Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into WI-63283-episode-twenty-six

Author: AlizaBernstein

articles/active-directory/app-provisioning/user-provisioning.md

@@ -7,7 +7,7 @@ ms.service: active-directory
 ms.subservice: app-provisioning
 ms.topic: overview
 ms.workload: identity
-ms.date: 02/09/2023
+ms.date: 02/14/2023
 ms.author: kenwith
 ms.reviewer: arvinh
 ---
@@ -20,7 +20,7 @@ In Azure Active Directory (Azure AD), the term *app provisioning* refers to auto
 
 Azure AD application provisioning refers to automatically creating user identities and roles in the applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change. Common scenarios include provisioning an Azure AD user into SaaS applications like [Dropbox](../../active-directory/saas-apps/dropboxforbusiness-provisioning-tutorial.md), [Salesforce](../../active-directory/saas-apps/salesforce-provisioning-tutorial.md), [ServiceNow](../../active-directory/saas-apps/servicenow-provisioning-tutorial.md), and many more.
 
-Azure AD also supports provisioning users into applications hosted on-premises or in a virtual machine, without having to open up any firewalls. If your application supports [SCIM](https://aka.ms/scimoverview), or you've built a SCIM gateway to connect to your legacy application, you can use the Azure AD Provisioning agent to [directly connect](./on-premises-scim-provisioning.md) with your application and automate provisioning and deprovisioning. If you have legacy applications that don't support SCIM and rely on an [LDAP](./on-premises-ldap-connector-configure.md) user store or a [SQL](./tutorial-ecma-sql-connector.md) database, Azure AD can support those as well. 
+Azure AD also supports provisioning users into applications hosted on-premises or in a virtual machine, without having to open up any firewalls. Your application must support [SCIM](https://aka.ms/scimoverview). Or, you must build a SCIM gateway to connect to your legacy application. If so, you can use the Azure AD Provisioning agent to [directly connect](./on-premises-scim-provisioning.md) with your application and automate provisioning and deprovisioning. If you have legacy applications that don't support SCIM and rely on an [LDAP](./on-premises-ldap-connector-configure.md) user store or a [SQL](./tutorial-ecma-sql-connector.md) database, Azure AD can support these applications as well. 
 
 App provisioning lets you:
 

articles/active-directory/conditional-access/overview.md

@@ -6,15 +6,15 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: conditional-access
 ms.topic: overview
-ms.date: 11/07/2022
+ms.date: 02/13/2023
 
 ms.author: joflore
 author: MicrosoftGuyJFlo
 manager: amycolannino
 ms.reviewer: calebb
 
 ms.collection: M365-identity-device-management
-ms.custom: contperf-fy20q4, azuread-video-2020
+ms.custom: zt-include
 ---
 # What is Conditional Access?
 
@@ -97,6 +97,8 @@ When licenses required for Conditional Access expire, policies aren't automatica
 
 [Security defaults](../fundamentals/concept-fundamentals-security-defaults.md) help protect against identity-related attacks and are available for all customers.  
 
+[!INCLUDE [active-directory-zero-trust](../../../includes/active-directory-zero-trust.md)]
+
 ## Next steps
 
 - [Building a Conditional Access policy piece by piece](concept-conditional-access-policies.md)

articles/active-directory/develop/howto-handle-samesite-cookie-changes-chrome-browser.md

@@ -9,11 +9,12 @@ ms.service: active-directory
 ms.subservice: develop
 ms.workload: identity
 ms.topic: conceptual
-ms.date: 01/27/2020
+ms.date: 02/07/2023
 ms.author: henrymbugua
 ms.reviewer: kkrishna, jmprieur
 ms.custom: aaddev
 ---
+
 # Handle SameSite cookie changes in Chrome browser
 
 ## What is SameSite?
@@ -29,7 +30,7 @@ By default, the `SameSite` value is NOT set in browsers and that's why there are
 
 Recent [updates to the standards on SameSite](https://tools.ietf.org/html/draft-west-cookie-incrementalism-00) propose protecting apps by making the default behavior of `SameSite` when no value is set to Lax. This mitigation means cookies will be restricted on HTTP requests except GET made from other sites. Additionally, a value of **None** is introduced to remove restrictions on cookies being sent. These updates will soon be released in an upcoming version of the Chrome browser.
 
-When web apps authenticate with the Microsoft Identity platform using the response mode "form_post", the login server responds to the application using an HTTP POST to send the tokens or auth code. Because this request is a cross-domain request (from `login.microsoftonline.com` to your domain - for instance `https://contoso.com/auth`), cookies that were set by your app now fall under the new rules in Chrome. The cookies that need to be used in cross-site scenarios are cookies that hold the *state* and *nonce* values, that are also sent in the login request. There are other cookies dropped by Azure AD to hold the session.
+When web apps authenticate with the Microsoft identity platform using the response mode "form_post", the login server responds to the application using an HTTP POST to send the tokens or auth code. Because this request is a cross-domain request (from `login.microsoftonline.com` to your domain - for instance `https://contoso.com/auth`), cookies that were set by your app now fall under the new rules in Chrome. The cookies that need to be used in cross-site scenarios are cookies that hold the _state_ and _nonce_ values, that are also sent in the login request. There are other cookies dropped by Azure Active Directory (Azure AD) to hold the session.
 
 If you don't update your web apps, this new behavior will result in authentication failures.
 
@@ -39,17 +40,17 @@ To overcome the authentication failures, web apps authenticating with the Micros
 Other browsers (see [here](https://www.chromium.org/updates/same-site/incompatible-clients) for a complete list) follow the previous behavior of `SameSite` and won't include the cookies if `SameSite=None` is set.
 That's why, to support authentication on multiple browsers web apps will have to set the `SameSite` value to `None` only on Chrome and leave the value empty on other browsers.
 
-This approach is demonstrated in our code samples below.
+This approach is demonstrated in the following sample code.
 
 # [.NET](#tab/dotnet)
 
-The table below presents the pull requests that worked around the SameSite changes in our ASP.NET and ASP.NET Core samples.
+The following table presents the pull requests that worked around the SameSite changes in our ASP.NET and ASP.NET Core samples.
 
-| Sample | Pull request |
-| ------ | ------------ |
-|  [ASP.NET Core web app incremental tutorial](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2)  |  [Same site cookie fix #261](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/pull/261)  |
-|  [ASP.NET MVC web app sample](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect)  |  [Same site cookie fix #35](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/pull/35)  |
-|  [active-directory-dotnet-admin-restricted-scopes-v2](https://github.com/azure-samples/active-directory-dotnet-admin-restricted-scopes-v2)  |  [Same site cookie fix #28](https://github.com/Azure-Samples/active-directory-dotnet-admin-restricted-scopes-v2/pull/28)  |
+| Sample                                                                                                                                    | Pull request                                                                                                               |
+| ----------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| [ASP.NET Core web app incremental tutorial](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2)         | [Same site cookie fix #261](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/pull/261) |
+| [ASP.NET MVC web app sample](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect)                                    | [Same site cookie fix #35](https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/pull/35)               |
+| [active-directory-dotnet-admin-restricted-scopes-v2](https://github.com/azure-samples/active-directory-dotnet-admin-restricted-scopes-v2) | [Same site cookie fix #28](https://github.com/Azure-Samples/active-directory-dotnet-admin-restricted-scopes-v2/pull/28)    |
 
 for details on how to handle SameSite cookies in ASP.NET and ASP.NET Core, see also:
 
@@ -58,16 +59,16 @@ for details on how to handle SameSite cookies in ASP.NET and ASP.NET Core, see a
 
 # [Python](#tab/python)
 
-| Sample |
-| ------ |
-|  [ms-identity-python-webapp](https://github.com/Azure-Samples/ms-identity-python-webapp)  |
+| Sample                                                                                  |
+| --------------------------------------------------------------------------------------- |
+| [ms-identity-python-webapp](https://github.com/Azure-Samples/ms-identity-python-webapp) |
 
 # [Java](#tab/java)
 
-| Sample | Pull request |
-| ------ | ------------ |
-|  [ms-identity-java-webapp](https://github.com/Azure-Samples/ms-identity-java-webapp)  | [Same site cookie fix #24](https://github.com/Azure-Samples/ms-identity-java-webapp/pull/24)
-|  [ms-identity-java-webapi](https://github.com/Azure-Samples/ms-identity-java-webapi)  | [Same site cookie fix #4](https://github.com/Azure-Samples/ms-identity-java-webapi/pull/4)
+| Sample                                                                              | Pull request                                                                                 |
+| ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| [ms-identity-java-webapp](https://github.com/Azure-Samples/ms-identity-java-webapp) | [Same site cookie fix #24](https://github.com/Azure-Samples/ms-identity-java-webapp/pull/24) |
+| [ms-identity-java-webapi](https://github.com/Azure-Samples/ms-identity-java-webapi) | [Same site cookie fix #4](https://github.com/Azure-Samples/ms-identity-java-webapi/pull/4)   |
 
 ---
 
@@ -79,4 +80,4 @@ Learn more about SameSite and the Web app scenario:
 
 - [Chromium SameSite page](https://www.chromium.org/updates/same-site)
 
-- [Scenario: Web app that signs in users](scenario-web-app-sign-user-overview.md)
+- [Scenario: Web app that signs in users](scenario-web-app-sign-user-overview.md)

articles/active-directory/develop/scenario-desktop-acquire-token-wam.md

@@ -129,7 +129,7 @@ Applications cannot remove accounts from Windows!
 - Removes app-only (not OS-wide) accounts.
 
 >[!NOTE]
-> Ony users can remove OS accounts, whereas apps themselves cannot. If an OS account is passed into `RemoveAsync`, and then `GetAccounts` is called with `ListWindowsWorkAndSchoolAccounts` enabled, the same OS accounts will still be returned.
+> Only users can remove OS accounts, whereas apps themselves cannot. If an OS account is passed into `RemoveAsync`, and then `GetAccounts` is called with `ListWindowsWorkAndSchoolAccounts` enabled, the same OS accounts will still be returned.
 
 ## Other considerations
 

articles/active-directory/develop/scenario-web-app-call-api-call-api.md

@@ -150,7 +150,7 @@ public async Task<IActionResult> Profile()
 > [!NOTE]
 > You can use the same principle to call any web API.
 >
-> Most Azure web APIs provide an SDK that simplifies calling the API as is the case for Microsoft Graph. See, for instance, [Create a web application that authorizes access to Blob storage with Azure AD](../../storage/common/storage-auth-aad-app.md?tabs=dotnet&toc=%2fazure%2fstorage%2fblobs%2ftoc.json) for an example of a web app using Microsoft.Identity.Web and using the Azure Storage SDK.
+> Most Azure web APIs provide an SDK that simplifies calling the API as is the case for Microsoft Graph.
 
 # [Java](#tab/java)