You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/fundamentals/whats-new-sovereign-clouds.md
+69Lines changed: 69 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,6 +21,75 @@ Azure AD receives improvements on an ongoing basis. To stay up to date with the
21
21
22
22
This page is updated monthly, so revisit it regularly.
23
23
24
+
## March 2023
25
+
26
+
### General Availability - Provisioning Insights Workbook
27
+
28
+
**Type:** New feature
29
+
**Service category:** Provisioning
30
+
**Product capability:** Monitoring & Reporting
31
+
32
+
This new workbook makes it easier to investigate and gain insights into your provisioning workflows in a given tenant. This includes HR-driven provisioning, cloud sync, app provisioning, and cross-tenant sync.
33
+
34
+
Some key questions this workbook can help answer are:
35
+
36
+
- How many identities have been synced in a given time range?
37
+
- How many create, delete, update, or other operations were performed?
38
+
- How many operations were successful, skipped, or failed?
39
+
- What specific identities failed? And what step did they fail on?
40
+
- For any given user, what tenants / applications were they provisioned or deprovisioned to?
41
+
42
+
For more information, see: [Provisioning insights workbook](../app-provisioning/provisioning-workbook.md).
43
+
44
+
---
45
+
46
+
### General Availability - Follow Azure Active Directory best practices with recommendations
47
+
48
+
**Type:** New feature
49
+
**Service category:** Reporting
50
+
**Product capability:** Monitoring & Reporting
51
+
52
+
Azure Active Directory recommendations help you improve your tenant posture by surfacing opportunities to implement best practices. On a daily basis, Azure AD analyzes the configuration of your tenant. During this analysis, Azure Active Directory compares the data of a recommendation with the actual configuration of your tenant. If a recommendation is flagged as applicable to your tenant, the recommendation appears in the Recommendations section of the Azure Active Directory Overview.
53
+
54
+
This release includes our first three recommendations:
55
+
56
+
- Convert from per-user MFA to Conditional Access MFA
57
+
- Migration applications from AD FS to Azure Active Directory
58
+
- Minimize MFA prompts from known devices.
59
+
60
+
We're developing more recommendations, so stay tuned!
61
+
62
+
For more information, see:
63
+
64
+
-[What are Azure Active Directory recommendations?](../reports-monitoring/overview-recommendations.md).
65
+
-[Use the Azure AD recommendations API to implement Azure AD best practices for your tenant](/graph/api/resources/recommendations-api-overview)
66
+
67
+
---
68
+
69
+
### General Availability - Improvements to Azure Active Directory Smart Lockout
70
+
71
+
**Type:** Changed feature
72
+
**Service category:** Other
73
+
**Product capability:** User Management
74
+
75
+
With a recent improvement, Smart Lockout now synchronizes the lockout state across Azure Active Directory data centers, so the total number of failed sign-in attempts allowed before an account is locked will match the configured lockout threshold.
76
+
77
+
For more information, see: [Protect user accounts from attacks with Azure Active Directory smart lockout](../authentication/howto-password-smart-lockout.md).
78
+
79
+
---
80
+
81
+
### General Availability- MFA events from ADFS and NPS adapter available in Sign-in logs
Customers with Cloud MFA activity from ADFS adapter, or NPS Extension, can now see these events in the Sign-in logs, rather than the legacy multi-factor authentication activity report. Not all attributes in the sign-in logs are populated for these events due to limited data from the on-premises components. Customers with ADFS using AD Health Connect and customers using NPS with the latest NPS extension installed will have a richer set of data in the events.
88
+
89
+
For more information, see: [Protect user accounts from attacks with Azure Active Directory smart lockout](../authentication/howto-password-smart-lockout.md).
90
+
91
+
---
92
+
24
93
## February 2023
25
94
26
95
### General Availability - Filter and transform group names in token claims configuration using regular expression
@@ -37,9 +37,6 @@ A managed identity from Azure Active Directory (Azure AD) allows your runbook to
37
37
38
38
Managed identities are the recommended way to authenticate in your runbooks, and is the default authentication method for your Automation account.
39
39
40
-
> [!NOTE]
41
-
> When you create an Automation account, the option to create a Run As account is no longer available. However, we continue to support a RunAs account for existing and new Automation accounts. You can [create a Run As account](create-run-as-account.md) in your Automation account from the Azure portal or by using PowerShell.
42
-
43
40
Here are some of the benefits of using managed identities:
44
41
45
42
- Using a managed identity instead of the Automation Run As account simplifies management. You don't have to renew the certificate used by a Run As account.
@@ -68,7 +65,7 @@ Run As accounts in Azure Automation provide authentication for managing Azure Re
68
65
- Azure Run As Account
69
66
- Azure Classic Run As Account
70
67
71
-
To create or renew a Run As account, permissions are needed at three levels:
68
+
To renew a Run As account, permissions are needed at three levels:
72
69
73
70
- Subscription,
74
71
- Azure Active Directory (Azure AD), and
@@ -82,11 +79,11 @@ You need the `Microsoft.Authorization/*/Write` permission. This permission is ob
To configure or renew Classic Run As accounts, you must have the Co-administrator role at the subscription level. To learn more about classic subscription permissions, see [Azure classic subscription administrators](../role-based-access-control/classic-administrators.md#add-a-co-administrator).
82
+
To renew Classic Run As accounts, you must have the Co-administrator role at the subscription level. To learn more about classic subscription permissions, see [Azure classic subscription administrators](../role-based-access-control/classic-administrators.md#add-a-co-administrator).
86
83
87
84
### Azure AD permissions
88
85
89
-
To be able to create or renew the service principal, you need to be a member of one of the following Azure AD built-in roles:
86
+
To renew the service principal, you need to be a member of one of the following Azure AD built-in roles:
@@ -105,40 +102,24 @@ To learn more about the Azure Resource Manager and Classic deployment models, se
105
102
>[!NOTE]
106
103
>Azure Cloud Solution Provider (CSP) subscriptions support only the Azure Resource Manager model. Non-Azure Resource Manager services are not available in the program. When you are using a CSP subscription, the Azure Classic Run As account is not created, but the Azure Run As account is created. To learn more about CSP subscriptions, see [Available services in CSP subscriptions](/azure/cloud-solution-provider/overview/azure-csp-available-services).
107
104
108
-
When you create an Automation account, the Run As account is created by default at the same time with a self-signed certificate. If you chose not to create it along with the Automation account, it can be created individually at a later time. An Azure Classic Run As Account is optional, and is created separately if you need to manage classic resources.
109
-
110
-
> [!NOTE]
111
-
> Azure Automation does not automatically create the Run As account. It has been replaced by using managed identities.
112
-
113
-
If you want to use a certificate issued by your enterprise or third-party certification authority (CA) instead of the default self-signed certificate, can use the [PowerShell script to create a Run As account](create-run-as-account.md#powershell-script-to-create-a-run-as-account) option for your Run As and Classic Run As accounts.
When you create a Run As account, it performs the following tasks:
120
-
121
-
* Creates an Azure AD application with a self-signed certificate, creates a service principal account for the application in Azure AD, and assigns the [Contributor](../role-based-access-control/built-in-roles.md#contributor) role for the account in your current subscription. You can change the certificate setting to [Reader](../role-based-access-control/built-in-roles.md#reader) or any other role. For more information, see [Role-based access control in Azure Automation](automation-role-based-access-control.md).
122
-
123
-
* Creates an Automation certificate asset named `AzureRunAsCertificate` in the specified Automation account. The certificate asset holds the certificate private key that the Azure AD application uses.
124
-
125
-
* Creates an Automation connection asset named `AzureRunAsConnection` in the specified Automation account. The connection asset holds the application ID, tenant ID, subscription ID, and certificate thumbprint.
109
+
Run As Account consists of the following components:
110
+
- An Azure AD application with a self-signed certificate, and a service principal account for the application in Azure AD, which is assigned the [Contributor](../role-based-access-control/built-in-roles.md#contributor) role for the account in your current subscription. You can change the certificate setting to [Reader](../role-based-access-control/built-in-roles.md#reader) or any other role. For more information, see [Role-based access control in Azure Automation](automation-role-based-access-control.md).
111
+
- An Automation certificate asset named `AzureRunAsCertificate` in the specified Automation account. The certificate asset holds the certificate private key that the Azure AD application uses.
112
+
- An Automation connection asset named `AzureRunAsConnection` in the specified Automation account. The connection asset holds the application ID, tenant ID, subscription ID, and certificate thumbprint.
126
113
127
114
### Azure Classic Run As account
128
115
129
-
> [!IMPORTANT]
130
-
> Azure Automation Run As Account will retire on September 30, 2023 and will be replaced with Managed Identities. Before that date, you'll need to start migrating your runbooks to use [managed identities](automation-security-overview.md#managed-identities). For more information, see [migrating from an existing Run As accounts to managed identity](https://learn.microsoft.com/azure/automation/migrate-run-as-accounts-managed-identity?tabs=run-as-account#sample-scripts) to start migrating the runbooks from Run As account to managed identities before 30 September 2023.
131
-
132
-
When you create an Azure Classic Run As account, it performs the following tasks:
116
+
Azure Classic Run As Account consists of the following components:
117
+
- A management certificate in the subscription.
118
+
- An Automation certificate asset named `AzureClassicRunAsCertificate` in the specified Automation account. The certificate asset holds the certificate private key used by the management certificate.
119
+
- An Automation connection asset named `AzureClassicRunAsConnection` in the specified Automation account. The connection asset holds the subscription name, subscription ID, and certificate asset name.
133
120
134
121
> [!NOTE]
135
-
> You must be a co-administrator on the subscription to create or renew this type of Run As account.
136
-
137
-
* Creates a management certificate in the subscription.
138
-
139
-
* Creates an Automation certificate asset named `AzureClassicRunAsCertificate` in the specified Automation account. The certificate asset holds the certificate private key used by the management certificate.
140
-
141
-
* Creates an Automation connection asset named `AzureClassicRunAsConnection` in the specified Automation account. The connection asset holds the subscription name, subscription ID, and certificate asset name.
122
+
> You must be a co-administrator on the subscription to renew this type of Run As account.
Copy file name to clipboardExpand all lines: articles/automation/delete-run-as-account.md
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Delete an Azure Automation Run As account
3
3
description: This article tells how to delete a Run As account with PowerShell or from the Azure portal.
4
4
services: automation
5
5
ms.subservice: process-automation
6
-
ms.date: 01/06/2021
6
+
ms.date: 04/12/2023
7
7
ms.topic: conceptual
8
8
---
9
9
@@ -26,8 +26,9 @@ Run As accounts in Azure Automation provide authentication for managing resource
26
26
27
27
28
28
29
-
5. While the account is being deleted, you can track the progress under **Notifications** from the menu.
29
+
5. While the account is being deleted, you can track the progress under **Notifications** from the menu. Run As accounts can't be restored after deletion.
30
30
31
31
## Next steps
32
32
33
-
To recreate your Run As or Classic Run As account, see [Create Run As accounts](create-run-as-account.md).
Copy file name to clipboardExpand all lines: articles/automation/manage-run-as-account.md
+1-22Lines changed: 1 addition & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Manage an Azure Automation Run As account
3
3
description: This article tells how to manage your Azure Automation Run As account with PowerShell or from the Azure portal.
4
4
services: automation
5
-
ms.date: 08/02/2021
5
+
ms.date: 04/12/2023
6
6
ms.topic: conceptual
7
7
---
8
8
@@ -161,30 +161,9 @@ You can allow Azure Automation to verify if Key Vault and your Run As account se
161
161
162
162
You can use the [Extend-AutomationRunAsAccountRoleAssignmentToKeyVault.ps1](https://aka.ms/AA5hugb) script in the PowerShell Gallery to grant your Run As account permissions to Key Vault. See [Assign a Key Vault access policy](../key-vault/general/assign-access-policy-powershell.md) for more details on setting permissions on Key Vault.
163
163
164
-
## Resolve misconfiguration issues for Run As accounts
165
-
166
-
Some configuration items necessary for a Run As or Classic Run As account might have been deleted or created improperly during initial setup. Possible instances of misconfiguration include:
167
-
168
-
* Certificate asset
169
-
* Connection asset
170
-
* Run As account removed from the Contributor role
171
-
* Service principal or application in Azure AD
172
-
173
-
For such misconfiguration instances, the Automation account detects the changes and displays a status of *Incomplete* on the Run As Accounts properties pane for the account.
174
-
175
-
:::image type="content" source="media/manage-run-as-account/automation-account-run-as-config-incomplete.png" alt-text="Incomplete Run As account configuration.":::
176
-
177
-
When you select the Run As account, the account properties pane displays the following error message:
178
-
179
-
```text
180
-
The Run As account is incomplete. Either one of these was deleted or not created - Azure Active Directory Application, Service Principal, Role, Automation Certificate asset, Automation Connect asset - or the Thumbprint is not identical between Certificate and Connection. Please delete and then re-create the Run As Account.
181
-
```
182
-
183
-
You can quickly resolve these Run As account issues by [deleting](delete-run-as-account.md) and [re-creating](create-run-as-account.md) the Run As account.
184
164
185
165
## Next steps
186
166
187
167
*[Application Objects and Service Principal Objects](../active-directory/develop/app-objects-and-service-principals.md).
188
168
*[Certificates overview for Azure Cloud Services](../cloud-services/cloud-services-certs-create.md).
189
-
* To create or re-create a Run As account, see [Create a Run As account](create-run-as-account.md).
190
169
* If you no longer need to use a Run As account, see [Delete a Run As account](delete-run-as-account.md).
@@ -519,7 +519,7 @@ Each of the Azure Monitor exporters supports configuration of securely sending t
519
519
520
520
You can view the telemetry data that was sent from your application through the **Logs (Analytics)** tab.
521
521
522
-
:::image type="content"source="./media/opencensus-python/0010-logs-query.png"lightbox="./media/opencensus-python/0010-logs-query.png" alt-text="Screenshot of the Overview pane with the Logs (Analytics) tab selected.":::
522
+
0 commit comments