Skip to content

Commit 0d57df4

Browse files
authored
Merge pull request #210021 from MicrosoftDocs/main
Publish to live, Friday 4 AM PST, 9/2
2 parents 1b7e742 + 88fff75 commit 0d57df4

File tree

118 files changed

+1736
-592
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

118 files changed

+1736
-592
lines changed

.openpublishing.publish.config.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -986,6 +986,7 @@
986986
".openpublishing.redirection.azure-percept.json",
987987
".openpublishing.redirection.azure-productivity.json",
988988
".openpublishing.redirection.azure-australia.json",
989+
".openpublishing.redirection.aks.json",
989990
"articles/azure-fluid-relay/.openpublishing.redirection.fluid-relay.json",
990991
"articles/azure-netapp-files/.openpublishing.redirection.azure-netapp-files.json",
991992
"articles/azure-relay/.openpublishing.redirection.relay.json",

.openpublishing.redirection.aks.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"redirections": [
3+
{
4+
"source_path_from_root": "/articles/aks/azure-cni-overlay.md",
5+
"redirect_url": "/azure/aks",
6+
"redirect_document_id": false
7+
}
8+
]
9+
}

articles/active-directory-domain-services/powershell-create-instance.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.service: active-directory
1010
ms.subservice: domain-services
1111
ms.workload: identity
1212
ms.topic: sample
13-
ms.date: 08/17/2022
13+
ms.date: 09/1/2022
1414
ms.author: justinha
1515
ms.custom: devx-track-azurepowershell
1616

@@ -48,7 +48,7 @@ To complete this article, you need the following resources:
4848

4949
Azure AD DS requires a service principal to authenticate and communicate and an Azure AD group to define which users have administrative permissions in the managed domain.
5050

51-
First, create an Azure AD service principal by using a specific application ID named *Domain Controller Services*. The ID value is *2565bd9d-da50-47d4-8b85-4c97f669dc36*. Don't change this application ID.
51+
First, create an Azure AD service principal by using a specific application ID named *Domain Controller Services*. The ID value is *2565bd9d-da50-47d4-8b85-4c97f669dc36* for global Azure and *6ba9a5d4-8456-4118-b521-9c5ca10cdf84* for other Azure clouds. Don't change this application ID.
5252

5353
Create an Azure AD service principal using the [New-AzureADServicePrincipal][New-AzureADServicePrincipal] cmdlet:
5454

@@ -230,7 +230,7 @@ When the Azure portal shows that the managed domain has finished provisioning, t
230230

231231
## Complete PowerShell script
232232

233-
The following complete PowerShell script combines all of the tasks shown in this article. Copy the script and save it to a file with a `.ps1` extension. Run the script in a local PowerShell console or the [Azure Cloud Shell][cloud-shell].
233+
The following complete PowerShell script combines all of the tasks shown in this article. Copy the script and save it to a file with a `.ps1` extension. For Azure Global, use AppId value *2565bd9d-da50-47d4-8b85-4c97f669dc36*. For other Azure clouds, use AppId value *6ba9a5d4-8456-4118-b521-9c5ca10cdf84*. Run the script in a local PowerShell console or the [Azure Cloud Shell][cloud-shell].
234234

235235
> [!NOTE]
236236
> To enable Azure AD DS, you must be a global administrator for the Azure AD tenant. You also need at least *Contributor* privileges in the Azure subscription.
@@ -251,7 +251,7 @@ Connect-AzureAD
251251
Connect-AzAccount
252252
253253
# Create the service principal for Azure AD Domain Services.
254-
New-AzureADServicePrincipal -AppId "6ba9a5d4-8456-4118-b521-9c5ca10cdf84"
254+
New-AzureADServicePrincipal -AppId "2565bd9d-da50-47d4-8b85-4c97f669dc36"
255255
256256
# First, retrieve the object ID of the 'AAD DC Administrators' group.
257257
$GroupObjectId = Get-AzureADGroup `

articles/active-directory/authentication/how-to-mfa-additional-context.md

Lines changed: 382 additions & 5 deletions
Large diffs are not rendered by default.

articles/active-directory/authentication/how-to-mfa-number-match.md

Lines changed: 254 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how to use number matching in MFA notifications
44
ms.service: active-directory
55
ms.subservice: authentication
66
ms.topic: conceptual
7-
ms.date: 08/08/2022
7+
ms.date: 09/01/2022
88
ms.author: justinha
99
author: mjsantani
1010
ms.collection: M365-identity-device-management
@@ -13,7 +13,7 @@ ms.collection: M365-identity-device-management
1313
---
1414
# How to use number matching in multifactor authentication (MFA) notifications (Preview) - Authentication Methods Policy
1515

16-
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security. The schema for the API to enable number match is currently being updated. **While the API is updated over the next two weeks, you should only use the Azure AD portal to enable number match.**
16+
This topic covers how to enable number matching in Microsoft Authenticator push notifications to improve user sign-in security. Number matching can be enabled by using the Azure portal or Microsoft Graph API.
1717

1818
>[!NOTE]
1919
>Number matching is a key security upgrade to traditional second factor notifications in Microsoft Authenticator that will be enabled by default for all tenants a few months after general availability (GA).<br>
@@ -25,8 +25,6 @@ Your organization will need to enable Authenticator (traditional second factor)
2525

2626
## Number matching
2727

28-
<!---check below with Mayur. The bit about the policy came from the number match FAQ at the end.--->
29-
3028
Number matching can be targeted to only a single group, which can be dynamic or nested. On-premises synchronized security groups and cloud-only security groups are supported for the Authentication Method Policy.
3129

3230
Number matching is available for the following scenarios. When enabled, all scenarios support number matching.
@@ -54,7 +52,7 @@ During self-service password reset, the Authenticator app notification will show
5452

5553
### Combined registration
5654

57-
When a user is goes through combined registration to set up the Authenticator app, the user is asked to approve a notification as part of adding the account. For users who are enabled for number matching, this notification will show a number that they need to type in their Authenticator app notification.
55+
When a user goes through combined registration to set up the Authenticator app, the user is asked to approve a notification as part of adding the account. For users who are enabled for number matching, this notification will show a number that they need to type in their Authenticator app notification.
5856

5957
### AD FS adapter
6058

@@ -86,7 +84,256 @@ To create the registry key that overrides push notifications:
8684

8785
## Enable number matching
8886

89-
To enable number matching, complete the following steps:
87+
88+
>[!NOTE]
89+
>In Graph Explorer, ensure you've consented to the **Policy.Read.All** and **Policy.ReadWrite.AuthenticationMethod** permissions.
90+
91+
Identify your single target group for the schema configuration. Then use the following API endpoint to change the numberMatchingRequiredState property under featureSettings to **enabled** and include or exclude groups:
92+
93+
```http
94+
https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
95+
```
96+
97+
98+
### MicrosoftAuthenticatorAuthenticationMethodConfiguration properties
99+
100+
**PROPERTIES**
101+
102+
| Property | Type | Description |
103+
|---------|------|-------------|
104+
| id | String | The authentication method policy identifier. |
105+
| state | authenticationMethodState | Possible values are: **enabled**<br>**disabled** |
106+
107+
**RELATIONSHIPS**
108+
109+
| Relationship | Type | Description |
110+
|--------------|------|-------------|
111+
| includeTargets | [microsoftAuthenticatorAuthenticationMethodTarget](/graph/api/resources/passwordlessmicrosoftauthenticatorauthenticationmethodtarget?view=graph-rest-beta&preserve-view=true) collection | A collection of users or groups who are enabled to use the authentication method |
112+
| featureSettings | [microsoftAuthenticatorFeatureSettings](/graph/api/resources/passwordlessmicrosoftauthenticatorauthenticationmethodtarget) collection | A collection of Microsoft Authenticator features. |
113+
114+
### MicrosoftAuthenticator includeTarget properties
115+
116+
**PROPERTIES**
117+
118+
| Property | Type | Description |
119+
|----------|------|-------------|
120+
| authenticationMode | String | Possible values are:<br>**any**: Both passwordless phone sign-in and traditional second factor notifications are allowed.<br>**deviceBasedPush**: Only passwordless phone sign-in notifications are allowed.<br>**push**: Only traditional second factor push notifications are allowed. |
121+
| id | String | Object ID of an Azure AD user or group. |
122+
| targetType | authenticationMethodTargetType | Possible values are: **user**, **group**.|
123+
124+
125+
126+
### MicrosoftAuthenticator featureSettings properties
127+
128+
**PROPERTIES**
129+
130+
| Property | Type | Description |
131+
|----------|------|-------------|
132+
| numberMatchingRequiredState | authenticationMethodFeatureConfiguration | Require number matching for MFA notifications. Value is ignored for phone sign-in notifications. |
133+
| displayAppInformationRequiredState | authenticationMethodFeatureConfiguration | Determines whether the user is shown application name in Microsoft Authenticator notification. |
134+
| displayLocationInformationRequiredState | authenticationMethodFeatureConfiguration | Determines whether the user is shown geographic location context in Microsoft Authenticator notification. |
135+
136+
### Authentication Method Feature Configuration properties
137+
138+
**PROPERTIES**
139+
140+
| Property | Type | Description |
141+
|----------|------|-------------|
142+
| excludeTarget | featureTarget | A single entity that is excluded from this feature. <br> Please note: You will be able to only exclude one group for number matching. |
143+
| includeTarget | featureTarget | A single entity that is included in this feature. <br> Please note: You will be able to only set one group for number matching. |
144+
| State | advancedConfigState | Possible values are:<br>**enabled** explicitly enables the feature for the selected group.<br>**disabled** explicitly disables the feature for the selected group.<br>**default** allows Azure AD to manage whether the feature is enabled or not for the selected group. |
145+
146+
### Feature Target properties
147+
148+
**PROPERTIES**
149+
150+
| Property | Type | Description |
151+
|----------|------|-------------|
152+
| id | String | ID of the entity targeted. |
153+
| targetType | featureTargetType | The kind of entity targeted, such as group, role, or administrative unit. The possible values are: ‘group’, 'administrativeUnit’, ‘role’, unknownFutureValue’. |
154+
155+
>[!NOTE]
156+
>Number matching can be enabled only for a single group.
157+
158+
### Example of how to enable number matching for all users
159+
160+
In **featureSettings**, you will need to change the **numberMatchingRequiredState** from **default** to **enabled**.
161+
162+
Note that the value of Authentication Mode can be either **any** or **push**, depending on whether or not you also want to enable passwordless phone sign-in. In these examples, we will use **any**, but if you do not want to allow passwordless, use **push**.
163+
164+
>[!NOTE]
165+
>For passwordless users, enabling or disabling number matching has no impact because it's already part of the passwordless experience.
166+
167+
You might need to patch the entire schema to prevent overwriting any previous configuration. In that case, do a GET first, update only the relevant fields, and then PATCH. The following example only shows the update to the **numberMatchingRequiredState** under **featureSettings**.
168+
169+
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will see the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
170+
171+
```json
172+
//Retrieve your existing policy via a GET.
173+
//Leverage the Response body to create the Request body section. Then update the Request body similar to the Request body as shown below.
174+
//Change the Query to PATCH and Run query
175+
176+
{
177+
"@odata.context": "https://graph.microsoft.com/beta/$metadata#authenticationMethodConfigurations/$entity",
178+
"@odata.type": "#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration",
179+
"id": "MicrosoftAuthenticator",
180+
"state": "enabled",
181+
"featureSettings": {
182+
"numberMatchingRequiredState": {
183+
"state": "enabled",
184+
"includeTarget": {
185+
"targetType": "group",
186+
"id": "all_users"
187+
},
188+
"excludeTarget": {
189+
"targetType": "group",
190+
"id": "00000000-0000-0000-0000-000000000000"
191+
}
192+
}
193+
},
194+
"[email protected]": "https://graph.microsoft.com/beta/$metadata#authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator')/microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration/includeTargets",
195+
"includeTargets": [
196+
{
197+
"targetType": "group",
198+
"id": "all_users",
199+
"isRegistrationRequired": false,
200+
"authenticationMode": "any",
201+
}
202+
]
203+
}
204+
205+
```
206+
207+
To confirm this has applied, please run the GET request below using the endpoint below.
208+
209+
```http
210+
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
211+
```
212+
213+
### Example of how to enable number matching for a single group
214+
215+
In **featureSettings**, you will need to change the **numberMatchingRequiredState** value from **default** to **enabled.**
216+
Inside the **includeTarget**, you will need to change the **id** from **all_users** to the ObjectID of the group from the Azure AD portal.
217+
218+
You need to PATCH the entire configuration to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the **numberMatchingRequiredState**.
219+
220+
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will see the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
221+
222+
```json
223+
{
224+
"@odata.context": "https://graph.microsoft.com/beta/$metadata#authenticationMethodConfigurations/$entity",
225+
"@odata.type": "#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration",
226+
"id": "MicrosoftAuthenticator",
227+
"state": "enabled",
228+
"featureSettings": {
229+
"numberMatchingRequiredState": {
230+
"state": "enabled",
231+
"includeTarget": {
232+
"targetType": "group",
233+
"id": "1ca44590-e896-4dbe-98ed-b140b1e7a53a"
234+
},
235+
"excludeTarget": {
236+
"targetType": "group",
237+
"id": "00000000-0000-0000-0000-000000000000"
238+
}
239+
}
240+
},
241+
"[email protected]": "https://graph.microsoft.com/beta/$metadata#authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator')/microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration/includeTargets",
242+
"includeTargets": [
243+
{
244+
"targetType": "group",
245+
"id": "all_users",
246+
"isRegistrationRequired": false,
247+
"authenticationMode": "any"
248+
}
249+
]
250+
}
251+
```
252+
253+
To verify, RUN GET again and verify the ObjectID
254+
255+
```http
256+
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
257+
```
258+
259+
### Example of removing the excluded group from number matching
260+
261+
In **featureSettings**, you will need to change the **numberMatchingRequiredState** value from **default** to **enabled.**
262+
You need to change the **id** of the **excludeTarget** to `00000000-0000-0000-0000-000000000000`.
263+
264+
You need to PATCH the entire configuration to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The example below only shows the update to the **numberMatchingRequiredState**.
265+
266+
Only users who are enabled for Microsoft Authenticator under Microsoft Authenticator’s **includeTargets** will be excluded from the number match requirement. Users who aren't enabled for Microsoft Authenticator won't see the feature.
267+
268+
```json
269+
{
270+
"@odata.context": "https://graph.microsoft.com/beta/$metadata#authenticationMethodConfigurations/$entity",
271+
"@odata.type": "#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration",
272+
"id": "MicrosoftAuthenticator",
273+
"state": "enabled",
274+
"featureSettings": {
275+
"numberMatchingRequiredState": {
276+
"state": "enabled",
277+
"includeTarget": {
278+
"targetType": "group",
279+
"id": "1ca44590-e896-4dbe-98ed-b140b1e7a53a"
280+
},
281+
"excludeTarget": {
282+
"targetType": "group",
283+
"id": " 00000000-0000-0000-0000-000000000000"
284+
}
285+
}
286+
},
287+
"[email protected]": "https://graph.microsoft.com/beta/$metadata#authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator')/microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration/includeTargets",
288+
"includeTargets": [
289+
{
290+
"targetType": "group",
291+
"id": "all_users",
292+
"isRegistrationRequired": false,
293+
"authenticationMode": "any"
294+
}
295+
]
296+
}
297+
```
298+
299+
## Turn off number matching
300+
301+
To turn number matching off, you will need to PATCH remove **numberMatchingRequiredState** from **enabled** to **disabled**/**default**.
302+
303+
```json
304+
{
305+
"@odata.context": "https://graph.microsoft.com/beta/$metadata#authenticationMethodConfigurations/$entity",
306+
"@odata.type": "#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration",
307+
"id": "MicrosoftAuthenticator",
308+
"state": "enabled",
309+
"featureSettings": {
310+
"numberMatchingRequiredState": {
311+
"state": "default",
312+
"includeTarget": {
313+
"targetType": "group",
314+
"id": "1ca44590-e896-4dbe-98ed-b140b1e7a53a"
315+
},
316+
"excludeTarget": {
317+
"targetType": "group",
318+
"id": " 00000000-0000-0000-0000-000000000000"
319+
}
320+
}
321+
},
322+
"[email protected]": "https://graph.microsoft.com/beta/$metadata#authenticationMethodsPolicy/authenticationMethodConfigurations('MicrosoftAuthenticator')/microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration/includeTargets",
323+
"includeTargets": [
324+
{
325+
"targetType": "group",
326+
"id": "all_users",
327+
"isRegistrationRequired": false,
328+
"authenticationMode": "any"
329+
}
330+
]
331+
}
332+
```
333+
334+
## Enable number matching in the portal
335+
336+
To enable number matching in the Azure AD portal, complete the following steps:
90337

91338
1. In the Azure AD portal, click **Security** > **Authentication methods** > **Microsoft Authenticator**.
92339
1. On the **Basics** tab, click **Yes** and **All users** to enable the policy for everyone, and change **Authentication mode** to **Push**.
@@ -101,4 +348,4 @@ To enable number matching, complete the following steps:
101348

102349
## Next steps
103350

104-
[Authentication methods in Azure Active Directory](concept-authentication-authenticator-app.md)
351+
[Authentication methods in Azure Active Directory](concept-authentication-authenticator-app.md)

0 commit comments

Comments
 (0)