Skip to content

Commit cb1462d

Browse files
authored
Merge pull request #230990 from omondiatieno/broken-links-fix
fix broken links
2 parents f721256 + 2173236 commit cb1462d

File tree

3 files changed

+111
-70
lines changed

3 files changed

+111
-70
lines changed

articles/active-directory/manage-apps/configure-authentication-for-federated-users-portal.md

Lines changed: 53 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: active-directory
88
ms.subservice: app-mgmt
99
ms.workload: infrastructure-services
1010
ms.topic: how-to
11-
ms.date: 01/02/2023
11+
ms.date: 03/16/2023
1212
ms.author: jomondi
1313
ms.reviewer: ludwignick
1414
ms.custom: seoapril2019, contperf-fy22q2
@@ -33,7 +33,8 @@ For federated users with cloud-enabled credentials, such as SMS sign-in or FIDO
3333
To configure HRD policy for an application in Azure AD, you need:
3434

3535
- An Azure account with an active subscription. If you don't already have one, you can [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
36-
- One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.
36+
- One of the following roles: Global Administrator, or owner of the service principal.
37+
3738
::: zone pivot="powershell-hrd"
3839
- The latest Azure AD PowerShell cmdlet preview.
3940
::: zone-end
@@ -91,13 +92,17 @@ The following policy auto-accelerates users to a federated identity provider sig
9192
::: zone pivot="powershell-hrd"
9293
9394
```powershell
94-
New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AccelerateToFederatedDomain`":true}}") -DisplayName BasicAutoAccelerationPolicy -Type HomeRealmDiscoveryPolicy
95+
New-AzureADPolicy
96+
-Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AccelerateToFederatedDomain`":true}}") -DisplayName BasicAutoAccelerationPolicy
97+
-Type HomeRealmDiscoveryPolicy
9598
```
9699
::: zone-end
97100

98101
::: zone pivot="graph-hrd"
99102

100-
```json
103+
```http
104+
POST /policies/homeRealmDiscoveryPolicies
105+
101106
"HomeRealmDiscoveryPolicy": {
102107
"AccelerateToFederatedDomain": true
103108
}
@@ -109,13 +114,18 @@ The following policy auto-accelerates users to a federated identity provider sig
109114
::: zone pivot="powershell-hrd"
110115

111116
```powershell
112-
New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AccelerateToFederatedDomain`":true, `"PreferredDomain`":`"federated.example.edu`"}}") -DisplayName MultiDomainAutoAccelerationPolicy -Type HomeRealmDiscoveryPolicy
117+
New-AzureADPolicy
118+
-Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AccelerateToFederatedDomain`":true, `"PreferredDomain`":`"federated.example.edu`"}}")
119+
-DisplayName MultiDomainAutoAccelerationPolicy
120+
-Type HomeRealmDiscoveryPolicy
113121
```
114122
::: zone-end
115123

116124
::: zone pivot="graph-hrd"
117125

118-
```json
126+
```http
127+
POST /policies/homeRealmDiscoveryPolicies
128+
119129
"HomeRealmDiscoveryPolicy": {
120130
"AccelerateToFederatedDomain": true,
121131
"PreferredDomain": [
@@ -128,9 +138,22 @@ New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AccelerateToFe
128138
The following policy enables username/password authentication for federated users directly with Azure AD for specific applications:
129139

130140

141+
::: zone pivot="powershell-hrd"
142+
143+
144+
```powershell
145+
New-AzureADPolicy
146+
-Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AllowCloudPasswordValidation`":true}}")
147+
-DisplayName EnableDirectAuthPolicy
148+
-Type HomeRealmDiscoveryPolicy
149+
```
150+
::: zone-end
151+
152+
131153
::: zone pivot="graph-hrd"
132154

133-
```json
155+
```http
156+
POST /policies/homeRealmDiscoveryPolicies
134157
135158
"EnableDirectAuthPolicy": {
136159
"AllowCloudPasswordValidation": true
@@ -142,10 +165,6 @@ The following policy enables username/password authentication for federated user
142165

143166
::: zone pivot="powershell-hrd"
144167

145-
```powershell
146-
New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AllowCloudPasswordValidation`":true}}") -DisplayName EnableDirectAuthPolicy -Type HomeRealmDiscoveryPolicy
147-
```
148-
149168
To see your new policy and get its **ObjectID**, run the following command:
150169

151170
```powershell
@@ -171,7 +190,9 @@ Get-AzureADServicePrincipal
171190
After you have the **ObjectID** of the service principal of the application for which you want to configure auto-acceleration, run the following command. This command associates the HRD policy that you created in step 1 with the service principal that you located in step 2.
172191

173192
```powershell
174-
Add-AzureADServicePrincipalPolicy -Id <ObjectID of the Service Principal> -RefObjectId <ObjectId of the Policy>
193+
Add-AzureADServicePrincipalPolicy
194+
-Id <ObjectID of the Service Principal>
195+
-RefObjectId <ObjectId of the Policy>
175196
```
176197

177198
You can repeat this command for each service principal to which you want to add the policy.
@@ -225,36 +246,35 @@ Use the previous example to get the **ObjectID** of the policy, and that of the
225246
226247
## Configuring policy through Graph Explorer
227248
228-
Set the HRD policy using Microsoft Graph. See [homeRealmDiscoveryPolicy](/graph/api/resources/homeRealmDiscoveryPolicy?view=graph-rest-1.0&preserve-view=true) resource type for information on how to create the policy.
229-
230249
From the Microsoft Graph explorer window:
231250
232-
1. Grant consent to the *Policy.ReadWrite.ApplicationConfiguration* permission.
233-
1. Use the URL https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies
234-
1. POST the new policy to this URL, or PATCH to https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/{policyID} if overwriting an existing one.
235-
1. POST or PATCH contents:
236-
237-
```json
238-
{
239-
"definition": [
240-
"{\"HomeRealmDiscoveryPolicy\":
241-
{\"AccelerateToFederatedDomain\":true,
242-
\"PreferredDomain\":\"federated.example.edu\",
243-
\"AlternateIdLogin\":{\"Enabled\":true}}}"
244-
],
245-
"displayName": "Home Realm Discovery auto acceleration",
246-
"isOrganizationDefault": true
247-
}
251+
1. Sign in with one of the roles listed in the prerequisites section.
252+
1. Grant consent to the `Policy.ReadWrite.ApplicationConfiguration` permission.
253+
1. Use the [Home realm discovery policy](/graph/api/resources/homerealmdiscoverypolicy) to create a new policy.
254+
1. POST the new policy, or PATCH to update an existing policy.
255+
256+
```http
257+
PATCH /policies/homeRealmDiscoveryPolicies/{id}
258+
{
259+
"definition": [
260+
"{\"HomeRealmDiscoveryPolicy\":
261+
{\"AccelerateToFederatedDomain\":true,
262+
\"PreferredDomain\":\"federated.example.edu\",
263+
\"AlternateIdLogin\":{\"Enabled\":true}}}"
264+
],
265+
"displayName": "Home Realm Discovery auto acceleration",
266+
"isOrganizationDefault": true
267+
}
248268
```
249-
1. To see your new policy and get its ObjectID, run the following query:
269+
1. To view your new policy, run the following query:
250270
251271
```http
252-
GET https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies
272+
GET /policies/homeRealmDiscoveryPolicies/{id}
253273
```
254274
1. To delete the HRD policy you created, run the query:
255275
256276
```http
257-
DELETE https://graph.microsoft.com/v1.0/policies/homeRealmDiscoveryPolicies/{policy objectID}
277+
DELETE /policies/homeRealmDiscoveryPolicies/{id}
258278
```
259279
::: zone-end
260280

0 commit comments

Comments
 (0)