Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into wk10-3

Author: sethmanheim

.openpublishing.publish.config.json

@@ -211,6 +211,12 @@
       "url": "https://github.com/Azure-Samples/media-services-v3-rest-postman",
       "branch": "master",
       "branch_mapping": {}
+    },
+    {
+      "path_to_root": "samples-qnamaker-nodejs",
+      "url": "https://github.com/Azure-Samples/cognitive-services-qnamaker-nodejs",
+      "branch": "master",
+      "branch_mapping": {}
     }
   ],
   "branch_target_mapping": {

.openpublishing.redirection.json

@@ -2126,6 +2126,11 @@
             "redirect_url": "/azure/azure-resource-manager/resource-manager-quickstart-create-templates-use-the-portal",
             "redirect_document_id": false
         },
+        {
+            "source_path": "articles/managed-applications/managed-apps-quickstart-cli.md",
+            "redirect_url": "/azure/managed-applications/publish-managed-app-definition-quickstart",
+            "redirect_document_id": false
+        },
         {
             "source_path": "articles/azure-resource-manager/managed-application-overview.md",
             "redirect_url": "/azure/managed-applications/overview",
@@ -16303,7 +16308,7 @@
         },
         {
             "source_path": "articles/active-directory/develop/active-directory-integrating-applications.md",
-            "redirect_url": "/azure/active-directory/develop/quickstart-v1-integrate-apps-with-azure-ad",
+            "redirect_url": "/azure/active-directory/develop/quickstart-v1-add-azure-ad-app",
             "redirect_document_id": true
         },
         {
@@ -16566,6 +16571,11 @@
             "redirect_url": "/azure/active-directory/develop/howto-app-gallery-listing",
             "redirect_document_id": true
         },
+        {
+            "source_path": "articles/active-directory/active-directory-appmodel-v2-overview.md",
+            "redirect_url": "/azure/active-directory/develop/v2-overview",
+            "redirect_document_id": false
+        },
         {
             "source_path": "articles/active-directory/develop/active-directory-appmodel-v2-overview.md",
             "redirect_url": "/azure/active-directory/develop/v2-overview",
@@ -29723,6 +29733,11 @@
         {    "source_path": "articles/billing/billing-set-up-alerts.md",
             "redirect_url": "/azure/billing/billing-getting-started",
             "redirect_document_id": false
+        },
+        {
+            "source_path": "articles/app-service/web-sites-java-add-app.md",
+            "redirect_url": "/azure/app-service/app-service-web-get-started-java",
+            "redirect_document_id" : false
         }
     ]
 }

articles/active-directory-b2c/TOC.yml

@@ -66,8 +66,6 @@
   items:
   - name: Access audit logs 
     href: active-directory-b2c-reference-audit-logs.md
-  - name: Collect logs using Application Insights
-    href: active-directory-b2c-troubleshoot-custom.md
   - name: Configure tokens
     href: active-directory-b2c-token-session-sso.md
   - name: Customize language
@@ -89,6 +87,8 @@
     items:
     - name: Create a custom policy
       href: active-directory-b2c-get-started-custom.md
+    - name: Collect logs using Application Insights
+      href: active-directory-b2c-troubleshoot-custom.md
     - name: Integrate RESTful APIs
       items:
       - name: Validate user input

articles/active-directory-b2c/b2clogin.md

@@ -1,53 +1,67 @@
 ---
-title: Using b2clogin.com | Microsoft Docs
-description: Learn about using b2clogin.com instead of login.microsoftonline.com. 
+title: Set redirect URLs to b2clogin.com for Azure Active Directory B2C | Microsoft Docs
+description: Learn about using b2clogin.com in your redirect URLs for Azure Active Directory B2C. 
 services: active-directory-b2c
 author: davidmu1
 manager: mtillman
 
 ms.service: active-directory
 ms.workload: identity
 ms.topic: conceptual
-ms.date: 04/29/2018
+ms.date: 10/04/2018
 ms.author: davidmu
 ms.component: B2C
 ---
 
-# Using B2Clogin.com
+# Set redirect URLs to b2clogin.com for Azure Active Directory B2C
 
-Going forward, we're encouraging all customers to use `<YourDirectoryName>.b2clogin.com` and we'll be deprecating `login.microsoftonline.com`. B2Clogin.com gives you additional benefits such as:
-* You no longer share the same cookie with the other Microsoft services.
-* You can remove all references to Microsoft in your URL (you can replace `<YourDirectoryName>.onmicrosoft.com` with your directory ID). For example: `https://<YourDirectoryName>.b2clogin.com/tfp/<YourDirectoryID>/<policyname>/v2.0/.well-known/openid-configuration`.
+When you set up an identity provider for sign-up and sign-in in your Azure Active Directory (Azure AD) B2C application, you need to specify a redirect URL. In the past, login.microsoftonline.com was used, now you should be using b2clogin.com.
 
-Here's what you need to do to migrate over to b2clogin.com
+Using b2clogin.com gives you additional benefits, such as:
 
-* Change the redirect URIs for your social identity provider apps
-* Edit your application to use B2Clogin.com instead of `login.microsoftonline.com` for policy references and token endpoints.
-* If you're using MSAL, you need to set `ValidateAuthority=false`.  
+- Cookies are no longer shared with the other Microsoft services.
+- Your URLs no longer include a reference to Microsoft. For example, `https://your-tenant-name.b2clogin.com/tfp/your-tenant-ID/policyname/v2.0/.well-known/openid-configuration`.
 
-##Redirect URIs for social identity providers
+To use b2clogin.com, set the redirect URLs in your identity provider applications to use b2clogin.com. You also set your Azure AD B2C application to use b2clogin.com for policy references and token endpoints. If you are using MSAL, you need to set the **ValidateAuthority** property to `false`.
 
-If you have social account identity providers set up in your directory you'll need to make modifications in their applications.  There is a parameter for the application for with each social provider that contains a list of trusted URLs to redirect back to Azure AD B2C.  Currently, you probably have it set up to redirect back to some `login.microsoftonline.com` site, you'll need to change this URL so that `YourDirectoryName.b2clogin.com` will be an authorized redirect URI.  Make sure to remove the `/te` as well.  There are slight variations to this URL for each identity provider so check the corresponding page to get the exact URL.  
+## Change redirect URLs
 
-| Identity provider |
-|-------------------|
-|[Microsoft account](active-directory-b2c-setup-msa-app.md)|
-|[Facebook](active-directory-b2c-setup-fb-app.md)|
-|[Google](active-directory-b2c-setup-goog-app.md)|
-|[Amazon](active-directory-b2c-setup-amzn-app.md)|
-|[LinkedIn](active-directory-b2c-setup-li-app.md)|
-|[Twitter](active-directory-b2c-setup-twitter-app.md)|
-|[GitHub](active-directory-b2c-setup-github-app.md)|
-|[Weibo](active-directory-b2c-setup-weibo-app.md)|
-|[QQ](active-directory-b2c-setup-qq-app.md)|
-|[WeChat](active-directory-b2c-setup-wechat-app.md)|
-|[Azure AD](active-directory-b2c-setup-oidc-azure-active-directory.md)|
-|[Custom OIDC](active-directory-b2c-setup-oidc-idp.md)|
+To use b2clogin.com, in the settings for your identity provider application, look for and change the list of trusted URLs to redirect back to Azure AD B2C.  Currently, you probably have it set up to redirect back to some login.microsoftonline.com site. 
 
-##Update your application references
+You'll need to change the redirect URL so that `your-tenant-name.b2clogin.com` is authorized. Make sure to replace `your-tenant-name` with the name of your Azure AD B2C tenant and remove `/te` if it exists in the URL. There are slight variations to this URL for each identity provider so check the corresponding page to get the exact URL.
 
-Your application probably refers to `login.microsoftonline.com` in several places, such as your policy references and token endpoints.  Make sure that your authorization endpoint, token endpoint, and issuer have been updated.  
+You can find set-up information for identity providers in the following articles:
 
-##Set `ValidateAuthority=false` in MSAL
+- [Microsoft account](active-directory-b2c-setup-msa-app.md)
+- [Facebook](active-directory-b2c-setup-fb-app.md)
+- [Google](active-directory-b2c-setup-goog-app.md)
+- [Amazon](active-directory-b2c-setup-amzn-app.md)
+- [LinkedIn](active-directory-b2c-setup-li-app.md)
+- [Twitter](active-directory-b2c-setup-twitter-app.md)
+- [GitHub](active-directory-b2c-setup-github-app.md)
+- [Weibo](active-directory-b2c-setup-weibo-app.md)
+- [QQ](active-directory-b2c-setup-qq-app.md)
+- [WeChat](active-directory-b2c-setup-wechat-app.md)
+- [Azure AD](active-directory-b2c-setup-oidc-azure-active-directory.md)
+- [Custom OIDC](active-directory-b2c-setup-oidc-idp.md)
 
-If you're using MSAL, you'll need to set `ValidateAuthority=false`.  For more information, see [this documentation](https://docs.microsoft.com/dotnet/api/microsoft.identity.client.clientapplicationbase?view=azure-dotnet).
+## Update your application
+
+Your Azure AD B2C application probably refers to `login.microsoftonline.com` in several places, such as your policy references and token endpoints.  Make sure that your authorization endpoint, token endpoint, and issuer have been updated to use `your-tenant-name.b2clogin.com`.  
+
+## Set the ValidateAuthority property
+
+If you're using MSAL, set the **ValidateAuthority** to `false`. The following example shows how you might set the property:
+
+```
+this.clientApplication = new UserAgentApplication(
+  env.auth.clientId,
+  env.auth.loginAuthority,
+  this.authCallback.bind(this),
+  {
+    validateAuthority: false
+  }
+);
+```
+
+ For more information, see [ClientApplicationBase Class ](https://docs.microsoft.com/dotnet/api/microsoft.identity.client.clientapplicationbase?view=azure-dotnet).

articles/active-directory/authentication/active-directory-certificate-based-authentication-get-started.md

@@ -200,6 +200,6 @@ An EAS profile can be configured and placed on the device through the utilizatio
 
 ## Next steps
 
-[Additional information about certificate-based authenticaion on Android devices.](active-directory-certificate-based-authentication-android.md)
+[Additional information about certificate-based authentication on Android devices.](active-directory-certificate-based-authentication-android.md)
 
-[Additional information about certificate-based authenticaion on iOS devices.](active-directory-certificate-based-authentication-ios.md)
+[Additional information about certificate-based authentication on iOS devices.](active-directory-certificate-based-authentication-ios.md)

articles/active-directory/authentication/concept-sspr-policy.md

@@ -116,27 +116,27 @@ To get started, you need to [download and install the Azure AD PowerShell module
 1. Connect to Windows PowerShell by using your company administrator credentials.
 2. Execute one of the following commands:
 
-   * To see if a single user’s password is set to never expire, run the following cmdlet by using the UPN (for example, *[email protected]*) or the user ID of the user you want to check: `Get-MSOLUser -UserPrincipalName <user ID> | Select PasswordNeverExpires`
-   * To see the **Password never expires** setting for all users, run the following cmdlet: `Get-MSOLUser | Select UserPrincipalName, PasswordNeverExpires`
+   * To see if a single user’s password is set to never expire, run the following cmdlet by using the UPN (for example, *[email protected]*) or the user ID of the user you want to check: `Get-AzureADUser -ObjectId <user ID> | Select-Object @{N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}}`
+   * To see the **Password never expires** setting for all users, run the following cmdlet: `Get-AzureADUser -All $true | Select-Object UserPrincipalName, @{N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}}`
 
 ### Set a password to expire
 
 1. Connect to Windows PowerShell by using your company administrator credentials.
 2. Execute one of the following commands:
 
-   * To set the password of one user so that the password expires, run the following cmdlet by using the UPN or the user ID of the user: `Set-MsolUser -UserPrincipalName <user ID> -PasswordNeverExpires $false`
-   * To set the passwords of all users in the organization so that they expire, use the following cmdlet: `Get-MSOLUser | Set-MsolUser -PasswordNeverExpires $false`
+   * To set the password of one user so that the password expires, run the following cmdlet by using the UPN or the user ID of the user: `Set-AzureADUser -ObjectId <user ID> -PasswordPolicies None`
+   * To set the passwords of all users in the organization so that they expire, use the following cmdlet: `Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies None`
 
 ### Set a password to never expire
 
 1. Connect to Windows PowerShell by using your company administrator credentials.
 2. Execute one of the following commands:
 
-   * To set the password of one user to never expire, run the following cmdlet by using the UPN or the user ID of the user: `Set-MsolUser -UserPrincipalName <user ID> -PasswordNeverExpires $true`
-   * To set the passwords of all the users in an organization to never expire, run the following cmdlet: `Get-MSOLUser | Set-MsolUser -PasswordNeverExpires $true`
+   * To set the password of one user to never expire, run the following cmdlet by using the UPN or the user ID of the user: `Set-AzureADUser -ObjectId <user ID> -PasswordPolicies DisablePasswordExpiration`
+   * To set the passwords of all the users in an organization to never expire, run the following cmdlet: `Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies DisablePasswordExpiration`
 
    > [!WARNING]
-   > Passwords set to `-PasswordNeverExpires $true` still age based on the `pwdLastSet` attribute. If you set the user passwords to never expire and then 90+ days go by, the passwords expire. Based on the `pwdLastSet` attribute, if you change the expiration to `-PasswordNeverExpires $false`, all passwords that have a `pwdLastSet` older than 90 days require the user to change them the next time they sign in. This change can affect a large number of users. 
+   > Passwords set to `-PasswordPolicies DisablePasswordExpiration` still age based on the `pwdLastSet` attribute. If you set the user passwords to never expire and then 90+ days go by, the passwords expire. Based on the `pwdLastSet` attribute, if you change the expiration to `-PasswordPolicies None`, all passwords that have a `pwdLastSet` older than 90 days require the user to change them the next time they sign in. This change can affect a large number of users. 
 
 ## Next steps
 

articles/active-directory/authentication/concept-sspr-writeback.md

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.component: authentication
 ms.topic: conceptual
-ms.date: 07/11/2018
+ms.date: 10/04/2018
 
 ms.author: joflore
 author: MicrosoftGuyJFlo
@@ -16,14 +16,20 @@ ms.reviewer: sahenry
 ---
 # What is password writeback?
 
-Having a cloud based password reset utility is great but most companies still have an on-premises directory where their users exist. How does Microsoft support keeping traditional on-premises Active Directory (AD) in sync with password changes in the cloud? Password writeback is a feature enabled with [Azure AD Connect](../hybrid/whatis-hybrid-identity.md) that allows password changes in the cloud to be written back to an existing on-premises directory in real-time.
+Having a cloud-based password reset utility is great but most companies still have an on-premises directory where their users exist. How does Microsoft support keeping traditional on-premises Active Directory (AD) in sync with password changes in the cloud? Password writeback is a feature enabled with [Azure AD Connect](../hybrid/whatis-hybrid-identity.md) that allows password changes in the cloud to be written back to an existing on-premises directory in real time.
 
 Password writeback is supported in environments that use:
 
 * [Active Directory Federation Services](../hybrid/how-to-connect-fed-management.md)
 * [Password hash synchronization](../hybrid/how-to-connect-password-hash-synchronization.md)
 * [Pass-through authentication](../hybrid/how-to-connect-pta.md)
 
+> [!WARNING]
+> Password writeback will stop working for customers who are using Azure AD Connect versions 1.0.8641.0 and older when the [Azure Access Control service (ACS) is retired on November 7th, 2018](../develop/active-directory-acs-migration.md). Azure AD Connect versions 1.0.8641.0 and older will no longer allow password writeback at that time because they depend on ACS for that functionality.
+>
+> To avoid a disruption in service, upgrade from a previous version of Azure AD Connect to a newer version, see the article [Azure AD Connect: Upgrade from a previous version to the latest](../hybrid/how-to-upgrade-previous-version.md)
+>
+
 Password writeback provides:
 
 * **Enforcement of on-premises Active Directory password policies**: When a user resets their password, it is checked to ensure it meets your on-premises Active Directory policy before committing it to that directory. This review includes checking the history, complexity, age, password filters, and any other password restrictions that you have defined in local Active Directory.

articles/active-directory/authentication/howto-authentication-phone-sign-in.md

@@ -34,7 +34,7 @@ For public preview, an admin must first add a policy via powershell to allow use
 
 ### Steps to enable
 
-1. Install the [public preview release of the Azure Active Directory V2 PowerShell Module](https://www.powershellgallery.com/packages/AzureADPreview/2.0.0.114).  
+1. Install the [public preview release of the Azure Active Directory V2 PowerShell Module](https://www.powershellgallery.com/packages/AzureADPreview/).  
 2. In PowerShell, run two commands:
    1. `Connect-AzureAD`
       1. In the authentication dialog, sign in with an account in the tenant. The account must either be a Security Administrator or Global Administrator.
@@ -72,4 +72,4 @@ One of the prerequisites to create this new, strong credential, is that the devi
 
 [Learn about device registration](../devices/overview.md#getting-devices-under-the-control-of-azure-ad)
 
-[Learn about Azure Multi-Factor Authentication](../authentication/howto-mfa-getstarted.md)
+[Learn about Azure Multi-Factor Authentication](../authentication/howto-mfa-getstarted.md)

articles/active-directory/authentication/howto-mfa-getstarted.md

@@ -27,9 +27,9 @@ Before you start, make sure you have the following prerequisites:
 
 **Enabled by conditional access policy** - This method is discussed in this article. It is the most flexible means to enable two-step verification for your users. Enabling using conditional access policy only works for Azure MFA in the cloud and is a premium feature of Azure AD.
 
-Enabled by Azure AD Identity Protection - This method uses the Azure AD Identity Protection risk policy to require two-step verification based only on sign-in risk for all cloud applications. This method requires Azure Active Directory P2 licensing. More information on this method can be found in [How to configure the user risk policy](../identity-protection/howto-user-risk-policy.md).
+**Enabled by Azure AD Identity Protection** - This method uses the Azure AD Identity Protection risk policy to require two-step verification based only on sign-in risk for all cloud applications. This method requires Azure Active Directory P2 licensing. More information on this method can be found in [How to configure the user risk policy](../identity-protection/howto-user-risk-policy.md).
 
-Enabled by changing user state - This is the traditional method for requiring two-step verification. It works with both Azure MFA in the cloud and Azure MFA Server. Using this method requires users to perform two-step verification **every time** they sign in and overrides conditional access policies. More information on this method can be found in [How to require two-step verification for a user](howto-mfa-userstates.md).
+**Enabled by changing user state** - This is the traditional method for requiring two-step verification. It works with both Azure MFA in the cloud and Azure MFA Server. Using this method requires users to perform two-step verification **every time** they sign in and overrides conditional access policies. More information on this method can be found in [How to require two-step verification for a user](howto-mfa-userstates.md).
 
 > [!Note]
 > More information about licenses and pricing can be found on the [Azure AD](https://azure.microsoft.com/pricing/details/active-directory/