Skip to content

Commit 1e9a9c2

Browse files
rolyonrolyon
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into rolyon-landing-data-lake-store
2 parents fdd8783 + 6bbc256 commit 1e9a9c2

26 files changed

+132
-109
lines changed

‎articles/active-directory-b2c/custom-policy-password-complexity.md

Lines changed: 81 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ manager: celestedg
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: conceptual
12-
ms.date: 12/13/2018
12+
ms.date: 03/10/2020
1313
ms.author: mimart
1414
ms.subservice: B2C
1515
---
@@ -22,109 +22,131 @@ In Azure Active Directory B2C (Azure AD B2C), you can configure the complexity r
2222

2323
## Prerequisites
2424

25-
Complete the steps in [Get started with custom policies in Active Directory B2C](custom-policy-get-started.md).
25+
Complete the steps in [Get started with custom policies](custom-policy-get-started.md). You should have a working custom policy for sign-up and sign-in with local accounts.
26+
2627

2728
## Add the elements
2829

29-
1. Copy the *SignUpOrSignIn.xml* file that you downloaded with the starter pack and name it *SingUpOrSignInPasswordComplexity.xml*.
30-
2. Open the *SingUpOrSignInPasswordComplexity.xml* file and change the **PolicyId** and the **PublicPolicyUri** to a new policy name. For example, *B2C_1A_signup_signin_password_complexity*.
31-
3. Add the following **ClaimType** elements with identifiers of `newPassword` and `reenterPassword`:
30+
To configure the password complexity, override the `newPassword` and `reenterPassword` [claim types](claimsschema.md) with a reference to [predicate validations](predicates.md#predicatevalidations). The PredicateValidations element groups a set of predicates to form a user input validation that can be applied to a claim type. Open the extensions file of your policy. For example, <em>`SocialAndLocalAccounts/`**`TrustFrameworkExtensions.xml`**</em>.
31+
32+
1. Search for the [BuildingBlocks](buildingblocks.md) element. If the element doesn't exist, add it.
33+
1. Locate the [ClaimsSchema](claimsschema.md) element. If the element doesn't exist, add it.
34+
1. Add the `newPassword` and `reenterPassword` claims to the **ClaimsSchema** element.
3235

3336
```XML
34-
<ClaimsSchema>
35-
<ClaimType Id="newPassword">
36-
<InputValidationReference Id="PasswordValidation" />
37-
</ClaimType>
38-
<ClaimType Id="reenterPassword">
39-
<InputValidationReference Id="PasswordValidation" />
40-
</ClaimType>
41-
</ClaimsSchema>
37+
<ClaimType Id="newPassword">
38+
<PredicateValidationReference Id="CustomPassword" />
39+
</ClaimType>
40+
<ClaimType Id="reenterPassword">
41+
<PredicateValidationReference Id="CustomPassword" />
42+
</ClaimType>
4243
```
4344

44-
4. [Predicates](predicates.md) have method types of `IsLengthRange` or `MatchesRegex`. The `MatchesRegex` type is used to match a regular expression. The `IsLengthRange` type takes a minimum and maximum string length. Add a **Predicates** element to the **BuildingBlocks** element if it doesn't exist with the following **Predicate** elements:
45+
1. [Predicates](predicates.md) defines a basic validation to check the value of a claim type and returns true or false. The validation is done by using a specified method element, and a set of parameters relevant to the method. Add the following predicates to the **BuildingBlocks** element, immediately after the closing of the `</ClaimsSchema>` element:
4546

4647
```XML
4748
<Predicates>
48-
<Predicate Id="PIN" Method="MatchesRegex" HelpText="The password must be a pin.">
49+
<Predicate Id="LengthRange" Method="IsLengthRange">
50+
<UserHelpText>The password must be between 6 and 64 characters.</UserHelpText>
51+
<Parameters>
52+
<Parameter Id="Minimum">6</Parameter>
53+
<Parameter Id="Maximum">64</Parameter>
54+
</Parameters>
55+
</Predicate>
56+
<Predicate Id="Lowercase" Method="IncludesCharacters">
57+
<UserHelpText>a lowercase letter</UserHelpText>
58+
<Parameters>
59+
<Parameter Id="CharacterSet">a-z</Parameter>
60+
</Parameters>
61+
</Predicate>
62+
<Predicate Id="Uppercase" Method="IncludesCharacters">
63+
<UserHelpText>an uppercase letter</UserHelpText>
64+
<Parameters>
65+
<Parameter Id="CharacterSet">A-Z</Parameter>
66+
</Parameters>
67+
</Predicate>
68+
<Predicate Id="Number" Method="IncludesCharacters">
69+
<UserHelpText>a digit</UserHelpText>
4970
<Parameters>
50-
<Parameter Id="RegularExpression">^[0-9]+$</Parameter>
71+
<Parameter Id="CharacterSet">0-9</Parameter>
5172
</Parameters>
5273
</Predicate>
53-
<Predicate Id="Length" Method="IsLengthRange" HelpText="The password must be between 8 and 16 characters.">
74+
<Predicate Id="Symbol" Method="IncludesCharacters">
75+
<UserHelpText>a symbol</UserHelpText>
5476
<Parameters>
55-
<Parameter Id="Minimum">8</Parameter>
56-
<Parameter Id="Maximum">16</Parameter>
77+
<Parameter Id="CharacterSet">@#$%^&amp;*\-_+=[]{}|\\:',.?/`~"();!</Parameter>
5778
</Parameters>
5879
</Predicate>
5980
</Predicates>
6081
```
6182

62-
5. Each **InputValidation** element is constructed by using the defined **Predicate** elements. This element allows you to perform boolean aggregations that are similar to `and` and `or`. Add an **InputValidations** element to the **BuildingBlocks** element if it doesn't exist with the following **InputValidation** element:
83+
1. Add the following predicate validations to the **BuildingBlocks** element, immediately after the closing of the `</Predicates>` element:
6384

6485
```XML
65-
<InputValidations>
66-
<InputValidation Id="PasswordValidation">
67-
<PredicateReferences Id="LengthGroup" MatchAtLeast="1">
68-
<PredicateReference Id="Length" />
69-
</PredicateReferences>
70-
<PredicateReferences Id="3of4" MatchAtLeast="3" HelpText="You must have at least 3 of the following character classes:">
71-
<PredicateReference Id="Lowercase" />
72-
<PredicateReference Id="Uppercase" />
73-
<PredicateReference Id="Number" />
74-
<PredicateReference Id="Symbol" />
75-
</PredicateReferences>
76-
</InputValidation>
77-
</InputValidations>
86+
<PredicateValidations>
87+
<PredicateValidation Id="CustomPassword">
88+
<PredicateGroups>
89+
<PredicateGroup Id="LengthGroup">
90+
<PredicateReferences MatchAtLeast="1">
91+
<PredicateReference Id="LengthRange" />
92+
</PredicateReferences>
93+
</PredicateGroup>
94+
<PredicateGroup Id="CharacterClasses">
95+
<UserHelpText>The password must have at least 3 of the following:</UserHelpText>
96+
<PredicateReferences MatchAtLeast="3">
97+
<PredicateReference Id="Lowercase" />
98+
<PredicateReference Id="Uppercase" />
99+
<PredicateReference Id="Number" />
100+
<PredicateReference Id="Symbol" />
101+
</PredicateReferences>
102+
</PredicateGroup>
103+
</PredicateGroups>
104+
</PredicateValidation>
105+
</PredicateValidations>
78106
```
79107

80-
6. Make sure that the **PolicyProfile** technical profile contains the following elements:
108+
1. The following technical profiles are [Active Directory technical profiles](active-directory-technical-profile.md), which read and write data to Azure Active Directory. Override these technical profiles in the extension file. Use `PersistedClaims` to disable the strong password policy. Find the **ClaimsProviders** element. Add the following claim providers as follows:
81109

82110
```XML
83-
<RelyingParty>
84-
<DefaultUserJourney ReferenceId="SignUpOrSignIn"/>
85-
<TechnicalProfile Id="PolicyProfile">
86-
<DisplayName>PolicyProfile</DisplayName>
87-
<Protocol Name="OpenIdConnect"/>
88-
<InputClaims>
89-
<InputClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration, DisableStrongPassword"/>
90-
</InputClaims>
91-
<OutputClaims>
92-
<OutputClaim ClaimTypeReferenceId="displayName"/>
93-
<OutputClaim ClaimTypeReferenceId="givenName"/>
94-
<OutputClaim ClaimTypeReferenceId="surname"/>
95-
<OutputClaim ClaimTypeReferenceId="email"/>
96-
<OutputClaim ClaimTypeReferenceId="objectId" PartnerClaimType="sub"/>
97-
</OutputClaims>
98-
<SubjectNamingInfo ClaimType="sub"/>
99-
</TechnicalProfile>
100-
</RelyingParty>
111+
<ClaimsProvider>
112+
<DisplayName>Azure Active Directory</DisplayName>
113+
<TechnicalProfiles>
114+
<TechnicalProfile Id="AAD-UserWriteUsingLogonEmail">
115+
<PersistedClaims>
116+
<PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration, DisableStrongPassword"/>
117+
</PersistedClaims>
118+
</TechnicalProfile>
119+
<TechnicalProfile Id="AAD-UserWritePasswordUsingObjectId">
120+
<PersistedClaims>
121+
<PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration, DisableStrongPassword"/>
122+
</PersistedClaims>
123+
</TechnicalProfile>
124+
</TechnicalProfiles>
125+
</ClaimsProvider>
101126
```
102127

103-
7. Save the policy file.
128+
1. Save the policy file.
104129

105130
## Test your policy
106131

107-
When testing your applications in Azure AD B2C, it can be useful to have the Azure AD B2C token returned to `https://jwt.ms` to be able to review the claims in it.
108-
109132
### Upload the files
110133

111134
1. Sign in to the [Azure portal](https://portal.azure.com/).
112135
2. Make sure you're using the directory that contains your Azure AD B2C tenant by selecting the **Directory + subscription** filter in the top menu and choosing the directory that contains your tenant.
113136
3. Choose **All services** in the top-left corner of the Azure portal, and then search for and select **Azure AD B2C**.
114137
4. Select **Identity Experience Framework**.
115138
5. On the Custom Policies page, click **Upload Policy**.
116-
6. Select **Overwrite the policy if it exists**, and then search for and select the *SingUpOrSignInPasswordComplexity.xml* file.
139+
6. Select **Overwrite the policy if it exists**, and then search for and select the *TrustFrameworkExtensions.xml* file.
117140
7. Click **Upload**.
118141

119142
### Run the policy
120143

121-
1. Open the policy that you changed. For example, *B2C_1A_signup_signin_password_complexity*.
144+
1. Open the sign-up or sign-in policy. For example, *B2C_1A_signup_signin*.
122145
2. For **Application**, select your application that you previously registered. To see the token, the **Reply URL** should show `https://jwt.ms`.
123146
3. Click **Run now**.
124147
4. Select **Sign up now**, enter an email address, and enter a new password. Guidance is presented on password restrictions. Finish entering the user information, and then click **Create**. You should see the contents of the token that was returned.
125148

126149
## Next steps
127150

128151
- Learn how to [Configure password change using custom policies in Azure Active Directory B2C](custom-policy-password-change.md).
129-
130-
152+
- - Learn more about the [Predicates](predicates.md) and [PredicateValidations](predicates.md#predicatevalidations) elements in the IEF reference.

‎articles/active-directory/authentication/howto-authentication-passwordless-phone.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ Registration features for passwordless authentication methods rely on the combin
5959
1. In **Microsoft Authenticator**, choose **Enable phone sign-in** from the account drop-down menu
6060
1. Follow the instructions in the app to finish registering for passwordless phone sign-in.
6161

62-
Organizations can point their users to the article [Sign in with your phone, not your password](../user-help/microsoft-authenticator-app-phone-signin-faq.md) for further assistance setting up in the Microsoft Authenticator app and enabling phone sign-in.
62+
Organizations can point their users to the article [Sign in with your phone, not your password](../user-help/microsoft-authenticator-app-phone-signin-faq.md) for further assistance setting up in the Microsoft Authenticator app and enabling phone sign-in. In order to apply these settings, you may need to log out and log back into the tenant.
6363

6464
## Sign in with passwordless credential
6565

‎articles/active-directory/saas-apps/github-tutorial.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,8 @@ In this section, you'll enable B.Simon to use Azure single sign-on by granting a
162162
c. Open the downloaded certificate from Azure portal in notepad, paste the content into the **Public Certificate** textbox.
163163

164164
d. Click on **Edit** icon to edit the **Signature Method** and **Digest Method** from **RSA-SHA1** and **SHA1** to **RSA-SHA256** and **SHA256** as shown below.
165+
166+
e. Update the **assertion consumer service URL (Reply URL)** from the default URL so that it the URL in Github matches the URL in the Azure app registration.
165167

166168
![image](./media/github-tutorial/tutorial_github_sha.png)
167169

@@ -219,4 +221,4 @@ When you click the GitHub tile in the Access Panel, you should be automatically
219221

220222
- [Try GitHub with Azure AD](https://aad.portal.azure.com/)
221223

222-
- [What is session control in Microsoft Cloud App Security?](https://docs.microsoft.com/cloud-app-security/proxy-intro-aad)
224+
- [What is session control in Microsoft Cloud App Security?](https://docs.microsoft.com/cloud-app-security/proxy-intro-aad)

‎articles/cost-management-billing/manage/mpa-request-ownership.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ Azure Marketplace products which are available for subscriptions that are manage
135135

136136
### Azure Reservations transfer
137137

138-
Azure Reservations don't automatically move with subscriptions. [Contact Azure support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade) to move Reservations.
138+
Azure Reservations don't automatically move with subscriptions.You can keep the reservation or [cancel and repurchse the reservation](https://docs.microsoft.com/azure/cost-management-billing/reservations/exchange-and-refund-azure-reservations) in CSP.
139139

140140
### Access to Azure services
141141

‎articles/databox/data-box-heavy-deploy-set-up.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ Take the following steps to cable your device.
9797

9898
On one of the nodes of the device, take the following steps to cable for network.
9999

100-
1. Use a CAT 6 RJ-45 network cable (blue cable in the picture) to connect the host computer to the 1-Gbps management port.
100+
1. Use a CAT 6 RJ-45 network cable (top-right cable in picture, attached to plug labeled MGMT) to connect the host computer to the 1-Gbps management port.
101101
2. Use a QSFP+ cable (fiber or copper) to connect at least one 40-Gbps (preferred over 1 Gbps) network interface for data. If using a 10-Gbps switch, use an SFP+ cable with a QSFP+ to SFP+ adapter (the QSA adapter) to connect the 40 Gbps network interface for data.
102102

103103
![Data Box Heavy ports cabled](media/data-box-heavy-deploy-set-up/data-box-heavy-ports-cabled.png)

0 commit comments

Comments
 (0)