You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/governance/trigger-custom-task.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,11 +36,11 @@ To use a custom task extension in your workflow, first a custom task extension m
36
36
37
37
1. In the left menu, select **Workflows (Preview)**.
38
38
39
-
1. On the workflows screen, select **custom task extension**.
39
+
1. On the workflows screen, select **Custom task extension**.
40
40
:::image type="content" source="media/trigger-custom-task/custom-task-extension-select.png" alt-text="Screenshot of selecting a custom task extension from a workflow overview page.":::
41
-
1. On the custom task extensions page, select **create custom task extension**.
41
+
1. On the custom task extensions page, select **Create custom task extension**.
42
42
:::image type="content" source="media/trigger-custom-task/create-custom-task-extension.png" alt-text="Screenshot for creating a custom task extension selection.":::
43
-
1. On the basics page you, give a display name and description for the custom task extension and select **Next**.
43
+
1. On the basics page you, enter a unique display name and description for the custom task extension and select **Next**.
44
44
:::image type="content" source="media/trigger-custom-task/custom-task-extension-basics.png" alt-text="Screenshot of the basics section for creating a custom task extension.":::
45
45
1. On the **Task behavior** page, you specify how the custom task extension will behave after executing the Azure Logic App and select **Next**.
46
46
:::image type="content" source="media/trigger-custom-task/custom-task-extension-behavior.png" alt-text="Screenshot for choose task behavior for custom task extension.":::
Copy file name to clipboardExpand all lines: articles/active-directory/identity-protection/overview-identity-protection.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -96,8 +96,7 @@ Conditional Access administrators can create policies that factor in user or sig
96
96
97
97
| Capability | Details | Azure AD Free / Microsoft 365 Apps | Azure AD Premium P1 | Azure AD Premium P2 |
98
98
| --- | --- | --- | --- | --- |
99
-
| Risk policies | User risk policy (via Identity Protection) | No | No | Yes |
100
-
| Risk policies | Sign-in risk policy (via Identity Protection or Conditional Access) | No | No | Yes |
99
+
| Risk policies | Sign-in and user risk policies (via Identity Protection or Conditional Access) | No | No | Yes |
101
100
| Security reports | Overview | No | No | Yes |
102
101
| Security reports | Risky users | Limited Information. Only users with medium and high risk are shown. No details drawer or risk history. | Limited Information. Only users with medium and high risk are shown. No details drawer or risk history. | Full access|
103
102
| Security reports | Risky sign-ins | Limited Information. No risk detail or risk level is shown. | Limited Information. No risk detail or risk level is shown. | Full access |
Copy file name to clipboardExpand all lines: articles/active-directory/manage-apps/protect-against-consent-phishing.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -62,9 +62,9 @@ Administrators should be in control of application use by providing the right in
62
62
- Block [consent phishing emails with Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/set-up-anti-phishing-policies#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365) by protecting against phishing campaigns where an attacker is impersonating a known user in the organization.
63
63
- Configure Microsoft Defender for Cloud Apps policies to help manage abnormal application activity in the organization. For example, [activity policies](/cloud-app-security/user-activity-policies), [anomaly detection](/cloud-app-security/anomaly-detection-policy), and [OAuth app policies](/cloud-app-security/app-permission-policy).
64
64
- Investigate and hunt for consent phishing attacks by following the guidance on [advanced hunting with Microsoft 365 Defender](/microsoft-365/security/defender/advanced-hunting-overview).
65
-
- Allow access to trusted applications and protect against those applications that aren't:
66
-
-Use applications that have been publisher verified. [Publisher verification](../develop/publisher-verification-overview.md) helps administrators and users understand the authenticity of application developers through a Microsoft supported vetting process.
67
-
-[Configure user consent settings](./configure-user-consent.md?tabs=azure-portal) to allow users to only consent to specific trusted applications, such as applications developed by the organization or from verified publishers and only for low risk permissions you select.
65
+
- Allow access to trusted applications that meet certain criteria and that protect against those applications that don't:
66
+
-[Configure user consent settings](./configure-user-consent.md?tabs=azure-portal) to allow users to only consent to applications that meet certain criteria, such as applications developed by your organization or from verified publishers and only for low risk permissions you select.
67
+
-Use applications that have been publisher verified. [Publisher verification](../develop/publisher-verification-overview.md) helps administrators and users understand the authenticity of application developers through a Microsoft supported vetting process. Even if an application does have a verified publisher, it is still important to review the consent prompt to understand and evaluate the request. For example, reviewing the permissions being requested to ensure they align with the scenario the app is requesting them to enable, additional app and publisher details on the consent prompt, etc.
68
68
- Create proactive [application governance](/microsoft-365/compliance/app-governance-manage-app-governance) policies to monitor third-party application behavior on the Microsoft 365 platform to address common suspicious application behaviors.
Copy file name to clipboardExpand all lines: articles/active-directory/privileged-identity-management/pim-create-azure-ad-roles-and-resource-roles-review.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.service: active-directory
10
10
ms.workload: identity
11
11
ms.topic: how-to
12
12
ms.subservice: pim
13
-
ms.date: 10/20/2022
13
+
ms.date: 1/9/2023
14
14
ms.author: amsliu
15
15
ms.custom: pim
16
16
ms.collection: M365-identity-device-management
@@ -26,7 +26,7 @@ The need for access to privileged Azure resource and Azure AD roles by employees
26
26
27
27
To create access reviews for Azure resources, you must be assigned to the [Owner](../../role-based-access-control/built-in-roles.md#owner) or the [User Access Administrator](../../role-based-access-control/built-in-roles.md#user-access-administrator) role for the Azure resources. To create access reviews for Azure AD roles, you must be assigned to the [Global Administrator](../roles/permissions-reference.md#global-administrator) or the [Privileged Role Administrator](../roles/permissions-reference.md#privileged-role-administrator) role.
28
28
29
-
Access Reviews for **Service Principals** requires an Entra Workload Identities Premium plan.
29
+
Access Reviews for **Service Principals** requires an Entra Workload Identities Premium plan in addition to Azure AD Premium P2 license.
30
30
31
31
- Workload Identities Premium licensing: You can view and acquire licenses on the [Workload Identities blade](https://portal.azure.com/#view/Microsoft_Azure_ManagedServiceIdentity/WorkloadIdentitiesBlade) in the Azure portal.
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/zenya-tutorial.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: saas-app-tutorial
10
10
ms.workload: identity
11
11
ms.topic: tutorial
12
-
ms.date: 11/21/2022
12
+
ms.date: 01/09/2023
13
13
ms.author: jeedes
14
14
---
15
15
@@ -93,6 +93,8 @@ Follow these steps to enable Azure AD SSO in the Azure portal.
93
93
b. Fill the **Identifier** box with the value that's displayed behind the label **EntityID** on the **Zenya SAML2 info** page. This page is still open in your other browser tab.
94
94
95
95
c. Fill the **Reply-URL** box with the value that's displayed behind the label **Reply URL** on the **Zenya SAML2 info** page. This page is still open in your other browser tab.
96
+
97
+
d. Fill the **Logout-URL** box with the value that's displayed behind the label **Logout URL** on the **Zenya SAML2 info** page. This page is still open in your other browser tab.
96
98
97
99
1. Zenya application expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration. The following screenshot shows the list of default attributes.
Copy file name to clipboardExpand all lines: articles/aks/http-proxy.md
+26-19Lines changed: 26 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Use the HTTP proxy configuration feature for Azure Kubernetes Servi
4
4
services: container-service
5
5
author: nickomang
6
6
ms.topic: article
7
-
ms.date: 05/23/2022
7
+
ms.date: 01/09/2023
8
8
ms.author: nickoman
9
9
---
10
10
@@ -19,21 +19,22 @@ Some more complex solutions may require creating a chain of trust to establish s
19
19
## Limitations and other details
20
20
21
21
The following scenarios are **not** supported:
22
+
22
23
- Different proxy configurations per node pool
23
24
- Updating proxy settings post cluster creation
24
25
- User/Password authentication
25
26
- Custom CAs for API server communication
26
27
- Windows-based clusters
27
28
- Node pools using Virtual Machine Availability Sets (VMAS)
29
+
- Using * as wildcard attached to a domain suffix for noProxy
28
30
29
31
By default, *httpProxy*, *httpsProxy*, and *trustedCa* have no value.
30
32
31
33
## Prerequisites
32
34
33
-
* An Azure subscription. If you don't have an Azure subscription, you can create a [free account](https://azure.microsoft.com/free).
34
-
* Latest version of [Azure CLI installed](/cli/azure/install-azure-cli).
35
+
The latest version of the Azure CLI. Run `az --version` to find the version, and run `az upgrade` to upgrade the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
35
36
36
-
## Configuring an HTTP proxy using Azure CLI
37
+
## Configuring an HTTP proxy using the Azure CLI
37
38
38
39
Using AKS with an HTTP proxy is done at cluster creation, using the [az aks create][az-aks-create] command and passing in configuration as a JSON file.
39
40
@@ -50,13 +51,18 @@ The schema for the config file looks like this:
50
51
}
51
52
```
52
53
53
-
`httpProxy`: A proxy URL to use for creating HTTP connections outside the cluster. The URL scheme must be `http`.
54
-
`httpsProxy`: A proxy URL to use for creating HTTPS connections outside the cluster. If this is not specified, then `httpProxy` is used for both HTTP and HTTPS connections.
55
-
`noProxy`: A list of destination domain names, domains, IP addresses or other network CIDRs to exclude proxying.
56
-
`trustedCa`: A string containing the `base64 encoded` alternative CA certificate content. For now we only support `PEM` format. Another thing to note is that, for compatibility with Go-based components that are part of the Kubernetes system, the certificate MUST support `Subject Alternative Names(SANs)` instead of the deprecated Common Name certs.
54
+
*`httpProxy`: A proxy URL to use for creating HTTP connections outside the cluster. The URL scheme must be `http`.
55
+
*`httpsProxy`: A proxy URL to use for creating HTTPS connections outside the cluster. If this isn't specified, then `httpProxy` is used for both HTTP and HTTPS connections.
56
+
*`noProxy`: A list of destination domain names, domains, IP addresses or other network CIDRs to exclude proxying.
57
+
*`trustedCa`: A string containing the `base64 encoded` alternative CA certificate content. Currently only the `PEM` format is supported.
58
+
59
+
> [!IMPORTANT]
60
+
> For compatibility with Go-based components that are part of the Kubernetes system, the certificate **must** support `Subject Alternative Names(SANs)` instead of the deprecated Common Name certs.
57
61
58
62
Example input:
59
-
Note the CA cert should be the base64 encoded string of the PEM format cert content.
63
+
64
+
> [!NOTE]
65
+
> The CA certificate should be the base64 encoded string of the PEM format cert content.
60
66
61
67
```json
62
68
{
@@ -70,7 +76,7 @@ Note the CA cert should be the base64 encoded string of the PEM format cert cont
70
76
}
71
77
```
72
78
73
-
Create a file and provide values for *httpProxy*, *httpsProxy*, and *noProxy*. If your environment requires it, also provide a *trustedCa* value. Next, deploy a cluster, passing in your filename via the `http-proxy-config` flag.
79
+
Create a file and provide values for *httpProxy*, *httpsProxy*, and *noProxy*. If your environment requires it, provide a value for *trustedCa*. Next, deploy a cluster, passing in your filename using the `http-proxy-config` flag.
74
80
75
81
```azurecli
76
82
az aks create -n $clusterName -g $resourceGroup --http-proxy-config aks-proxy-config.json
@@ -80,7 +86,7 @@ Your cluster will initialize with the HTTP proxy configured on the nodes.
80
86
81
87
## Configuring an HTTP proxy using Azure Resource Manager (ARM) templates
82
88
83
-
Deploying an AKS cluster with an HTTP proxy configured via ARM template is straightforward. The same schema used for CLI deployment exists in the `Microsoft.ContainerService/managedClusters` definition under properties:
89
+
Deploying an AKS cluster with an HTTP proxy configured using an ARM template is straightforward. The same schema used for CLI deployment exists in the `Microsoft.ContainerService/managedClusters` definition under properties:
84
90
85
91
```json
86
92
"properties": {
@@ -96,34 +102,34 @@ Deploying an AKS cluster with an HTTP proxy configured via ARM template is strai
96
102
}
97
103
```
98
104
99
-
In your template, provide values for *httpProxy*, *httpsProxy*, and *noProxy*. If necessary, also provide a value for `*trustedCa*. Deploy the template, and your cluster should initialize with your HTTP proxy configured on the nodes.
105
+
In your template, provide values for *httpProxy*, *httpsProxy*, and *noProxy*. If necessary, provide a value for *trustedCa*. Deploy the template, and your cluster should initialize with your HTTP proxy configured on the nodes.
100
106
101
107
## Handling CA rollover
102
108
103
-
Values for *httpProxy*, *httpsProxy*, and *noProxy*cannot be changed after cluster creation. However, to support rolling CA certs, the value for *trustedCa* can be changed and applied to the cluster with the [az aks update][az-aks-update] command.
109
+
Values for *httpProxy*, *httpsProxy*, and *noProxy*can't be changed after cluster creation. However, to support rolling CA certs, the value for *trustedCa* can be changed and applied to the cluster with the [az aks update][az-aks-update] command.
104
110
105
-
For example, assuming a new file has been created with the base64 encoded string of the new CA cert called *aks-proxy-config-2.json*, the following action will update the cluster:
111
+
For example, assuming a new file has been created with the base64 encoded string of the new CA cert called *aks-proxy-config-2.json*, the following action updates the cluster:
106
112
107
113
```azurecli
108
114
az aks update -n $clusterName -g $resourceGroup --http-proxy-config aks-proxy-config-2.json
109
115
```
110
116
111
117
## Monitoring add-on configuration
112
118
113
-
When using the HTTP proxy with the Monitoring add-on, the following configurations are supported:
119
+
The HTTP proxy with the Monitoring add-on supports the following configurations:
114
120
115
121
- Outbound proxy without authentication
116
122
- Outbound proxy with username & password authentication
117
123
- Outbound proxy with trusted cert for Log Analytics endpoint
118
124
119
-
The following configurations are not supported:
125
+
The following configurations aren't supported:
120
126
121
-
- The Custom Metrics and Recommended Alerts features are not supported when using proxy with trusted cert
122
-
- Outbound proxy is not supported with Azure Monitor Private Link Scope (AMPLS)
127
+
- The Custom Metrics and Recommended Alerts features aren't supported when you use a proxy with trusted certificates
128
+
- Outbound proxy isn't supported with Azure Monitor Private Link Scope (AMPLS)
123
129
124
130
## Next steps
125
-
- For more on the network requirements of AKS clusters, see [control egress traffic for cluster nodes in AKS][aks-egress].
126
131
132
+
For more information regarding the network requirements of AKS clusters, see [control egress traffic for cluster nodes in AKS][aks-egress].
127
133
128
134
<!-- LINKS - internal -->
129
135
[aks-egress]: ./limit-egress-traffic.md
@@ -134,3 +140,4 @@ The following configurations are not supported:
0 commit comments