You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- An Azure AD tenant where you can register an app. If you don’t have access to an Azure AD tenant, you can get one by registering with the [Microsoft 365 Developer Program](https://developer.microsoft.com/microsoft-365/dev-program) or by creating an [Azure free account](https://azure.microsoft.com/free).
31
+
- An Azure account that has an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
32
+
- The Azure account must have permission to manage applications in Azure Active Directory (Azure AD). Any of the following Azure AD roles include the required permissions:
Every app that uses Azure Active Directory (Azure AD) for authentication must be registered with Azure AD. Follow the instructions in [Register an application](quickstart-register-app.md) with these additions:
39
+
Every app that uses Azure AD for authentication must be registered with Azure AD. Follow the instructions in [Register an application](quickstart-register-app.md) with these additions:
34
40
35
41
- For **Supported account types**, select **Accounts in this organizational directory only**.
36
-
- Leave the **Redirect URI** drop down set to **Web** and enter `https://localhost:5001/signin-oidc`. The default port for an app running on Kestrel is 5001. If the app is available on a different port, specify that port number instead of `5001`.
42
+
- Leave the **Redirect URI** drop down set to **Web** and enter `https://localhost:5001/signin-oidc`. The default port for an app running on Kestrel is `5001`. If the app is available on a different port, specify that port number instead of `5001`.
37
43
38
44
Under **Manage**, select **Authentication** > **Implicit grant and hybrid flows**. Select **ID tokens**, and then select **Save**.
39
45
40
46
Finally, because the app calls a protected API (in this case Microsoft Graph), it needs a client secret in order to verify its identity when it requests an access token to call that API.
41
47
42
48
1. Within the same app registration, under **Manage**, select **Certificates & secrets** and then **Client secrets**.
43
49
2. Create a **New client secret** that never expires.
44
-
3. Make note of the secret's **Value** as you will use it in the next step. You can’t access it again once you navigate away from this pane. However, you can recreate it as needed.
50
+
3. Make note of the secret's **Value** as you'll use it in the next step. You can’t access it again once you navigate away from this pane. However, you can recreate it as needed.
45
51
46
52
## Create the app using the .NET CLI
47
53
48
-
Run the following command to download the templates for Microsoft.Identity.Web, which we will make use of in this tutorial.
54
+
Run the following command to download the templates for `Microsoft.Identity.Web`, which we'll make use of in this tutorial.
49
55
50
56
```dotnetcli
51
-
dotnet new --install Microsoft.Identity.Web.ProjectTemplates
57
+
dotnet new install Microsoft.Identity.Web.ProjectTemplates
52
58
```
53
59
54
60
Then, run the following command to create the application. Replace the placeholders in the command with the proper information from your app's overview page and execute the command in a command shell. The output location specified with the `-o|--output` option creates a project folder if it doesn't exist and becomes part of the app's name.
Now, navigate to your new Blazor app in your editor and add the client secret to the *appsettings.json* file, replacing the text "secret-from-app-registration".
73
+
Now, navigate to your new Blazor app in your editor and add the client secret to the _appsettings.json_ file, replacing the text "secret-from-app-registration".
68
74
69
75
```json
70
76
"ClientSecret": "secret-from-app-registration",
@@ -86,21 +92,21 @@ In your browser, navigate to `https://localhost:5001`, and log in using an Azure
86
92
87
93
Before you start, log out of your app since you'll be making changes to the required permissions, and your current token won't work. If you haven't already, run your app again and select **Log out** before updating the code below.
88
94
89
-
Now you will update your app's registration and code to pull a user's email and display the messages within the app. To achieve this, first extend the app registration permissions in Azure AD to enable access to the email data. Then, add code to the Blazor app to retrieve and display this data in one of the pages.
95
+
Now you'll update your app's registration and code to pull a user's email and display the messages within the app. To achieve this, first extend the app registration permissions in Azure AD to enable access to the email data. Then, add code to the Blazor app to retrieve and display this data in one of the pages.
90
96
91
97
1. In the Azure portal, select your app in **App registrations**.
92
98
1. Under **Manage**, select **API permissions**.
93
99
1. Select **Add a permission** > **Microsoft Graph**.
94
100
1. Select **Delegated Permissions**, then search for and select the **Mail.Read** permission.
95
101
1. Select **Add permissions**.
96
102
97
-
In the *appsettings.json* file, update your code so it fetches the appropriate token with the right permissions. Add "mail.read" after the "user.read" scope under "DownstreamAPI". This is specifying which scopes (or permissions) the app will request access to.
103
+
In the *appsettings.json* file, update your code so it fetches the appropriate token with the right permissions. Add `mail.read` after the `user.read` scope under `DownstreamAPI`. This is specifying which scopes (or permissions) the app will request access to.
98
104
99
105
```json
100
106
"Scopes": "user.read mail.read"
101
107
```
102
108
103
-
Next, update the code in the *FetchData.razor* file to retrieve email data instead of the default (random) weather details. Replace the code in that file with the following:
109
+
Next, update the code in the *FetchData.razor* file to retrieve email data instead of the default (random) weather details. Replace the code in that file with the following code snippet:
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/whats-new-docs.md
+12-18Lines changed: 12 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,18 @@ manager: CelesteDG
15
15
16
16
Welcome to what's new in Azure Active Directory External Identities documentation. This article lists new docs that have been added and those that have had significant updates in the last three months. To learn what's new with the External Identities service, see [What's new in Azure Active Directory](../fundamentals/whats-new.md).
17
17
18
+
## November 2022
19
+
20
+
### Updated articles
21
+
22
+
-[Tutorial: Use PowerShell to bulk invite Azure AD B2B collaboration users](bulk-invite-powershell.md)
23
+
-[Grant B2B users in Azure AD access to your on-premises applications](hybrid-cloud-to-on-premises.md)
24
+
-[Reset redemption status for a guest user](reset-redemption-status.md)
25
+
-[Language customization in Azure Active Directory](user-flow-customize-language.md)
26
+
-[B2B collaboration overview](what-is-b2b.md)
27
+
-[Azure Active Directory External Identities: What's new](whats-new-docs.md)
28
+
-[Tutorial: Enforce multi-factor authentication for B2B guest users](b2b-tutorial-require-mfa.md)
29
+
18
30
## October 2022
19
31
20
32
### Updated articles
@@ -52,21 +64,3 @@ Welcome to what's new in Azure Active Directory External Identities documentatio
52
64
-[Add Azure Active Directory B2B collaboration users in the Azure portal](add-users-administrator.md)
53
65
-[Leave an organization as an external user](leave-the-organization.md)
54
66
-[Grant B2B users in Azure AD access to your on-premises applications](hybrid-cloud-to-on-premises.md)
55
-
56
-
## August 2022
57
-
58
-
### Updated articles
59
-
60
-
-[Allow or block invitations to B2B users from specific organizations](allow-deny-list.md)
61
-
-[Azure Active Directory B2B best practices](b2b-fundamentals.md)
62
-
-[Azure Active Directory B2B collaboration FAQs](faq.yml)
You can remove workflows that are no longer needed. Deleting these workflows allows you to make sure your lifecycle strategy is up to date. When a workflow is deleted, it enters a soft delete state. During this period, it's still able to be viewed within the deleted workflows list, and can be restored if needed. 30 days after a workflow enters a soft delete state it will be permanently removed. If you don't wish to wait 30 days for a workflow to permanently delete you can always manually delete it yourself.
20
20
21
+
## Prerequisites
22
+
23
+
- Azure AD Premium P2
24
+
25
+
For more information, see: [License requirements](what-are-lifecycle-workflows.md#license-requirements)
Copy file name to clipboardExpand all lines: articles/active-directory/governance/lifecycle-workflows-deployment.md
+8-5Lines changed: 8 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,10 +40,10 @@ Planning your Lifecycle Workflow deployment is essential to make sure you achiev
40
40
41
41
For more information on deployment plans, see [Azure AD deployment plans](../fundamentals/active-directory-deployment-plans.md)
42
42
43
-
## Licenses
43
+
## License requirements
44
44
45
45
46
-
[!INCLUDE [Azure AD Premium P2 license](../../../includes/active-directory-p2-license.md)]
46
+
[!INCLUDE [Azure AD Premium P2 license](../../../includes/lifecycle-workflows-license.md)]
47
47
48
48
>[!Note]
49
49
>Be aware that if your license expires, any workflows that you have created will stop working.
@@ -104,21 +104,24 @@ This section introduces Lifecycle Workflow concepts you should know before you p
104
104
105
105
106
106
## Prerequisites to deploying Lifecycle Workflows
107
-
The following is important information about your organization and the technologies that need to be in place prior to deploying Lifecycle Workflows. Ensure that you can answer yes to each of the items before attempting to deploy Lifecycle Workflows.
107
+
108
+
The following information is important information about your organization and the technologies that need to be in place prior to deploying Lifecycle Workflows. Ensure that you can answer yes to each of the items before attempting to deploy Lifecycle Workflows.
108
109
109
110
|Item|Description|Documentation|
110
111
|-----|-----|-----|
111
112
|Inbound Provisioning|You have a process to create user accounts for employees in Azure AD such as HR inbound, SuccessFactors, or MIM.<br><br> Alternatively you have a process to create user accounts in Active Directory and those accounts are provisioned to Azure AD.|[Workday to Active Directory](../saas-apps/workday-inbound-tutorial.md)<br><br>[Workday to Azure AD](../saas-apps/workday-inbound-tutorial.md)<br><br>[SuccessFactors to Active Directory](../saas-apps/sap-successfactors-inbound-provisioning-tutorial.md)</br></br>[SuccessFactors to Azure AD](../saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial.md)<br><br>[Azure AD Connect](../hybrid/whatis-azure-ad-connect-v2.md)<br><br>[Azure AD Connect cloud sync](../cloud-sync/what-is-cloud-sync.md)|
112
-
|Attribute synchronization|The accounts in Azure AD have the employeeHireDate and employeeLeaveDateTime attributes populated. The values may be populated when the accounts are created from an HR system or synchronized from AD using Azure AD Connect or cloud sync. You have additional attributes, that will be used to determine the scope, such as department, populated or the ability to populate, with data.|[How to synchronize attributes for Lifecycle Workflows](how-to-lifecycle-workflow-sync-attributes.md)
113
+
|Attribute synchronization|The accounts in Azure AD have the employeeHireDate and employeeLeaveDateTime attributes populated. The values may be populated when the accounts are created from an HR system or synchronized from AD using Azure AD Connect or cloud sync. You have additional attributes that will be used to determine the scope such as department, populated or the ability to populate, with data.|[How to synchronize attributes for Lifecycle Workflows](how-to-lifecycle-workflow-sync-attributes.md)
113
114
114
115
## Understanding parts of a workflow
116
+
115
117
Before you begin planning a Lifecycle Workflow deployment, you should become familiar with the parts of workflow and the terminology around Lifecycle Workflows.
116
118
117
119
The [Understanding Lifecycle Workflows](understanding-lifecycle-workflows.md) document, uses the portal to explain the parts of a workflow. The [Developer API reference Lifecycle Workflows](lifecycle-workflows-developer-reference.md) document, uses a GRAPH example to explain the parts of a workflow.
118
120
119
121
You can use this document to become familiar with the parts of workflow prior to deploying them.
120
122
121
123
## Limitations and constraints
124
+
122
125
The following table provides information that you need to be aware of as you create and deploy Lifecycle workflows.
123
126
124
127
|Item|Description|
@@ -133,7 +136,7 @@ The following table provides information that you need to be aware of as you cre
133
136
134
137
The following is additional information you should be aware of.
135
138
136
-
- You cannot enable the schedule for the Real-Time Leaver scenario. This is by design.
139
+
- You can't enable the schedule for the Real-Time Leaver scenario. This is by design.
0 commit comments