Merge pull request #206547 from MicrosoftDocs/repo_sync_working_branch

Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-docs (branch main)

Author: huypub

articles/active-directory/authentication/concept-authentication-methods.md

@@ -62,7 +62,7 @@ The following table outlines when an authentication method can be used during a
 
 | Method                         | Primary authentication | Secondary authentication  |
 |--------------------------------|:----------------------:|:-------------------------:|
-| Windows Hello for Business     | Yes                    | MFA                       |
+| Windows Hello for Business     | Yes                    | MFA\*                      |
 | Microsoft Authenticator app    | Yes                    | MFA and SSPR              |
 | FIDO2 security key             | Yes                    | MFA                       |
 | OATH hardware tokens (preview) | No                     | MFA and SSPR              |
@@ -71,6 +71,8 @@ The following table outlines when an authentication method can be used during a
 | Voice call                     | No                     | MFA and SSPR              |
 | Password                       | Yes                    |                           |
 
+> \* Windows Hello for Business, by itself, does not serve as a step-up MFA credential. For example, an MFA Challenge from Sign-in Frequency or SAML Request containing forceAuthn=true. Windows Hello for Business can serve as a step-up MFA credential by being used in FIDO2 authentication. This requires users to be enabled for FIDO2 authentication to work sucessfully.
+
 All of these authentication methods can be configured in the Azure portal, and increasingly using the [Microsoft Graph REST API](/graph/api/resources/authenticationmethods-overview).
 
 To learn more about how each authentication method works, see the following separate conceptual articles:

articles/active-directory/hybrid/concept-azure-ad-connect-sync-default-configuration.md

@@ -71,6 +71,7 @@ The following attribute rules apply:
 ### Contact out-of-box rules
 A contact object must satisfy the following to be synchronized:
 
+* Must have mail attribute value.
 * The contact must be mail-enabled. It is verified with the following rules:
   * `IsPresent([proxyAddresses]) = True)`. The proxyAddresses attribute must be populated.
   * A primary email address can be found in either the proxyAddresses attribute or the mail attribute. The presence of an \@ is used to verify that the content is an email address. One of these two rules must be evaluated to True.

articles/virtual-desktop/security-guide.md

@@ -148,8 +148,6 @@ By restricting operating system capabilities, you can strengthen the security of
 
 Trusted launch are Gen2 Azure VMs with enhanced security features aimed to protect against “bottom of the stack” threats through attack vectors such as rootkits, boot kits, and kernel-level malware. The following are the enhanced security features of trusted launch, all of which are supported in Azure Virtual Desktop. To learn more about trusted launch, visit [Trusted launch for Azure virtual machines](../virtual-machines/trusted-launch.md).
 
->[!NOTE]
->Bring your own custom image for Trusted Launch VM is not yet supported. When deploying an AVD Host Pool, you will be limited to the list of pre-canned OS images listed in the dropdown "Image" combo box. 
 
 ### Secure Boot
 

articles/virtual-machines/automatic-extension-upgrade.md

@@ -71,6 +71,7 @@ Automatic Extension Upgrade supports the following extensions (and more are adde
 - [Guest Configuration Extension](./extensions/guest-configuration.md) – Linux and Windows
 - Key Vault – [Linux](./extensions/key-vault-linux.md) and [Windows](./extensions/key-vault-windows.md)
 - [Azure Monitor Agent](../azure-monitor/agents/azure-monitor-agent-overview.md)
+- [DSC extension for Linux](extensions/dsc-linux.md)
 
 
 ## Enabling Automatic Extension Upgrade