Merge pull request #103868 from MicrosoftDocs/master

2/10 PM Publish

Author: huypub

.openpublishing.redirection.json

@@ -24510,6 +24510,11 @@
       "redirect_url": "/azure/virtual-machines/workloads/sap/high-availability-multi-sid",
       "redirect_document_id": false
     },
+    {
+      "source_path": "articles/virtual-machines/virtual-machines-azure-slave-plugin-for-hudson-classic.md",
+      "redirect_url": "/azure/virtual-machines/",
+      "redirect_document_id": false
+    },
     {
       "source_path": "articles/virtual-machines/virtual-machines-windows-sap-planning-guide.md",
       "redirect_url": "/azure/virtual-machines/workloads/sap/planning-guide",
@@ -38602,7 +38607,7 @@
     },
     {
       "source_path": "articles/billing/billing-set-up-alerts.md",
-      "redirect_url": "/azure/billing/billing-getting-started",
+      "redirect_url": "/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-usage-spending",
       "redirect_document_id": false
     },
     {
@@ -41704,6 +41709,11 @@
       "source_path": "articles/virtual-machines/windows/classic/capture-image-classic.md",
       "redirect_url": "/previous-versions/azure/virtual-machines/windows/classic/capture-image-classic",
       "redirect_document_id": false
+    },
+	{
+      "source_path": "articles/virtual-machines/virtual-machines-availability-set-supportability.md",
+      "redirect_url": "/azure/virtual-machines/troubleshooting/virtual-machines-availability-set-supportability",
+      "redirect_document_id": false
     },
     {
       "source_path": "articles/virtual-machines/windows/classic/configure-availability-classic.md",

articles/active-directory-b2c/azure-monitor.md

@@ -44,7 +44,7 @@ You authorize a user or group in your Azure AD B2C directory (the **Service Prov
 
 This is the resource group containing the destination Azure storage account, event hub, or Log Analytics workspace to receive data from Azure Monitor. You specify the resource group name when you deploy the Azure Resource Manager template.
 
-[Create a resource group](../azure-resource-manager/management/manage-resource-groups-portal.md#create-resource-groups) or choose an existing one the Azure Active Directory (Azure AD) tenant that contains your Azure subscription, *not* the directory that contains your Azure AD B2C tenant.
+[Create a resource group](../azure-resource-manager/management/manage-resource-groups-portal.md#create-resource-groups) or choose an existing one in the Azure Active Directory (Azure AD) tenant that contains your Azure subscription, *not* the directory that contains your Azure AD B2C tenant.
 
 This example uses a resource group named *azure-ad-b2c-monitor* in the *Central US* region.
 

articles/active-directory/app-provisioning/how-provisioning-works.md

@@ -84,6 +84,8 @@ You can use scoping filters to define attribute-based rules that determine which
 It's possible to use the Azure AD user provisioning service to provision B2B (or guest) users in Azure AD to SaaS applications. 
 However, for B2B users to sign in to the SaaS application using Azure AD, the SaaS application must have its SAML-based single sign-on capability configured in a specific way. For more information on how to configure SaaS applications to support sign-ins from B2B users, see [Configure SaaS apps for B2B collaboration](../b2b/configure-saas-apps.md).
 
+Note that the userPrincipalName for a guest user is often stored as "alias#EXT#@domain.com". when the userPrincipalName is included in your attribute mappings as a source attribute, the #EXT# is stripped from the userPrincipalName. If you require the #EXT# to be present, replace userPrincipalName with originalUserPrincipalName as the source attribute. 
+
 ## Provisioning cycles: Initial and incremental
 
 When Azure AD is the source system, the provisioning service uses the [Differential Query feature of the Azure AD Graph API](https://msdn.microsoft.com/Library/Azure/Ad/Graph/howto/azure-ad-graph-api-differential-query) to monitor users and groups. The provisioning service runs an initial cycle against the source system and target system, followed by periodic incremental cycles.

articles/active-directory/governance/entitlement-management-access-package-assignments.md

@@ -23,7 +23,7 @@ ms.collection: M365-identity-device-management
 ---
 # View, add, and remove assignments for an access package in Azure AD entitlement management
 
-In Azure AD entitlement management, you can see who has been assigned to access packages, their policy, and status. If an access package has an appropriate policy, you can also directly assign user to an access package. This article describes how to view, add, and remove assignments for an access packages.
+In Azure AD entitlement management, you can see who has been assigned to access packages, their policy, and status. If an access package has an appropriate policy, you can also directly assign user to an access package. This article describes how to view, add, and remove assignments for access packages.
 
 ## View who has an assignment
 
@@ -47,6 +47,10 @@ In Azure AD entitlement management, you can see who has been assigned to access
 
 1. To download a CSV file of the filtered list, click **Download**.
 
+### Viewing assignments programmatically
+
+You can also retrieve assignments in an access package using Microsoft Graph.  A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission can call the API to [list accessPackageAssignments](https://docs.microsoft.com/graph/api/accesspackageassignment-list?view=graph-rest-beta).
+
 ## Directly assign a user
 
 In some cases, you might want to directly assign specific users to an access package so that users don't have to go through the process of requesting the access package. To directly assign users, the access package must have a policy that allows administrator direct assignments.
@@ -75,6 +79,10 @@ In some cases, you might want to directly assign specific users to an access pac
 
     After a few moments, click **Refresh** to see the users in the Assignments list.
 
+### Directly assigning users programmatically
+
+You can also directly assign a user to an access package using Microsoft Graph.  A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission can call the API to [create an accessPackageAssignmentRequest](https://docs.microsoft.com/graph/api/accesspackageassignmentrequest-post?view=graph-rest-beta).
+
 ## Remove an assignment
 
 **Prerequisite role:** Global administrator, User administrator, Catalog owner, or Access package manager

articles/active-directory/governance/entitlement-management-access-package-create.md

@@ -129,7 +129,18 @@ On the **Review + create** tab, you can review your settings and check for any v
 
     The new access package appears in the list of access packages.
 
+## Creating an access package programmatically
+
+You can also create an access package using Microsoft Graph.  A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission can call the API to
+
+1. [List the accessPackageResources in the catalog](https://docs.microsoft.com/graph/api/accesspackagecatalog-list-accesspackageresources?view=graph-rest-beta) and [create an accessPackageResourceRequest](https://docs.microsoft.com/graph/api/accesspackageresourcerequest-post?view=graph-rest-beta) for any resources that are not yet in the catalog.
+1. [List the accessPackageResourceRoles](https://docs.microsoft.com/graph/api/accesspackagecatalog-list-accesspackageresourceroles?view=graph-rest-beta) of each accessPackageResource in an accessPackageCatalog. This list of roles will then be used to select a role, when subsequently creating an accessPackageResourceRoleScope.
+1. [Create an accessPackage](https://docs.microsoft.com/graph/api/accesspackage-post?view=graph-rest-beta).
+1. [Create an accessPackageAssignmentPolicy](https://docs.microsoft.com/graph/api/accesspackageassignmentpolicy-post?view=graph-rest-beta).
+1. [Create an accessPackageResourceRoleScope](https://docs.microsoft.com/graph/api/accesspackage-post-accesspackageresourcerolescopes?view=graph-rest-beta) for each resource role needed in the access package.
+
 ## Next steps
 
 - [Share link to request an access package](entitlement-management-access-package-settings.md)
 - [Change resource roles for an access package](entitlement-management-access-package-resources.md)
+- [Directly assign a user to the access package](entitlement-management-access-package-assignments.md)

articles/active-directory/governance/entitlement-management-catalog-create.md

@@ -49,6 +49,10 @@ A catalog is a container of resources and access packages. You create a catalog
 
 1. Click **Create** to create the catalog.
 
+### Creating a catalog programmatically
+
+You can also create a catalog using Microsoft Graph.  A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission can call the API to [create an accessPackageCatalog](https://docs.microsoft.com/graph/api/accesspackagecatalog-post?view=graph-rest-beta).
+
 ## Add resources to a catalog
 
 To include resources in an access package, the resources must exist in a catalog. The types of resources you can add are groups, applications, and SharePoint Online sites. The groups can be cloud-created Office 365 Groups or cloud-created Azure AD security groups. The applications can be Azure AD enterprise applications, including both SaaS applications and your own applications federated to Azure AD. The sites can be SharePoint Online sites or SharePoint Online site collections.
@@ -75,6 +79,10 @@ To include resources in an access package, the resources must exist in a catalog
 
     These resources can now be included in access packages within the catalog.
 
+### Adding a resource to a catalog programmatically
+
+You can also add a resource to a catalog using Microsoft Graph.  A user in an appropriate role, or a catalog and resource owner, with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission can call the API to [create an accessPackageResourceRequest](https://docs.microsoft.com/graph/api/accesspackageresourcerequest-post?view=graph-rest-beta).
+
 ## Remove resources from a catalog
 
 You can remove resources from a catalog. A resource can only be removed from a catalog if it is not being used in any of the catalog's access packages.
@@ -143,6 +151,10 @@ You can delete a catalog, but only if it does not have any access packages.
 
 1. In the message box that appears, click **Yes**.
 
+### Deleting a catalog programmatically
+
+You can also delete a catalog using Microsoft Graph.  A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission can call the API to [delete an accessPackageCatalog](https://docs.microsoft.com/graph/api/accesspackagecatalog-delete?view=graph-rest-beta).
+
 ## Next steps
 
 - [Delegate access governance to access package managers](entitlement-management-delegate-managers.md)

articles/active-directory/governance/entitlement-management-delegate-catalog.md

@@ -24,7 +24,9 @@ ms.collection: M365-identity-device-management
 
 # Delegate access governance to catalog creators in Azure AD entitlement management
 
-To delegate to users who aren't administrators, so that they can create their own catalogs, you can add those users to the Azure AD entitlement management-defined catalog creator role. You can add individual users, or you can add a group, whose members are then able to create catalogs.
+A catalog is a container of resources and access packages. You create a catalog when you want to group related resources and access packages. By default, a Global administrator or a User administrator can [create a catalog](entitlement-management-catalog-create.md), and can add additional users as catalog owners.
+
+To delegate to users who aren't administrators, so that they can create their own catalogs, you can add those users to the Azure AD entitlement management-defined catalog creator role. You can add individual users, or you can add a group, whose members are then able to create catalogs.  After creating a catalog, they can subsequently add resources they own to their catalog.
 
 ## As an IT administrator, delegate to a catalog creator
 

articles/active-directory/governance/entitlement-management-scenarios.md

@@ -149,6 +149,10 @@ There are several ways that you can configure entitlement management for your or
 1. [View access packages for a user](entitlement-management-reports.md#view-access-packages-for-a-user)
 1. [View resource assignments for a user](entitlement-management-reports.md#view-resource-assignments-for-a-user)
 
+## Programmatic administration
+
+You can also manage access packages, catalogs, policies, requests and assignments using Microsoft Graph.  A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission can call the [entitlement management API](https://docs.microsoft.com/graph/api/resources/entitlementmanagement-root?view=graph-rest-beta).
+
 ## Next steps
 
 - [Delegation and roles](entitlement-management-delegate.md)

articles/active-directory/manage-apps/access-panel-collections.md

@@ -13,7 +13,7 @@ ms.workload: identity
 ms.tgt_pltfrm: na
 ms.devlang: na
 ms.topic: article
-ms.date: 01/28/2020
+ms.date: 02/10/2020
 ms.author: mimart
 ms.reviewer: kasimpso
 ms.collection: M365-identity-device-management
@@ -26,7 +26,7 @@ Your users can use the My Apps portal to view and start the cloud-based applicat
 > [!NOTE]
 > This article covers how an admin can enable and create collections. For information for the end user about how to use the My Apps portal and collections, see [Access and use collections](https://docs.microsoft.com/azure/active-directory/user-help/my-applications-portal-workspaces).
 
-## Enable My Apps preview features
+## Enable the latest My Apps features
 
 1. Open the [**Azure portal**](https://portal.azure.com/) and sign in as a user administrator or Global Administrator.
 
@@ -35,8 +35,8 @@ Your users can use the My Apps portal to view and start the cloud-based applicat
 3. Under **User feature previews**, select **Manage user feature preview settings**.
 
 4. Under **Users can use preview features for My Apps**, choose one of the following options:
-   * **Selected** - Enables preview features for a specific group. Use the **Select a group** option to select the group for which you want to enable preview features.  
-   * **All** - Enables preview features for all users.
+   * **Selected** - Enables the features for a specific group. Use the **Select a group** option to select the group for which you want to enable the features.  
+   * **All** - Enables the features for all users.
 
 > [!NOTE]
 > To open the My Apps portal, users can use the link `https://myapps.microsoft.com` or the customized link for your organization, such as `https://myapps.microsoft.com/contoso.com`. After you enable the new My Apps experience, the **An updated My Applications experience is available** banner will display at the top of the My Apps page, and users can select **Try it** to view the new experience. To stop using the new experience, users can select **Yes** from the **Leave new experience** banner at the top of the page.

articles/api-management/api-management-authentication-policies.md

@@ -150,7 +150,7 @@ In this example client certificate is identified by resource name.
 
 |Name|Description|Required|Default|  
 |----------|-----------------|--------------|-------------|  
-|resource|String. The App ID URI of the target web API (secured resource) in Azure Active Directory.|Yes|N/A|  
+|resource|String. The App ID of the target web API (secured resource) in Azure Active Directory.|Yes|N/A|  
 |output-token-variable-name|String. Name of the context variable that will receive token value as an object type `string`. |No|N/A|  
 |ignore-error|Boolean. If set to `true`, the policy pipeline will continue to execute even if an access token is not obtained.|No|false|