Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into pauljewell-java-resources

Author: pauljewellmsft

articles/active-directory/cloud-infrastructure-entitlement-management/how-to-add-remove-user-to-group.md

@@ -21,7 +21,7 @@ This article describes how you can add or remove a new user for a group in Permi
 
 ## Add a user
 
-1. Navigate to the [Microsoft Entra admin center](https://entra.microsoft.com/#home). 
+1. Navigate to the [Microsoft Entra admin center](https://entra.microsoft.com/#home).
 1. From the Azure Active Directory tile, select **Go to Azure Active Directory**. 
 1. From the navigation pane, select the **Groups** drop-down menu, then **All groups**.
 1. Select the group name for the group you want to add the user to.

articles/active-directory/cloud-infrastructure-entitlement-management/onboard-azure.md

@@ -17,7 +17,7 @@ ms.author: jfields
 This article describes how to onboard a Microsoft Azure subscription or subscriptions on Permissions Management. Onboarding a subscription creates a new authorization system to represent the Azure subscription in Permissions Management.
 
 > [!NOTE]
-> A *global administrator* or *super admin* (an admin for all authorization system types) can perform the tasks in this article after the global administrator has initially completed the steps provided in [Enable Permissions Management on your Azure Active Directory tenant](onboard-enable-tenant.md).
+> A *global administrator* or *root user* (an admin for all authorization system types) can perform the tasks in this article after the global administrator has initially completed the steps provided in [Enable Permissions Management on your Azure Active Directory tenant](onboard-enable-tenant.md).
 
 ## Explanation
 

articles/active-directory/fundamentals/1-secure-access-posture.md

@@ -1,94 +1,98 @@
 ---
-title: Determine your security posture for external collaboration with Azure Active Directory 
-description: Before you can execute an external access security plan, you must determine what you are trying to achieve.
+title: Determine your security posture for external access with Azure Active Directory 
+description: Learn about governance of external access and assessing collaboration needs, by scenario
 services: active-directory
-author: janicericketts
+author: jricketts
 manager: martinco
 ms.service: active-directory
 ms.workload: identity
 ms.subservice: fundamentals
 ms.topic: conceptual
-ms.date: 08/19/2022
+ms.date: 02/03/2023
 ms.author: jricketts
 ms.reviewer: ajburnle
 ms.custom: "it-pro, seodec18"
 ms.collection: M365-identity-device-management
 ---
 
-# Determine your security posture for external access 
+# Determine your security posture for external access with Azure Active Directory 
 
-As you consider governing external access, you’ll need to assess the security and collaboration needs for your organization overall, and within each scenario. At the organizational level, consider the amount of control you need your IT team to have over day-to-day collaboration. Organizations in regulated industries may require more IT control. For example, a defense contractor may be required to positively identify and document each external user, their access, and the removal of access. This requirement may be on all access, or on specific scenarios or workloads. On the other end of the spectrum, a consulting firm may generally allow end users to determine the external users they need to collaborate with, within certain IT guard rails. 
+As you consider the governance of external access, assess your organization's security and collaboration needs, by scenario. You can start with the level of control the IT team has over the day-to-day collaboration of end users. Organizations in highly regulated industries might require more IT team control. For example, defense contractors can have a requirement to positively identify and document external users, their access, and access removal: all access, scenario-based, or workloads. Consulting agencies can use certain features to allow end users to determine the external users they collaborate with. 
 
-![IT versus end-user control of collaboration](media/secure-external-access/1-overall-control.png)
+  ![Bar graph of the span from full IT team control, to end-user self service.](media/secure-external-access/1-overall-control.png)
 
-> [!NOTE]
-> Overly tight control on collaboration can lead to higher IT budgets, reduced productivity, and delayed business outcomes. When official collaboration channels are perceived as too onerous, end users tend to go around IT provided systems to get their jobs done, by for example emailing unsecured documents.
-
-## Think in terms of scenarios
+   > [!NOTE]
+   > A high degree of control over collaboration can lead to higher IT budgets, reduced productivity, and delayed business outcomes. When official collaboration channels are perceived as onerous, end users tend to evade official channels. An example is end users sending unsecured documents by email.
 
-In many cases IT can delegate partner access, at least in some scenarios, while providing guard rails for security. The IT guard rails can be help ensure that intellectual property stays secure, while empowering employees to collaborate with partners to get work done.
+## Scenario-based planning
 
-As you consider the scenarios within your organization, assess the need for employee versus business partner access to resources. A bank may have compliance needs that restrict access to certain resources, like user account information, to a small group of internal employees. Conversely, the same bank may enable delegated access for partners working on a marketing campaign.
+IT teams can delegate partner access to empower employees to collaborate with partners. This delegation can occur while maintaining sufficient security to protect intellectual property.
 
-![continuum of governance per scenario](media\secure-external-access\1-scenarios.png)
+Compile and assess your organizations scenarios to help assess employee versus business partner access to resources. Financial institutions might have compliance standards that restrict employee access to resources such as account information. Conversely, the same institutions can enable delegated partner access for projects such as marketing campaigns.
 
-In each scenario, consider 
+   ![Diagram of a balance of IT team goverened access to partner self-service.](media/secure-external-access/1-scenarios.png)
 
-* the sensitivity of the information at risk
+### Scenario considerations
 
-* whether you need to restrict what partners can see about other users
+Use the following list to help measure the level of access control.
 
-* the cost of a breach vs the weight of centralized control and end-user friction
+* Information sensitivity, and associated risk of its exposure
+* Partner access to information about other end users
+* The cost of a breach versus the overhead of centralized control and end-user friction
 
- You may also start with centrally managed controls to meet compliance targets and delegate control to end users over time. All access management models may simultaneously coexist within an organization. 
+Organizations can start with highly managed controls to meet compliance targets, and then delegate some control to end users, over time. There can be simultaneous access-management models in an organization. 
 
-The use of [partner managed credentials](../external-identities/what-is-b2b.md) provides your organization with an essential signal that terminates access to your resources once the external user has lost access to the resources of their own company.
+> [!NOTE]
+> Partner-managed credentials are a method to signal the termination of access to resources, when an external user loses access to resources in their own company. Learn more: [B2B collaboration overview](../external-identities/what-is-b2b.md)
 
-## Goals of securing external access
+## External-access security goals
 
-The goals of IT-governed and delegated access differ.
+The goals of IT-governed and delegated access differ. The primary goals of IT-governed access are:
 
-**The primary goals of IT-governed access are to:**
+* Meet governance, regulatory, and compliance (GRC) targets
+* High level of control over partner access to information about end users, groups, and other partners
 
-* Meet governance, regulatory, and compliance (GRC) targets. 
+The primary goals of delegating access are:
 
-* Tightly control partner access and what partners can see about member users, groups, and other partners.
+* Enable business owners to determine collaboration partners, with security constraints
+* Enable partners to request access, based on rules defined by business owners
 
-**The primary goals of delegating access are to:**
+### Common goals 
 
-* Enable business owners to govern who they collaborate with, within IT constraints.
+#### Control access to applications, data, and content
 
-* Enable business partners to request access based on rules defined by business owners.
+Levels of control can be accomplished through various methods, depending on your version of Azure AD and Microsoft 365.
 
-Whichever you enact for your organization and scenarios you'll need to: 
+* [Azure AD plans and pricing](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing)
+* [Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). 
 
-* **Control access to applications, data, and content**. This can be accomplished through a variety of methods, depending on your versions of [Azure AD](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing) and [Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). 
+#### Reduce attack surface
 
-* **Reduce the attack surface**. [Privileged identity management](../privileged-identity-management/pim-configure.md), [data loss prevention (DLP),](/exchange/security-and-compliance/data-loss-prevention/data-loss-prevention) and [encryption capabilities](/exchange/security-and-compliance/data-loss-prevention/data-loss-prevention) reduce the attack surface.
+* [What is Azure AD Privileged Identity Management?](../privileged-identity-management/pim-configure.md) -  manage, control, and monitor access to resources in Azure AD, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune
+* [Data loss prevention in Exchange Server](/exchange/policy-and-compliance/data-loss-prevention/data-loss-prevention?view=exchserver-2019&preserve-view=true)
 
-* **Regularly review activity and audit log to confirm compliance**. IT can delegate access decisions to business owners through entitlement management while access reviews provide a way to periodically confirm continued access. Automated data classification with sensitivity labels helps to automate encryption of sensitive content making it easy for employee end users to comply.
+#### Confirm compliance with activity and audit log reviews
 
-## Next steps 
+IT teams can delegate access decisions to business owners through entitlement management, while access reviews help confirm continued access. You can use automated data classification with sensitivity labels to automate the encryption of sensitive content, easing compliance for end users.
 
-See the following articles on securing external access to resources. We recommend you take the actions in the listed order.
+## Next steps
 
-1. [Determine your security posture for external access](1-secure-access-posture.md) (You are here.)
+See the following articles to learn more about securing external access to resources. We recommend you follow the listed order.
 
-2. [Discover your current state](2-secure-access-current-state.md)
+1. [Determine your security posture for external access with Azure AD](1-secure-access-posture.md) (You're here)
 
-3. [Create a governance plan](3-secure-access-plan.md)
+2. [Discover the current state of external collaboration in your organization](2-secure-access-current-state.md)
 
-4. [Use groups for security](4-secure-access-groups.md)
+3. [Create a security plan for external access](3-secure-access-plan.md)
 
-5. [Transition to Azure AD B2B](5-secure-access-b2b.md)
+4. [Secure external access with groups in Azure AD and Microsoft 365](4-secure-access-groups.md)
 
-6. [Secure access with Entitlement Management](6-secure-access-entitlement-managment.md)
+5. [Transition to governed collaboration with Azure AD B2B collaboration](5-secure-access-b2b.md)
 
-7. [Secure access with Conditional Access policies](7-secure-access-conditional-access.md)
+6. [Manage external access with Azure AD entitlement management](6-secure-access-entitlement-managment.md)
 
-8. [Secure access with Sensitivity labels](8-secure-access-sensitivity-labels.md)
+7. [Manage external access with Conditional Access policies](7-secure-access-conditional-access.md)
 
-9. [Secure access to Microsoft Teams, OneDrive, and SharePoint](9-secure-access-teams-sharepoint.md)
- 
+8. [Control external access to resources in Azure AD with sensitivity labels](8-secure-access-sensitivity-labels.md) 
 
-​
+9. [Secure external access to Microsoft Teams, SharePoint, and OneDrive with Azure AD](9-secure-access-teams-sharepoint.md)

articles/active-directory/fundamentals/whats-deprecated-azure-ad.md

@@ -1,7 +1,7 @@
 ---
 title: What's deprecated in Azure Active Directory?
 description: Learn about features being deprecated in Azure Active Directory
-author: jricketts
+author: janicericketts
 manager: martinco
 ms.service: active-directory
 ms.subservice: fundamentals

articles/active-directory/reports-monitoring/how-to-view-applied-conditional-access-policies.md

@@ -9,7 +9,7 @@ ms.service: active-directory
 ms.topic: how-to
 ms.workload: identity
 ms.subservice: report-monitor
-ms.date: 10/31/2022
+ms.date: 02/03/2023
 ms.author: sarahlipsey
 ms.reviewer: besiler 
 
@@ -32,41 +32,30 @@ As an Azure AD administrator, you can use the sign-in logs to:
 
 Some scenarios require you to get an understanding of how your Conditional Access policies were applied to a sign-in event. Common examples include:
 
-- *Helpdesk administrators* who need to look at applied Conditional Access policies to understand if a policy is the root cause of a ticket that a user opened. 
+- Helpdesk administrators who need to look at applied Conditional Access policies to understand if a policy is the root cause of a ticket that a user opened. 
 
-- *Tenant administrators* who need to verify that Conditional Access policies have the intended effect on the users of a tenant.
+- Tenant administrators who need to verify that Conditional Access policies have the intended effect on the users of a tenant.
 
 You can access the sign-in logs by using the Azure portal, Microsoft Graph, and PowerShell.  
 
 ## Required administrator roles 
 
-To see applied Conditional Access policies in the sign-in logs, administrators must have permissions to view both the logs and the policies.
+To see applied Conditional Access policies in the sign-in logs, administrators must have permissions to view *both* the logs and the policies. The least privileged built-in role that grants *both* permissions is *Security Reader*. As a best practice, your Global Administrator should add the Security Reader role to the related administrator accounts. 
 
-The least privileged built-in role that grants both permissions is *Security Reader*. As a best practice, your global administrator should add the Security Reader role to the related administrator accounts. 
-
-The following built-in roles grant permissions to read Conditional Access policies:
+The following built-in roles grant permissions to *read Conditional Access policies*:
 
 - Global Administrator 
-
 - Global Reader 
-
 - Security Administrator 
-
 - Security Reader 
-
 - Conditional Access Administrator 
 
-
-The following built-in roles grant permission to view sign-in logs: 
+The following built-in roles grant permission to *view sign-in logs*: 
 
 - Global Administrator 
-
 - Security Administrator 
-
 - Security Reader 
-
 - Global Reader 
-
 - Reports Reader 
 
 ## Permissions for client apps 
@@ -76,9 +65,7 @@ If you use a client app to pull sign-in logs from Microsoft Graph, your app need
 Any of the following permissions is sufficient for a client app to access applied certificate authority (CA) policies in sign-in logs through Microsoft Graph: 
 
 - `Policy.Read.ConditionalAccess` 
-
 - `Policy.ReadWrite.ConditionalAccess` 
-
 - `Policy.Read.All` 
 
 ## Permissions for PowerShell 
@@ -89,37 +76,28 @@ Like any other client app, the Microsoft Graph PowerShell module needs client pe
 - `AuditLog.Read.All` 
 - `Directory.Read.All` 
 
-These permissions are the least privileged permissions with the necessary access. 
-
-To consent to the necessary permissions, use: 
-
-`Connect-MgGraph -Scopes Policy.Read.ConditionalAccess, AuditLog.Read.All, Directory.Read.All`
-
-To view the sign-in logs, use: 
+The following permissions are the least privileged permissions with the necessary access:
 
-`Get-MgAuditLogSignIn`
+- To consent to the necessary permissions: `Connect-MgGraph -Scopes Policy.Read.ConditionalAccess, AuditLog.Read.All, Directory.Read.All`
+- To view the sign-in logs: `Get-MgAuditLogSignIn`
 
 For more information about this cmdlet, see [Get-MgAuditLogSignIn](/powershell/module/microsoft.graph.reports/get-mgauditlogsignin).
 
 The Azure AD Graph PowerShell module doesn't support viewing applied Conditional Access policies. Only the Microsoft Graph PowerShell module returns applied Conditional Access policies.  
 
-## Confirming access 
-
-On the **Conditional Access** tab, you see a list of Conditional Access policies applied to that sign-in event. 
-
-To confirm that you have admin access to view applied Conditional Access policies in the sign-in logs: 
-
-1. Go to the Azure portal. 
-
-2. In the upper-right corner, select your directory, and then select **Azure Active Directory** on the left pane. 
+## View Conditional Access policies in Azure AD sign-in logs
 
-3. In the **Monitoring** section, select **Sign-in logs**. 
+The activity details of sign-in logs contain several tabs. The **Conditional Access** tab lists the Conditional Access policies applied to that sign-in event. 
 
-4. Select an item in the sign-in table to open the **Activity Details: Sign-ins context** pane.  
+1. Sign in to the [Azure portal](https://portal.azure.com) using the Security Reader role.
+1. In the **Monitoring** section, select **Sign-in logs**. 
+1. Select  a sign-in item from the table to open the **Activity Details: Sign-ins context** pane.  
+1. Select the **Conditional Access** tab.
 
-5. Select the **Conditional Access** tab on the context pane. If your screen is small, you might need to select the ellipsis (**...**) to see all tabs on the context pane.  
+If you don't see the Conditional Access policies, confirm you're using a role that provides access to both the sign-in logs and the Conditional Access policies.
 
 ## Next steps
 
-* [Sign-in error code reference](./concept-sign-ins.md)
-* [Sign-in report overview](concept-sign-ins.md)
+* [Troubleshoot sign-in problems](../conditional-access/troubleshoot-conditional-access.md#azure-ad-sign-in-events)
+* [Review the Conditional Access sign-in logs FAQs](reports-faq.yml#conditional-access)
+* [Learn about the sign-in logs](concept-sign-ins.md)

articles/active-directory/reports-monitoring/overview-reports.md

@@ -9,7 +9,7 @@ ms.service: active-directory
 ms.topic: overview
 ms.workload: identity
 ms.subservice: report-monitor
-ms.date: 11/01/2022
+ms.date: 02/03/2023
 ms.author: sarahlipsey
 ms.reviewer: sarbar  
 
@@ -70,6 +70,6 @@ In addition to the user interface, Azure AD also provides you with [programmatic
 
 ## Next steps
 
-- [Risky sign-ins report](../identity-protection/overview-identity-protection.md)
+- [Risky sign-ins report](../identity-protection/howto-identity-protection-investigate-risk.md#risky-sign-ins)
 - [Audit logs report](concept-audit-logs.md)
 - [Sign-ins logs report](concept-sign-ins.md)