You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -115,7 +115,7 @@ Scoping filters are configured as part of the attribute mappings for each Azure
115
115
116
116
f. **IS NOT NULL**. Clause returns "true" if the evaluated attribute isn't empty.
117
117
118
-
g. **REGEX MATCH**. Clause returns "true" if the evaluated attribute matches a regular expression pattern. For example: ([1-9][0-9]) matches any number between 10 and 99 (case sensitive).
118
+
g. **REGEX MATCH**. Clause returns "true" if the evaluated attribute matches a regular expression pattern. For example: `([1-9][0-9])` matches any number between 10 and 99 (case sensitive).
119
119
120
120
h. **NOT REGEX MATCH**. Clause returns "true" if the evaluated attribute doesn't match a regular expression pattern. It will return "false" if the attribute is null / empty.
121
121
@@ -145,14 +145,13 @@ Scoping filters are configured as part of the attribute mappings for each Azure
145
145
>[!IMPORTANT]
146
146
> Saving a new scoping filter triggers a new full sync for the application, where all users in the source system are evaluated again against the new scoping filter. If a user in the application was previously in scope for provisioning, but falls out of scope, their account is disabled or deprovisioned in the application. To override this default behavior, refer to [Skip deletion for user accounts that go out of scope](../app-provisioning/skip-out-of-scope-deletions.md).
147
147
148
-
149
148
## Common scoping filters
150
149
| Target Attribute| Operator | Value | Description|
151
150
|----|----|----|----|
152
-
|userPrincipalName|REGEX MATCH|.\*@domain.com|All users with userPrincipal that has the domain @domain.com will be in scope for provisioning|
153
-
|userPrincipalName|NOT REGEX MATCH|.\*@domain.com|All users with userPrincipal that has the domain @domain.com will be out of scope for provisioning|
154
-
|department|EQUALS|sales|All users from the sales department are in scope for provisioning|
155
-
|workerID|REGEX MATCH|(1[0-9][0-9][0-9][0-9][0-9][0-9])| All employees with workerIDs between 1000000 and 2000000 are in scope for provisioning.|
151
+
|userPrincipalName|REGEX MATCH|`.\*@domain.com`|All users with userPrincipal that has the domain @domain.com will be in scope for provisioning|
152
+
|userPrincipalName|NOT REGEX MATCH|`.\*@domain.com`|All users with userPrincipal that has the domain @domain.com will be out of scope for provisioning|
153
+
|department|EQUALS|`sales`|All users from the sales department are in scope for provisioning|
154
+
|workerID|REGEX MATCH|`(1[0-9][0-9][0-9][0-9][0-9][0-9])`| All employees with workerIDs between 1000000 and 2000000 are in scope for provisioning.|
156
155
157
156
## Related articles
158
157
*[Automate user provisioning and deprovisioning to SaaS applications](../app-provisioning/user-provisioning.md)
Copy file name to clipboardExpand all lines: articles/active-directory/fundamentals/whats-new.md
+174Lines changed: 174 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,6 +32,180 @@ Azure AD receives improvements on an ongoing basis. To stay up to date with the
32
32
This page updates monthly, so revisit it regularly. If you're looking for items older than six months, you can find them in [Archive for What's new in Azure Active Directory](whats-new-archive.md).
33
33
34
34
35
+
## April 2023
36
+
37
+
### Public Preview - Custom attributes for Azure Active Directory Domain Services
38
+
39
+
**Type:** New feature
40
+
**Service category:** Azure Active Directory Domain Services
41
+
**Product capability:** Azure Active Directory Domain Services
42
+
43
+
Azure Active Directory Domain Services will now support synchronizing custom attributes from Azure AD for on-premises accounts. For more information, see: [Custom attributes for Azure Active Directory Domain Services](/azure/active-directory-domain-services/concepts-custom-attributes).
44
+
45
+
---
46
+
47
+
### General Availability - Enablement of combined security information registration for MFA and self-service password reset (SSPR)
Last year we announced the combined registration user experience for MFA and self-service password reset (SSPR) was rolling out as the default experience for all organizations. We're happy to announce that the combined security information registration experience is now fully rolled out. This change doesn't affect tenants located in the China region. For more information, see: [Combined security information registration for Azure Active Directory overview](../authentication/concept-registration-mfa-sspr-combined.md).
54
+
55
+
---
56
+
57
+
### General Availability - PIM alert: Alert on active-permanent role assignments in Azure or assignments made outside of PIM
[Alert on Azure subscription role assignments made outside of Privileged Identity Management (PIM)](../privileged-identity-management/pim-resource-roles-configure-alerts.md) provides an alert in PIM for Azure subscription assignments made outside of PIM. An owner or User Access Administrator can take a quick remediation action to remove those assignments.
64
+
65
+
---
66
+
67
+
### Public Preview - Enhanced Create User and Invite User Experiences
68
+
69
+
**Type:** Changed feature
70
+
**Service category:** User Management
71
+
**Product capability:** User Management
72
+
73
+
Admins can now define more properties when creating and inviting a user in the Entra admin portal. These improvements bring our UX to parity with our [Create User APIS](/graph/api/user-post-users). Additionally, admins can now add users to a group or administrative unit, as well as assign roles. For more information, see: [Add or delete users using Azure Active Directory](../fundamentals/add-users-azure-active-directory.md).
74
+
75
+
---
76
+
77
+
### Public Preview - Azure AD Conditional Access protected actions
78
+
79
+
**Type:** Changed feature
80
+
**Service category:** RBAC
81
+
**Product capability:** Access Control
82
+
83
+
The protected actions public preview introduces the ability to apply Conditional Access to select permissions. When a user performs a protected action, they must satisfy Conditional Access policy requirements. For more information, see: [What are protected actions in Azure AD? (preview)](../roles/protected-actions-overview.md).
84
+
85
+
---
86
+
87
+
### Public Preview - Token Protection for Sign-in Sessions
88
+
89
+
**Type:** New feature
90
+
**Service category:** Conditional Access
91
+
**Product capability:** User Authentication
92
+
93
+
Token Protection for sign-in sessions is our first release on a road-map to combat attacks involving token theft and replay. It provides conditional access enforcement of token proof-of-possession for supported clients and services that ensures that access to specified resources is only from a device to which the user has signed in. For more information, see: [Conditional Access: Token protection (preview)](../conditional-access/concept-token-protection.md).
94
+
95
+
---
96
+
97
+
### General Availability- New limits on number and size of group secrets starting June 2023
98
+
99
+
**Type:** Plan for change
100
+
**Service category:** Group Management
101
+
**Product capability:** Directory
102
+
103
+
Starting in June 2023, the secrets stored on a single group can't exceed 48 individual secrets, or have a total size greater than 10KB across all secrets on a single group. Groups with more than 10KB of secrets will immediately stop working in June 2023. In June, groups exceeding 48 secrets are unable to increase the number of secrets they have, though they may still update or delete those secrets. We highly recommend reducing to fewer than 48 secrets by January 2024.
104
+
105
+
Group secrets are typically created when a group is assigned credentials to an app using Password-based single sign-on. To reduce the number of secrets assigned to a group, we recommend creating additional groups, and splitting up group assignments to your Password-based SSO applications across those new groups. For more information, see: [Add password-based single sign-on to an application](../manage-apps/configure-password-single-sign-on-non-gallery-applications.md).
106
+
107
+
---
108
+
109
+
### Public Preview - Authenticator Lite in Outlook
110
+
111
+
**Type:** New feature
112
+
**Service category:** Microsoft Authenticator App
113
+
**Product capability:** User Authentication
114
+
115
+
Authenticator Lite is an additional surface for AAD users to complete multifactor authentication using push notifications on their Android or iOS device. With Authenticator Lite, users can satisfy a multifactor authentication requirement from the convenience of a familiar app. Authenticator Lite is currently enabled in the Outlook mobile app. Users may receive a notification in their Outlook mobile app to approve or deny, or use the Outlook app to generate an OATH verification code that can be entered during sign-in. The *'Microsoft managed'* setting for this feature will be set to enabled on May 26th, 2023. This will enable the feature for all users in tenants where the feature is set to Microsoft managed. If you wish to change the state of this feature, please do so before May 26th, 2023. For more information, see: [How to enable Microsoft Authenticator Lite for Outlook mobile (preview)](../authentication/how-to-mfa-authenticator-lite.md).
116
+
117
+
---
118
+
119
+
### General Availability - Updated look and feel for Per-user MFA
As part of ongoing service improvements, we are making updates to the per-user MFA admin configuration experience to align with the look and feel of Azure. This change does not include any changes to the core functionality and will only include visual improvements. For more information, see: [Enable per-user Azure AD Multi-Factor Authentication to secure sign-in events](../authentication/howto-mfa-userstates.md).
126
+
127
+
---
128
+
129
+
### General Availability - Additional terms of use audit logs will be turned off
130
+
131
+
**Type:** Fixed
132
+
**Service category:** Terms of Use
133
+
**Product capability:** AuthZ/Access Delegation
134
+
135
+
Due to a technical issue, we have recently started to emit additional audit logs for terms of use. The additional audit logs will be turned off by the first of May and are tagged with the core directory service and the agreement category. If you have built a dependency on the additional audit logs, you must switch to the regular audit logs tagged with the terms of use service.
136
+
137
+
---
138
+
139
+
### General Availability - New Federated Apps available in Azure AD Application gallery - April 2023
140
+
141
+
142
+
143
+
**Type:** New feature
144
+
**Service category:** Enterprise Apps
145
+
**Product capability:** 3rd Party Integration
146
+
147
+
In April 2023 we've added the following 10 new applications in our App gallery with Federation support:
You can also find the documentation of all the applications from here https://aka.ms/AppsTutorial.
153
+
154
+
For listing your application in the Azure AD app gallery, read the details here https://aka.ms/AzureADAppRequest
155
+
156
+
---
157
+
158
+
### Public Preview - New provisioning connectors in the Azure AD Application Gallery - April 2023
159
+
160
+
**Type:** New feature
161
+
**Service category:** App Provisioning
162
+
**Product capability:** 3rd Party Integration
163
+
164
+
165
+
We've added the following new applications in our App gallery with Provisioning support. You can now automate creating, updating, and deleting of user accounts for these newly integrated apps:
For more information about how to better secure your organization by using automated user account provisioning, see: [Automate user provisioning to SaaS applications with Azure AD](../app-provisioning/user-provisioning.md).
178
+
179
+
180
+
---
181
+
182
+
### Public Preview - New PIM Azure resource picker
With this new experience, PIM now automatically manages any type of resource in a tenant, so discovery and activation is no longer required. With the new resource picker, users can directly choose the scope they want to manage from the Management Group down to the resources themselves, making it faster and easier to locate the resources they need to administer. For more information, see: [Assign Azure resource roles in Privileged Identity Management](../privileged-identity-management/pim-resource-roles-assign-roles.md).
189
+
190
+
---
191
+
192
+
### General availability - Self Service Password Reset (SSPR) now supports PIM eligible users and indirect group role assignment
Self Service Password Reset (SSPR) can now PIM eligible users, and evaluate group-based memberships, along with direct memberships when checking if a user is in a particular administrator role. This capability provides more accurate SSPR policy enforcement by validating if users are in scope for the default SSPR admin policy or your organizations SSPR user policy.
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/alvao-provisioning-tutorial.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,7 +40,7 @@ The scenario outlined in this tutorial assumes that you already have the followi
40
40
1. Determine what data to [map between Azure AD and ALVAO](../app-provisioning/customize-application-attributes.md).
41
41
42
42
## Step 2. Configure ALVAO to support provisioning with Azure AD
43
-
1. Find your **Tenant SCIM Endpoint URL**, which is in the form: {ALVAO REST API address}/scim, for example, https://app.contoso.com/alvaorestapi/scim.
43
+
1. Find your **Tenant SCIM Endpoint URL**, which should have the format `{ALVAO REST API address}/scim` (for example, https://app.contoso.com/alvaorestapi/scim).
44
44
1. Generate a new **Secret Token** in **WebApp - Administration - Settings - [Active Directory and Azure Active Directory](https://doc.alvao.com/en/11.1/list-of-windows/alvao-webapp/administration/settings/activedirectory)** and copy its value.
45
45
46
46
## Step 3. Add ALVAO from the Azure AD application gallery
0 commit comments