Merge pull request #107836 from MicrosoftDocs/master

3/16 AM Publish

Author: huypub

articles/active-directory-b2c/TOC.yml

@@ -74,6 +74,8 @@
       href: custom-policy-overview.md
   - name: User accounts
     href: user-overview.md
+  - name: User profile attributes
+    href: user-profile-attributes.md
 - name: How-to guides
   items:
   - name: App integration

articles/active-directory-b2c/active-directory-technical-profile.md

@@ -9,7 +9,7 @@ manager: celestedg
 ms.service: active-directory
 ms.workload: identity
 ms.topic: reference
-ms.date: 03/09/2020
+ms.date: 03/16/2020
 ms.author: mimart
 ms.subservice: B2C
 ---
@@ -250,7 +250,7 @@ The following technical profile deletes a social user account using **alternativ
 | ClientId | No | The client identifier for accessing the tenant as a third party. For more information, see [Use custom attributes in a custom profile edit policy](custom-policy-custom-attributes.md) |
 | IncludeClaimResolvingInClaimsHandling  | No | For input and output claims, specifies whether [claims resolution](claim-resolver-overview.md) is included in the technical profile. Possible values: `true`, or `false` (default). If you want to use a claims resolver in the technical profile, set this to `true`. |
 
-### Error messages
+## Error messages
 
 The following settings can be used to configure the error message displayed upon failure. The metadata should be configured in the [self-asserted](self-asserted-technical-profile.md) technical profile. The error messages can be [localized](localization.md).
 

articles/active-directory-b2c/custom-policy-ui-customization.md

@@ -9,7 +9,7 @@ manager: celestedg
 ms.service: active-directory
 ms.workload: identity
 ms.topic: conceptual
-ms.date: 02/13/2020
+ms.date: 03/16/2020
 ms.author: mimart
 ms.subservice: B2C
 ---

articles/active-directory-b2c/user-profile-attributes.md

@@ -0,0 +1,114 @@
+---
+title: User profile attributes in Azure Active Directory B2C
+description: Learn about the user resource type attributes that are supported by the Azure AD B2C directory user profile. Find out about built-in attributes, extensions, and how attributes map to Microsoft Graph.
+services: active-directory-b2c
+author: msmimart
+manager: celestedg
+
+ms.service: active-directory
+ms.workload: identity
+ms.topic: conceptual
+ms.date: 3/11/2020
+ms.author: mimart
+ms.subservice: B2C
+---
+
+# User profile attributes
+
+Your Azure Active Directory (Azure AD) B2C directory user profile comes with a built-in set of attributes, such as given name, surname, city, postal code, and phone number. You can extend the user profile with your own application data without requiring an external data store. Most of the attributes that can be used with Azure AD B2C user profiles are also supported by Microsoft Graph. This article describes supported Azure AD B2C user profile attributes. It also notes those attributes that are not supported by Microsoft Graph, as well as Microsoft Graph attributes that should not be used with Azure AD B2C.
+
+> [!IMPORTANT]
+> You should not use built-in or extension attributes to store sensitive personal data, such as account credentials, government identification numbers, cardholder data, financial account data, healthcare information, or sensitive background information.
+
+You can also integrate with external systems. For example, you can use Azure AD B2C for authentication, but delegate to an external customer relationship management (CRM) or customer loyalty database as the authoritative source of customer data. For more information, see the [remote profile](https://github.com/azure-ad-b2c/samples/tree/master/policies/remote-profile) solution.
+
+The table below lists the [user resource type](https://docs.microsoft.com/graph/api/resources/user) attributes that are supported by the Azure AD B2C directory user profile. It gives the following information about each attribute:
+
+- Attribute name used by Azure AD B2C (followed by the Microsoft Graph name in parentheses, if different)
+- Attribute data type
+- Attribute description
+- If the attribute is available in the Azure portal
+- If the attribute can be used in a user flow
+- If the attribute can be used in a custom policy [Azure AD technical profile](active-directory-technical-profile.md) and in which section (<InputClaims>, <OutputClaims>, or <PersistedClaims>)
+
+|Name     |Type     |Description|Azure portal|User flows|Custom policy|
+|---------|---------|----------|------------|----------|-------------|
+|accountEnabled  |Boolean|Whether the user account is enabled or disabled: **true** if the account is enabled, otherwise **false**.|Yes|No|Persisted, Output|
+|ageGroup        |String|The user’s age group. Possible values: null, Undefined, Minor, Adult, NotAdult.|Yes|No|Persisted, Output|
+|alternativeSecurityId|String|A single user identity from the external identity provider.|No|No|Input, Persisted, Output|
+|alternativeSecurityIds|alternative securityId collection|A collection of user identities from external identity providers.|No|No|Persisted, Output|
+|city            |String|The city in which the user is located. Max length 128.|Yes|Yes|Persisted, Output|
+|consentProvidedForMinor|String|Whether the consent has been provided for a minor. Allowed values: null, granted, denied, or notRequired.|Yes|No|Persisted, Output|
+|country         |String|The country/region in which the user is located. Example: “US” or “UK”. Max length 128.|Yes|Yes|Persisted, Output|
+|createdDateTime|DateTime|The date the user object was created. Read only.|No|No|Persisted, Output|
+|creationType    |String|If the user account was created as a local account for an Azure Active Directory B2C tenant, the value is LocalAccount or nameCoexistence. Read only.|No|No|Persisted, Output|
+|dateOfBirth     |Date|Date of birth.|No|No|Persisted, Output|
+|department      |String|The name for the department in which the user works. Max length 64.|Yes|No|Persisted, Output|
+|displayName     |String|The display name for the user. Max length 256.|Yes|Yes|Persisted, Output|
+|facsimileTelephoneNumber<sup>1</sup>|String|The telephone number of the user's business fax machine.|Yes|No|Persisted, Output|
+|givenName       |String|The given name (first name) of the user. Max length 64.|Yes|Yes|Persisted, Output|
+|jobTitle        |String|The user's job title. Max length 128.|Yes|Yes|Persisted, Output|
+|immutableId     |String|An identifier which is typically used for users migrated from on-premises Active Directory.|No|No|Persisted, Output|
+|legalAgeGroupClassification|String|Legal age group classification. Read-only and calculated based on ageGroup and consentProvidedForMinor properties. Allowed values: null, minorWithOutParentalConsent, minorWithParentalConsent, minorNoParentalConsentRequired, notAdult and adult.|Yes|No|Persisted, Output|
+|legalCountry<sup>1</sup>  |String|Country for legal purposes.|No|No|Persisted, Output|
+|mail            |String|The SMTP address for the user, for example, "[email protected]". Read-only.|No|No|Persisted, Output|
+|mailNickName    |String|The mail alias for the user. Max length 64.|No|No|Persisted, Output|
+|mobile (mobilePhone) |String|The primary cellular telephone number for the user. Max length 64.|Yes|No|Persisted, Output|
+|netId           |String|Net ID.|No|No|Persisted, Output|
+|objectId        |String|A globally unique identifier (GUID) that is the unique identifier for the user. Example: 12345678-9abc-def0-1234-56789abcde. Read only, Immutable.|Read only|Yes|Input, Persisted, Output|
+|otherMails      |String collection|A list of additional email addresses for the user. Example: ["[email protected]", "[email protected]"].|Yes (Alternate email)|No|Persisted, Output|
+|password        |String|The password for the local account during user creation.|No|No|Persisted|
+|passwordPolicies     |String|Policy of the password. It's a string consisting of different policy name separated by comma. i.e. "DisablePasswordExpiration, DisableStrongPassword".|No|No|Persisted, Output|
+|physicalDeliveryOfficeName (officeLocation)|String|The office location in the user's place of business. Max length 128.|Yes|No|Persisted, Output|
+|postalCode      |String|The postal code for the user's postal address. The postal code is specific to the user's country/region. In the United States of America, this attribute contains the ZIP code. Max length 40.|Yes|No|Persisted, Output|
+|preferredLanguage    |String|The preferred language for the user. Should follow ISO 639-1 Code. Example: "en-US".|No|No|Persisted, Output|
+|refreshTokensValidFromDateTime|DateTime|Any refresh tokens issued before this time are invalid, and applications will get an error when using an invalid refresh token to acquire a new access token. If this happens, the application will need to acquire a new refresh token by making a request to the authorize endpoint. Read-only.|No|No|Output|
+|signInNames     |String|The unique sign-in name of the local account user of any type in the directory. Use this to get a user with sign-in value without specifying the local account type.|No|No|Input|
+|signInNames.userName |String|The unique username of the local account user in the directory. Use this to create or get a user with a specific sign-in username. Specifying this in PersistedClaims alone during Patch operation will remove other types of signInNames. If you would like to add a new type of signInNames, you also need to persist existing signInNames.|No|No|Input, Persisted, Output|
+|signInNames.phoneNumber |String|The unique phone number of the local account user in the directory. Use this to create or get a user with a specific sign-in phone number. Specifying this in PersistedClaims alone during Patch operation will remove other types of signInNames. If you would like to add a new type of signInNames, you also need to persist existing signInNames.|No|No|Input, Persisted, Output|
+|signInNames.emailAddress |String|The unique email address of the local account user in the directory. Use this to create or get a user with a specific sign-in email address. Specifying this in PersistedClaims alone during Patch operation will remove other types of signInNames. If you would like to add a new type of signInNames, you also need to persist existing signInNames.|No|No|Input, Persisted, Output|
+|state           |String|The state or province in the user's address. Max length 128.|Yes|Yes|Persisted, Output|
+|streetAddress   |String|The street address of the user's place of business. Max length 1024.|Yes|Yes|Persisted, Output|
+|strongAuthentication AlternativePhoneNumber<sup>1</sup>|String|The secondary telephone number of the user, used for multi-factor authentication.|Yes|No|Persisted, Output|
+|strongAuthenticationEmailAddress<sup>1</sup>|String|The SMTP address for the user. Example: "[email protected]" This attribute is used for sign-in with username policy, to store the user email address. The email address then used in a password reset flow.|Yes|No|Persisted, Output|
+|strongAuthenticationPhoneNumber<sup>1</sup>|String|The primary telephone number of the user, used for multi-factor authentication.|Yes|No|Persisted, Output|
+|surname         |String|The user's surname (family name or last name). Max length 64.|Yes|Yes|Persisted, Output|
+|telephoneNumber (first entry of businessPhones)|String|The primary telephone number of the user's place of business.|Yes|No|Persisted, Output|
+|userPrincipalName    |String|The user principal name (UPN) of the user. The UPN is an Internet-style login name for the user based on the Internet standard RFC 822. The domain must be present in the tenant's collection of verified domains. This property is required when an account is created. Immutable.|No|No|Input, Persisted, Output|
+|usageLocation   |String|Required for users that will be assigned licenses due to legal requirement to check for availability of services in countries. Not nullable. A two letter country code (ISO standard 3166). Examples: "US", "JP", and "GB".|Yes|No|Persisted, Output|
+|userType        |String|A string value that can be used to classify user types in your directory. Value must be Member. Read-only.|Read only|No|Persisted, Output|
+|userState (externalUserState)<sup>2</sup>|String|For Azure AD B2B account only, indicates whether the invitation is PendingAcceptance or Accepted.|No|No|Persisted, Output|
+|userStateChangedOn (externalUserStateChangeDateTime)<sup>2</sup>|DateTime|Shows the timestamp for the latest change to the UserState property.|No|No|Persisted, Output|
+|<sup>1 </sup>Not supported by Microsoft Graph<br><sup>2 </sup>Should not be used with Azure AD B2C||||||
+
+
+## Extension attributes
+
+You’ll often need to create your own attributes, as in the following cases:
+
+- A customer-facing application needs to persist for an attribute like **LoyaltyNumber**.
+- An identity provider has a unique user identifier like **uniqueUserGUID** that must be saved.
+- A custom user journey needs to persist for a state of a user, like **migrationStatus**.
+
+Azure AD B2C extends the set of attributes stored on each user account. Extension attributes [extend the schema](https://docs.microsoft.com/graph/extensibility-overview#schema-extensions) of the user objects in the directory. The extension attributes can only be registered on an application object, even though they might contain data for a user. The extension attribute is attached to the application called b2c-extensions-app. Do not modify this application, as it's used by Azure AD B2C for storing user data. You can find this application under Azure Active Directory App registrations.
+
+> [!NOTE]
+> - Up to 100 extension attributes can be written to any user account.
+> - If the b2c-extensions-app application is deleted, those extension attributes are removed from all users along with any data they contain.
+> - If an extension attribute is deleted by the application, it's removed from all user accounts and the values are deleted.
+> - The underlying name of the extension attribute is generated in the format "Extension_" + Application ID + "_" + Attribute name. For example, if you create an extension attribute LoyaltyNumber, and the b2c-extensions-app Application ID is 831374b3-bd50-41bf-aa54-263ec9e050fc, the underlying extension attribute name will be: extension_831374b3bd5041bfaa54263ec9e050fc_LoyaltyNumber. You use the underlying name when you run Graph API queries to create or update user accounts.
+
+The following data types are supported when defining a property in a schema extension:
+
+|Property type |Remarks  |
+|--------------|---------|
+|Boolean    | Possible values: **true** or **false**. |
+|DateTime   | Must be specified in ISO 8601 format. Will be stored in UTC.   |
+|Integer    | 32-bit value.               |
+|String     | 256 characters maximum.     |
+
+## Next steps
+Learn more about extension attributes:
+- [Schema extensions](https://docs.microsoft.com/graph/extensibility-overview#schema-extensions)
+- [Define custom attributes with user flow](user-flow-custom-attributes.md)
+- [Define custom attributes with custom policy](custom-policy-custom-attributes.md)

articles/active-directory/privileged-identity-management/media/pim-getting-started/pim-all-services-find.png

@@ -11,7 +11,7 @@ ms.service: active-directory
 ms.subservice: pim
 ms.topic: conceptual
 ms.workload: identity
-ms.date: 03/05/2020
+ms.date: 03/13/2020
 ms.author: curtand
 ms.custom: pim  
 ms.collection: M365-identity-device-management
@@ -31,57 +31,17 @@ To use Privileged Identity Management, you must have one of the following licens
 
 For more information, see [License requirements to use Privileged Identity Management](subscription-requirements.md).
 
-## First person to use PIM
-
-If you're the first person to use Privileged Identity Management in your directory, you are automatically assigned the [Security Administrator](../users-groups-roles/directory-assign-admin-roles.md#security-administrator) and [Privileged Role Administrator](../users-groups-roles/directory-assign-admin-roles.md#privileged-role-administrator) roles in the directory. Only privileged role administrators can manage Azure AD role assignments of users. In addition, you may choose to run the [security wizard](pim-security-wizard.md) that walks you through the initial discovery and assignment experience.
-
-## Enable PIM
-
-To start using Privileged Identity Management in your directory, you must first enable Privileged Identity Management.
-
-1. Sign in to the [Azure portal](https://portal.azure.com/) as a Global Administrator of your directory.
-
-    You must be a Global Administrator with an organizational account (for example, @yourdomain.com), not a Microsoft account (for example, @outlook.com), to enable Privileged Identity Management for a directory.
-
-1. Click **All services** and find the **Azure AD Privileged Identity Management** service.
-
-    ![Azure AD Privileged Identity Management in All services](./media/pim-getting-started/pim-all-services-find.png)
-
-1. Click to open the Privileged Identity Management Quickstart.
-
-1. In the list, click **Consent to PIM**.
-
-    ![Consent to Privileged Identity Management to enable Privileged Identity Management](./media/pim-getting-started/consent-pim.png)
-
-1. Click **Verify my identity** to verify your identity with Azure MFA. You'll be asked to pick an account.
-
-    ![Pick an account window to verify your identity](./media/pim-getting-started/pick-account.png)
-
-1. If more information is required for verification, you'll be guided through the process. For more information, see [Get help with two-step verification](../user-help/multi-factor-authentication-end-user-troubleshoot.md).
-
-    ![More information required window if your organization needs more information](./media/pim-getting-started/more-information-required.png)
-
-    For example, you might be asked to provide phone verification.
-
-    ![Additional security verification page asking how to contact you](./media/pim-getting-started/additional-security-verification.png)
-
-1. Once you have completed the verification process, click the **Consent** button.
-
-1. In the message that appears, click **Yes** to consent to the Privileged Identity Management service.
-
-    ![Consent to Privileged Identity Management message to complete consent process](./media/pim-getting-started/consent-pim-message.png)
-
 ## Sign up PIM for Azure AD roles
 
 Once you have enabled Privileged Identity Management for your directory, you'll need to sign up Privileged Identity Management to manage Azure AD roles.
 
 1. Open **Azure AD Privileged Identity Management**.
 
-1. Click **Azure AD roles**.
+1. Select **Azure AD roles**.
 
     ![Sign up Privileged Identity Management for Azure AD roles](./media/pim-getting-started/sign-up-pim-azure-ad-roles.png)
 
-1. Click **Sign up**.
+1. Select **Sign up**.
 
 1. In the message that appears, click **Yes** to sign up Privileged Identity Management to manage Azure AD roles.
 
@@ -108,15 +68,15 @@ Once Privileged Identity Management is set up, you can start your identity manag
 
 ## Add a PIM tile to the dashboard
 
-To make it easier to open Privileged Identity Management, you should add a Privileged Identity Management tile to your Azure portal dashboard.
+To make it easier to open Privileged Identity Management, add a Privileged Identity Management tile to your Azure portal dashboard.
 
 1. Sign in to the [Azure portal](https://portal.azure.com/).
 
-1. Click **All services** and find the **Azure AD Privileged Identity Management** service.
+1. Select **All services** and find the **Azure AD Privileged Identity Management** service.
 
     ![Azure AD Privileged Identity Management in All services](./media/pim-getting-started/pim-all-services-find.png)
 
-1. Click to open the Privileged Identity Management Quickstart.
+1. Select the Privileged Identity Management Quickstart.
 
 1. Check **Pin blade to dashboard** to pin the Privileged Identity Management Quickstart blade to the dashboard.
 

articles/active-directory/privileged-identity-management/media/pim-getting-started/pim-quickstart-pin-to-dashboard.png

@@ -103,7 +103,7 @@ This article focused on how to secure your pods. To implement some of these area
 * [Integrate Azure Key Vault with AKS][aks-keyvault-flexvol]
 
 <!-- EXTERNAL LINKS -->
-[aad-pod-identity]: https://github.com/Azure/aad-pod-identity#demo-pod
+[aad-pod-identity]: https://github.com/Azure/aad-pod-identity#demo
 [aks-keyvault-flexvol]: https://github.com/Azure/kubernetes-keyvault-flexvol
 [linux-capabilities]: http://man7.org/linux/man-pages/man7/capabilities.7.html
 [selinux-labels]: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.12/#selinuxoptions-v1-core