You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Most hacking related breaches use either stolen or weak passwords. Often, IT will enforce stronger password complexity or frequent password changes to reduce the risk of a security incident. However, this increases help desk costs and leads to poor user experiences as users are required to memorize or store new, complex passwords.
17
17
18
-
FIDO2 security keys offer an alternative. FIDO2 security keys can replace weak credentials with strong hardware-backed public/private-key credentials which cannot be reused, replayed, or shared across services. Security keys support shared device scenarios, allowing you to carry your credential with you and safely authenticate to an Azure Active Directory joined Windows 10 device that’s part of your organization.
18
+
FIDO2 security keys offer an alternative. FIDO2 security keys can replace weak credentials with strong hardware-backed public/private-key credentials which can't be reused, replayed, or shared across services. Security keys support shared device scenarios, allowing you to carry your credential with you and safely authenticate to an Azure Active Directory joined Windows 10 device that’s part of your organization.
19
19
20
20
Microsoft partners with FIDO2 security key vendors to ensure that security devices work on Windows, the Microsoft Edge browser, and online Microsoft accounts, to enable strong password-less authentication.
21
21
22
22
You can become a Microsoft-compatible FIDO2 security key vendor through the following process. Microsoft doesn't commit to do go-to-market activities with the partner and will evaluate partner priority based on customer demand.
23
23
24
-
1. First, your authenticator needs to have a FIDO2 certification. We will not be able to work with providers who do not have a FIDO2 certification. To learn more about the certification, please visit this website: [https://fidoalliance.org/certification/](https://fidoalliance.org/certification/)
24
+
1. First, your authenticator needs to have a FIDO2 certification. We won't be able to work with providers who don't have a FIDO2 certification. To learn more about the certification, please visit this website: [https://fidoalliance.org/certification/](https://fidoalliance.org/certification/)
25
25
2. After you have a FIDO2 certification, please fill in your request to our form here: [https://forms.office.com/r/NfmQpuS9hF](https://forms.office.com/r/NfmQpuS9hF). Our engineering team will only test compatibility of your FIDO2 devices. We won't test security of your solutions.
26
26
3. Once we confirm a move forward to the testing phase, the process usually take about 3-6 months. The steps usually involve:
27
27
- Initial discussion between Microsoft and your team.
28
28
- Verify FIDO Alliance Certification or the path to certification if not complete
29
29
- Receive an overview of the device from the vendor
30
30
- Microsoft will share our test scripts with you. Our engineering team will be able to answer questions if you have any specific needs.
31
-
- You will complete and send all passed results to Microsoft Engineering team
31
+
- You'll complete and send all passed results to Microsoft Engineering team
32
32
4. Upon successful passing of all tests by Microsoft Engineering team, Microsoft will confirm vendor's device is listed in [the FIDO MDS](https://fidoalliance.org/metadata/).
33
33
5. Microsoft will add your FIDO2 Security Key on Azure AD backend and to our list of approved FIDO2 vendors.
34
34
35
35
## Current partners
36
36
37
37
The following table lists partners who are Microsoft-compatible FIDO2 security key vendors.
Copy file name to clipboardExpand all lines: articles/active-directory/fundamentals/users-default-permissions.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ Users and contacts | <ul><li>Enumerate the list of all users and contacts<li>Rea
37
37
Groups | <ul><li>Create security groups<li>Create Microsoft 365 groups<li>Enumerate the list of all groups<li>Read all properties of groups<li>Read non-hidden group memberships<li>Read hidden Microsoft 365 group memberships for joined groups<li>Manage properties, ownership, and membership of groups that the user owns<li>Add guests to owned groups<li>Manage dynamic membership settings<li>Delete owned groups<li>Restore owned Microsoft 365 groups</li></ul> | <ul><li>Read properties of non-hidden groups, including membership and ownership (even non-joined groups)<li>Read hidden Microsoft 365 group memberships for joined groups<li>Search for groups by display name or object ID (if allowed)</li></ul> | <ul><li>Read object ID for joined groups<li>Read membership and ownership of joined groups in some Microsoft 365 apps (if allowed)</li></ul>
38
38
Applications | <ul><li>Register (create) new applications<li>Enumerate the list of all applications<li>Read properties of registered and enterprise applications<li>Manage application properties, assignments, and credentials for owned applications<li>Create or delete application passwords for users<li>Delete owned applications<li>Restore owned applications</li></ul> | <ul><li>Read properties of registered and enterprise applications</li></ul> | <ul><li>Read properties of registered and enterprise applications
39
39
Devices</li></ul> | <ul><li>Enumerate the list of all devices<li>Read all properties of devices<li>Manage all properties of owned devices</li></ul> | No permissions | No permissions
40
-
Directory | <ul><li>Read all company information<li>Read all domains<li>Read all partner contracts</li></ul> | <ul><li>Read company display name<li>Read all domains</li></ul> | <ul><li>Read company display name<li>Read all domains</li></ul>
40
+
Organization | <ul><li>Read all company information<li>Read all domains<li>Read configuration of certificate-based authentication<li>Read all partner contracts</li></ul> | <ul><li>Read company display name<li>Read all domains<li>Read configuration of certificate-based authentication</li></ul> | <ul><li>Read company display name<li>Read all domains</li></ul>
41
41
Roles and scopes | <ul><li>Read all administrative roles and memberships<li>Read all properties and membership of administrative units</li></ul> | No permissions | No permissions
42
42
Subscriptions | <ul><li>Read all subscriptions<li>Enable service plan memberships</li></ul> | No permissions | No permissions
43
43
Policies | <ul><li>Read all properties of policies<li>Manage all properties of owned policies</li></ul> | No permissions | No permissions
Copy file name to clipboardExpand all lines: articles/active-directory/saas-apps/mural-identity-tutorial.md
+35-6Lines changed: 35 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: saas-app-tutorial
10
10
ms.workload: identity
11
11
ms.topic: tutorial
12
-
ms.date: 12/10/2021
12
+
ms.date: 09/19/2022
13
13
ms.author: jeedes
14
14
15
15
---
@@ -86,10 +86,12 @@ Follow these steps to enable Azure AD SSO in the Azure portal.
86
86
| Name | Source Attribute|
87
87
| -------- | --------- |
88
88
| email | user.userprincipalname |
89
+
| FirstName | user.givenname |
90
+
| LastName | user.surname |
89
91
90
-
1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, find **Certificate (Base64)** and select **Download** to download the certificate and save it on your computer.
92
+
1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, find **Certificate (PEM)** and select **Download** to download the certificate and save it on your computer.
1. On the **Set up MURAL Identity** section, copy the appropriate URL(s) based on your requirement.
95
97
@@ -121,7 +123,34 @@ In this section, you'll enable B.Simon to use Azure single sign-on by granting a
121
123
122
124
## Configure MURAL Identity SSO
123
125
124
-
To configure single sign-on on **MURAL Identity** side, you need to send the downloaded **Certificate (Base64)** and appropriate copied URLs from Azure portal to [MURAL Identity support team](mailto:[email protected]). They set this setting to have the SAML SSO connection set properly on both sides.
126
+
1. Log in to the MURAL Identity website as an administrator.
127
+
128
+
1. Click your **name** in the bottom left corner of the dashboard and select **Company dashboard** from the list of options.
129
+
130
+
1. Click **SSO** in the left sidebar and perform the below steps.
131
+
132
+
133
+
134
+
a. Download the **MURAL's metadata**.
135
+
136
+
b. In the **Sign in URL** textbox, paste the **Login URL** value, which you have copied from the Azure portal.
137
+
138
+
c. In the **Sign in certificate**, upload the **Certificate (PEM)**, which you have downloaded from the Azure portal.
139
+
140
+
d. Select **HTTP-POST** as the Request binding type and select **SHA256** as the Sign in algorithm type.
141
+
142
+
e. In the **Claim mapping** section, fill the following fields.
* First name: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`
147
+
148
+
* Last name: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`
149
+
150
+
f. Click **Test single sign-on** to test the configuration and **Save** it.
151
+
152
+
> [!NOTE]
153
+
> For more information on how to configure the SSO at MURAL, please follow [this](https://support.mural.co/articles/6224385-mural-s-azure-ad-integration) support page.
125
154
126
155
### Create MURAL Identity test user
127
156
@@ -135,13 +164,13 @@ In this section, you test your Azure AD single sign-on configuration with follow
135
164
136
165
* Click on **Test this application** in Azure portal. This will redirect to MURAL Identity Sign on URL where you can initiate the login flow.
137
166
138
-
* Go to MURAL Identity Sign-on URL directly and initiate the login flow from there.
167
+
* Go to MURAL Identity Signon URL directly and initiate the login flow from there.
139
168
140
169
#### IDP initiated:
141
170
142
171
* Click on **Test this application** in Azure portal and you should be automatically signed in to the MURAL Identity for which you set up the SSO.
143
172
144
-
You can also use Microsoft My Apps to test the application in any mode. When you click the MURAL Identity tile in the My Apps, if configured in SP mode you would be redirected to the application signon page for initiating the login flow and if configured in IDP mode, you should be automatically signed in to the MURAL Identity for which you set up the SSO. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).
173
+
You can also use Microsoft My Apps to test the application in any mode. When you click the MURAL Identity tile in the My Apps, if configured in SP mode you would be redirected to the application sign-on page for initiating the login flow and if configured in IDP mode, you should be automatically signed in to the MURAL Identity for which you set up the SSO. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).
Copy file name to clipboardExpand all lines: articles/aks/faq.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -303,7 +303,7 @@ AKS doesn't apply Network Security Groups (NSGs) to its subnet and doesn't modif
303
303
304
304
## How does Time syncronization work in AKS?
305
305
306
-
AKS nodes run the "chrony" service which pulls time from the localhost, which in turn sync time with ntp.ubuntu.com. Containers running on pods get the time from the AKS nodes. Applications launched inside a container use time from the container of the pod.
306
+
AKS nodes run the "chrony" service which pulls time from the localhost. Containers running on pods get the time from the AKS nodes. Applications launched inside a container use time from the container of the pod.
0 commit comments