You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -24,6 +24,9 @@ If you’re just getting started, check out the [Microsoft identity platform doc
24
24
25
25
Use the following checklist to ensure that your application is effectively integrated with the [Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/).
26
26
27
+
> [!TIP]
28
+
> The *Integration assistant* in the Azure portal can help you apply many of these best practices and recommendations. Select any of your [app registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) in the Azure portal, and then select the **Integration assistant (preview)** menu item to get started with the assistant.
title: 'Azure AD Connect: Hybrid identity considerations for Azure Government'
3
-
description: Special considerations for deploying Azure AD Connect with the government cloud.
2
+
title: 'Azure AD Connect: Hybrid identity considerations for Azure Government cloud'
3
+
description: Special considerations for deploying Azure AD Connect with the Azure Government cloud.
4
4
services: active-directory
5
5
author: billmath
6
6
manager: daveba
@@ -13,68 +13,89 @@ ms.author: billmath
13
13
ms.collection: M365-identity-device-management
14
14
---
15
15
16
-
# Hybrid identity considerations for Azure Government
17
-
The following document describes the considerations for implementing a hybrid environment with the Azure Government cloud. This information is provided as reference for administrators and architects who are working with the Azure Government cloud.
18
-
> [!NOTE]
19
-
> In order to integrate an on-premises AD environment with the Azure Governemnt cloud, you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594).
16
+
# Hybrid identity considerations for the Azure Government cloud
20
17
21
-
> [!NOTE]
22
-
> For a full list of U.S. Government DoD Endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints)
18
+
This article describes considerations for integrating a hybrid environment with the Microsoft Azure Government cloud. This information is provided as a reference for administrators and architects who work with the Azure Government cloud.
23
19
24
-
## Pass-Through Authentication
25
-
The following information is provided for implementation of pass-through authentication (PTA) and the Azure Government cloud.
20
+
> [!NOTE]
21
+
> To integrate an on-premises Microsoft Azure Active Directory (Azure AD) environment with the Azure Government cloud, you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594).
22
+
23
+
For a full list of United States government Department of Defense endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints).
24
+
25
+
## Azure AD Pass-through Authentication
26
+
27
+
The following information describes implementation of Pass-through Authentication and the Azure Government cloud.
28
+
29
+
### Allow access to URLs
30
+
31
+
Before you deploy the Pass-through Authentication agent, verify whether a firewall exists between your servers and Azure AD. If your firewall or proxy allows Domain Name System (DNS) blocked or safe programs, add the following connections.
26
32
27
-
### Allow access to URLs
28
-
Before deploying the pass-through authentication agent, verify if there is a firewall between your servers and Azure AD. If your firewall or proxy allows DNS whitelisting, add the following connections:
29
33
> [!NOTE]
30
-
> The following guidance also applies to installing the [Application Proxy connector](https://aka.ms/whyappproxy) for Azure Government environments.
34
+
> The following guidance also applies to installing the [Azure AD Application Proxy connector](https://aka.ms/whyappproxy) for Azure Government environments.
31
35
32
36
|URL |How it's used|
33
-
|-----|-----|
34
-
|*.msappproxy.us *.servicebus.usgovcloudapi.net|Communication between the agent and the Azure AD cloud service |
35
-
|mscrl.microsoft.us:80 crl.microsoft.us:80 </br>ocsp.msocsp.us:80 www.microsoft.us:80| The agent uses these URLs to verify certificates.|
36
-
|login.windows.us secure.aadcdn.microsoftonline-p.com *.microsoftonline.us </br>*.microsoftonline-p.us </br>*.msauth.net </br>*.msauthimages.net </br>*.msecnd.net</br>*.msftauth.net </br>*.msftauthimages.net</br>*.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.|
37
-
38
-
### Install the agent for the Azure Government cloud
39
-
In order to install the agent for the Azure Government cloud, you must follow these specific steps:
40
-
In the command line terminal, navigate to folder where the executable for installing the agent is located.
41
-
Run the following command which specifies the installation is for Azure Government.
Set up your Azure AD Connect server: If you use Pass-through Authentication as your sign-in method, no additional prerequisite check is required. If you use password hash synchronization as your sign-in method, and if there is a firewall between Azure AD Connect and Azure AD, ensure that:
55
-
- You use version 1.1.644.0 or later of Azure AD Connect.
56
-
- If your firewall or proxy allows DNS whitelisting, add the connections to the *.msapproxy.us URLs over port 443. If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite is applicable only when you enable the feature. It is not required for actual user sign-ins.
57
-
58
-
### Rolling out seamless SSO
59
-
You can gradually roll out Seamless SSO to your users using the instructions provided below. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory:
60
-
https://autologon.microsoft.us
61
-
62
-
In addition, you need to enable an Intranet zone policy setting called Allow updates to status bar via script through Group Policy.
63
-
Browser considerations
64
-
Mozilla Firefox (all platforms)
65
-
Mozilla Firefox doesn't automatically use Kerberos authentication. Each user must manually add the Azure AD URL to their Firefox settings by using the following steps:
66
-
1. Run Firefox and enter about:config in the address bar. Dismiss any notifications that you see.
67
-
2. Search for the network.negotiate-auth.trusted-uris preference. This preference lists Firefox's trusted sites for Kerberos authentication.
68
-
3. Right-click and select Modify.
69
-
4. Enter https://autologon.microsoft.us in the field.
70
-
5. Select OK and then reopen the browser.
71
-
72
-
### Microsoft Edge based on Chromium (all platforms)
73
-
If you have overridden the `AuthNegotiateDelegateAllowlist` or the `AuthServerAllowlist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well.
74
-
75
-
### Google Chrome (all platforms)
76
-
If you have overridden the `AuthNegotiateDelegateWhitelist` or the `AuthServerWhitelist` policy settings in your environment, ensure that you add Azure AD's URL (https://autologon.microsoft.us) to them as well.
37
+
|-----|-----|
38
+
|*.msappproxy.us</br>*.servicebus.usgovcloudapi.net|The agent uses these URLs to communicate with the Azure AD cloud service. |
39
+
|mscrl.microsoft.us:80 </br>crl.microsoft.us:80 </br>ocsp.msocsp.us:80 </br>www.microsoft.us:80| The agent uses these URLs to verify certificates.|
40
+
|login.windows.us </br>secure.aadcdn.microsoftonline-p.com </br>*.microsoftonline.us </br>*.microsoftonline-p.us </br>*.msauth.net </br>*.msauthimages.net </br>*.msecnd.net</br>*.msftauth.net </br>*.msftauthimages.net</br>*.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.
41
+
42
+
### Install the agent for the Azure Government cloud
43
+
44
+
Follow these steps to install the agent for the Azure Government cloud:
45
+
46
+
1. In the command-line terminal, go to the folder that contains the executable file that installs the agent.
47
+
1. Run the following commands, which specify that the installation is for Azure Government.
If you use Pass-through Authentication as your sign-on method, no additional prerequisite check is required. If you use password hash synchronization as your sign-on method and there is a firewall between Azure AD Connect and Azure AD, ensure that:
66
+
67
+
- You use Azure AD Connect version 1.1.644.0 or later.
68
+
- If your firewall or proxy allows DNS blocked or safe programs, add the connections to the *.msappproxy.us URLs over port 443.
69
+
70
+
If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite applies only when you enable the feature. It isn't required for actual user sign-ons.
71
+
72
+
### Roll out Seamless Single Sign-On
73
+
74
+
You can gradually roll out Azure AD Seamless Single Sign-On to your users by using the following instructions. You start by adding the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to all or selected users' Intranet zone settings by using Group Policy in Active Directory.
75
+
76
+
You also need to enable the intranet zone policy setting **Allow updates to status bar via script through Group Policy**.
77
+
78
+
## Browser considerations
79
+
80
+
### Mozilla Firefox (all platforms)
81
+
82
+
Mozilla Firefox doesn't automatically use Kerberos authentication. Each user must manually add the Azure AD URL to their Firefox settings by following these steps:
83
+
84
+
1. Run Firefox and enter **about:config** in the address bar. Dismiss any notifications that you might see.
85
+
1. Search for the **network.negotiate-auth.trusted-uris** preference. This preference lists the sites trusted by Firefox for Kerberos authentication.
86
+
1. Right-click the preference name and then select **Modify**.
87
+
1. Enter [**https://autologon.microsoft.us**](https://autologon.microsoft.us**) in the box.
88
+
1. Select **OK** and then reopen the browser.
89
+
90
+
### Microsoft Edge based on Chromium (all platforms)
91
+
92
+
If you have overridden the `AuthNegotiateDelegateAllowlist` or `AuthServerAllowlist` policy settings in your environment, ensure that you add the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to them.
93
+
94
+
### Google Chrome (all platforms)
95
+
96
+
If you have overridden the `AuthNegotiateDelegateWhitelist` or `AuthServerWhitelist` policy settings in your environment, ensure that you add the Azure AD URL [https://autologon.microsoft.us](https://autologon.microsoft.us) to them.
Copy file name to clipboardExpand all lines: articles/aks/faq.md
+5-2Lines changed: 5 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -123,6 +123,8 @@ Windows Server support for node pool includes some limitations that are part of
123
123
124
124
## Does AKS offer a service-level agreement?
125
125
126
+
AKS provides the ability to achieve 99.95% availability for the API server with [Uptime SLA][uptime-sla.md].
127
+
126
128
In a service-level agreement (SLA), the provider agrees to reimburse the customer for the cost of the service if the published service level isn't met. Since AKS is free, no cost is available to reimburse, so AKS has no formal SLA. However, AKS seeks to maintain availability of at least 99.5 percent for the Kubernetes API server.
127
129
128
130
It is important to recognize the distinction between AKS service availability which refers to uptime of the Kubernetes control plane and the availability of your specific workload which is running on Azure Virtual Machines. Although the control plane may be unavailable if the control plane is not ready, your cluster workloads running on Azure VMs can still function. Given Azure VMs are paid resources they are backed by a financial SLA. Read [here for more details](https://azure.microsoft.com/support/legal/sla/virtual-machines/v1_8/) on the Azure VM SLA and how to increase that availability with features like [Availability Zones][availability-zones].
@@ -139,7 +141,7 @@ The `az aks update-credentials` command can be used to move an AKS cluster betwe
139
141
140
142
Movement of clusters between subscriptions is currently unsupported.
141
143
142
-
## Can I move my AKS clusters from the current azure subscription to another?
144
+
## Can I move my AKS clusters from the current Azure subscription to another?
143
145
144
146
Moving your AKS cluster and it's associated resources between Azure subscriptions is not supported.
145
147
@@ -205,11 +207,12 @@ No AKS is a managed service, and manipulation of the IaaS resources is not suppo
title: Azure Kubernetes Service (AKS) high availability with Uptime SLA
3
+
description: Learn about the optional high availability Uptime SLA offering for the Azure Kubernetes Service (AKS) API Server.
4
+
services: container-service
5
+
ms.topic: conceptual
6
+
ms.date: 05/11/2020
7
+
---
8
+
9
+
# Azure Kubernetes Service (AKS) Uptime SLA
10
+
11
+
Uptime SLA is an optional feature to enable financially backed higher SLA for a cluster. Uptime SLA guarantees 99.95% availability of the Kubernetes API server endpoint for clusters that use [Availability Zone][availability-zones] and 99.9% of availability for clusters that don't use availability zones. AKS uses master node replicas across update and fault domains to ensure SLA requirements are met.
12
+
13
+
Customers needing SLA for compliance reasons or extending SLA's to their customers should turn on this feature. Customers with critical workloads who need higher availability with an option of SLA benefit from enabling this feature. Enable the feature with Availability Zones to obtain higher availability of the Kubernetes API server.
14
+
15
+
Customers can create unlimited free clusters with a service level objective (SLO) of 99.5%.
16
+
17
+
> [!Important]
18
+
> For clusters with egress lockdown, see [limit egress traffic](limit-egress-traffic.md) to open appropriate ports for Uptime SLA.
19
+
20
+
## SLA terms and conditions
21
+
22
+
Uptime SLA is a paid feature and enabled per cluster. Uptime SLA pricing is determined by the number of clusters, and not by the size of the clusters. You can view [Uptime SLA pricing details](https://azure.microsoft.com/pricing/details/kubernetes-service/) for more information.
23
+
24
+
## Region Availability
25
+
26
+
Uptime SLA is available in the following regions:
27
+
28
+
* Australia East
29
+
* Canada Central
30
+
* East US
31
+
* East US 2
32
+
* South Central US
33
+
* South East Asia
34
+
* West US 2
35
+
36
+
## Before you begin
37
+
38
+
* The Azure CLI version 2.7.0 or later
39
+
40
+
## Creating a cluster with Uptime SLA
41
+
42
+
To create a new cluster with the Uptime SLA, you use the Azure CLI.
43
+
44
+
The following example creates a resource group named *myResourceGroup* in the *eastus* location.
45
+
46
+
```azurecli-interactive
47
+
az group create --name myResourceGroup --location eastus
48
+
```
49
+
Use the [az aks create][az-aks-create] command to create an AKS cluster. The following example creates a cluster named *myAKSCluster* with one node. Azure Monitor for containers is also enabled using the *--enable-addons monitoring* parameter. This operation takes several minutes to complete.
50
+
51
+
```azurecli-interactive
52
+
az aks create --resource-group myResourceGroup --name myAKSCluster --uptime-sla --node-count 1 --enable-addons monitoring --generate-ssh-keys
53
+
```
54
+
After a few minutes, the command completes and returns JSON-formatted information about the cluster. The following JSON snippet shows the paid tier for the SKU, indicating your cluster is enabled with Uptime SLA.
0 commit comments