Merge pull request #264650 from flang-msft/fxl---entra-preview-changes

Fxl---entra preview changes

Author: AnnaMHuff

articles/azure-cache-for-redis/TOC.yml

@@ -131,10 +131,10 @@
 
 - name: Authentication and authorization
   items:
-  - name: Role-based access control
-    href: cache-configure-role-based-access-control.md
   - name: Microsoft Entra ID for authentication
     href: cache-azure-active-directory-for-authentication.md
+  - name: Role-based access control
+    href: cache-configure-role-based-access-control.md
   - name: Managed identity for storage accounts
     href: cache-managed-identity.md
 

articles/azure-cache-for-redis/cache-azure-active-directory-for-authentication.md

@@ -7,22 +7,21 @@ author: flang-msft
 ms.custom: references_regions
 ms.service: cache
 ms.topic: conceptual
-ms.date: 06/23/2023
+ms.date: 02/07/2024
 ms.author: franlanglois
 
 ---
 
-# Use Microsoft Entra ID for cache authentication
+# Use Microsoft Entra ID (preview) for cache authentication
 
 Azure Cache for Redis offers two methods to authenticate to your cache instance:
 
-- [access key](cache-configure.md#access-keys)
+- [Access keys](cache-configure.md#access-keys)
+- [Microsoft Entra ID (preview)](cache-configure.md#preview-microsoft-entra-authentication)
 
-- [Microsoft Entra token](/azure/active-directory/develop/access-tokens)
+Although access key authentication is simple, it comes with a set of challenges around security and password management. For contrast, in this article, you learn how to use a Microsoft Entra token for cache authentication.
 
-Although access key authentication is simple, it comes with a set of challenges around security and password management. In this article, you learn  how to use a Microsoft Entra token for cache authentication.
-
-Azure Cache for Redis offers a password-free authentication mechanism by integrating with [Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-whatis). This integration also includes [role-based access control](/azure/role-based-access-control/) functionality provided through [access control lists (ACLs)](https://redis.io/docs/management/security/acl/) supported in open source Redis.
+Azure Cache for Redis offers a password-free authentication mechanism by integrating with [Microsoft Entra ID (preview)](/azure/active-directory/fundamentals/active-directory-whatis). This integration also includes [role-based access control](/azure/role-based-access-control/) functionality provided through [access control lists (ACLs)](https://redis.io/docs/management/security/acl/) supported in open source Redis.
 
 To use the ACL integration, your client application must assume the identity of a Microsoft Entra entity, like service principal or managed identity, and connect to your cache. In this article, you learn how to use your service principal or managed identity to connect to your cache, and how to grant your connection predefined permissions based on the Microsoft Entra artifact being used for the connection.
 
@@ -34,77 +33,74 @@ To use the ACL integration, your client application must assume the identity of
 
 ## Prerequisites and limitations
 
-- To enable Microsoft Entra token-based authentication for your Azure Cache for Redis instance, at least one Redis user must be configured under the **Data Access Policy** setting in the Resource menu.
-- Microsoft Entra ID-based authentication is supported for SSL connections and TLS 1.2 only.
-- Microsoft Entra ID-based authentication isn't supported on Azure Cache for Redis instances that run Redis version 4.
+- Microsoft Entra ID-based authentication is supported for SSL connections and TLS 1.2 or higher.
 - Microsoft Entra ID-based authentication isn't supported on Azure Cache for Redis instances that [depend on Cloud Services](./cache-faq.yml#caches-with-a-dependency-on-cloud-services--classic).
 - Microsoft Entra ID based authentication isn't supported in the Enterprise tiers of Azure Cache for Redis Enterprise.
 - Some Redis commands are blocked. For a full list of blocked commands, see [Redis commands not supported in Azure Cache for Redis](cache-configure.md#redis-commands-not-supported-in-azure-cache-for-redis).
 
 > [!IMPORTANT]
-> Once a connection is established using Microsoft Entra token, client applications must periodically refresh Microsoft Entra token before expiry, and send an `AUTH` command to Redis server to avoid disruption of connections. For more information, see [Configure your Redis client to use Microsoft Entra ID](#configure-your-redis-client-to-use-azure-active-directory).
-
-<a name='enable-azure-ad-token-based-authentication-on-your-cache'></a>
+> Once a connection is established using Microsoft Entra token, client applications must periodically refresh Microsoft Entra token before expiry, and send an `AUTH` command to Redis server to avoid disruption of connections. For more information, see [Configure your Redis client to use Microsoft Entra ID](#configure-your-redis-client-to-use-microsoft-entra-id).
 
-## Enable Microsoft Entra token based authentication on your cache
+## Enable Microsoft Entra ID authentication on your cache
 
 1. In the Azure portal, select the Azure Cache for Redis instance where you'd like to configure Microsoft Entra token-based authentication.
 
-1. Select **(PREVIEW) Data Access Configuration** from the Resource menu.
+1. Select **Authentication** from the Resource menu.
 
-1. Select "**Add**" and choose **New Redis User**.
+1. In the working pane, select **(PREVIEW) Enable Microsoft Entra Authentication**.
 
-1. On the **Access Policy** tab, select one the available policies in the table: **Owner**, **Contributor**, or **Reader**. Then, select the **Next:Redis Users**.
+1. Select **Enable Microsoft Entra Authentication**, and enter the name of a valid user. The user you enter is automatically assigned _Data Owner Access Policy_ by default when you select **Save**. You can also enter a managed identity or service principal to connect to your cache instance.
 
-   :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-new-redis-user.png" alt-text="Screenshot showing the available Access Policies.":::
+    :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-enable-microsoft-entra.png" alt-text="Screenshot showing authentication selected in the resource menu and the enable Microsoft Entra authentication checked.":::
 
-1. Choose either the **User or service principal** or **Managed Identity** to determine how you want to use for authenticate to your Azure Cache for Redis instance.
+1. A popup dialog box displays asking if you want to update your configuration, and informing you that it takes several minutes. Select **Yes.**
 
-1. Then, select **Select members** and select  **Select**. Then, select **Next : Review + Design**.
-   :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-select-members.png" alt-text="Screenshot showing members to add as New Redis Users.":::
+   > [!IMPORTANT]
+   > Once the enable operation is complete, the nodes in your cache instance reboots to load the new configuration. We recommend performing this operation during your maintenance window or outside your peak business hours. The operation can take up to 30 minutes.
+
+## Using data access configuration with your cache
+
+If you would like to use a custom access policy instead of Redis Data Owner, go to the **Data Access Configuration** on the Resource menu. For more information, see [Configure a custom data access policy for your application](cache-configure-role-based-access-control.md#configure-a-custom-data-access-policy-for-your-application).
+
+1. In the Azure portal, select the Azure Cache for Redis instance where you'd like to add to the Data Access Configuration.
+
+1. Select **(PREVIEW) Data Access Configuration** from the Resource menu.
 
-1. From the Resource menu, select **Advanced settings**.
+1. Select **Add** and choose **New Redis User**.
 
-1. Check the box labeled **(PREVIEW) Enable Microsoft Entra Authorization** and select **OK**. Then, select **Save**.
+1. On the **Access Policy** tab, select one the available policies in the table: **Data Owner**, **Data Contributor**, or **Data Reader**. Then, select the **Next:Redis Users**.
 
-   :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-azure-ad-access-authorization.png" alt-text="Screenshot of Microsoft Entra ID access authorization.":::
+   :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-new-redis-user.png" alt-text="Screenshot showing the available Access Policies.":::
+
+1. Choose either the **User or service principal** or **Managed Identity** to determine how to assign access to your Azure Cache for Redis instance. If you select **User or service principal**,and you want to add a _user_, you must first [enable Microsoft Entra Authentication](#enable-microsoft-entra-id-authentication-on-your-cache).
+
+1. Then, select **Select members** and select  **Select**. Then, select **Next : Review + Assign**.
+   :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-select-members.png" alt-text="Screenshot showing members to add as New Redis Users.":::
 
 1. A dialog box displays a popup notifying you that upgrading is permanent and might cause a brief connection blip. Select **Yes.**
 
    > [!IMPORTANT]
    > Once the enable operation is complete, the nodes in your cache instance reboots to load the new configuration. We recommend performing this operation during your maintenance window or outside your peak business hours. The operation can take up to 30 minutes.
 
-<a name='configure-your-redis-client-to-use-azure-active-directory'></a>
-
 ## Configure your Redis client to use Microsoft Entra ID
 
-Because most Azure Cache for Redis clients assume that a password/access key is used for authentication, you likely need to update your client workflow to support authentication using Microsoft Entra ID. In this section, you learn how to configure your client applications to connect to Azure Cache for Redis using a Microsoft Entra token.
-
-:::image type="content" source="media/cache-azure-active-directory-for-authentication/azure-ad-token.png" alt-text="Architecture diagram showing the flow of a token from Microsoft Entra ID to a customer application to a cache.":::
+Because most Azure Cache for Redis clients assume that a password and access key are used for authentication, you likely need to update your client workflow to support authentication using Microsoft Entra ID. In this section, you learn how to configure your client applications to connect to Azure Cache for Redis using a Microsoft Entra token.
 
-<a name='azure-ad-client-workflow'></a>
+<!-- :::image type="content" source="media/cache-azure-active-directory-for-authentication/azure-ad-token.png" alt-text="Architecture diagram showing the flow of a token from Microsoft Entra ID to a customer application to a cache."::: -->
 
 ### Microsoft Entra Client Workflow
 
-1. Configure your client application to acquire a Microsoft Entra token for scope  `https://redis.azure.com/.default` or `acca5fbb-b7e4-4009-81f1-37e38fd66d78/.default` using the [Microsoft Authentication Library (MSAL)](/azure/active-directory/develop/msal-overview).
-
-   <!-- (ADD code snippet) -->
+1. Configure your client application to acquire a Microsoft Entra token for scope,  `https://redis.azure.com/.default` or `acca5fbb-b7e4-4009-81f1-37e38fd66d78/.default`, using the [Microsoft Authentication Library (MSAL)](/azure/active-directory/develop/msal-overview).
 
 1. Update your Redis connection logic to use following `UserName` and `Password`:
 
-   - `UserName` = Object ID of your managed identity or service principal
-
-   - `Password` = Microsoft Entra token that you acquired using MSAL
-
-   <!-- (ADD code snippet) -->
+    `UserName` = Object ID of your managed identity or service principal
+    `Password` = Microsoft Entra token that you acquired using MSAL
 
 1. Ensure that your client executes a Redis [AUTH command](https://redis.io/commands/auth/) automatically before your Microsoft Entra token expires using:
 
-   - `UserName` = Object ID of your managed identity or service principal
-
-   - `Password` = Microsoft Entra token refreshed periodically
-
-   <!-- (ADD code snippet) -->
+    `UserName` = Object ID of your managed identity or service principal
+    `Password` = Microsoft Entra token refreshed periodically
 
 ### Client library support
 
@@ -124,8 +120,6 @@ The following table includes links to code samples, which demonstrate how to con
 | ioredis             | Node.js        | [ioredis code sample](https://aka.ms/redis/aad/sample-code/js-ioredis)    |
 | node-redis          | Node.js        | [node-redis code sample](https://aka.ms/redis/aad/sample-code/js-noderedis)  |
 
-<a name='best-practices-for-azure-ad-authentication'></a>
-
 ### Best practices for Microsoft Entra authentication
 
 - Configure private links or firewall rules to protect your cache from a Denial of Service attack.

articles/azure-cache-for-redis/cache-configure-role-based-access-control.md

@@ -94,7 +94,7 @@ The following list contains some examples of permission strings for various scen
 
 - Allow application to execute only _read_ commands
 
-    Permissions string: `+@read *`
+    Permissions string: `+@read ~*`
 
 - Allow application to execute _read_ command category and set command on keys with prefix `Az`.
 
@@ -116,22 +116,22 @@ The following list contains some examples of permission strings for various scen
 
 1. [Configure Permissions](#permissions-for-your-data-access-policy) as per your requirements.
 
-1. From the Resource menu, select **Advanced settings**.
+1. To add a user to the access policy using Microsoft Entra ID, you must first enable Microsoft Entra ID by selecting **Authentication** from the Resource menu.
 
-1. If not checked already, Check the box labeled **(PREVIEW) Enable Microsoft Entra Authorization** and select **OK**. Then, select **Save**.
+1. Select **(PREVIEW) Enable Microsoft Entra Authentication** as the tab in the working pane.
 
-   :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-azure-ad-access-authorization.png" alt-text="Screenshot of Microsoft Entra ID access authorization.":::
+1. If not checked already, check the box labeled **(PREVIEW) Enable Microsoft Entra Authentication** and select **OK**. Then, select **Save**.
 
-1. A dialog box displays a popup notifying you that upgrading is permanent and might cause a brief connection blip. Select **Yes.**
+   :::image type="content" source="media/cache-azure-active-directory-for-authentication/cache-enable-microsoft-entra.png" alt-text="Screenshot of Microsoft Entra ID access authorization.":::
+
+1. A popup dialog box displays asking if you want to update your configuration, and informing you that it takes several minutes. Select **Yes.**
 
    > [!IMPORTANT]
    > Once the enable operation is complete, the nodes in your cache instance reboots to load the new configuration. We recommend performing this operation during your maintenance window or outside your peak business hours. The operation can take up to 30 minutes.
 
-<a name='configure-your-redis-client-to-use-azure-active-directory'></a>
-
 ## Configure your Redis client to use Microsoft Entra ID
 
-Now that you have configured Redis User and Data access policy for configuring role based access control, you need to update your client workflow to support authenticating using a specific user/password. To learn how to configure you client application to connect to your cache instance as a specific Redis User, see [Configure your Redis client to use Azure AD.](cache-azure-active-directory-for-authentication.md#configure-your-redis-client-to-use-azure-active-directory)
+Now that you have configured Redis User and Data access policy for configuring role based access control, you need to update your client workflow to support authenticating using a specific user/password. To learn how to configure your client application to connect to your cache instance as a specific Redis User, see [Configure your Redis client to use Microsoft Entra ID](cache-azure-active-directory-for-authentication.md#configure-your-redis-client-to-use-microsoft-entra-id).
 
 ## Next steps