Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)

Author: Learn Build Service GitHub App

articles/active-directory/authentication/fido2-compatibility.md

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: authentication
 ms.topic: conceptual
-ms.date: 06/29/2023
+ms.date: 07/26/2023
 
 author: justinha
 ms.author: justinha
@@ -21,32 +21,84 @@ Azure Active Directory allows [FIDO2 security keys](./concept-authentication-pas
 
 ## Supported browsers
 
-This table shows support for authenticating Azure Active Directory (Azure AD) and Microsoft Accounts (MSA). Microsoft accounts are created by consumers for services such as Xbox, Skype, or Outlook.com. Supported device types include **USB**, near-field communication (**NFC**), and bluetooth low energy (**BLE**).
+This table shows support for authenticating Azure Active Directory (Azure AD) and Microsoft Accounts (MSA). Microsoft accounts are created by consumers for services such as Xbox, Skype, or Outlook.com. 
 
-| OS | Chrome | Chrome  | Chrome | Edge | Edge | Edge | Firefox | Firefox | Firefox | Safari | Safari | Safari
-|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
-| | USB | NFC | BLE | USB | NFC | BLE | USB | NFC | BLE | USB | NFC | BLE |
-| **Windows**  | ![Chrome supports USB on Windows for Azure AD accounts.][y] | ![Chrome supports NFC on Windows for Azure AD accounts.][y] | ![Chrome supports BLE on Windows for Azure AD accounts.][y] | ![Edge supports USB on Windows for Azure AD accounts.][y] | ![Edge supports NFC on Windows for Azure AD accounts.][y] | ![Edge supports BLE on Windows for Azure AD accounts.][y] | ![Firefox supports USB on Windows for Azure AD accounts.][y] | ![Firefox supports NFC on Windows for Azure AD accounts.][y] | ![Firefox supports BLE on Windows for Azure AD accounts.][y] |  ![Safari supports USB on Windows for Azure AD accounts.][n] | ![Safari supports NFC on Windows for Azure AD accounts.][n] | ![Safari supports BLE on Windows for Azure AD accounts.][n] |
-| **macOS**  | ![Chrome supports USB on macOS for Azure AD accounts.][y] | ![Chrome supports NFC on macOS for Azure AD accounts.][n] | ![Chrome supports BLE on macOS for Azure AD accounts.][n] | ![Edge supports USB on macOS for Azure AD accounts.][y] | ![Edge supports NFC on macOS for Azure AD accounts.][n] | ![Edge supports BLE on macOS for Azure AD accounts.][n] | ![Firefox supports USB on macOS for Azure AD accounts.][n] | ![Firefox supports NFC on macOS for Azure AD accounts.][n] | ![Firefox supports BLE on macOS for Azure AD accounts.][n] | ![Safari supports USB on macOS for Azure AD accounts.][y] | ![Safari supports NFC on macOS for Azure AD accounts.][n] | ![Safari supports BLE on macOS for Azure AD accounts.][n] |
-| **ChromeOS**  | ![Chrome supports USB on ChromeOS for Azure AD accounts.][y] | ![Chrome supports NFC on ChromeOS for Azure AD accounts.][n] | ![Chrome supports BLE on ChromeOS for Azure AD accounts.][n] | ![Edge supports USB on ChromeOS for Azure AD accounts.][n] | ![Edge supports NFC on ChromeOS for Azure AD accounts.][n] | ![Edge supports BLE on ChromeOS for Azure AD accounts.][n] | ![Firefox supports USB on ChromeOS for Azure AD accounts.][n] | ![Firefox supports NFC on ChromeOS for Azure AD accounts.][n] | ![Firefox supports BLE on ChromeOS for Azure AD accounts.][n] | ![Safari supports USB on ChromeOS for Azure AD accounts.][n] | ![Safari supports NFC on ChromeOS for Azure AD accounts.][n] | ![Safari supports BLE on ChromeOS for Azure AD accounts.][n] |
-| **Linux**  | ![Chrome supports USB on Linux for Azure AD accounts.][y] | ![Chrome supports NFC on Linux for Azure AD accounts.][n] | ![Chrome supports BLE on Linux for Azure AD accounts.][n] | ![Edge supports USB on Linux for Azure AD accounts.][n] | ![Edge supports NFC on Linux for Azure AD accounts.][n] | ![Edge supports BLE on Linux for Azure AD accounts.][n] | ![Firefox supports USB on Linux for Azure AD accounts.][n] | ![Firefox supports NFC on Linux for Azure AD accounts.][n] | ![Firefox supports BLE on Linux for Azure AD accounts.][n] | ![Safari supports USB on Linux for Azure AD accounts.][n] | ![Safari supports NFC on Linux for Azure AD accounts.][n] | ![Safari supports BLE on Linux for Azure AD accounts.][n] |
-| **iOS**  | ![Chrome supports USB on iOS for Azure AD accounts.][y] | ![Chrome supports NFC on iOS for Azure AD accounts.][y] | ![Chrome supports BLE on iOS for Azure AD accounts.][n] | ![Edge supports USB on iOS for Azure AD accounts.][y] | ![Edge supports NFC on iOS for Azure AD accounts.][y] | ![Edge supports BLE on iOS for Azure AD accounts.][n] | ![Firefox supports USB on Linux for Azure AD accounts.][n] | ![Firefox supports NFC on iOS for Azure AD accounts.][n] | ![Firefox supports BLE on iOS for Azure AD accounts.][n] | ![Safari supports USB on iOS for Azure AD accounts.][y] | ![Safari supports NFC on iOS for Azure AD accounts.][y] | ![Safari supports BLE on iOS for Azure AD accounts.][n] |
-| **Android**  | ![Chrome supports USB on Android for Azure AD accounts.][n] | ![Chrome supports NFC on Android for Azure AD accounts.][n] | ![Chrome supports BLE on Android for Azure AD accounts.][n] | ![Edge supports USB on Android for Azure AD accounts.][n] | ![Edge supports NFC on Android for Azure AD accounts.][n] | ![Edge supports BLE on Android for Azure AD accounts.][n] | ![Firefox supports USB on Android for Azure AD accounts.][n] | ![Firefox supports NFC on Android for Azure AD accounts.][n] | ![Firefox supports BLE on Android for Azure AD accounts.][n] | ![Safari supports USB on Android for Azure AD accounts.][n] | ![Safari supports NFC on Android for Azure AD accounts.][n] | ![Safari supports BLE on Android for Azure AD accounts.][n] |
-
-- Key registration is currently not supported with ChromeOS/Chrome Browser.
-- For iOS and macOS on Safari browser, PIN requests fail if the PIN isn't already set on the security key.
-- Security key PIN for user verification isn't currently supported with Android.
+| OS  | Chrome | Edge | Firefox | Safari |
+|:---:|:------:|:----:|:-------:|:------:|
+| **Windows**  | ✅ | ✅ | ✅ | N/A |
+| **macOS**  | ✅ | ✅ | ✅ | ✅ |
+| **ChromeOS**  | ✅ | N/A | N/A | N/A |
+| **Linux**  | ✅ | ❌ | ❌ | N/A |
+| **iOS**  | ✅ | ✅ | ✅ | ✅ |
+| **Android**  | ❌ | ❌ | ❌ | N/A |
 
 >[!NOTE]
->This is the view for web support. Authentication for native apps in iOS and Android are not available yet.
+>This is the view for web support. Authentication for native apps in iOS and Android isn't available yet.
 
-## Unsupported browsers
+## Browser support for each platform
 
-The following operating system and browser combinations aren't supported, but future support and testing is being investigated. If you would like to see other operating system and browser support, please leave feedback on our [product feedback site](https://feedback.azure.com/d365community/).
+The following tables show which transports are supported for each platform. Supported device types include **USB**, near-field communication (**NFC**), and bluetooth low energy (**BLE**).
 
-| Operating system | Browser |
-| ---- | ---- |
-| Android | Chrome |
+### Windows
+
+| Browser | USB  | NFC | BLE |
+|---------|------|-----|-----|
+| Edge    | ✅ | ✅ | ✅ |
+| Chrome   | ✅ | ✅ | ✅ |
+| Firefox   | ✅ | ✅ | ✅ |
+
+### macOS
+
+| Browser | USB  | NFC<sup>1</sup> | BLE<sup>1</sup> |
+|---------|------|-----|-----|
+| Edge    | &#x2705; | N/A | N/A |
+| Chrome   | &#x2705; | N/A | N/A |
+| Firefox<sup>2</sup>   | &#x2705; | N/A | N/A |
+| Safari<sup>2</sup>   | &#x2705; | N/A | N/A |
+
+<sup>1</sup>NFC and BLE security keys aren't supported on macOS by Apple.
+
+<sup>2</sup>New security key registration doesn't work on these macOS browsers because they don't prompt to set up biometrics or PIN.
+
+### ChromeOS
+
+| Browser<sup>1</sup> | USB  | NFC | BLE |
+|---------|------|-----|-----|
+| Chrome  | &#x2705; | &#10060; | &#10060; |
+
+<sup>1</sup>Security key registration isn't supported on ChromeOS or Chrome browser.
+
+### Linux
+
+| Browser | USB  | NFC | BLE |
+|---------|------|-----|-----|
+| Edge    | &#10060; | &#10060; | &#10060; |
+| Chrome  | &#x2705; | &#10060; | &#10060; |
+| Firefox | &#10060; | &#10060; | &#10060; |
+
+
+### iOS
+
+| Browser<sup>1</sup> | Lightning  | NFC | BLE<sup>2</sup> |
+|---------|------------|-----|-----|
+| Edge    |  &#x2705;  | &#x2705; | N/A | 
+| Chrome  |  &#x2705;  | &#x2705; | N/A |
+| Firefox |  &#x2705;  | &#x2705; | N/A |
+| Safari  |  &#x2705;  | &#x2705; | N/A |
+
+<sup>1</sup>New security key registration doesn't work on iOS browsers because they don't prompt to set up biometrics or PIN.
+
+<sup>2</sup>BLE security keys aren't supported on iOS by Apple.
+
+### Android
+
+| Browser<sup>1</sup> | USB  | NFC | BLE |
+|---------|------|-----|-----|
+| Edge    | &#10060;  | &#10060; | &#10060; |
+| Chrome  | &#10060;  | &#10060; | &#10060; |
+| Firefox | &#10060;  | &#10060; | &#10060; |
+
+<sup>1</sup>Security key biometrics or PIN for user verficiation isn't currently supported on Android by Google. Azure AD requires user verification for all FIDO2 authentications.
 
 ## Minimum browser version
 
@@ -58,7 +110,7 @@ The following are the minimum browser version requirements.
 | Edge | Windows 10 version 1903<sup>1</sup> |
 | Firefox | 66 |
 
-<sup>1</sup>All versions of the new Chromium-based Microsoft Edge support Fido2. Support on Microsoft Edge legacy was added in 1903.
+<sup>1</sup>All versions of the new Chromium-based Microsoft Edge support FIDO2. Support on Microsoft Edge legacy was added in 1903.
 
 ## Next steps
 [Enable passwordless security key sign-in](./howto-authentication-passwordless-security-key.md)

articles/active-directory/conditional-access/TOC.yml

@@ -68,6 +68,8 @@
     items: 
     - name: Require MFA for administrators
       href: howto-conditional-access-policy-admin-mfa.md
+    - name: Require phishing-resistant MFA for administrators
+      href: how-to-policy-phish-resistant-admin-mfa.md
     - name: Secure security info registration
       href: howto-conditional-access-policy-registration.md
     - name: Block legacy authentication
@@ -76,6 +78,8 @@
       href: howto-policy-guest-mfa.md
     - name: Require MFA for all users
       href: howto-conditional-access-policy-all-users-mfa.md
+    - name: Require MFA for Microsoft admin portals
+      href: how-to-policy-mfa-admin-portals.md
     - name: Require MFA for Azure management
       href: howto-conditional-access-policy-azure-management.md
     - name: Require MFA for risky sign-in