Skip to content

Commit cc8803b

Browse files
Banani-RathBanani-Rath
committed
Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)
2 parents ddf6582 + 201a682 commit cc8803b

File tree

89 files changed

+1754
-341
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+1754
-341
lines changed

‎articles/active-directory/authentication/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@
8484
href: concept-registration-mfa-sspr-combined.md
8585
- name: Resilient access controls
8686
href: concept-resilient-controls.md
87+
- name: Web browser cookies
88+
href: concept-authentication-web-browser-cookies.md
8789
- name: How-to guides
8890
items:
8991
- name: Manage authentication methods

‎articles/active-directory/authentication/concept-authentication-web-browser-cookies.md

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
title: Web browser cookies used in Azure Active Directory authentication
3+
description: Learn about Web browser cookies used in Azure Active Directory authentication.
4+
5+
services: active-directory
6+
ms.service: active-directory
7+
ms.subservice: authentication
8+
ms.topic: overview
9+
ms.date: 12/06/2022
10+
11+
ms.author: justinha
12+
author: custorod
13+
manager: amycolannino
14+
ms.reviewer: sahenry, michmcla
15+
16+
ms.collection: M365-identity-device-management
17+
18+
# Customer intent: As an Azure AD administrator, I want to understand which weh browser cookies are used for Azure AD.
19+
---
20+
# Web browser cookies used in Azure Active Directory authentication
21+
22+
During authentication against Azure Active Directory (Azure AD) through a web browser, multiple cookies are involved in the process. Some of the cookies are common on all requests. Other cookies are used for specific authentication flows or specific client-side conditions.
23+
24+
Persistent session tokens are stored as persistent cookies on the web browser's cookie jar. Non-persistent session tokens are stored as session cookies on the web browser, and are destroyed when the browser session is closed.
25+
26+
| Cookie Name | Type | Comments |
27+
|--|--|--|
28+
| ESTSAUTH | Common | Contains user's session information to facilitate SSO. Transient. |
29+
| ESTSAUTHPERSISTENT | Common | Contains user's session information to facilitate SSO. Persistent. |
30+
| ESTSAUTHLIGHT | Common | Contains Session GUID Information. Lite session state cookie used exclusively by client-side JavaScript in order to facilitate OIDC sign-out. Security feature. |
31+
| SignInStateCookie | Common | Contains list of services accessed to facilitate sign-out. No user information. Security feature. |
32+
| CCState | Common | Contains session information state to be used between Azure AD and the [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md). |
33+
| buid | Common | Tracks browser related information. Used for service telemetry and protection mechanisms. |
34+
| fpc | Common | Tracks browser related information. Used for tracking requests and throttling. |
35+
| esctx | Common | Session context cookie information. For CSRF protection. Binds a request to a specific browser instance so the request can't be replayed outside the browser. No user information. |
36+
| ch | Common | ProofOfPossessionCookie. Stores the Proof of Possession cookie hash to the user agent. |
37+
| ESTSSC | Common | Legacy cookie containing session count information no longer used. |
38+
| ESTSSSOTILES | Common | Tracks session sign-out. When present and not expired, with value "ESTSSSOTILES=1", it will interrupt SSO, for specific SSO authentication model, and will present tiles for user account selection. |
39+
| AADSSOTILES | Common | Tracks session sign-out. Similar to ESTSSSOTILES but for other specific SSO authentication model. |
40+
| ESTSUSERLIST | Common | Tracks Browser SSO user's list. |
41+
| SSOCOOKIEPULLED | Common | Prevents looping on specific scenarios. No user information. |
42+
| cltm | Common | For telemetry purposes. Tracks AppVersion, ClientFlight and Network type. |
43+
| brcap | Common | Client-side cookie (set by JavaScript) to validate client/web browser's touch capabilities. |
44+
| clrc | Common | Client-side cookie (set by JavaScript) to control local cached sessions on the client. |
45+
| CkTst | Common | Client-side cookie (set by JavaScript). No longer in active use. |
46+
| wlidperf | Common | Client-side cookie (set by JavaScript) that tracks local time for performance purposes. |
47+
| x-ms-gateway-slice | Common | Azure AD Gateway cookie used for tracking and load balance purposes. |
48+
| stsservicecookie | Common | Azure AD Gateway cookie also used for tracking purposes. |
49+
| x-ms-refreshtokencredential | Specific | Available when [Primary Refresh Token (PRT)](../devices/concept-primary-refresh-token.md) is in use. |
50+
| estsStateTransient | Specific | Applicable to new session information model only. Transient. |
51+
| estsStatePersistent | Specific | Same as estsStateTransient, but persistent. |
52+
| ESTSNCLOGIN | Specific | National Cloud Login related Cookie. |
53+
| UsGovTraffic | Specific | US Gov Cloud Traffic Cookie. |
54+
| ESTSWCTXFLOWTOKEN | Specific | Saves flowToken information when redirecting to ADFS. |
55+
| CcsNtv | Specific | To control when Azure AD Gateway will send requests to [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md). Native flows. |
56+
| CcsWeb | Specific | To control when Azure AD Gateway will send requests to [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md). Web flows. |
57+
| Ccs* | Specific | Cookies with prefix Ccs*, have the same purpose as the ones without prefix, but only apply when [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md) is in use. |
58+
| threxp | Specific | Used for throttling control. |
59+
| rrc | Specific | Cookie used to identify a recent B2B invitation redemption. |
60+
| debug | Specific | Cookie used to track if user's browser session is enabled for DebugMode. |
61+
| MSFPC | Specific | This cookie is not specific to any ESTS flow, but is sometimes present. It applies to all Microsoft Sites (when accepted by users). Identifies unique web browsers visiting Microsoft sites. It's used for advertising, site analytics, and other operational purposes. |
62+
63+
> [!NOTE]
64+
> Cookies identified as client-side cookies are set locally on the client device by JavaScript, hence, will be marked with HttpOnly=false.
65+
>
66+
> Cookie definitions and respective names are subject to change at any moment in time according to Azure AD service requirements.
67+
68+
## Next steps
69+
70+
To learn more about self-service password reset concepts, see [How Azure AD self-service password reset works][concept-sspr].
71+
72+
To learn more about multi-factor authentication concepts, see [How Azure AD Multi-Factor Authentication works][concept-mfa].
73+
74+
<!-- INTERNAL LINKS -->
75+
[concept-sspr]: concept-sspr-howitworks.md
76+
[concept-mfa]: concept-mfa-howitworks.md
77+

‎articles/active-directory/authentication/how-to-authentication-methods-manage.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,9 @@ For each method, note whether or not it's enabled for the tenant. The following
4545

4646
| Multifactor authentication policy | Authentication method policy |
4747
|-----------------------------------|------------------------------|
48-
| Call to phone | Voice calls |
49-
| Text message to phone | SMS<br>Microsoft Authenticator |
50-
| Notification through mobile app | Microsoft Authenticator |
48+
| Call to phone | Phone calls |
49+
| Text message to phone | SMS |
50+
| Notification through mobile app | Microsoft Authenticator |
5151
| Verification code from mobile app or hardware token | Third party software OATH tokens<br>Hardware OATH tokens (not yet available)<br>Microsoft Authenticator |
5252

5353
### Review the legacy SSPR policy

‎articles/active-directory/authentication/howto-authentication-passwordless-phone.md

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ services: active-directory
77
ms.service: active-directory
88
ms.subservice: authentication
99
ms.topic: how-to
10-
ms.date: 09/15/2022
10+
ms.date: 12/06/2022
1111

1212

1313
ms.author: justinha
@@ -73,24 +73,28 @@ To enable the authentication method for passwordless phone sign-in, complete the
7373
1. Under **Microsoft Authenticator**, choose the following options:
7474
1. **Enable** - Yes or No
7575
1. **Target** - All users or Select users
76-
1. Each added group or user is enabled by default to use Microsoft Authenticator in both passwordless and push notification modes ("Any" mode). To change the mode, for each row:
77-
1. Browse to **...** > **Configure**.
78-
1. For **Authentication mode** - choose **Any**, or **Passwordless**. Choosing **Push** prevents the use of the passwordless phone sign-in credential.
76+
1. Each added group or user is enabled by default to use Microsoft Authenticator in both passwordless and push notification modes ("Any" mode). To change the mode, for each row for **Authentication mode** - choose **Any**, or **Passwordless**. Choosing **Push** prevents the use of the passwordless phone sign-in credential.
7977
1. To apply the new policy, click **Save**.
8078

8179
>[!NOTE]
82-
>If you see an error when you try to save, the cause might be due to the number of users or groups being added. As a workaround, replace the users and groups you are trying to add with a single group, in the same operation, and then click **Save** again.
80+
>If you see an error when you try to save, the cause might be due to the number of users or groups being added. As a workaround, replace the users and groups you are trying to add with a single group, in the same operation, and then select **Save** again.
8381
8482
## User registration
8583

86-
Users register themselves for the passwordless authentication method of Azure AD by using the following steps:
84+
Users register themselves for the passwordless authentication method of Azure AD. For users who already registered the Microsoft Authenticator app for [multi-factor authentication](./concept-mfa-howitworks.md), skip to the next section, [enable phone sign-in](#enable-phone-sign-in). To register the Microsoft Authenticator app, follow these steps:
8785

8886
1. Browse to [https://aka.ms/mysecurityinfo](https://aka.ms/mysecurityinfo).
89-
1. Sign in, then click **Add method** > **Authenticator app** > **Add** to add Microsoft Authenticator.
87+
1. Sign in, then select **Add method** > **Authenticator app** > **Add** to add Microsoft Authenticator.
9088
1. Follow the instructions to install and configure the Microsoft Authenticator app on your device.
9189
1. Select **Done** to complete Microsoft Authenticator configuration.
92-
1. In **Microsoft Authenticator**, choose **Enable phone sign-in** from the drop-down menu for the account registered.
93-
1. Follow the instructions in the app to finish registering the account for passwordless phone sign-in.
90+
91+
### Enable phone sign-in
92+
93+
After users registered themselves for the Microsoft Authenticator app, they need to enable phone sign-in:
94+
95+
1. In **Microsoft Authenticator**, select the account registered.
96+
2. Select **Enable phone sign-in**.
97+
3. Follow the instructions in the app to finish registering the account for passwordless phone sign-in.
9498

9599
An organization can direct its users to sign in with their phones, without using a password. For further assistance configuring Microsoft Authenticator and enabling phone sign-in, see [Sign in to your accounts using the Microsoft Authenticator app](https://support.microsoft.com/account-billing/sign-in-to-your-accounts-using-the-microsoft-authenticator-app-582bdc07-4566-4c97-a7aa-56058122714c).
96100

‎articles/active-directory/authentication/overview-authentication.md

Lines changed: 0 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -87,54 +87,6 @@ When you sign in with a passwordless method, credentials are provided by using m
8787

8888
Azure AD provides ways to natively authenticate using passwordless methods to simplify the sign-in experience for users and reduce the risk of attacks.
8989

90-
## Web browser cookies
91-
92-
When authenticating against Azure Active Directory through a web browser, multiple cookies are involved in the process. Some of the cookies are common on all requests, other cookies are specific to some particular scenarios, i.e., specific authentication flows and/or specific client-side conditions.
93-
94-
Persistent session tokens are stored as persistent cookies on the web browser's cookie jar, and non-persistent session tokens are stored as session cookies on the web browser and are destroyed when the browser session is closed.
95-
96-
| Cookie Name | Type | Comments |
97-
|--|--|--|
98-
| ESTSAUTH | Common | Contains user's session information to facilitate SSO. Transient. |
99-
| ESTSAUTHPERSISTENT | Common | Contains user's session information to facilitate SSO. Persistent. |
100-
| ESTSAUTHLIGHT | Common | Contains Session GUID Information. Lite session state cookie used exclusively by client-side JavaScript in order to facilitate OIDC sign-out. Security feature. |
101-
| SignInStateCookie | Common | Contains list of services accessed to facilitate sign-out. No user information. Security feature. |
102-
| CCState | Common | Contains session information state to be used between Azure AD and the [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md). |
103-
| buid | Common | Tracks browser related information. Used for service telemetry and protection mechanisms. |
104-
| fpc | Common | Tracks browser related information. Used for tracking requests and throttling. |
105-
| esctx | Common | Session context cookie information. For CSRF protection. Binds a request to a specific browser instance so the request can't be replayed outside the browser. No user information. |
106-
| ch | Common | ProofOfPossessionCookie. Stores the Proof of Possession cookie hash to the user agent. |
107-
| ESTSSC | Common | Legacy cookie containing session count information no longer used. |
108-
| ESTSSSOTILES | Common | Tracks session sign-out. When present and not expired, with value "ESTSSSOTILES=1", it will interrupt SSO, for specific SSO authentication model, and will present tiles for user account selection. |
109-
| AADSSOTILES | Common | Tracks session sign-out. Similar to ESTSSSOTILES but for other specific SSO authentication model. |
110-
| ESTSUSERLIST | Common | Tracks Browser SSO user's list. |
111-
| SSOCOOKIEPULLED | Common | Prevents looping on specific scenarios. No user information. |
112-
| cltm | Common | For telemetry purposes. Tracks AppVersion, ClientFlight and Network type. |
113-
| brcap | Common | Client-side cookie (set by JavaScript) to validate client/web browser's touch capabilities. |
114-
| clrc | Common | Client-side cookie (set by JavaScript) to control local cached sessions on the client. |
115-
| CkTst | Common | Client-side cookie (set by JavaScript). No longer in active use. |
116-
| wlidperf | Common | Client-side cookie (set by JavaScript) that tracks local time for performance purposes. |
117-
| x-ms-gateway-slice | Common | Azure AD Gateway cookie used for tracking and load balance purposes. |
118-
| stsservicecookie | Common | Azure AD Gateway cookie also used for tracking purposes. |
119-
| x-ms-refreshtokencredential | Specific | Available when [Primary Refresh Token (PRT)](../devices/concept-primary-refresh-token.md) is in use. |
120-
| estsStateTransient | Specific | Applicable to new session information model only. Transient. |
121-
| estsStatePersistent | Specific | Same as estsStateTransient, but persistent. |
122-
| ESTSNCLOGIN | Specific | National Cloud Login related Cookie. |
123-
| UsGovTraffic | Specific | US Gov Cloud Traffic Cookie. |
124-
| ESTSWCTXFLOWTOKEN | Specific | Saves flowToken information when redirecting to ADFS. |
125-
| CcsNtv | Specific | To control when Azure AD Gateway will send requests to [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md). Native flows. |
126-
| CcsWeb | Specific | To control when Azure AD Gateway will send requests to [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md). Web flows. |
127-
| Ccs* | Specific | Cookies with prefix Ccs*, have the same purpose as the ones without prefix, but only apply when [Azure AD Backup Authentication Service](../conditional-access/resilience-defaults.md) is in use. |
128-
| threxp | Specific | Used for throttling control. |
129-
| rrc | Specific | Cookie used to identify a recent B2B invitation redemption. |
130-
| debug | Specific | Cookie used to track if user's browser session is enabled for DebugMode. |
131-
| MSFPC | Specific | This cookie is not specific to any ESTS flow, but is sometimes present. It applies to all Microsoft Sites (when accepted by users). Identifies unique web browsers visiting Microsoft sites. It's used for advertising, site analytics, and other operational purposes. |
132-
133-
> [!NOTE]
134-
> Cookies identified as client-side cookies are set locally on the client device by JavaScript, hence, will be marked with HttpOnly=false.
135-
>
136-
> Cookie definitions and respective names are subject to change at any moment in time according to Azure AD service requirements.
137-
13890
## Next steps
13991

14092
To get started, see the [tutorial for self-service password reset (SSPR)][tutorial-sspr] and [Azure AD Multi-Factor Authentication][tutorial-azure-mfa].

‎articles/active-directory/governance/entitlement-management-access-package-auto-assignment-policy.md

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,42 @@ To create a policy for an access package, you need to start from the access pack
7070

7171
## Create an automatic assignment policy programmatically (Preview)
7272

73-
You can also create a policy using Microsoft Graph. A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission, or an application in a catalog role or with the `EntitlementManagement.ReadWrite.All` permission, can call the [create an accessPackageAssignmentPolicy](/graph/api/entitlementmanagement-post-assignmentpolicies?tabs=http&view=graph-rest-1.0&preserve-view=true) API. In your [request payload](/graph/api/resources/accesspackageassignmentpolicy?view=graph-rest-1.0&preserve-view=true), include the `displayName`, `description`, `specificAllowedTargets`, [`automaticRequestSettings`](/graph/api/resources/accesspackageautomaticrequestsettings?view=graph-rest-1.0&preserve-view=true) and `accessPackage` properties of the policy.
73+
There are two ways to create an access package assignment policy for automatic assignment programmatically, through Microsoft Graph and through the PowerShell cmdlets for Microsoft Graph.
74+
75+
### Creating an access package assignment policy through Graph
76+
77+
You can create a policy using Microsoft Graph. A user in an appropriate role with an application that has the delegated `EntitlementManagement.ReadWrite.All` permission, or an application in a catalog role or with the `EntitlementManagement.ReadWrite.All` permission, can call the [create an accessPackageAssignmentPolicy](/graph/api/entitlementmanagement-post-assignmentpolicies?tabs=http&view=graph-rest-1.0&preserve-view=true) API. In your [request payload](/graph/api/resources/accesspackageassignmentpolicy?view=graph-rest-1.0&preserve-view=true), include the `displayName`, `description`, `specificAllowedTargets`, [`automaticRequestSettings`](/graph/api/resources/accesspackageautomaticrequestsettings?view=graph-rest-1.0&preserve-view=true) and `accessPackage` properties of the policy.
78+
79+
### Creating an access package assignment policy through PowerShell
80+
81+
You can also create a policy in PowerShell with the cmdlets from the [Microsoft Graph PowerShell cmdlets for Identity Governance](https://www.powershellgallery.com/packages/Microsoft.Graph.Identity.Governance/) module version 1.16.0 or later.
82+
83+
This script below illustrates using the `v1.0` profile, to create a policy for automatic assignment to an access package. See [create an accessPackageAssignmentPolicy](/graph/api/entitlementmanagement-post-assignmentpolicies?tabs=http&view=graph-rest-v1.0&preserve-view=true) for more examples.
84+
85+
```powershell
86+
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All"
87+
Select-MgProfile -Name "v1.0"
88+
89+
$apid = "cdd5f06b-752a-4c9f-97a6-82f4eda6c76d"
90+
91+
$pparams = @{
92+
DisplayName = "Sales department users"
93+
Description = "All users from sales department"
94+
AllowedTargetScope = "specificDirectoryUsers"
95+
SpecificAllowedTargets = @( @{
96+
"@odata.type" = "#microsoft.graph.attributeRuleMembers"
97+
description = "All users from sales department"
98+
membershipRule = '(user.department -eq "Sales")'
99+
} )
100+
AutomaticRequestSettings = @{
101+
RequestAccessForAllowedTargets = $true
102+
}
103+
AccessPackage = @{
104+
Id = $apid
105+
}
106+
}
107+
New-MgEntitlementManagementAssignmentPolicy -BodyParameter $pparams
108+
```
74109

75110
## Next steps
76111

0 commit comments

Comments
 (0)