| `
101
-
select count, @{n=’Ext TenantID/App User Pair’;e={$_.name}}]
97
+
#Initial connection
98
+
Connect-MgGraph -Scopes "AuditLog.Read.All"
99
+
Select-MgProfile -Name "beta"
100
+
101
+
#Get external access
102
+
$TenantId = "<replace-with-your-tenant-ID>"
103
+
104
+
Get-MgAuditLogSignIn -Filter "ResourceTenantId ne '$TenantID'" -All:$True |
Copy file name to clipboardExpand all lines: articles/advisor/resource-graph-samples.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Azure Resource Graph sample queries for Azure Advisor
3
3
description: Sample Azure Resource Graph queries for Azure Advisor showing use of resource types and tables to access Azure Advisor related resources and properties.
Copy file name to clipboardExpand all lines: articles/aks/nat-gateway.md
+14-1Lines changed: 14 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,6 +25,17 @@ To use Managed NAT gateway, you must have the following:
25
25
* The `aks-preview` extension version 0.5.31 or later
26
26
* Kubernetes version 1.20.x or above
27
27
28
+
### Install aks-preview CLI extension
29
+
30
+
You also need the *aks-preview* Azure CLI extension version 0.5.31 or later. Install the *aks-preview* Azure CLI extension by using the [az extension add][az-extension-add] command. Or install any available updates by using the [az extension update][az-extension-update] command.
31
+
32
+
```azurecli-interactive
33
+
# Install the aks-preview extension
34
+
az extension add --name aks-preview
35
+
36
+
# Update the extension to make sure you have the latest version installed
37
+
az extension update --name aks-preview
38
+
```
28
39
29
40
### Register the `AKS-NATGatewayPreview` feature flag
30
41
@@ -159,4 +170,6 @@ To create an AKS cluster with a user-assigned NAT Gateway, use `--outbound-type
Copy file name to clipboardExpand all lines: articles/app-service/overview-vnet-integration.md
+14Lines changed: 14 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -91,6 +91,20 @@ Learn [how to configure application routing](./configure-vnet-integration-routin
91
91
92
92
We recommend that you use the **Route All** configuration setting to enable routing of all traffic. Using the configuration setting allows you to audit the behavior with [a built-in policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F33228571-70a4-4fa1-8ca1-26d0aba8d6ef). The existing WEBSITE_VNET_ROUTE_ALL app setting can still be used, and you can enable all traffic routing with either setting.
93
93
94
+
#### Configuration routing
95
+
96
+
When you are using virtual network integration, you can configure how parts of the configuration traffic is managed. By default, the mentioned configurations will go directly to the internet unless you actively configure it to be routed through the virtual network integration.
97
+
98
+
##### Content storage
99
+
100
+
Bringing you own storage for content in often used in Functions where [content storage](./../azure-functions/configure-networking-how-to.md#restrict-your-storage-account-to-a-virtual-network) is configured as part of the Functions app.
101
+
102
+
To route content storage traffic through the virtual network integration, you need to add an app setting named `WEBSITE_CONTENTOVERVNET` with the value `1`. In addition to adding the app setting, you must also ensure that any firewall or Network Security Group configured on traffic from the subnet allow traffic to port 443 and 445.
103
+
104
+
##### Container image pull
105
+
106
+
When using custom containers for Linux, you can pull the container over the virtual network integration. To route the container pull traffic through the virtual network integration, you must add an app setting named `WEBSITE_PULL_IMAGE_OVER_VNET` with the value `true`.
107
+
94
108
#### Network routing
95
109
96
110
You can use route tables to route outbound traffic from your app to wherever you want. Route tables affect your destination traffic. When **Route All** is disabled in [application routing](#application-routing), only private traffic (RFC1918) is affected by your route tables. Common destinations can include firewall devices or gateways. Routes that are set on your integration subnet won't affect replies to inbound app requests.
0 commit comments