Merge pull request #183361 from davidmu1/publishapps1

Publishapps1

Author: v-shils

articles/active-directory/develop/TOC.yml

@@ -558,7 +558,7 @@
     - name: Publish to App Source
       href: v2-howto-get-appsource-certified.md
     - name: Publish to Azure AD App Gallery
-      href: v2-howto-app-gallery-listing.md
+      href: ../manage-apps/v2-howto-app-gallery-listing.md?toc=/azure/active-directory/develop/toc.json&bc=/azure/active-directory/develop/breadcrumb/toc.json
     - name: Publish to the Office 365 Seller Dashboard
       href: /office/dev/store/add-in-submission-guide
   - name: Remove an app registration

articles/active-directory/develop/media/howto-app-gallery-listing/timeline-2.png

@@ -148,6 +148,8 @@
           href: migrate-okta-sync-provisioning-to-azure-active-directory.md
         - name: Migrate Okta federation to Azure AD managed authentication
           href: migrate-okta-federation-to-azure-active-directory.md
+    - name: Publish applications
+      href: v2-howto-app-gallery-listing.md
     - name: Secure legacy apps 
       items:
       - name: Secure hybrid access with Azure AD 
@@ -200,6 +202,8 @@
         href: troubleshoot-password-based-sso.md
       - name: Troubleshoot SAML-based single sign-on
         href: troubleshoot-saml-based-sso.md
+      - name: Troubleshoot Microsoft Application Network sign-in
+        href: troubleshoot-app-publishing.md
       - name: Debug SAML-based single sign-on
         href: debug-saml-sso-issues.md
       - name: Unexpected consent prompt

articles/active-directory/manage-apps/media/howto-app-gallery-listing/blocked.png

@@ -0,0 +1,40 @@
+---
+title: Your sign-in was blocked
+description: Troubleshoot a blocked sign-in to the Microsoft Application Network portal. 
+titleSuffix: Azure AD
+services: active-directory
+author: davidmu1
+manager: CelesteDG
+ms.service: active-directory
+ms.subservice: app-mgmt
+ms.topic: troubleshooting
+ms.workload: identity
+ms.date: 1/18/2022
+ms.author: davidmu
+ms.reviewer: jeedes
+#Customer intent: As a publisher of an application, I want troubleshoot a blocked sign-in to the Microsoft Application Network portal.
+---
+
+# Your sign-in was blocked
+
+This article provides information for resolving a blocked sign-in to the Microsoft Application Network portal.
+
+## Symptoms
+
+The user sees this message when trying to sign in to the Microsoft Application Network portal.
+
+:::image type="content" source="/media/howto-app-gallery-listing/blocked.png" alt-text="Screenshot that shows a blocked sign-in to the portal.":::
+
+## Cause
+
+The guest user is federated to a home tenant that is also an Azure AD tenant. The guest user is at high risk. High risk users aren't allowed to access resources. All high risk users (employees, guests, or vendors) must remediate their risk to access resources. For guest users, this user risk comes from the home tenant and the policy comes from the resource tenant.
+ 
+## Solutions
+
+- MFA registered guest users remediate their own user risk. The guest user [resets or changes a secured password](https://aka.ms/sspr) at their home tenant (this needs MFA and SSPR at the home tenant). The secured password change or reset must be initiated on Azure AD and not on-premises.
+
+- Guest users have their administrators remediate their risk. In this case, the administrator resets a password (temporary password generation). The guest user's administrator can go to https://aka.ms/RiskyUsers and select **Reset password**.
+
+- Guest users have their administrators dismiss their risk. The admin can go to https://aka.ms/RiskyUsers and select **Dismiss user risk**. However, the administrator must do the due diligence to make sure the risk assessment was a false positive before dismissing the user risk. Otherwise, resources are put at risk by suppressing a risk assessment without investigation.
+
+If you have any issues with access, contact the [Azure AD SSO Integration Team](mailto:[email protected]).

articles/active-directory/manage-apps/media/howto-app-gallery-listing/customer-request-2.png

@@ -0,0 +1,108 @@
+---
+title: Publish your application
+description: Learn how to publish your application in the Azure Active Directory application gallery. 
+titleSuffix: Azure AD
+services: active-directory
+author: eringreenlee
+manager: CelesteDG
+ms.service: active-directory
+ms.subservice: app-mgmt
+ms.topic: how-to
+ms.workload: identity
+ms.date: 1/18/2022
+ms.author: ergreenl
+---
+
+# Publish your application in the Azure Active Directory application gallery
+
+You can publish your application in the Azure Active Directory (Azure AD) application gallery. When your application is published, it's made available as an option for users when they add applications to their tenant. For more information, see [Overview of the Azure Active Directory application gallery](overview-application-gallery.md).
+
+To publish your application in the gallery, you need to complete the following tasks:
+
+- Make sure that you complete the prerequisites.
+- Create and publish documentation.
+- Submit your application.
+- Join the Microsoft partner network.
+
+## Prerequisites
+
+- To publish your application in the gallery, you must first read and agree to specific [terms and conditions](https://azure.microsoft.com/support/legal/active-directory-app-gallery-terms/).
+- Every application in the gallery must implement one of the supported single sign-on (SSO) options. To learn more about the supported options, see [Plan a single sign-on deployment](plan-sso-deployment.md). To learn more about authentication, see [Authentication vs. authorization](../develop/authentication-vs-authorization.md) and [Azure active Directory code samples](../develop/sample-v2-code.md). For password SSO, make sure that your application supports form authentication so that password vaulting can be used. For a quick introduction about single sign-on configuration in the portal, see [Enable single sign-on for an enterprise application](add-application-portal-setup-sso.md).
+- For federated applications (OpenID and SAML/WS-Fed), the application must support the [software-as-a-service (SaaS) model](https://azure.microsoft.com/overview/what-is-saas/) to be listed in the gallery. The enterprise gallery applications must support multiple user configurations and not any specific user.
+- For Open ID Connect, the application must be multitenanted and the [Azure AD consent framework](../develop/consent-framework.md) must be properly implemented for the application. The user can send the sign-in request to a common endpoint so that any user can provide consent to the application. You can control user access based on the tenant ID and the user's UPN received in the token.
+- Supporting provisioning is optional, but highly recommended. Provisioning must be done using the System for Cross-domain Identity Management (SCIM) protocol, which is easy to implement. Using SCIM allows users to automatically create and update accounts in your application without relying on manual processes such as uploading CSV files. To learn more about the Azure AD SCIM implementation, see [build a SCIM endpoint and configure user provisioning with Azure AD](../app-provisioning/use-scim-to-provision-users-and-groups.md).
+
+You can get a free test account with all the premium Azure AD features - 90 days free and can get extended as long as you do dev work with it: [Join the Microsoft 365 Developer Program](/office/developer-program/microsoft-365-developer-program).
+
+## Create and publish documentation
+
+### Documentation on your site
+
+Ease of adoption is a significant factor in enterprise software decisions. Clear easy-to-follow documentation supports your users in their adoption journey and reduces support costs.
+
+Your documentation should at a minimum include the following items:
+
+- Introduction to your SSO functionality
+    - Protocols supported
+    - Version and SKU
+    - Supported identity providers list with documentation links
+- Licensing information for your application
+- Role-based access control for configuring SSO
+- SSO Configuration Steps
+    - UI configuration elements for SAML with expected values from the provider
+    - Service provider information to be passed to identity providers
+- If OIDC/OAuth, list of permissions required for consent with business justifications
+- Testing steps for pilot users
+- Troubleshooting information, including error codes and messages
+- Support mechanisms for users
+- Details about your SCIM endpoint, including the resources and attributes supported
+
+### Documentation on the Microsoft site
+
+When your application is added to the gallery, documentation is created that explains the step-by-step process. For an example, see [Tutorials for integrating SaaS applications with Azure Active Directory](../saas-apps/tutorial-list.md). This documentation is created based on your submission to the gallery, and you can easily update it if you make changes to your application using your GitHub account.
+
+## Submit your application
+
+After you've tested that your application integration works with Azure AD, submit your application request in the [Microsoft Application Network portal](https://microsoft.sharepoint.com/teams/apponboarding/Apps). The first time you try to sign into the portal you are presented with one of two screens. 
+
+- If you receive the message "That didn't work", then you need to contact the [Azure AD SSO Integration Team](mailto:[email protected]). Provide the email account that you want to use for submitting the request. A business email address such as `[email protected]` is preferred. The Azure AD team will add the account in the Microsoft Application Network portal.
+- If you see a "Request Access" page, then fill in the business justification and select **Request Access**.
+
+After the account is added, you can sign in to the Microsoft Application Network portal and submit the request by selecting the **Submit Request (ISV)** tile on the home page. If you see the **Your sign-in was blocked** error while logging in, see [Troubleshoot sign-in to the Microsoft Application Network portal](troubleshoot-app-publishing.md).
+
+### Implementation-specific options
+
+On the Application Registration Form, select the feature that you want to enable. Select **OpenID Connect & OAuth 2.0**, **SAML 2.0/WS-Fed**, or **Password SSO(UserName & Password)** depending on the feature that your application supports.
+
+If you're implementing a [SCIM](../app-provisioning/use-scim-to-provision-users-and-groups.md) 2.0 endpoint for user provisioning, select **User Provisioning (SCIM 2.0)**. Download the schema to provide in the onboarding request. For more information, see [Export provisioning configuration and roll back to a known good state](../app-provisioning/export-import-provisioning-configuration.md). The schema that you configured is used when testing the non-gallery application to build the gallery application. 
+
+You can track application requests by customer name at the Microsoft Application Network portal. For more information, see [Application requests by Customers](https://microsoft.sharepoint.com/teams/apponboarding/Apps/SitePages/AppRequestsByCustomers.aspx).
+
+### Timelines
+
+The timeline for the process of listing a SAML 2.0 or WS-Fed application in the gallery is 7 to 10 business days.
+
+:::image type="content" source="/media/howto-app-gallery-listing/timeline.png" alt-text="Screenshot that shows the timeline for listing a SAML application.":::
+
+The timeline for the process of listing an OpenID Connect application in the gallery is 2 to 5 business days.
+
+:::image type="content" source="/media/howto-app-gallery-listing/timeline-2.png" alt-text="Screenshot that shows the timeline for listing an OpenID Connect application.":::
+
+The timeline for the process of listing a SCIM provisioning application in the gallery is variable and depends on numerous factors.
+
+Not all applications can be onboarded. Per the terms and conditions, the choice may be made to not list an application. Onboarding applications is at the sole discretion of the onboarding team. If your application is declined, you should use the non-gallery provisioning application to satisfy your provisioning needs.
+
+Here's the flow of customer-requested applications.
+
+:::image type="content" source="/media/howto-app-gallery-listing/customer-request-2.png" alt-text="Screenshot that shows the customer-requested apps flow.":::
+
+For any escalations, send email to the [Azure AD SSO Integration Team](mailto:[email protected]), and a response is sent as soon as possible.
+
+
+## Join the Microsoft partner network
+
+The Microsoft Partner Network provides instant access to exclusive resources, programs, tools, and connections. To join the network and create your go to market plan, see [Reach commercial customers](https://partner.microsoft.com/explore/commercial#gtm).
+
+## Next steps
+
+- Learn more about managing enterprise applications in [What is application management in Azure Active Directory?](what-is-application-management.md)