You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Enable combined security information registration in Azure Active Directory
19
19
20
-
Before combined registration, users registered authentication methods for Azure AD Multi-Factor Authentication and self-service password reset (SSPR) separately. People were confused that similar methods were used for Azure AD Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Azure AD Multi-Factor Authentication and SSPR.
20
+
Before combined registration, users registered authentication methods for Azure AD Multi-Factor Authentication and self-service password reset (SSPR) separately. Users were confused that similar methods were used for Azure AD Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Azure AD Multi-Factor Authentication and SSPR.
21
21
22
22
> [!NOTE]
23
-
> Effective Oct. 1st, 2022, we will begin to enable combined registration for all users in Azure AD tenants created before August 15th, 2020. Tenants created after this date are enabled with combined registration.
23
+
> Effective Mar. 14th, 2023 combined registration is now the default MFA and SSPR registration experience for all organizations.
24
24
25
-
To make sure you understand the functionality and effects before you enable the new experience, see the [Combined security information registration concepts](concept-registration-mfa-sspr-combined.md).
25
+
To help you understand the functionality and effects of the new experience, see the [Combined security information registration concepts](concept-registration-mfa-sspr-combined.md).
26
26
27
27
28
28
29
-
## Enable combined registration
30
-
31
-
To enable combined registration, complete these steps:
32
-
33
-
1. Sign in to the Azure portal as a user administrator or global administrator.
34
-
2. Go to **Azure Active Directory** > **User settings** > **Manage user feature settings**.
35
-
3. Under **Users can use the combined security information registration experience**, choose to enable for a **Selected** group of users or for **All** users.
36
-
37
-
38
-
39
-
> [!IMPORTANT]
40
-
> If your Azure tenant has already been enabled for combined registration, you might not see the configuration option for **Users can use the combined security information registration experience** or even see it grayed out.
41
-
42
-
> [!NOTE]
43
-
> After you enable combined registration, users who register or confirm their phone number or mobile app through the new experience can use them for Azure AD Multi-Factor Authentication and SSPR, if those methods are enabled in the Azure AD Multi-Factor Authentication and SSPR policies.
44
-
>
45
-
> If you then disable this experience, users who go to the previous SSPR registration page at `https://aka.ms/ssprsetup` are required to perform multi-factor authentication before they can access the page.
46
-
47
-
If you have configured the *Site to Zone Assignment List* in Internet Explorer, the following sites have to be in the same zone:
## Conditional Access policies for combined registration
55
30
56
31
To secure when and how users register for Azure AD Multi-Factor Authentication and self-service password reset, you can use user actions in Conditional Access policy. This functionality may be enabled in organizations that want users to register for Azure AD Multi-Factor Authentication and SSPR from a central location, such as a trusted network location during HR onboarding.
@@ -91,6 +66,6 @@ Complete the following steps to create a policy that applies to all selected use
91
66
92
67
If you need help, see [troubleshoot combined security info registration](howto-registration-mfa-sspr-combined-troubleshoot.md) or learn [What is the location condition in Azure AD Conditional Access?](../conditional-access/location-condition.md)
93
68
94
-
Once users are enabled for combined registration, you can then [enable self-service password reset](tutorial-enable-sspr.md) and [enable Azure AD Multi-Factor Authentication](tutorial-enable-azure-mfa.md).
69
+
Review how you can [enable self-service password reset](tutorial-enable-sspr.md) and [enable Azure AD Multi-Factor Authentication](tutorial-enable-azure-mfa.md) in your tenant.
95
70
96
71
If needed, learn how to [force users to re-register authentication methods](howto-mfa-userdevicesettings.md#manage-user-authentication-options).
Copy file name to clipboardExpand all lines: articles/aks/enable-host-encryption.md
+6-8Lines changed: 6 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,17 +24,17 @@ This feature can only be set at cluster creation or node pool creation time.
24
24
25
25
### Prerequisites
26
26
27
-
-Make sure you have the CLI extension v2.23 or higher version installed.
27
+
-Ensure you have the CLI extension v2.23 or higher version installed.
28
28
29
29
### Limitations
30
30
31
31
- Can only be enabled on new node pools.
32
32
- Can only be enabled in [Azure regions][supported-regions] that support server-side encryption of Azure managed disks and only with specific [supported VM sizes][supported-sizes].
33
-
- Requires an AKS cluster and node pool based on Virtual Machine Scale Sets as *VM set type*.
33
+
- Requires an AKS cluster and node pool based on Virtual Machine Scale Sets(VMSS) as *VM set type*.
34
34
35
35
## Use host-based encryption on new clusters
36
36
37
-
Configure the cluster agent nodes to use host-based encryption when the cluster is created.
37
+
Configure the cluster agent nodes to use host-based encryption when the cluster is created.
38
38
39
39
```azurecli-interactive
40
40
az aks create --name myAKSCluster --resource-group myResourceGroup -s Standard_DS2_v2 -l westus2 --enable-encryption-at-host
@@ -52,13 +52,11 @@ az aks nodepool add --name hostencrypt --cluster-name myAKSCluster --resource-gr
52
52
53
53
If you want to create new node pools without the host-based encryption feature, you can do so by omitting the `--enable-encryption-at-host` parameter.
54
54
55
-
> [!NOTE]
56
-
> Once you've enabled host-based encryption, make sure you provide the proper permissions to grant access to your Azure Key Vault keys. For more information, see [Full control of your keys][full-control-keys] and [Built-in roles for Key Vault data plane operations][akv-built-in-roles].
57
-
58
55
## Next steps
59
56
60
-
- Review [best practices for AKS cluster security][best-practices-security].
61
-
- Read more about [host-based encryption](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data).
57
+
Review [best practices for AKS cluster security][best-practices-security]
58
+
Read more about [host-based encryption](../virtual-machines/disk-encryption.md#encryption-at-host---end-to-end-encryption-for-your-vm-data).
Copy file name to clipboardExpand all lines: articles/aks/node-upgrade-github-actions.md
+21-16Lines changed: 21 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,9 +41,9 @@ This article also assumes you have a [GitHub][github] account to create your act
41
41
`cron` is a utility that allows you to run a set of commands, or job, on an automated schedule. To create job to update your AKS nodes on an automated schedule, you'll need a repository to host your actions. Usually, GitHub actions are configured in the same repository as your application, but you can use any repository. For this article we'll be using your [profile repository][profile-repository]. If you don't have one, create a new repository with the same name as your GitHub username.
42
42
43
43
1. Navigate to your repository on GitHub
44
-
1. Click on the **Actions** tab at the top of the page.
45
-
1. If you already set up a workflow in this repository, you'll be directed to the list of completed runs, in this case, click on the **New Workflow** button. If this is your first workflow in the repository, GitHub will present you with some project templates, click on the **Set up a workflow yourself** link below the description text.
46
-
1. Change the workflow `name` and `on` tags similar to the below. GitHub Actions use the same [POSIX cron syntax][cron-syntax] as any Linux-based system. In this schedule, we're telling the workflow to run every 15 days at 3am.
44
+
2. Select the **Actions** tab at the top of the page.
45
+
3. If you already set up a workflow in this repository, you'll be directed to the list of completed runs, in this case, select the **New Workflow** button. If this is your first workflow in the repository, GitHub will present you with some project templates, select the **Set up a workflow yourself** link below the description text.
46
+
4. Change the workflow `name` and `on` tags similar to the below. GitHub Actions use the same [POSIX cron syntax][cron-syntax] as any Linux-based system. In this schedule, we're telling the workflow to run every 15 days at 3am.
47
47
48
48
```yml
49
49
name: Upgrade cluster node images
@@ -52,7 +52,7 @@ This article also assumes you have a [GitHub][github] account to create your act
52
52
- cron: '0 3 */15 * *'
53
53
```
54
54
55
-
1. Create a new job using the below. This job is named `upgrade-node`, runs on an Ubuntu agent, and will connect to your Azure CLI account to execute the needed steps to upgrade the nodes.
55
+
5. Create a new job using the below. This job is named `upgrade-node`, runs on an Ubuntu agent, and will connect to your Azure CLI account to execute the needed steps to upgrade the nodes.
56
56
57
57
```yml
58
58
name: Upgrade cluster node images
@@ -73,15 +73,15 @@ In the `steps` key, you'll define all the work the workflow will execute to upgr
73
73
Download and sign in to the Azure CLI.
74
74
75
75
1. On the right-hand side of the GitHub Actions screen, find the *marketplace search bar* and type **"Azure Login"**.
76
-
1. You'll get as a result, an Action called **Azure Login** published **by Azure**:
76
+
2. You'll get as a result, an Action called **Azure Login** published **by Azure**:
77
77
78
78
:::image type="content" source="media/node-upgrade-github-actions/azure-login-search.png" alt-text="Search results showing two lines, the first action is called 'Azure Login' and the second 'Azure Container Registry Login'":::
79
79
80
-
1. Click on **Azure Login**. On the next screen, click the **copy icon** in the top right of the code sample.
80
+
3. Select **Azure Login**. On the next screen, select the **copy icon** in the top right of the code sample.
81
81
82
-
:::image type="content" source="media/node-upgrade-github-actions/azure-login.png" alt-text="Azure Login action result pane with code sample below, red square around a copy icon highlights the click spot":::
82
+
:::image type="content" source="media/node-upgrade-github-actions/azure-login.png" alt-text="Azure Login action result pane with code sample below, red square around a copy icon highlights the select spot":::
83
83
84
-
1. Paste the following under the `steps` key:
84
+
4. Paste the following under the `steps` key:
85
85
86
86
```yml
87
87
name: Upgrade cluster node images
@@ -101,7 +101,10 @@ Download and sign in to the Azure CLI.
101
101
creds: ${{ secrets.AZURE_CREDENTIALS }}
102
102
```
103
103
104
-
1. From the Azure CLI, run the following command to generate a new username and password.
104
+
5. From the Azure CLI, run the following command to generate a new username and password.
105
+
106
+
> [!NOTE]
107
+
> This example creates the `Contributor` role at the *Subscription* scope. You may provide the role and scope that meets your needs. For more information, see [Azure built-in roles][azure-built-in-roles] and [Azure RBAC scope levels][azure-rbac-scope-levels].
105
108
106
109
```azurecli-interactive
107
110
az ad sp create-for-rbac --role Contributor --scopes /subscriptions/{subscriptionID} -o json
@@ -124,13 +127,13 @@ Download and sign in to the Azure CLI.
124
127
}
125
128
```
126
129
127
-
1. **In a new browser window** navigate to your GitHub repository and open the **Settings** tab of the repository. Click **Secrets** then, click on **New Repository Secret**.
128
-
1. For *Name*, use `AZURE_CREDENTIALS`.
129
-
1. For *Value*, add the entire contents from the output of the previous step where you created a new username and password.
130
+
6. **In a new browser window** navigate to your GitHub repository and open the **Settings** tab of the repository. Select **Secrets** then, select **New Repository Secret**.
131
+
7. For *Name*, use `AZURE_CREDENTIALS`.
132
+
8. For *Value*, add the entire contents from the output of the previous step where you created a new username and password.
130
133
131
134
:::image type="content" source="media/node-upgrade-github-actions/azure-credential-secret.png" alt-text="Form showing AZURE_CREDENTIALS as secret title, and the output of the executed command pasted as JSON":::
132
135
133
-
1. Click **Add Secret**.
136
+
9. Select **Add Secret**.
134
137
135
138
The CLI used by your action will be logged to your Azure account and ready to run commands.
136
139
@@ -140,7 +143,7 @@ To create the steps to execute Azure CLI commands.
140
143
141
144
:::image type="content" source="media/node-upgrade-github-actions/azure-cli-action.png" alt-text="Search result for 'Azure CLI Action' with first result being shown as made by Azure":::
142
145
143
-
1. Click the copy button on the *GitHub marketplace result* and paste the contents of the action in the main editor, below the *Azure Login* step, similar to the following:
146
+
1. Select the copy button on the *GitHub marketplace result* and paste the contents of the action in the main editor, below the *Azure Login* step, similar to the following:
144
147
145
148
```yml
146
149
name: Upgrade cluster node images
@@ -168,7 +171,7 @@ To create the steps to execute Azure CLI commands.
168
171
> You can decouple the `-g` and `-n` parameters from the command by adding them to secrets similar to the previous steps. Replace the `{resourceGroupName}` and `{aksClusterName}` placeholders by their secret counterparts, for example `${{secrets.RESOURCE_GROUP_NAME}}` and `${{secrets.AKS_CLUSTER_NAME}}`
169
172
170
173
1. Rename the file to `upgrade-node-images`.
171
-
1. Click **Start Commit**, add a message title, and save the workflow.
174
+
1. Select **Start Commit**, add a message title, and save the workflow.
172
175
173
176
Once you create the commit, the workflow will be saved and ready for execution.
0 commit comments