Skip to content

Commit 7e5ffef

Browse files
v-ccolinv-ccolin
authored
Merge pull request #206917 from MicrosoftDocs/main
Merge main to live, 4 AM
2 parents 0c8e213 + aab13a7 commit 7e5ffef

File tree

332 files changed

+6650
-2963
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

332 files changed

+6650
-2963
lines changed

‎.openpublishing.publish.config.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -978,6 +978,7 @@
978978
".openpublishing.redirection.app-service.json",
979979
".openpublishing.redirection.key-vault.json",
980980
".openpublishing.redirection.sql-database.json",
981+
".openpublishing.redirection.machine-configuration.json",
981982
".openpublishing.redirection.security-benchmark.json",
982983
"articles/synapse-analytics/.openpublishing.redirection.synapse-analytics.json",
983984
".openpublishing.redirection.azure-web-pubsub.json",

‎.openpublishing.redirection.active-directory.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@
5555
"redirect_url": "/azure/active-directory/authentication/how-to-mfa-registration-campaign",
5656
"redirect_document_id": false
5757
},
58+
{
59+
"source_path_from_root": "/articles/active-directory/develop/workload-identity-federation-create-trust-github.md",
60+
"redirect_url":"/azure/active-directory/develop/workload-identity-federation-create-trust",
61+
"redirect_document_id": false
62+
},
5863
{
5964
"source_path_from_root": "/articles/active-directory/develop/active-directory-v2-limitations.md",
6065
"redirect_url": "/azure/active-directory/azuread-dev/azure-ad-endpoint-comparison",

‎.openpublishing.redirection.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7641,6 +7641,16 @@
76417641
"redirect_url": "/azure/azure-monitor/app/overview-dashboard",
76427642
"redirect_document_id": true
76437643
},
7644+
{
7645+
"source_path_from_root": "/articles/azure-monitor/agents/azure-monitor-agent-overview.md",
7646+
"redirect_url": "/azure/azure-monitor/agents/agents-overview",
7647+
"redirect_document_id": true
7648+
},
7649+
{
7650+
"source_path_from_root": "/azure/azure-monitor/agents/agents-overview.md#log-analytics-agent",
7651+
"redirect_url": "/azure/azure-monitor/agents/log-analytics-agent",
7652+
"redirect_document_id": true
7653+
},
76447654
{
76457655
"source_path_from_root": "/articles/cognitive-services/Computer-vision/deploy-computer-vision-on-container-instances.md",
76467656
"redirect_url": "/azure/cognitive-services/containers/azure-container-instance-recipe",

‎.openpublishing.redirection.machine-configuration.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"redirections": [
3+
{
4+
"source_path_from_root": "/articles/governance/policy/concepts/guest-configuration.md",
5+
"redirect_url": "/azure/governance/machine-configuration/overview",
6+
"redirect_document_id": false
7+
},
8+
{
9+
"source_path_from_root": "/articles/governance/policy/concepts/guest-configuration-policy-effects.md",
10+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-policy-effects",
11+
"redirect_document_id": false
12+
},
13+
{
14+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-desired-state-configuration-extension-migration.md",
15+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-dsc-extension-migration",
16+
"redirect_document_id": false
17+
},
18+
{
19+
"source_path_from_root": "/articles/governance/policy/concepts/guest-configuration-custom.md",
20+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-custom",
21+
"redirect_document_id": false
22+
},
23+
{
24+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-create.md",
25+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-create",
26+
"redirect_document_id": false
27+
},
28+
{
29+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-create-test.md",
30+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-create-test",
31+
"redirect_document_id": false
32+
},
33+
{
34+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-create-signing.md",
35+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-create-signing",
36+
"redirect_document_id": false
37+
},
38+
{
39+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-create-setup.md",
40+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-create-setup",
41+
"redirect_document_id": false
42+
},
43+
{
44+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-create-publish.md",
45+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-create-publish",
46+
"redirect_document_id": false
47+
},
48+
{
49+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-create-definition.md",
50+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-create-definition",
51+
"redirect_document_id": false
52+
},
53+
{
54+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-create-assignment.md",
55+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-create-assignment",
56+
"redirect_document_id": false
57+
},
58+
{
59+
"source_path_from_root": "/articles/governance/policy/how-to/guest-configuration-azure-automation-migration.md",
60+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-azure-automation-migration",
61+
"redirect_document_id": false
62+
},
63+
{
64+
"source_path_from_root": "/articles/governance/policy/concepts/guest-configuration-assignments.md",
65+
"redirect_url": "/azure/governance/machine-configuration/machine-configuration-assignments",
66+
"redirect_document_id": false
67+
},
68+
]
69+
}

‎.whatsnew/.azure-monitor.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"$schema": "https://whatsnewapi.azurewebsites.net/schema",
3+
"docSetProductName": "Azure Monitor",
4+
"rootDirectory": "articles/azure-monitor/",
5+
"docLinkSettings": {
6+
"linkFormat": "relative",
7+
"relativeLinkPrefix": "/azure/azure-monitor/"
8+
},
9+
"inclusionCriteria": {
10+
"labels": [
11+
"label:whats-new"
12+
],
13+
"minAdditionsToFile": 1
14+
},
15+
"areas": [
16+
{
17+
"names": ["."],
18+
"heading": "General"
19+
},
20+
{
21+
"names":["agents"],
22+
"heading": "Agents"
23+
},
24+
{
25+
"names":["alters"],
26+
"heading": "Alerts"
27+
},
28+
{
29+
"names":["app"],
30+
"heading": "Application Insights"
31+
},
32+
{
33+
"names":["autoscale"],
34+
"heading": "Autoscale"
35+
},
36+
{
37+
"names":["change"],
38+
"heading": "Change Analysis"
39+
},
40+
{
41+
"names":["containers"],
42+
"heading": "Containers"
43+
},
44+
{
45+
"names":["essentials"],
46+
"heading": "Essentials"
47+
},
48+
{
49+
"names":["insights"],
50+
"heading": "Insights"
51+
},
52+
{
53+
"names":["logs"],
54+
"heading": "Logs"
55+
},
56+
{
57+
"names":["media"],
58+
"heading": "Media"
59+
},
60+
{
61+
"names":["profiler"],
62+
"heading": "Profiler"
63+
},
64+
{
65+
"names":["snapshot-debugger"],
66+
"heading": "Snapshot Debugger"
67+
},
68+
{
69+
"names":["visualize"],
70+
"heading": "Visualize"
71+
},
72+
{
73+
"names":["vm"],
74+
"heading": "VMs"
75+
}
76+
]
77+
}

‎articles/active-directory-domain-services/manage-group-policy.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ This article shows you how to install the Group Policy Management tools, then ed
2424
If you are interested in server management strategy, including machines in Azure and
2525
[hybrid connected](../azure-arc/servers/overview.md),
2626
consider reading about the
27-
[guest configuration](../governance/policy/concepts/guest-configuration.md)
27+
[guest configuration](../governance/machine-configuration/overview.md)
2828
feature of
2929
[Azure Policy](../governance/policy/overview.md).
3030

‎articles/active-directory/authentication/howto-authentication-passwordless-security-key-windows.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ services: active-directory
66
ms.service: active-directory
77
ms.subservice: authentication
88
ms.topic: how-to
9-
ms.date: 05/04/2022
9+
ms.date: 07/06/2022
1010

1111
ms.author: justinha
1212
author: justinha
@@ -30,7 +30,7 @@ This document focuses on enabling FIDO2 security key based passwordless authenti
3030
| [Azure AD joined devices](../devices/concept-azure-ad-join.md) require Windows 10 version 1909 or higher | X | |
3131
| [Hybrid Azure AD joined devices](../devices/concept-azure-ad-join-hybrid.md) require Windows 10 version 2004 or higher | | X |
3232
| Fully patched Windows Server 2016/2019 Domain Controllers. | | X |
33-
| [Azure AD Connect](../hybrid/how-to-connect-install-roadmap.md#install-azure-ad-connect) version 1.4.32.0 or later | | X |
33+
| [Azure AD Hybrid Authentication Management module](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.1.1.0) | | X |
3434
| [Microsoft Endpoint Manager](/intune/fundamentals/what-is-intune) (Optional) | X | X |
3535
| Provisioning package (Optional) | X | X |
3636
| Group Policy (Optional) | | X |

‎articles/active-directory/develop/TOC.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,6 @@
148148
href: workload-identity-federation.md
149149
- name: Trust an external identity provider (federation)
150150
href: workload-identity-federation-create-trust.md
151-
- name: Configure an app to trust a GitHub repo
152-
href: workload-identity-federation-create-trust-github.md
153151
- name: Access identity platform-protected resources from GCP
154152
href: workload-identity-federation-create-trust-gcp.md
155153
- name: Exchange AD FS SAML for Microsoft Graph access token

‎articles/active-directory/develop/includes/workload-identity-federation-apps-considerations.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
title: Workload identity federation for app considerations
3+
description: Important considerations and restrictions for creating a federated identity credential on an app.
4+
services: active-directory
5+
author: rwike77
6+
manager: CelesteDG
7+
8+
ms.service: active-directory
9+
ms.subservice: develop
10+
ms.workload: identity
11+
ms.topic: include
12+
ms.date: 07/29/2022
13+
ms.author: ryanwi
14+
ms.reviewer: shkhalid, udayh, vakarand
15+
ms.custom: aaddev
16+
---
17+
18+
## Important considerations and restrictions
19+
20+
Anyone with permissions to create an app registration and add a secret or certificate can add a federated identity credential. If the **Users can register applications** switch in the [User Settings](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/UserSettings) blade is set to **No**, however, you won't be able to create an app registration or configure the federated identity credential. Find an admin to configure the federated identity credential on your behalf. Anyone in the Application Administrator or Application Owner roles can do this.
21+
22+
A maximum of 20 federated identity credentials can be added to an application.
23+
24+
When you configure a federated identity credential, there are several important pieces of information to provide.
25+
26+
*issuer* and *subject* are the key pieces of information needed to set up the trust relationship. The combination of `issuer` and `subject` must be unique on the app. When the external software workload requests Microsoft identity platform to exchange the external token for an access token, the *issuer* and *subject* values of the federated identity credential are checked against the `issuer` and `subject` claims provided in the external token. If that validation check passes, Microsoft identity platform issues an access token to the external software workload.
27+
28+
*issuer* is the URL of the external identity provider and must match the `issuer` claim of the external token being exchanged. Required. If the `issuer` claim has leading or trailing whitespace in the value, the token exchange is blocked. This field has a character limit of 600 characters.
29+
30+
*subject* is the identifier of the external software workload and must match the `sub` (`subject`) claim of the external token being exchanged. *subject* has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. This field has a character limit of 600 characters.
31+
32+
> [!IMPORTANT]
33+
> The *subject* setting values must exactly match the configuration on the GitHub workflow configuration. Otherwise, Microsoft identity platform will look at the incoming external token and reject the exchange for an access token. You won't get an error, the exchange fails without error.
34+
35+
> [!IMPORTANT]
36+
> If you accidentally add the incorrect external workload information in the *subject* setting the federated identity credential is created successfully without error. The error does not become apparent until the token exchange fails.
37+
38+
*audiences* lists the audiences that can appear in the external token. Required. The recommended value is "api://AzureADTokenExchange". It says what Microsoft identity platform must accept in the `aud` claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you may need to create a new application registration in your IdP to serve as the audience of this token. This field can only accept a single value and has a limit of 600 characters.
39+
40+
*name* is the unique identifier for the federated identity credential. Required. This field has a character limit of 120 characters and must be URL friendly. It is immutable once created.
41+
42+
*description* is the user-provided description of the federated identity credential. Optional. The description is not validated or checked by Azure AD. This field has a limit of 600 characters.

articles/active-directory/develop/media/workload-identity-federation-create-trust-github/add-credential.png renamed to articles/active-directory/develop/media/workload-identity-federation-create-trust/add-credential.png

File renamed without changes.

0 commit comments

Comments
 (0)