You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -208,4 +207,4 @@ If the sign-in process is successful, your browser is redirected to `https://jwt
208
207
- Learn how to [pass the Azure AD token to your application](idp-pass-through-user-flow.md).
209
208
- Check out the Azure AD multi-tenant federation [Live demo](https://github.com/azure-ad-b2c/unit-tests/tree/main/Identity-providers#azure-active-directory), and how to pass Azure AD access token [Live demo](https://github.com/azure-ad-b2c/unit-tests/tree/main/Identity-providers#azure-active-directory-with-access-token)
Copy file name to clipboardExpand all lines: articles/active-directory-b2c/relyingparty.md
+3-2Lines changed: 3 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ manager: CelesteDG
8
8
ms.service: active-directory
9
9
ms.workload: identity
10
10
ms.topic: reference
11
-
ms.date: 06/26/2022
11
+
ms.date: 11/17/2022
12
12
ms.custom: project-no-code
13
13
ms.author: kengaderdus
14
14
ms.subservice: B2C
@@ -144,7 +144,8 @@ The **UserJourneyBehaviors** element contains the following elements:
144
144
| JourneyFraming | 0:1| Allows the user interface of this policy to be loaded in an iframe. |
145
145
| ScriptExecution| 0:1| The supported [JavaScript](javascript-and-page-layout.md) execution modes. Possible values: `Allow` or `Disallow` (default).
146
146
147
-
147
+
When you use the above elements, you need add them to your **UserJourneyBehaviors** element in the order specified in the table. For example, the **JourneyInsights** element must be added before (above) the **ScriptExecution** element.
148
+
148
149
### SingleSignOn
149
150
150
151
The **SingleSignOn** element contains the following attributes:
Copy file name to clipboardExpand all lines: articles/active-directory/develop/v2-oauth2-device-code.md
+17-17Lines changed: 17 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,29 +9,31 @@ ms.service: active-directory
9
9
ms.subservice: develop
10
10
ms.workload: identity
11
11
ms.topic: conceptual
12
-
ms.date: 06/25/2021
12
+
ms.date: 11/15/2022
13
13
ms.author: ludwignick
14
14
ms.reviewer: marsma
15
-
ms.custom: aaddev
15
+
ms.custom: aaddev, engagement-fy23
16
16
---
17
17
18
18
# Microsoft identity platform and the OAuth 2.0 device authorization grant flow
19
19
20
-
The Microsoft identity platform supports the [device authorization grant](https://tools.ietf.org/html/rfc8628), which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or printer. To enable this flow, the device has the user visit a webpage in their browser on another device to sign in. Once the user signs in, the device is able to get access tokens and refresh tokens as needed.
20
+
The Microsoft identity platform supports the [device authorization grant](https://tools.ietf.org/html/rfc8628), which allows users to sign in to input-constrained devices such as a smart TV, IoT device, or a printer. To enable this flow, the device has the user visit a webpage in a browser on another device to sign in. Once the user signs in, the device is able to get access tokens and refresh tokens as needed.
21
21
22
-
This article describes how to program directly against the protocol in your application. When possible, we recommend you use the supported Microsoft Authentication Libraries (MSAL) instead to [acquire tokens and call secured web APIs](authentication-flows-app-scenarios.md#scenarios-and-supported-authentication-flows). Also take a look at the [sample apps that use MSAL](sample-v2-code.md).
22
+
This article describes how to program directly against the protocol in your application. When possible, we recommend you use the supported Microsoft Authentication Libraries (MSAL) instead to [acquire tokens and call secured web APIs](authentication-flows-app-scenarios.md#scenarios-and-supported-authentication-flows). You can refer to [sample apps that use MSAL](sample-v2-code.md) for examples.
The client must first check with the authentication server for a device and user code that's used to initiate authentication. The client collects this request from the `/devicecode` endpoint. In this request, the client should also include the permissions it needs to acquire from the user. From the moment this request is sent, the user has only 15 minutes to sign in (the usual value for `expires_in`), so only make this request when the user has indicated they're ready to sign in.
34
+
The client must first check with the authentication server for a device and user code that's used to initiate authentication. The client collects this request from the `/devicecode` endpoint. In the request, the client should also include the permissions it needs to acquire from the user.
35
+
36
+
From the moment the request is sent, the user has 15 minutes to sign in. This is the default value for `expires_in`. The request should only be made when the user has indicated they're ready to sign in.
|`tenant`| Required | Can be /common, /consumers, or /organizations. It can also be the directory tenant that you want to request permission from in GUID or friendly name format. |
51
+
|`tenant`| Required | Can be `/common`, `/consumers`, or `/organizations`. It can also be the directory tenant that you want to request permission from in GUID or friendly name format. |
50
52
|`client_id`| Required | The **Application (client) ID** that the [Azure portal – App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) experience assigned to your app. |
51
53
|`scope`| Required | A space-separated list of [scopes](v2-permissions-and-consent.md) that you want the user to consent to. |
52
54
@@ -68,19 +70,17 @@ A successful response will be a JSON object containing the required information
68
70
69
71
## Authenticating the user
70
72
71
-
After receiving the `user_code` and `verification_uri`, the client displays these to the user, instructing them to sign in using their mobile phone or PC browser.
73
+
After receiving the `user_code` and `verification_uri`, the client displays these to the user, instructing them to use their mobile phone or PC browser to sign in.
72
74
73
-
If the user authenticates with a personal account (on /common or /consumers), they will be asked to sign in again in order to transfer authentication state to the device. They will also be asked to provide consent, to ensure they are aware of the permissions being granted. This does not apply to work or school accounts used to authenticate.
75
+
If the user authenticates with a personal account, using `/common` or `/consumers`, they'll be asked to sign in again in order to transfer authentication state to the device. This is because the device is unable to access the user's cookies. They'll also be asked to consent to the permissions requested by the client. This however doesn't apply to work or school accounts used to authenticate.
74
76
75
77
While the user is authenticating at the `verification_uri`, the client should be polling the `/token` endpoint for the requested token using the `device_code`.
76
78
77
79
```HTTP
78
80
POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
The device code flow is a polling protocol so your client must expect to receive errors before the user has finished authenticating.
95
+
The device code flow is a polling protocol so errors served to the client must be expected prior to completion of user authentication.
96
96
97
97
| Error | Description | Client Action |
98
98
| ------ | ----------- | -------------|
99
99
|`authorization_pending`| The user hasn't finished authenticating, but hasn't canceled the flow. | Repeat the request after at least `interval` seconds. |
100
-
|`authorization_declined`| The end user denied the authorization request.| Stop polling, and revert to an unauthenticated state. |
100
+
|`authorization_declined`| The end user denied the authorization request.| Stop polling and revert to an unauthenticated state. |
101
101
|`bad_verification_code`| The `device_code` sent to the `/token` endpoint wasn't recognized. | Verify that the client is sending the correct `device_code` in the request. |
102
-
|`expired_token`|At least`expires_in`seconds have passed, and authentication is no longer possible with this`device_code`. | Stop polling and revert to an unauthenticated state. |
102
+
|`expired_token`|Value of`expires_in`has been exceeded and authentication is no longer possible with `device_code`. | Stop polling and revert to an unauthenticated state. |
103
103
104
104
### Successful authentication response
105
105
@@ -119,8 +119,8 @@ A successful token response will look like:
119
119
| Parameter | Format | Description |
120
120
| --------- | ------ | ----------- |
121
121
|`token_type`| String| Always `Bearer`. |
122
-
|`scope`| Space separated strings | If an access token was returned, this lists the scopes the access token is valid for. |
123
-
|`expires_in`| int | Number of seconds before the included access token is valid for. |
122
+
|`scope`| Space separated strings | If an access token was returned, this lists the scopes in which the access token is valid for. |
123
+
|`expires_in`| int | Number of seconds the included access token is valid for. |
124
124
|`access_token`| Opaque string | Issued for the [scopes](v2-permissions-and-consent.md) that were requested. |
125
125
|`id_token`| JWT | Issued if the original `scope` parameter included the `openid` scope. |
126
126
|`refresh_token`| Opaque string | Issued if the original `scope` parameter included `offline_access`. |
# Managing custom domain names in your Azure Active Directory
22
22
23
-
A domain name is an important part of the identifier for resources in many Azure Active Directory (Azure AD), part of Microsoft Entra: it's part of a user name or email address for a user, part of the address for a group, and is sometimes part of the app ID URI for an application. A resource in Azure AD can include a domain name that's owned by the Azure AD organization (sometimes called a tenant) that contains the resource. Only a Global Administrator can manage domains in Azure AD.
23
+
A domain name is an important part of the identifier for resources in many Azure Active Directory (Azure AD) deployments. It is part of a user name or email address for a user, part of the address for a group, and is sometimes part of the app ID URI for an application. A resource in Azure AD can include a domain name that's owned by the Azure AD organization (sometimes called a tenant) that contains the resource. Only a Global Administrator can manage domains in Azure AD.
24
24
25
25
## Set the primary domain name for your Azure AD organization
26
26
@@ -50,7 +50,7 @@ If you have already added a contoso.com domain to one Azure AD organization, you
50
50
51
51
## What to do if you change the DNS registrar for your custom domain name
52
52
53
-
If you change the DNS registrars, there are no additional configuration tasks in Azure AD. You can continue using the domain name with Azure AD without interruption. If you use your custom domain name with Microsoft 365, Intune, or other services that rely on custom domain names in Azure AD, see the documentation for those services.
53
+
If you change the DNS registrars, there are no other configuration tasks in Azure AD. You can continue using the domain name with Azure AD without interruption. If you use your custom domain name with Microsoft 365, Intune, or other services that rely on custom domain names in Azure AD, see the documentation for those services.
54
54
55
55
## Delete a custom domain name
56
56
@@ -67,7 +67,7 @@ You must change or delete any such resource in your Azure AD organization before
67
67
> [!Note]
68
68
> To delete the custom domain, use a Global Administrator account that is based on either the default domain (onmicrosoft.com) or a different custom domain (mydomainname.com).
69
69
70
-
###ForceDelete option
70
+
## ForceDelete option
71
71
72
72
You can **ForceDelete** a domain name in the [Azure AD Admin Center](https://aad.portal.azure.com) or using [Microsoft Graph API](/graph/api/domain-forcedelete). These options use an asynchronous operation and update all references from the custom domain name like “[email protected]” to the initial default domain name such as “[email protected].”
73
73
@@ -87,22 +87,36 @@ An error is returned when:
87
87
* The number of objects to be renamed is greater than 1000
88
88
* One of the applications to be renamed is a multi-tenant app
89
89
90
-
### Frequently asked questions
90
+
## Best Practices for Domain Hygiene
91
+
92
+
Use a reputable registrar that provides ample notifications for domain name changes, registration expiry, a grace period for expired domains, and maintains high security standards for controlling who has access to your domain name configuration and TXT records.
93
+
Keep your domain names current with your Registrar, and verify TXT records for accuracy.
94
+
95
+
* If you purposefully are expiring your domain name or turning over ownership to someone else (separately from your Azure AD tenant), you should delete it from your Azure AD tenant prior to expiring or transferring.
96
+
* If you do allow your domain name to expire, if you are able to reactivate it/regain control of it, carefully review all TXT records with the registrar to ensure no tampering of your domain name took place.
97
+
* If you can't reactivate or regain control of your domain name immediately, you should delete it from your Azure AD tenant. Dom't readd/re-verify until you are able to resolve ownership of the domain name and verify the full TXT record for correctness.
98
+
99
+
>[!NOTE]
100
+
> Microsoft will not allow a domain name to be verified with more than Azure AD tenant. Once you delete a domain name from your tenant, you will not be able to re-add/re-verify it with your Azure AD tenant if it is subsequently added and verified with another Azure AD tenant.
101
+
102
+
## Frequently asked questions
91
103
92
104
**Q: Why is the domain deletion failing with an error that states that I have Exchange mastered groups on this domain name?** <br>
93
-
**A:** Today, certain groups like Mail-Enabled Security groups and distributed lists are provisioned by Exchange and need to be manually cleaned up in [Exchange Admin Center (EAC)](https://outlook.office365.com/ecp/). There may be lingering ProxyAddresses which rely on the custom domain name and will need to be updated manually to another domain name.
105
+
**A:** Today, certain groups like Mail-Enabled Security groups and distributed lists are provisioned by Exchange and need to be manually cleaned up in [Exchange Admin Center (EAC)](https://outlook.office365.com/ecp/). There may be lingering ProxyAddresses, which rely on the custom domain name and will need to be updated manually to another domain name.
94
106
95
107
**Q: I am logged in as admin\@contoso.com but I cannot delete the domain name “contoso.com”?**<br>
96
-
**A:** You cannot reference the custom domain name you are trying to delete in your user account name. Ensure that the Global Administrator account is using the initial default domain name (.onmicrosoft.com) such as [email protected]. Sign in with a different Global Administrator account that such as [email protected] or another custom domain name like “fabrikam.com” where the account is [email protected].
108
+
**A:** You can't reference the custom domain name you are trying to delete in your user account name. Ensure that the Global Administrator account is using the initial default domain name (.onmicrosoft.com) such as [email protected]. Sign in with a different Global Administrator account that such as [email protected] or another custom domain name like “fabrikam.com” where the account is [email protected].
97
109
98
110
**Q: I clicked the Delete domain button and see `In Progress` status for the Delete operation. How long does it take? What happens if it fails?**<br>
99
-
**A:** The delete domain operation is an asynchronous background task that renames all references to the domain name. It should complete within a minute or two. If domain deletion fails, ensure that you don’t have:
111
+
**A:**The delete domain operation is an asynchronous background task that renames all references to the domain name. It may take up to 24 hours to complete. If domain deletion fails, ensure that you don’t have:
100
112
101
113
* Apps configured on the domain name with the appIdentifierURI
102
114
* Any mail-enabled group referencing the custom domain name
103
115
* More than 1000 references to the domain name
116
+
* The domain to be removed the set as the Primary domain of your organization
104
117
105
-
If you find that any of the conditions haven’t been met, manually clean up the references and try to delete the domain again.
118
+
Also note that the ForceDelete option won't work if the domain uses Federated authentication type. In that case the users/groups on the domain must be renamed or removed using the on-premises Active Directory before reattempting the domain removal.
119
+
If you find that any of the conditions haven’t been met, manually clean up the references, and try to delete the domain again.
106
120
107
121
## Use PowerShell or the Microsoft Graph API to manage domain names
0 commit comments