You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-maps/how-to-manage-authentication.md
+48-25Lines changed: 48 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,14 +13,15 @@ custom.ms: subject-rbac-steps
13
13
14
14
# Manage authentication in Azure Maps
15
15
16
-
When you create an Azure Maps account, your client ID is automatically generated along with primary and secondary keys that are required for authentication when using [Azure Active Directory (Azure AD)](../active-directory/fundamentals/active-directory-whatis.md) or [Shared Key authentication](./azure-maps-authentication.md#shared-key-authentication).
16
+
When you create an Azure Maps account, your client ID and shared keys are created automatically. These values are required for authentication when using either [Azure Active Directory (Azure AD)] or [Shared Key authentication].
17
17
18
18
## Prerequisites
19
19
20
-
Sign in to the [Azure portal](https://portal.azure.com). If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin.
21
-
- A familiarization with [managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md). Be sure to understand the two [Managed identity types](../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) and how they differ.
- A familiarization with [Azure Maps Authentication](./azure-maps-authentication.md).
20
+
Sign in to the [Azure portal]. If you don't have an Azure subscription, create a [free account] before you begin.
21
+
22
+
- A familiarization with [managed identities for Azure resources]. Be sure to understand the two [Managed identity types] and how they differ.
23
+
-[An Azure Maps account].
24
+
- A familiarization with [Azure Maps Authentication].
24
25
25
26
## View authentication details
26
27
@@ -29,7 +30,7 @@ Sign in to the [Azure portal](https://portal.azure.com). If you don't have an Az
29
30
30
31
To view your Azure Maps authentication details:
31
32
32
-
1. Sign in to the [Azure portal](https://portal.azure.com).
33
+
1. Sign in to the [Azure portal].
33
34
34
35
2. Select **All resources** in the **Azure services** section, then select your Azure Maps account.
35
36
@@ -41,18 +42,18 @@ To view your Azure Maps authentication details:
41
42
42
43
## Choose an authentication category
43
44
44
-
Depending on your application needs, there are specific pathways to application security. Azure AD defines specific authentication categories to support a wide range of authentication flows. To choose the best category for your application, see [application categories](../active-directory/develop/authentication-flows-app-scenarios.md#application-categories).
45
+
Depending on your application needs, there are specific pathways to application security. Azure AD defines specific authentication categories to support a wide range of authentication flows. To choose the best category for your application, see [application categories].
45
46
46
47
> [!NOTE]
47
48
> Understanding categories and scenarios will help you secure your Azure Maps application, whether you use Azure Active Directory or shared key authentication.
48
49
49
50
## How to add and remove managed identities
50
51
51
-
To enable [Shared access signature (SAS) token authentication](./azure-maps-authentication.md#shared-access-signature-token-authentication) with the Azure Maps REST API you need to add a user-assigned managed identity to your Azure Maps account.
52
+
To enable [Shared access signature (SAS) token authentication] with the Azure Maps REST API, you need to add a user-assigned managed identity to your Azure Maps account.
52
53
53
54
### Create a managed identity
54
55
55
-
You can create a user-assigned managed identity before or after creating a map account. You can add the managed identity through the portal, Azure management SDKs, or the Azure Resource Manager (ARM) template. To add a user-assigned managed identity through an ARM template, specify the resource identifier of the user-assigned managed identity. See example below:
56
+
You can create a user-assigned managed identity before or after creating a map account. You can add the managed identity through the portal, Azure management SDKs, or the Azure Resource Manager (ARM) template. To add a user-assigned managed identity through an ARM template, specify the resource identifier of the user-assigned managed identity.
56
57
57
58
```json
58
59
"identity": {
@@ -67,7 +68,7 @@ You can create a user-assigned managed identity before or after creating a map a
67
68
68
69
You can remove a system-assigned identity by disabling the feature through the portal or the Azure Resource Manager template in the same way that it was created. User-assigned identities can be removed individually. To remove all identities, set the identity type to `"None"`.
69
70
70
-
Removing a system-assigned identity in this way will also delete it from Azure AD. System-assigned identities are also automatically removed from Azure AD when the Azure Maps account is deleted.
71
+
Removing a system-assigned identity in this way also deletes it from Azure AD. System-assigned identities are also automatically removed from Azure AD when the Azure Maps account is deleted.
71
72
72
73
To remove all identities by using the Azure Resource Manager template, update this section:
73
74
@@ -79,20 +80,20 @@ To remove all identities by using the Azure Resource Manager template, update th
79
80
80
81
## Choose an authentication and authorization scenario
81
82
82
-
This table outlines common authentication and authorization scenarios in Azure Maps. Each scenario describes a type of app which can be used to access Azure Maps REST API. Use the links to learn detailed configuration information for each scenario.
83
+
This table outlines common authentication and authorization scenarios in Azure Maps. Each scenario describes a type of app that can be used to access Azure Maps REST API. Use the links to learn detailed configuration information for each scenario.
83
84
84
85
> [!IMPORTANT]
85
86
> For production applications, we recommend implementing Azure AD with Azure role-based access control (Azure RBAC).
|[Trusted daemon app or non-interactive client app]| Shared Key | N/A | Medium | High |
91
+
|[Trusted daemon or non-interactive client app]| Azure AD | High | Low | Medium |
92
+
|[Web single page app with interactive single-sign-on]| Azure AD | High | Medium | Medium |
93
+
|[Web single page app with non-interactive sign-on]| Azure AD | High | Medium | Medium |
94
+
|[Web app, daemon app, or non-interactive sign-on app]| SAS Token | High | Medium | Low |
95
+
|[Web application with interactive single-sign-on]| Azure AD | High | High | Medium |
96
+
|[IoT device or an input constrained application]| Azure AD | High | Medium | Medium |
96
97
97
98
## View built-in Azure Maps role definitions
98
99
@@ -131,7 +132,7 @@ Request a token from the Azure AD token endpoint. In your Azure AD request, use
131
132
| Azure public cloud |`https://login.microsoftonline.com`|`https://atlas.microsoft.com/`|
132
133
| Azure Government cloud |`https://login.microsoftonline.us`|`https://atlas.microsoft.com/`|
133
134
134
-
For more information about requesting access tokens from Azure AD for users and service principals, see [Authentication scenarios for Azure AD](../active-directory/develop/authentication-vs-authorization.md). To view specific scenarios, see [the table of scenarios](./how-to-manage-authentication.md#choose-an-authentication-and-authorization-scenario).
135
+
For more information about requesting access tokens from Azure AD for users and service principals, see [Authentication scenarios for Azure AD]. To view specific scenarios, see [the table of scenarios].
135
136
136
137
## Manage and rotate shared keys
137
138
@@ -142,14 +143,14 @@ Your Azure Maps subscription keys are similar to a root password for your Azure
142
143
143
144
### Manually rotate subscription keys
144
145
145
-
To help keep your Azure Maps account secure, we recommend periodically rotating your subscription keys. If possible, use Azure Key Vault to manage your access keys. If you aren't using Key Vault, you'll need to manually rotate your keys.
146
+
To help keep your Azure Maps account secure, we recommend periodically rotating your subscription keys. If possible, use Azure Key Vault to manage your access keys. If you aren't using Key Vault, you need to manually rotate your keys.
146
147
147
148
Two subscription keys are assigned so that you can rotate your keys. Having two keys ensures that your application maintains access to Azure Maps throughout the process.
148
149
149
150
To rotate your Azure Maps subscription keys in the Azure portal:
150
151
151
152
1. Update your application code to reference the secondary key for the Azure Maps account and deploy.
152
-
2. In the [Azure portal](https://portal.azure.com/), navigate to your Azure Maps account.
153
+
2. In the [Azure portal], navigate to your Azure Maps account.
153
154
3. Under **Settings**, select **Authentication**.
154
155
4. To regenerate the primary key for your Azure Maps account, select the **Regenerate** button next to the primary key.
155
156
5. Update your application code to reference the new primary key and deploy.
@@ -163,9 +164,31 @@ To rotate your Azure Maps subscription keys in the Azure portal:
163
164
Find the API usage metrics for your Azure Maps account:
164
165
165
166
> [!div class="nextstepaction"]
166
-
> [View usage metrics](how-to-view-api-usage.md)
167
+
> [View usage metrics]
167
168
168
169
Explore samples that show how to integrate Azure AD with Azure Maps:
169
170
170
171
> [!div class="nextstepaction"]
171
-
> [Azure AD authentication samples](https://github.com/Azure-Samples/Azure-Maps-AzureAD-Samples)
172
+
> [Azure AD authentication samples]
173
+
174
+
[Azure portal]: https://portal.azure.com/
175
+
[Azure AD authentication samples]: https://github.com/Azure-Samples/Azure-Maps-AzureAD-Samples
176
+
[View usage metrics]: how-to-view-api-usage.md
177
+
[Authentication scenarios for Azure AD]: ../active-directory/develop/authentication-vs-authorization.md
178
+
[the table of scenarios]: how-to-manage-authentication.md#choose-an-authentication-and-authorization-scenario
179
+
[Trusted daemon app or non-interactive client app]: how-to-secure-daemon-app.md
180
+
[Trusted daemon or non-interactive client app]: how-to-secure-daemon-app.md
181
+
[Web single page app with interactive single-sign-on]: how-to-secure-spa-users.md
182
+
[Web single page app with non-interactive sign-on]: how-to-secure-spa-app.md
183
+
[Web app, daemon app, or non-interactive sign-on app]: how-to-secure-sas-app.md
184
+
[Web application with interactive single-sign-on]: how-to-secure-webapp-users.md
185
+
[IoT device or an input constrained application]: how-to-secure-device-code.md
Copy file name to clipboardExpand all lines: articles/azure-maps/how-to-manage-creator.md
+31-16Lines changed: 31 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Manage Microsoft Azure Maps Creator
3
-
description: In this article, you'll learn how to manage Microsoft Azure Maps Creator.
3
+
description: This article demonstrates how to manage Microsoft Azure Maps Creator.
4
4
author: eriklindeman
5
5
ms.author: eriklind
6
6
ms.date: 01/20/2022
@@ -11,13 +11,13 @@ services: azure-maps
11
11
12
12
# Manage Azure Maps Creator
13
13
14
-
You can use Azure Maps Creator to create private indoor map data. Using the Azure Maps API and the Indoor Maps module, you can develop interactive and dynamic indoor map web applications. For pricing information, see the *Creator* section in [Azure Maps pricing](https://aka.ms/CreatorPricing).
14
+
You can use Azure Maps Creator to create private indoor map data. Using the Azure Maps API and the Indoor Maps module, you can develop interactive and dynamic indoor map web applications. For pricing information, see the *Creator* section in [Azure Maps pricing].
15
15
16
16
This article takes you through the steps to create and delete a Creator resource in an Azure Maps account.
17
17
18
18
## Create Creator resource
19
19
20
-
1. Sign in to the [Azure portal](https://portal.azure.com)
20
+
1. Sign in to the [Azure portal].
21
21
22
22
2. Navigate to the Azure portal menu. Select **All resources**, and then select your Azure Maps account.
23
23
@@ -51,26 +51,26 @@ To delete the Creator resource:
51
51
52
52
:::image type="content" source="./media/how-to-manage-creator/creator-delete.png" alt-text="A screenshot of the Azure Maps Creator Resource page with the delete button highlighted.":::
53
53
54
-
3. You'll be asked to confirm deletion by typing in the name of your Creator resource. After the resource is deleted, you see a confirmation page that looks like the following:
54
+
3. You're prompted to confirm deletion by typing in the name of your Creator resource. After the resource is deleted, you see a confirmation page that looks like the following example:
55
55
56
56
:::image type="content" source="./media/how-to-manage-creator/creator-confirm-delete.png" alt-text="A screenshot of the Azure Maps Creator Resource deletion confirmation page.":::
57
57
58
58
## Authentication
59
59
60
60
Creator inherits Azure Maps Access Control (IAM) settings. All API calls for data access must be sent with authentication and authorization rules.
61
61
62
-
Creator usage data is incorporated in your Azure Maps usage charts and activity log. For more information, see [Manage authentication in Azure Maps](./how-to-manage-authentication.md).
62
+
Creator usage data is incorporated in your Azure Maps usage charts and activity log. For more information, see [Manage authentication in Azure Maps].
63
63
64
64
>[!Important]
65
65
>We recommend using:
66
66
>
67
-
> * Azure Active Directory (Azure AD) in all solutions that are built with an Azure Maps account using Creator services. For more information, on Azure AD, see [Azure AD authentication](azure-maps-authentication.md#azure-ad-authentication).
67
+
> * Azure Active Directory (Azure AD) in all solutions that are built with an Azure Maps account using Creator services. For more information, on Azure AD, see [Azure AD authentication].
68
68
>
69
-
>* Role-based access control settings (RBAC). Using these settings, map makers can act as the Azure Maps Data Contributor role, and Creator map data users can act as the Azure Maps Data Reader role. For more information, see [Authorization with role-based access control](azure-maps-authentication.md#authorization-with-role-based-access-control).
69
+
>* Role-based access control settings (RBAC). Using these settings, map makers can act as the Azure Maps Data Contributor role, and Creator map data users can act as the Azure Maps Data Reader role. For more information, see [Authorization with role-based access control].
70
70
71
71
## Access to Creator services
72
72
73
-
Creator services and services that use data hosted in Creator (for example, Render service), are accessible at a geographical URL. The geographical URL is determined by the location selected during creation. For example, if Creator is created in a region in the United States geographical location, all calls to the Conversion service must be submitted to `us.atlas.microsoft.com/conversions`. To view mappings of region to geographical location, [see Creator service geographic scope](creator-geographic-scope.md).
73
+
Creator services and services that use data hosted in Creator (for example, Render service), are accessible at a geographical URL. The geographical URL determines the location selected during creation. For example, if Creator is created in a region in the United States geographical location, all calls to the Conversion service must be submitted to `us.atlas.microsoft.com/conversions`. To view mappings of region to geographical location, [see Creator service geographic scope].
74
74
75
75
Also, all data imported into Creator should be uploaded into the same geographical location as the Creator resource. For example, if Creator is provisioned in the United States, all raw data should be uploaded via `us.atlas.microsoft.com/mapData/upload`.
76
76
@@ -79,27 +79,42 @@ Also, all data imported into Creator should be uploaded into the same geographic
79
79
Introduction to Creator services for indoor mapping:
0 commit comments