You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/how-provisioning-works.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: active-directory
9
9
ms.subservice: app-provisioning
10
10
ms.topic: conceptual
11
11
ms.workload: identity
12
-
ms.date: 12/10/2019
12
+
ms.date: 05/20/2020
13
13
ms.author: mimart
14
14
ms.reviewer: arvinh
15
15
---
@@ -59,7 +59,7 @@ When you configure provisioning to a SaaS application, one of the types of attri
59
59
60
60
For outbound provisioning from Azure AD to a SaaS application, relying on [user or group assignments](../manage-apps/assign-user-or-group-access-portal.md) is the most common way to determine which users are in scope for provisioning. Because user assignments are also used for enabling single sign-on, the same method can be used for managing both access and provisioning. Assignment-based scoping doesn't apply to inbound provisioning scenarios such as Workday and Successfactors.
61
61
62
-
***Groups.** With an Azure AD Premium license plan, you can use groups to assign access to a SaaS application. Then, when the provisioning scope is set to **Sync only assigned users and groups**, the Azure AD provisioning service will provision or de-provision users based on whether they're members of a group that's assigned to the application. The group object itself isn't provisioned unless the application supports group objects. Ensure that groups assigned to your application have the property "SecurityEnabled" set to "False".
62
+
***Groups.** With an Azure AD Premium license plan, you can use groups to assign access to a SaaS application. Then, when the provisioning scope is set to **Sync only assigned users and groups**, the Azure AD provisioning service will provision or de-provision users based on whether they're members of a group that's assigned to the application. The group object itself isn't provisioned unless the application supports group objects. Ensure that groups assigned to your application have the property "SecurityEnabled" set to "True".
63
63
64
64
***Dynamic groups.** The Azure AD user provisioning service can read and provision users in [dynamic groups](../users-groups-roles/groups-create-rule.md). Keep these caveats and recommendations in mind:
> Consider [enabling the admin consent workflow](configure-admin-consent-workflow.md) to allow users to request an administrator's review and approval of an application that the user is not allowed to consent to--for example, when user consent has been disabled or when an application is requesting permissions that the user is not allowed to grant.
@@ -97,7 +97,7 @@ Permission classifications allow you to identify the impact that different permi
97
97
98
98
In this example, we've classified the minimum set of permission required for single sign-on:
> For the Microsoft Graph API, the minimum permissions needed to do basic single sign on are `openid`, `profile`, `User.Read` and `offline_access`. With these permissions an app can read the profile details of the signed-in user and can maintain this access even when the user is no longer using the app.
@@ -187,7 +187,7 @@ You can configure which users are allowed to consent to apps accessing their gro
187
187
188
188
In this example, all group owners are allowed to consent to apps accessing their groups' data:
Copy file name to clipboardExpand all lines: articles/azure-resource-manager/templates/deployment-script-template.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: azure-resource-manager
5
5
author: mumian
6
6
ms.service: azure-resource-manager
7
7
ms.topic: conceptual
8
-
ms.date: 05/06/2020
8
+
ms.date: 05/20/2020
9
9
ms.author: jgao
10
10
11
11
---
@@ -250,6 +250,8 @@ You can control how PowerShell responds to non-terminating errors by using the [
250
250
251
251
Setting environment variables (EnvironmentVariable) in your container instances allows you to provide dynamic configuration of the application or script run by the container. Deployment script handles non-secured and secured environment variables in the same way as Azure Container Instance. For more information, see [Set environment variables in container instances](../../container-instances/container-instances-environment-variables.md#secure-values).
252
252
253
+
The max allowed size for environment variables is 64KB.
254
+
253
255
## Debug deployment scripts
254
256
255
257
The script service creates a [storage account](../../storage/common/storage-account-overview.md) (unless you specify an existing storage account) and a [container instance](../../container-instances/container-instances-overview.md) for script execution. If these resources are automatically created by the script service, both resources have the **azscripts** suffix in the resource names.
Copy file name to clipboardExpand all lines: articles/backup/backup-azure-sap-hana-database.md
+33-38Lines changed: 33 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,66 +27,61 @@ In this article, you will learn how to:
27
27
28
28
Refer to the [prerequisites](tutorial-backup-sap-hana-db.md#prerequisites) and the [What the pre-registration script does](tutorial-backup-sap-hana-db.md#what-the-pre-registration-script-does) sections to set up the database for backup.
29
29
30
-
### Set up network connectivity
30
+
### Establish network connectivity
31
31
32
-
For all operations, the SAP HANA VM requires connectivity to Azure public IP addresses. VM operations (database discovery, configure backups, schedule backups, restore recovery points, and so on) fail without connectivity to Azure public IP addresses.
32
+
For all operations, an SAP HANA database running on an Azure VM requires connectivity to the Azure Backup service, Azure Storage, and Azure Active Directory. This can be achieved by using private endpoints or by allowing access to the required public IP addresses or FQDNs. Not allowing proper connectivity to the required Azure services may lead to failure in operations like database discovery, configuring backup, performing backups, and restoring data.
33
33
34
-
Establish connectivity by using one of the following options:
34
+
The following table lists the various alternatives you can use for establishing connectivity:
| Private endpoints | Allow backups over private IPs inside the virtual network <br><br> Provide granular control on the network and vault side | Incurs standard private endpoint [costs](https://azure.microsoft.com/pricing/details/private-link/)|
39
+
| NSG service tags | Easier to manage as range changes are automatically merged <br><br> No additional costs | Can be used with NSGs only <br><br> Provides access to the entire service |
40
+
| Azure Firewall FQDN tags | Easier to manage since the required FQDNs are automatically managed | Can be used with Azure Firewall only |
41
+
| Allow access to service FQDNs/IPs | No additional costs <br><br> Works with all network security appliances and firewalls | A broad set of IPs or FQDNs may be required to be accessed |
42
+
| Use an HTTP proxy | Single point of internet access to VMs | Additional costs to run a VM with the proxy software |
37
43
38
-
This option allows the [IP ranges](https://www.microsoft.com/download/details.aspx?id=41653) in the downloaded file. To access a network security group (NSG), use the Set-AzureNetworkSecurityRule cmdlet. If your safe recipients list only includes region-specific IPs, you'll also need to update the safe recipients list the Azure Active Directory (Azure AD) service tag to enable authentication.
44
+
More details around using these options are shared below:
39
45
40
-
#### Allow access using NSG tags
46
+
#### Private endpoints
41
47
42
-
If you use NSG to restrict connectivity, then you should use AzureBackup service tag to allows outbound access to Azure Backup. In addition, you should also allow connectivity for authentication and data transfer by using [rules](https://docs.microsoft.com/azure/virtual-network/security-overview#service-tags) for Azure AD and Azure Storage. This can be done from the Azure portal or via PowerShell.
48
+
Private endpoints allow you to connect securely from servers inside a virtual network to your Recovery Services vault. The private endpoint uses an IP from the VNET address space for your vault. The network traffic between your resources inside the virtual network and the vault travels over your virtualnetwork and a private link on the Microsoft backbone network. This eliminates exposure from the public internet. Read more on private endpoints for Azure Backup [here](https://docs.microsoft.com/azure/backup/private-endpoints).
43
49
44
-
To create a rule using the portal:
50
+
#### NSG tags
45
51
46
-
1. In **All Services**, go to **Network security groups** and select the network security group.
47
-
2. Select **Outbound security rules** under **Settings**.
48
-
3. Select **Add**. Enter all the required details for creating a new rule as described in [security rule settings](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group#security-rule-settings). Ensure the option **Destination** is set to **Service Tag** and **Destination service tag** is set to **AzureBackup**.
49
-
4. Click **Add**, to save the newly created outbound security rule.
52
+
If you use Network Security Groups (NSG), use the *AzureBackup* service tag to allow outbound access to Azure Backup. In addition to the Azure Backup tag, you also need to allow connectivity for authentication and data transfer by creating similar [NSG rules](https://docs.microsoft.com/azure/virtual-network/security-overview#service-tags) for *Azure AD* and *Azure Storage*. The following steps describe the process to create a rule for the Azure Backup tag:
50
53
51
-
To create a rule using PowerShell:
54
+
1. In **All Services**, go to **Network security groups** and select the network security group.
52
55
53
-
1. Add Azure account credentials and update the national clouds<br/>
54
-
`Add-AzureRmAccount`<br/>
56
+
1. Select **Outbound security rules** under **Settings**.
55
57
56
-
2. Select the NSG subscription<br/>
57
-
`Select-AzureRmSubscription "<Subscription Id>"`
58
+
1. Select **Add**. Enter all the required details for creating a new rule as described in [security rule settings](https://docs.microsoft.com/azure/virtual-network/manage-network-security-group#security-rule-settings). Ensure the option **Destination** is set to *Service Tag* and **Destination service tag** is set to *AzureBackup*.
If you're using Azure Firewall, create an application rule by using the *AzureBackup*[Azure Firewall FQDN tag](https://docs.microsoft.com/azure/firewall/fqdn-tags). This allows all outbound access to Azure Backup.
**Allow access by using Azure Firewall tags**. If you're using Azure Firewall, create an application rule by using the AzureBackup [FQDN tag](https://docs.microsoft.com/azure/firewall/fqdn-tags). This allows outbound access to Azure Backup.
70
+
If you choose to allow access service IPs, refer to the IP ranges in the JSON file available [here](https://www.microsoft.com/download/confirmation.aspx?id=56519). You'll need to allow access to IPs corresponding to Azure Backup, Azure Storage, and Azure Active Directory.
75
71
76
-
**Deploy an HTTP proxy server to route traffic**. When you back up an SAP HANA database on an Azure VM, the backup extension on the VM uses the HTTPS APIs to send management commands to Azure Backup and data to Azure Storage. The backup extension also uses Azure AD for authentication. Route the backup extension traffic for these three services through the HTTP proxy. The extensions are the only component that's configured for access to the public internet.
72
+
#### Allow access to service FQDNs
77
73
78
-
Connectivity options include the following advantages and disadvantages:
74
+
You can also use the following FQDNs to allow access to the required services from your servers:
79
75
80
-
**Option** | **Advantages** | **Disadvantages**
81
-
--- | --- | ---
82
-
Allow IP ranges | No additional costs | Complex to manage because the IP address ranges change over time <br/><br/> Provides access to the whole of Azure, not just Azure Storage
83
-
Use NSG service tags | Easier to manage as range changes are automatically merged <br/><br/> No additional costs <br/><br/> | Can be used with NSGs only <br/><br/> Provides access to the entire service
84
-
Use Azure Firewall FQDN tags | Easier to manage as the required FQDNs are automatically managed | Can be used with Azure Firewall only
85
-
Use an HTTP proxy | Granular control in the proxy over the storage URLs is allowed <br/><br/> Single point of internet access to VMs <br/><br/> Not subject to Azure IP address changes | Additional costs to run a VM with the proxy software
| Azure AD | Allow access to FQDNs under sections 56 and 59 according to [this article](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online)|
When you back up an SAP HANA database running on an Azure VM, the backup extension on the VM uses the HTTPS APIs to send management commands to Azure Backup and data to Azure Storage. The backup extension also uses Azure AD for authentication. Route the backup extension traffic for these three services through the HTTP proxy. Use the list of IPs and FQDNs mentioned above for allowing access to the required services. Authenticated proxy servers aren't supported.
90
85
91
86
[!INCLUDE [How to create a Recovery Services vault](../../includes/backup-create-rs-vault.md)]
0 commit comments