updating

Author: billmath

articles/active-directory/hybrid/how-to-connect-pta-quick-start.md

@@ -1,5 +1,5 @@
 ---
-title: 'Azure AD Pass-through Authentication - Quick start | Microsoft Docs'
+title: 'Azure AD Pass-through Authentication - Quickstart | Microsoft Docs'
 description: This article describes how to get started with Azure Active Directory (Azure AD) Pass-through Authentication.
 services: active-directory
 keywords: Azure AD Connect Pass-through Authentication, install Active Directory, required components for Azure AD, SSO, Single Sign-on
@@ -18,7 +18,7 @@ ms.author: billmath
 ms.collection: M365-identity-device-management
 ---
 
-# Azure Active Directory Pass-through Authentication: Quick start
+# Azure Active Directory Pass-through Authentication: Quickstart
 
 ## Deploy Azure AD Pass-through Authentication
 
@@ -61,12 +61,12 @@ Ensure that the following prerequisites are in place.
      | **8080** (optional) | Authentication Agents report their status every ten minutes over port 8080, if port 443 is unavailable. This status is displayed on the Azure AD portal. Port 8080 is _not_ used for user sign-ins. |
      
      If your firewall enforces rules according to the originating users, open these ports for traffic from Windows services that run as a network service.
-   - If your firewall or proxy allows DNS whitelisting, whitelist connections to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If not, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
+   - If your firewall or proxy allows DNS whitelisting, add connections to **\*.msappproxy.net** and **\*.servicebus.windows.net**. If not, allow access to the [Azure datacenter IP ranges](https://www.microsoft.com/download/details.aspx?id=41653), which are updated weekly.
    - Your Authentication Agents need access to **login.windows.net** and **login.microsoftonline.com** for initial registration. Open your firewall for those URLs as well.
    - For certificate validation, unblock the following URLs: **mscrl.microsoft.com:80**, **crl.microsoft.com:80**, **ocsp.msocsp.com:80**, and **www\.microsoft.com:80**. Since these URLs are used for certificate validation with other Microsoft products you may already have these URLs unblocked.
 
 ### Azure Government cloud prerequisite
-Prior to enabling Pass-through Authentication through Azure AD Connect with Step 2, download the latest release of the PTA agent from the Azure Portal.  You need to ensure that your agent is versions **x.x.xxx.x** or later.  To verify your agent see [Upgrade authentication agents](how-to-connect-pta-upgrade-preview-authentication-agents.md)
+Prior to enabling Pass-through Authentication through Azure AD Connect with Step 2, download the latest release of the PTA agent from the Azure portal.  You need to ensure that your agent is versions **x.x.xxx.x** or later.  To verify your agent see [Upgrade authentication agents](how-to-connect-pta-upgrade-preview-authentication-agents.md)
 
 After downloading the latest release of the agent, proceed with the below instructions to configure Pass-Through Authentication through Azure AD Connect.
 
@@ -114,8 +114,8 @@ If you plan to deploy Pass-through Authentication in a production environment, y
 Installing multiple Pass-through Authentication Agents ensures high availability, but not deterministic load balancing between the Authentication Agents. To determine how many Authentication Agents you need for your tenant, consider the peak and average load of sign-in requests that you expect to see on your tenant. As a benchmark, a single Authentication Agent can handle 300 to 400 authentications per second on a standard 4-core CPU, 16-GB RAM server.
 
 To estimate network traffic, use the following sizing guidance:
-- Each request has a payload size of (0.5K + 1K * num_of_agents) bytes; i.e., data from Azure AD to the Authentication Agent. Here, "num_of_agents" indicates the number of Authentication Agents registered on your tenant.
-- Each response has a payload size of 1K bytes; i.e., data from the Authentication Agent to Azure AD.
+- Each request has a payload size of (0.5K + 1K * num_of_agents) bytes, that is, data from Azure AD to the Authentication Agent. Here, "num_of_agents" indicates the number of Authentication Agents registered on your tenant.
+- Each response has a payload size of 1K bytes, that is, data from the Authentication Agent to Azure AD.
 
 For most customers, three Authentication Agents in total are sufficient for high availability and capacity. You should install Authentication Agents close to your domain controllers to improve sign-in latency.
 

articles/active-directory/hybrid/reference-connect-government-cloud.md

@@ -1,5 +1,5 @@
 ---
-title: 'Azure AD Connect: Hybrid Identity Considerations for Azure Government '
+title: 'Azure AD Connect: Hybrid identity considerations for Azure Government'
 description: Special considerations for deploying Azure AD Connect with the government cloud.
 services: active-directory
 author: billmath
@@ -14,9 +14,9 @@ ms.collection: M365-identity-device-management
 ---
 
 # Hybrid identity considerations for Azure Government 
-The following document describes the considerations for implementing a hybrid environment with the Azure Government cloud.  This information is provide as reference for administrators and architects who are working with the Azure Government cloud.  
+The following document describes the considerations for implementing a hybrid environment with the Azure Government cloud.  This information is provided as reference for administrators and architects who are working with the Azure Government cloud.  
 > [!NOTE] 
-> In order to integrate an on-premises AD environment with the Azure Governemnt cloud you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594). 
+> In order to integrate an on-premises AD environment with the Azure Governemnt cloud, you need to upgrade to the latest release of [Azure AD Connect](https://www.microsoft.com/download/details.aspx?id=47594). 
 
 > [!NOTE] 
 > For a full list of U.S. Government DoD Endpoints, refer to the [documentation](https://docs.microsoft.com/office365/enterprise/office-365-u-s-government-dod-endpoints) 
@@ -25,7 +25,7 @@ The following document describes the considerations for implementing a hybrid en
 The following information is provided for implementation of pass-through authentication (PTA) and the Azure Government cloud.
 
 ### Allow access to URLs  
-Before deploying the pass-through authentication agent, verify if there is a firewall between your servers and Azure AD. If your firewall or proxy allows DNS whitelisting, whitelist the following connections: 
+Before deploying the pass-through authentication agent, verify if there is a firewall between your servers and Azure AD. If your firewall or proxy allows DNS whitelisting, add the following connections: 
 > [!NOTE]
 > The following guidance also applies to installing the [Application Proxy connector](https://aka.ms/whyappproxy) for Azure Government environments.
 
@@ -36,7 +36,7 @@ Before deploying the pass-through authentication agent, verify if there is a fir
 |login.windows.us secure.aadcdn.microsoftonline-p.com *.microsoftonline.us </br>*.microsoftonline-p.us </br>*.msauth.net </br>*.msauthimages.net </br>*.msecnd.net</br>*.msftauth.net </br>*.msftauthimages.net</br>*.phonefactor.net </br>enterpriseregistration.windows.net</br>management.azure.com </br>policykeyservice.dc.ad.msft.net</br>ctdl.windowsupdate.us:80| The agent uses these URLs during the registration process.| 
 
 ### Install the agent for the Azure Government cloud 
-In order to install the agent for the Azure Government cloud you must follow these specific steps: 
+In order to install the agent for the Azure Government cloud, you must follow these specific steps: 
 In the command line terminal, navigate to folder where the executable for installing the agent is located. 
 Run the following command which specifies the installation is for Azure Government. 
 
@@ -53,7 +53,8 @@ AADApplicationProxyConnectorInstaller.exe ENVIRONMENTNAME="AzureUSGovernment"
 ## Single sign on 
 Set up your Azure AD Connect server: If you use Pass-through Authentication as your sign-in method, no additional prerequisite check is required. If you use password hash synchronization as your sign-in method, and if there is a firewall between Azure AD Connect and Azure AD, ensure that:
 - You use version 1.1.644.0 or later of Azure AD Connect. 
-- If your firewall or proxy allows DNS whitelisting, whitelist the connections to the *.msapproxy.us URLs over port 443. If not, allow access to the Azure datacenter IP ranges, which are updated weekly. This prerequisite is applicable only when you enable the feature. It is not required for actual user sign-ins. 
+- If your firewall or proxy allows DNS whitelisting, add the connections to the *.msapproxy.us URLs over port 443. If not, allow access to the Azure datacenter IP ranges, which are updated weekly. Th
+- is prerequisite is applicable only when you enable the feature. It is not required for actual user sign-ins. 
 
 ### Rolling out seamless SSO 
 You can gradually roll out Seamless SSO to your users using the instructions provided below. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory: