Merge pull request #212997 from MicrosoftDocs/main

Merge main to live, 4 AM

Author: v-ccolin

articles/active-directory/develop/multi-service-web-app-access-microsoft-graph-as-user.md

@@ -275,10 +275,15 @@ public class IndexModel : PageModel
 
 # [Node.js](#tab/programming-language-nodejs)
 
-The web app gets the user's access token from the incoming requests header, which is then passed down to Microsoft Graph client to make an authenticated request to the `/me` endpoint.
+Using the [microsoft-identity-express](https://github.com/Azure-Samples/microsoft-identity-express) package, the web app gets the user's access token from the incoming requests header. microsoft-identity-express detects that the web app is hosted on App Service and gets the access token from the App Service authentication/authorization module. The access token is then passed down to the Microsoft Graph SDK client to make an authenticated request to the `/me` endpoint.
 
 To see this code as part of a sample application, see *graphController.js* in the [sample on GitHub](https://github.com/Azure-Samples/ms-identity-easyauth-nodejs-storage-graphapi/tree/main/2-WebApp-graphapi-on-behalf).
 
+> [!NOTE]
+> The microsoft-identity-express package isn't required in your web app for basic authentication/authorization or to authenticate requests with Microsoft Graph. It's possible to [securely call downstream APIs](../../app-service/tutorial-auth-aad.md#call-api-securely-from-server-code) with only the App Service authentication/authorization module enabled.
+> 
+> However, the App Service authentication/authorization is designed for more basic authentication scenarios. Later, when your web app needs to handle more complex scenarios, you can disable the App Service authentication/authorization module and microsoft-identity-express will already be a part of your app.
+
 ```nodejs
 const graphHelper = require('../utils/graphHelper');
 
@@ -328,4 +333,4 @@ If you're finished with this tutorial and no longer need the web app or associat
 ## Next steps
 
 > [!div class="nextstepaction"]
-> [App service accesses Microsoft Graph as the app](multi-service-web-app-access-microsoft-graph-as-app.md)
+> [App service accesses Microsoft Graph as the app](multi-service-web-app-access-microsoft-graph-as-app.md)

articles/active-directory/external-identities/azure-ad-account.md

@@ -38,7 +38,7 @@ Azure AD account is an identity provider option for your self-service sign-up us
 ![Azure AD account in a self-service sign-up user flow](media/azure-ad-account/azure-ad-account-user-flow.png)
 
 ## Verifying the application's publisher domain
-As of November 2020, new application registrations show up as unverified in the user consent prompt unless [the application's publisher domain is verified](../develop/howto-configure-publisher-domain.md) ***and*** the company’s identity has been verified with the Microsoft Partner Network and associated with the application. ([Learn more](../develop/publisher-verification-overview.md) about this change.) Note that for Azure AD user flows, the publisher’s domain appears only when using a [Microsoft account](microsoft-account.md) or other Azure AD tenant as the identity provider. To meet these new requirements, do the following:
+As of November 2020, new application registrations show up as unverified in the user consent prompt unless [the application's publisher domain is verified](../develop/howto-configure-publisher-domain.md), ***and*** the company’s identity has been verified with the Microsoft Partner Network and associated with the application. ([Learn more](../develop/publisher-verification-overview.md) about this change.) For Azure AD user flows, the publisher’s domain appears only when using a [Microsoft account](microsoft-account.md) or other Azure AD tenant as the identity provider. To meet these new requirements, follow these steps:
 
 1. [Verify your company identity using your Microsoft Partner Network (MPN) account](/partner-center/verification-responses). This process verifies information about your company and your company’s primary contact.
 1. Complete the publisher verification process to associate your MPN account with your app registration using one of the following options:
@@ -48,4 +48,4 @@ As of November 2020, new application registrations show up as unverified in the
 ## Next steps
 
 - [Add Azure Active Directory B2B collaboration users](add-users-administrator.md)
-- [Add self-service sign-up to an app](self-service-sign-up-user-flow.md)
+- [Add self-service sign-up to an app](self-service-sign-up-user-flow.md)

articles/active-directory/external-identities/media/azure-ad-account/azure-ad-account-identity-provider.png

@@ -56,7 +56,6 @@ const appSettings = {
     },
     authRoutes: {
         redirect: "/.auth/login/aad/callback", // Enter the redirect URI here
-        error: "/error", // enter the relative path to error handling route
         unauthorized: "/unauthorized" // enter the relative path to unauthorized route
     },
 }
@@ -118,4 +117,4 @@ getAuthenticatedClient = (accessToken) => {
 
 [!INCLUDE [tutorial-clean-up-steps](./includes/tutorial-cleanup.md)]
 
-[!INCLUDE [tutorial-content-below-code](./includes/tutorial-microsoft-graph-as-app/cleanup.md)]
+[!INCLUDE [tutorial-content-below-code](./includes/tutorial-microsoft-graph-as-app/cleanup.md)]