Merge pull request #188785 from omondiatieno/app-management-tutorials

app management tutorials

Author: Court72

articles/active-directory/manage-apps/toc.yml

@@ -24,8 +24,10 @@
       href: delete-application-portal.md
   - name: Tutorials
     items:
-    - name: List of app integration tutorials
-      href: ../saas-apps/tutorial-list.md
+    - name: Manage access and security
+      href: tutorial-manage-access-security.md
+    - name: Govern and monitor
+      href: tutorial-govern-monitor.md
   - name: Samples
     items: 
     - name: Overview of App Management samples
@@ -86,6 +88,8 @@
   - name: How-to guides
     expanded: false
     items:
+    - name: List of app integration tutorials
+      href: ../saas-apps/tutorial-list.md
     - name: Assign owners
       href: assign-app-owners.md
     - name: Manage access

articles/active-directory/manage-apps/tutorial-govern-monitor.md

@@ -0,0 +1,111 @@
+---
+title: "Tutorial: Govern and monitor applications"
+titleSuffix: Azure AD
+description: In this tutorial, you learn how to govern and monitor an application in Azure Active Directory.
+author: omondiatieno
+manager: CelesteDG
+ms.author: jomondi
+ms.service: active-directory
+ms.subservice: app-mgmt
+ms.topic: tutorial
+ms.date: 02/24/2022
+# Customer intent: As an administrator of an Azure AD tenant, I want to govern and monitor my applications.
+---
+
+# Tutorial: Govern and monitor applications
+
+The IT administrator at Fabrikam has added and configured an application from the [Azure Active Directory (Azure AD) application gallery](overview-application-gallery.md). They also made sure that access can be managed and that the application is secure by using the information in [Tutorial: Manage application access and security](tutorial-manage-access-security.md). They now need to understand the resources that are available to govern and monitor the application.
+
+Using the information in this tutorial, an administrator of the application learns how to:
+
+> [!div class="checklist"]
+> * Create an access review
+> * Access the audit logs report
+> * Access the sign-ins report
+> * Send logs to Azure Monitor
+
+## Prerequisites
+
+- An Azure account with an active subscription. If you don't already have one, [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
+- One of the following roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator.
+- An enterprise application that has been configured in your Azure AD tenant.
+
+## Create an access review
+
+The administrator wants to make sure that users or guests have appropriate access. They decide to ask users of the application to participate in an access review and recertify or attest to their need for access. When the access review is finished, they can then make changes and remove access from users who no longer need it. For more information, see
+[Manage user and guest user access with access reviews](../governance/manage-access-review.md).
+
+To create an access review:
+
+1. Sign in to the [Azure portal](https://portal.azure.com/) with one of the roles listed in the prerequisites.
+1. Go to **Azure Active Directory**, and then select **Identity Governance**.
+1. On the left menu, select **Access reviews**.
+1. Select **New access review** to create a new access review.
+1. In **Select what to review**, select **Applications**.
+1. Select **+ Select application(s)**, select the application, and then choose **Select**.
+1. Now you can select a scope for the review. Your options are:
+    - **Guest users only** - This option limits the access review to only the Azure AD B2B guest users in your directory.
+    - **All users** - This option scopes the access review to all user objects associated with the resource.
+    Select **All users**.
+1. Select **Next: Reviews**.
+1. In the **Specify reviewers** section, in the Select reviewers box, select **Selected user(s) or group(s)**, select **+ Select reviewers**, and then select the user account that is assigned to the application.
+1. In the **Specify recurrence of review** section, specify the following selections:
+    - **Duration (in days)** - Accept the default value of **3**.
+    - **Review recurrence** - select **One time**.
+    - **Start date** - Accept today's date as the start date.
+1. Select **Next: Settings**.
+1. In the **Upon completion settings** section, you can specify what happens after the review finishes. Select **Auto apply results to resource**.
+1. Select **Next: Review + Create**.
+1. Name the access review. Optionally, give the review a description. The name and description are shown to the reviewers.
+1. Review the information and select **Create**.
+
+### Start the access review
+
+After you've specified the settings for an access review, select **Start**. The access review appears in your list with an indicator of its status.
+
+By default, Azure AD sends an email to reviewers shortly after the review starts. If you choose not to have Azure AD send the email, be sure to inform the reviewers that an access review is waiting for them to complete. You can show them the instructions for how to review access to groups or applications. If your review is for guests to review their own access, show them the instructions for how to review access for themselves to groups or applications.
+
+If you've assigned guests as reviewers and they haven't accepted their invitation to the tenant, they won't receive an email from access reviews. They must first accept the invitation before they can begin reviewing.
+
+## Access the audit logs report
+
+The audit logs report combines several reports around application activities into a single view for context-based reporting. For more information, see [Audit logs in Azure Active Directory](../reports-monitoring/concept-audit-logs.md).
+
+To access the audit logs report, select **Audit logs** from the **Activity** section of the Azure Active Directory page.
+
+The audit logs report consolidates the following reports:
+
+- Password reset activity
+- Password reset registration activity
+- Self-service groups activity
+- Office365 Group Name Changes
+- Account provisioning activity
+- Password rollover status
+- Account provisioning errors
+
+## Access the sign-ins report
+
+The Sign-ins view includes all user sign-ins, and the Application Usage report. You also can view application usage information in the Manage section of the Enterprise applications overview. For more information, see [Sign-in logs in Azure Active Directory](../reports-monitoring/concept-sign-ins.md)
+
+To access the sign-in logs report, select **Sign-ins** from the **Monitoring** section of the Azure Active Directory blade.
+
+## Send logs to Azure Monitor
+
+The Azure AD activity logs only store information for a maximum of 30 days. Depending on your needs, you may require extra storage to back up the activity logs data. Using the Azure Monitor, you can archive the audit and sign logs to an Azure storage account to retain the data for a longer time. 
+The Azure Monitor is also useful for rich visualization, monitoring and alerting of data. To learn more about the Azure Monitor and the cost considerations for extra storage, see [Azure AD activity logs in Azure Monitor](../reports-monitoring/concept-activity-logs-azure-monitor.md).
+
+To send logs to your logs analytics workspace:
+
+1. Select **Diagnostic settings**, and then select **Add diagnostic setting**. You can also select Export Settings from the Audit Logs or Sign-ins page to get to the diagnostic settings configuration page.
+1. In the Diagnostic settings menu, select **Send to Log Analytics workspace**, and then select Configure.
+1. Select the Log Analytics workspace you want to send the logs to, or create a new workspace in the provided dialog box.
+1.	Select the logs that you would like to send to the workspace.
+1.	Select **Save** to save the setting.
+
+After about 15 minutes, verify that events are streamed to your Log Analytics workspace.
+
+## Next steps
+
+Advance to the next article to learn how to...
+> [!div class="nextstepaction"]
+> [Manage consent to applications and evaluate consent requests](manage-consent-requests.md)

articles/active-directory/manage-apps/tutorial-manage-access-security.md

@@ -0,0 +1,155 @@
+---
+title: "Tutorial: Manage application access and security"
+titleSuffix: Azure AD
+description: In this tutorial, you learn how to manage access to an application in Azure Active Directory and make sure it's secure.
+author: omondiatieno
+manager: CelesteDG
+ms.author: jomondi
+ms.service: active-directory
+ms.subservice: app-mgmt
+ms.topic: tutorial
+ms.date: 02/24/2022
+
+# Customer intent: As an administrator of an Azure AD tenant, I want to manage access to my applications and make sure they are secure.
+---
+
+# Tutorial: Manage application access and security
+
+The IT administrator at Fabrikam has added and configured an application from the Azure Active Directory (Azure AD) application gallery. They now need to understand the features that are available to manage access to the application and make sure the application is secure.
+Using the information in this tutorial, an administrator learns how to:
+
+> [!div class="checklist"]
+> * Grant consent for the application on behalf of all users
+> * Enable multi-factor authentication to make sign-in more secure
+> * Communicate a term of use to users of the application
+> * Create a collection in the My Apps portal
+
+## Prerequisites
+
+* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
+* One of the following roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, or Application Administrator.
+* An enterprise application that has been configured in your Azure AD tenant.
+* At least one user account added and assigned to the application. For more information, see [Quickstart: Create and assign a user account](add-application-portal-assign-users.md).
+
+## Grant tenant wide admin consent
+
+For the application that the administrator added to their tenant, they want to set it up so that all users in the organization can use it and not have to individually request consent to use it. To avoid the need for user consent, they can grant consent for the application on behalf of all users in the organization. For more information, see [Consent and permissions overview](consent-and-permissions-overview.md).
+
+1. Sign in to the [Azure portal](https://portal.azure.com/) with one of the roles listed in the prerequisites.
+2. Search for and select **Azure Active Directory**.
+3. Select **Enterprise applications**.
+4. Select the application to which you want to grant tenant-wide admin consent.
+5. Under **Security**, select **Permissions**.
+6. Carefully review the permissions that the application requires. If you agree with the permissions the application requires, select **Grant admin consent**.
+
+## Create a Conditional Access policy
+
+The administrator wants to make sure that only the people they assign to the application can securely sign in. To do this, they can configure a conditional access policy for a group of users that enforces multi-factor authentication (MFA). For more information, see [What is Conditional Access?](../conditional-access/overview.md).
+
+### Create a group
+
+It's easier for an administrator to manage access to the application by assigning all users of the application to a group. The administrator can then manage access at a group level.
+
+1. In the left menu of the tenant overview, select **Groups**.
+1. Select **New group** at the top of the pane.
+1. Enter *MFA-Test-Group* for the name of the group.
+1. Select No members selected, and then choose the user account that you assigned to the application.
+1. Select **Create**.
+
+### Create a Conditional Access policy for the group
+
+1. In the left menu of the tenant overview, select **Security**.
+1. Select **Conditional Access**, select **+ New policy**, and then select **Create new policy**.
+1. Enter a name for the policy, such as *MFA Pilot*.
+1. Under **Assignments**, select **Users and groups**
+1. On the **Include** tab, choose **Select users and groups**, and then select **Users and groups**.
+1. Browse for and select the *MFA-Test-Group* that you previously created, and then choose **Select**.
+1. Don't select **Create** yet, you add MFA to the policy in the next section.
+
+### Configure multi-factor authentication
+
+In this tutorial, the administrator can find the basic steps to configure the application, but they should consider creating a plan for MFA before starting. For more information, see [Plan an Azure Active Directory Multi-Factor Authentication deployment](../authentication/howto-mfa-getstarted.md).
+
+1. Under **Cloud apps or actions**, select **No cloud apps, actions, or authentication contexts selected**. For this tutorial, on the **Include** tab, choose **Select apps**.
+1. Search for and select your application, and then select **Select**.
+1. Under **Access controls** and **Grant**, select **0 controls selected**.
+1. Check the box for **Require multi-factor authentication**, and then choose **Select**.
+1. Set **Enable policy** to **On**.
+1. To apply the Conditional Access policy, select **Create**.
+
+## Test multi-factor authentication
+
+1. Open a new browser window in InPrivate or incognito mode and browse to the URL of the application.
+1. Sign in with the user account that you assigned to the application. You're required to register for and use Azure AD Multi-Factor Authentication. Follow the prompts to complete the process and verify you successfully sign into the Azure portal.
+1. Close the browser window.
+
+## Create a terms of use statement
+
+Juan wants to make sure that certain terms and conditions are known to users before they start using the application. For more information, see [Azure Active Directory terms of use](../conditional-access/terms-of-use.md).
+
+1. In Microsoft Word, create a new document.
+1. Type My terms of use, and then save the document on your computer as *mytou.pdf*.
+1. Under **Manage**, in the **Conditional Access** menu, select **Terms of use**.
+1. In the top menu, select **+ New terms**.
+1. In the **Name** textbox, type *My TOU*.
+1. In the **Display name** textbox, type *My TOU*.
+1. Upload your terms of use PDF file.
+1. For **Language**, select **English**.
+1. For **Require users to expand the terms of use**, select **On**.
+1. For **Enforce with conditional access policy templates**, select **Custom policy**.
+1. Select **Create**.
+
+## Add the terms of use to the policy
+
+1. In the left menu of the tenant overview, select **Security**.
+1. Select **Conditional Access**, and then select the *MFA Pilot* policy.
+1. Under **Access controls** and **Grant**, select the controls selected link.
+1. Select *My TOU*.
+1. Select **Require all the selected controls**, and then choose **Select**.
+1. Select **Save**.
+
+## Create a collection in the My Apps portal
+
+The My Apps portal enables administrators and users to manage the applications used in the organization. For more information, see [End-user experiences for applications](end-user-experiences.md).
+
+> [!NOTE]
+> Applications only appear in a user's my Apps portal after the user is assigned to the application and the application is configured to be visible to users. See [Configure application properties](add-application-portal-configure.md) to learn how to make the application visible to users.
+
+1. Open the Azure portal.
+1. Go to **Azure Active Directory**, and then select **Enterprise Applications**.
+1. Under **Manage**, select **Collections**.
+1. Select **New collection**. In the New collection page, enter a **Name** for the collection (it's recommended to not use "collection" in the name. Then enter a **Description**.
+1. Select the **Applications** tab. Select **+ Add application**, and then in the Add applications page, select all the applications you want to add to the collection, or use the Search box to find applications.
+1. When you're finished adding applications, select **Add**. The list of selected applications appears. You can use the arrows to change the order of applications in the list.
+1. Select the **Owners** tab. Select **+ Add users and groups**, and then in the Add users and groups page, select the users or groups you want to assign ownership to. When you're finished selecting users and groups, choose **Select**.
+1. Select the **Users and groups** tab. Select **+ Add users and groups**, and then in the **Add users and groups** page, select the users or groups you want to assign the collection to. Or use the Search box to find users or groups. When you're finished selecting users and groups, choose **Select**.
+1. Select **Review + Create**, and then select **Create**. The properties for the new collection appear.
+
+## Clean up resources
+
+You can keep the resources for future use, or if you're not going to continue to use the resources created in this tutorial, delete them with the following steps.
+
+## Delete the application
+
+1. In the left menu, select **Enterprise applications**. The **All applications** pane opens and displays a list of the applications in your Azure AD tenant. Search for and select the application that you want to delete.
+1. In the **Manage** section of the left menu, select **Properties**.
+1. At the top of the **Properties** pane, select **Delete**, and then select **Yes** to confirm you want to delete the application from your Azure AD tenant.
+
+## Delete the conditional access policy
+
+1. Select **Enterprise applications**.
+1. Under **Security**, select **Conditional Access**.
+1. Search for and select **MFA Pilot**.
+1. Select **Delete** at the top of the pane.
+
+## Delete the group
+
+1. Select **Azure Active Directory**, and then select **Groups**.
+1. From the **Groups - All groups** page, search for and select the **MFA-Test-Group** group.
+1. On the overview page, select **Delete**.
+
+## Next steps
+
+For information about how you can make sure that your application is healthy and being used correctly, see:
+> [!div class="nextstepaction"]
+> [Govern and monitor your application](tutorial-govern-monitor.md)