Skip to content

Commit cf8c9b7

Browse files
tamramtamram
committed
fix merge conflicts
2 parents 1d3fb8c + 75af834 commit cf8c9b7

File tree

679 files changed

+12806
-9019
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

679 files changed

+12806
-9019
lines changed

‎.openpublishing.publish.config.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -998,6 +998,7 @@
998998
".openpublishing.redirection.baremetal-infrastructure.json",
999999
"articles/iot-dps/.openpublishing.redirection.iot-dps.json",
10001000
"articles/cloud-shell/.openpublishing.redirection.cloud-shell.json",
1001-
".openpublishing.redirection.azure-vmware.json"
1001+
".openpublishing.redirection.azure-vmware.json",
1002+
".openpublishing.redirection.openshift.json"
10021003
]
10031004
}

‎.openpublishing.redirection.active-directory.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11055,6 +11055,16 @@
1105511055
"source_path_from_root": "/articles/active-directory/develop/microsoft-graph-intro.md",
1105611056
"redirect_url": "/graph/overview?toc=/azure/active-directory/develop/toc.json&bc=/azure/active-directory/develop/breadcrumb/toc.json",
1105711057
"redirect_document_id": false
11058+
},
11059+
{
11060+
"source_path_from_root": "/articles/active-directory/privileged-identity-management/concept-privileged-access-versus-role-assignable.md",
11061+
"redirect_url": "azure/active-directory/privileged-identity-management/concept-pim-for-groups",
11062+
"redirect_document_id": false
11063+
},
11064+
{
11065+
"source_path_from_root": "/articles/active-directory/privileged-identity-management/groups-features.md",
11066+
"redirect_url": "azure/active-directory/privileged-identity-management/concept-pim-for-groups",
11067+
"redirect_document_id": false
1105811068
}
1105911069
]
1106011070
}

‎.openpublishing.redirection.azure-monitor.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5671,6 +5671,16 @@
56715671
"source_path_from_root": "/articles/azure-monitor/logs/azure-data-explorer-monitor-cross-service-query.md",
56725672
"redirect_url": "/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy",
56735673
"redirect_document_id": false
5674+
},
5675+
{
5676+
"source_path_from_root": "/articles/azure-monitor/app/mobile-center-quickstart.md",
5677+
"redirect_url": "https://github.com/Microsoft/appcenter",
5678+
"redirect_document_id": false
5679+
},
5680+
{
5681+
"source_path_from_root": "/articles/azure-monitor/app/windows-desktop.md",
5682+
"redirect_url": "https://github.com/Microsoft/appcenter",
5683+
"redirect_document_id": false
56745684
}
56755685
]
56765686
}

‎.openpublishing.redirection.azure-productivity.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,11 @@
8989
"source_path": "articles/lab-services/how-to-enable-nested-virtualization-template-vm.md",
9090
"redirect_url": "/azure/lab-services/concept-nested-virtualization-template-vm",
9191
"redirect_document_id": true
92+
},
93+
{
94+
"source_path": "articles/lab-services/troubleshoot.md",
95+
"redirect_url": "/azure/lab-services/troubleshoot-lab-creation",
96+
"redirect_document_id": true
9297
}
9398
]
9499
}

‎.openpublishing.redirection.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18384,6 +18384,11 @@
1838418384
"redirect_url": "/azure/sentinel/enable-monitoring",
1838518385
"redirect_document_id": false
1838618386
},
18387+
{
18388+
"source_path_from_root": "/articles/sentinel/web-normalization-schema.md",
18389+
"redirect_url": "/azure/sentinel/normalization-schema-web",
18390+
"redirect_document_id": true
18391+
},
1838718392
{
1838818393
"source_path_from_root": "/articles/sentinel/dns-normalization-schema.md",
1838918394
"redirect_url": "/azure/sentinel/normalization-schema-dns",
@@ -27965,6 +27970,11 @@
2796527970
"redirect_url": "/azure/azure-cache-for-redis/cache-insights-overview",
2796627971
"redirect_document_id": false
2796727972
},
27973+
{
27974+
"source_path_from_root": "/articles/aks/uptime-sla.md",
27975+
"redirect_url": "/azure/aks/free-standard-pricing-tiers",
27976+
"redirect_document_id": "false"
27977+
},
2796827978
{
2796927979
"source_path": "articles/dotnet-develop-multitenant-applications.md",
2797027980
"redirect_URL": "/azure/architecture/guide/multitenant/overview",

‎.openpublishing.redirection.openshift.json

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"redirections": [
3+
{
4+
"source_path_from_root": "/articles/openshift/cluster-administration-cluster-admin-role.md",
5+
"redirect_url": "/azure/openshift/intro-openshift",
6+
"redirect_document_id": false
7+
},
8+
{
9+
"source_path_from_root": "/articles/openshift/cluster-administration-security-context-constraints.md",
10+
"redirect_url": "/azure/openshift/intro-openshift",
11+
"redirect_document_id": false
12+
},
13+
{
14+
"source_path_from_root": "/articles/openshift/howto-aad-app-configuration.md",
15+
"redirect_url": "/azure/openshift/intro-openshift",
16+
"redirect_document_id": false
17+
},
18+
{
19+
"source_path_from_root": "/articles/openshift/howto-create-private-cluster-3x.md",
20+
"redirect_url": "/azure/openshift/intro-openshift",
21+
"redirect_document_id": false
22+
},
23+
{
24+
"source_path_from_root": "/articles/openshift/howto-create-tenant.md",
25+
"redirect_url": "/azure/openshift/intro-openshift",
26+
"redirect_document_id": false
27+
},
28+
{
29+
"source_path_from_root": "/articles/openshift/howto-deploy-prometheus.md",
30+
"redirect_url": "/azure/openshift/intro-openshift",
31+
"redirect_document_id": false
32+
},
33+
{
34+
"source_path_from_root": "/articles/openshift/howto-manage-projects.md",
35+
"redirect_url": "/azure/openshift/intro-openshift",
36+
"redirect_document_id": false
37+
},
38+
{
39+
"source_path_from_root": "/articles/openshift/howto-run-privileged-containers.md",
40+
"redirect_url": "/azure/openshift/intro-openshift",
41+
"redirect_document_id": false
42+
},
43+
{
44+
"source_path_from_root": "/articles/openshift/howto-setup-environment.md",
45+
"redirect_url": "/azure/openshift/intro-openshift",
46+
"redirect_document_id": false
47+
},
48+
{
49+
"source_path_from_root": "/articles/openshift/migration.md",
50+
"redirect_url": "/azure/openshift/intro-openshift",
51+
"redirect_document_id": false
52+
},
53+
{
54+
"source_path_from_root": "/articles/openshift/supported-resources.md",
55+
"redirect_url": "/azure/openshift/intro-openshift",
56+
"redirect_document_id": false
57+
}
58+
]
59+
}

‎articles/active-directory-b2c/partner-datawiza.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ms.reviewer: kengaderdus
99
ms.service: active-directory
1010
ms.workload: identity
1111
ms.topic: how-to
12-
ms.date: 12/12/2022
12+
ms.date: 01/23/2023
1313
ms.author: gasinh
1414
ms.subservice: B2C
1515
---

‎articles/active-directory/app-provisioning/accidental-deletions.md

Lines changed: 44 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,67 @@
11
---
2-
title: Enable accidental deletions prevention in Application Provisioning in Azure Active Directory
3-
description: Enable accidental deletions prevention in Application Provisioning in Azure Active Directory.
2+
title: Enable accidental deletions prevention in the Azure AD provisioning service
3+
description: Enable accidental deletions prevention in the Azure Active Directory (Azure AD) provisioning service for applications and cross-tenant synchronization.
44
services: active-directory
55
author: kenwith
66
manager: amycolannino
77
ms.service: active-directory
88
ms.subservice: app-provisioning
99
ms.topic: how-to
1010
ms.workload: identity
11-
ms.date: 10/06/2022
11+
ms.date: 01/23/2023
1212
ms.author: kenwith
1313
ms.reviewer: arvinh
14+
zone_pivot_groups: app-provisioning-cross-tenant-synchronization
1415
---
1516

1617
# Enable accidental deletions prevention in the Azure AD provisioning service
1718

19+
::: zone pivot="app-provisioning"
1820
The Azure AD provisioning service includes a feature to help avoid accidental deletions. This feature ensures that users aren't disabled or deleted in an application unexpectedly.
21+
::: zone-end
22+
23+
::: zone pivot="cross-tenant-synchronization"
24+
> [!IMPORTANT]
25+
> [Cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md) is currently in PREVIEW.
26+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
27+
28+
The Azure AD provisioning service includes a feature to help avoid accidental deletions. This feature ensures that users aren't disabled or deleted in the target tenant unexpectedly.
29+
::: zone-end
1930

2031
The feature lets you specify a deletion threshold, above which an admin
2132
needs to explicitly choose to allow the deletions to be processed.
2233

2334
## Configure accidental deletion prevention
35+
2436
To enable accidental deletion prevention:
37+
2538
1. In the Azure portal, select **Azure Active Directory**.
26-
2. Select **Enterprise applications** and then select your app.
39+
40+
::: zone pivot="app-provisioning"
41+
2. Select **Enterprise applications** and then select your application.
42+
2743
3. Select **Provisioning** and then on the provisioning page select **Edit provisioning**.
28-
4. Under **Settings**, select the **Prevent accidental deletions** checkbox and specify a deletion
29-
threshold. Also, be sure the notification email address is completed. If the deletion threshold is met an email will be sent.
30-
5. Select **Save**, to save the changes.
44+
::: zone-end
45+
46+
::: zone pivot="cross-tenant-synchronization"
47+
2. Select **Cross-tenant synchronization (Preview)** > **Configurations** and then select your configuration.
48+
49+
3. Select **Provisioning**.
50+
::: zone-end
51+
52+
4. Under **Settings**, select the **Prevent accidental deletions** check box and specify a deletion
53+
threshold.
54+
55+
5. Ensure the **Notification Email** address is completed.
56+
57+
If the deletion threshold is met, an email will be sent.
58+
59+
6. Select **Save** to save the changes.
3160

3261
When the deletion threshold is met, the job will go into quarantine and a notification email will be sent. The quarantined job can then be allowed or rejected. To learn more about quarantine behavior, see [Application provisioning in quarantine status](application-provisioning-quarantine-status.md).
3362

3463
## Recovering from an accidental deletion
35-
If you encounter an accidental deletion you'll see it on the provisioning status page. It will say **Provisioning has been quarantined. See quarantine details for more information**.
64+
If you encounter an accidental deletion, you'll see it on the provisioning status page. It will say **Provisioning has been quarantined. See quarantine details for more information**.
3665

3766
You can click either **Allow deletes** or **View provisioning logs**.
3867

@@ -48,8 +77,8 @@ The **Allow deletes** action will delete the objects that triggered the accident
4877

4978
If you don't want to allow the deletions, you need to do the following:
5079
- Investigate the source of the deletions. You can use the provisioning logs for details.
51-
- Prevent the deletion by assigning the user / group to the app again, restoring the user / group, or updating your provisioning configuration.
52-
- Once you've made the necessary changes to prevent the user / group from being deleted, restart provisioning. Please don't restart provisioning until you've made the necessary changes to prevent the users / groups from being deleted.
80+
- Prevent the deletion by assigning the user / group to the application (or configuration) again, restoring the user / group, or updating your provisioning configuration.
81+
- Once you've made the necessary changes to prevent the user / group from being deleted, restart provisioning. Don't restart provisioning until you've made the necessary changes to prevent the users / groups from being deleted.
5382

5483

5584
### Test deletion prevention
@@ -60,21 +89,21 @@ Let the provisioning job run (20 – 40 mins) and navigate back to the provision
6089
## Common de-provisioning scenarios to test
6190
- Delete a user / put them into the recycle bin.
6291
- Block sign in for a user.
63-
- Unassign a user or group from the application.
64-
- Remove a user from a group that’s providing them access to the app.
92+
- Unassign a user or group from the application (or configuration).
93+
- Remove a user from a group that's providing them access to the application (or configuration).
6594

6695
To learn more about de-provisioning scenarios, see [How Application Provisioning Works](how-provisioning-works.md#de-provisioning).
6796

6897
## Frequently Asked Questions
6998

7099
### What scenarios count toward the deletion threshold?
71-
When a user is set to be removed from the target application, it will be counted against the
100+
When a user is set to be removed from the target application (or target tenant), it will be counted against the
72101
deletion threshold. Scenarios that could lead to a user being removed from the target
73-
application could include: unassigning the user from the application and soft / hard deleting a user in the directory. Groups
102+
application (or target tenant) could include: unassigning the user from the application (or configuration) and soft / hard deleting a user in the directory. Groups
74103
evaluated for deletion count towards the deletion threshold. In addition to deletions, the same functionality also works for disables.
75104

76105
### What is the interval that the deletion threshold is evaluated on?
77-
It is evaluated each cycle. If the number of deletions doesn't exceed the threshold during a
106+
It's evaluated each cycle. If the number of deletions doesn't exceed the threshold during a
78107
single cycle, the “circuit breaker” won’t be triggered. If multiple cycles are needed to reach a
79108
steady state, the deletion threshold will be evaluated per cycle.
80109

‎articles/active-directory/app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md

Lines changed: 47 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,33 @@
11
---
2-
title: Use scoping filters in Azure Active Directory Application Provisioning
3-
description: Learn how to use scoping filters to prevent objects in apps that support automated user provisioning from being provisioned if an object doesn't satisfy your business requirements in Azure Active Directory Application Provisioning.
2+
title: Scoping users or groups to be provisioned with scoping filters in Azure Active Directory
3+
description: Learn how to use scoping filters to define attribute-based rules that determine which users or groups are provisioned in Azure Active Directory.
44
services: active-directory
55
author: kenwith
66
manager: amycolannino
77
ms.service: active-directory
88
ms.subservice: app-provisioning
99
ms.workload: identity
1010
ms.topic: how-to
11-
ms.date: 06/15/2022
11+
ms.date: 01/23/2023
1212
ms.author: kenwith
1313
ms.reviewer: arvinh
14+
zone_pivot_groups: app-provisioning-cross-tenant-synchronization
1415
---
1516

16-
# Attribute-based application provisioning with scoping filters
17-
The objective of this article is to explain how to use scoping filters to define attribute-based rules that determine which users are provisioned to an application.
17+
# Scoping users or groups to be provisioned with scoping filters
18+
19+
::: zone pivot="cross-tenant-synchronization"
20+
> [!IMPORTANT]
21+
> [Cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md) is currently in PREVIEW.
22+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
23+
::: zone-end
24+
25+
This article describes how to use scoping filters in the Azure Active Directory (Azure AD) provisioning service to define attribute-based rules that determine which users or groups are provisioned.
1826

1927
## Scoping filter use cases
2028

21-
A scoping filter allows the Azure Active Directory (Azure AD) provisioning service to include or exclude any users who have an attribute that matches a specific value. For example, when provisioning users from Azure AD to a SaaS application used by a sales team, you can specify that only users with a "Department" attribute of "Sales" should be in scope for provisioning.
29+
::: zone pivot="app-provisioning"
30+
You use scoping filters to prevent objects in applications that support automated user provisioning from being provisioned if an object doesn't satisfy your business requirements. A scoping filter allows you to include or exclude any users who have an attribute that matches a specific value. For example, when provisioning users from Azure AD to a SaaS application used by a sales team, you can specify that only users with a "Department" attribute of "Sales" should be in scope for provisioning.
2231

2332
Scoping filters can be used differently depending on the type of provisioning connector:
2433

@@ -29,7 +38,14 @@ Scoping filters can be used differently depending on the type of provisioning co
2938
3039
* **Inbound provisioning from HCM applications to Azure AD and Active Directory**. When an [HCM application such as Workday](../saas-apps/workday-tutorial.md) is the source system, scoping filters are the primary method for determining which users should be provisioned from the HCM application to Active Directory or Azure AD.
3140

32-
By default, Azure AD provisioning connectors do not have any attribute-based scoping filters configured.
41+
By default, Azure AD provisioning connectors don't have any attribute-based scoping filters configured.
42+
::: zone-end
43+
44+
::: zone pivot="cross-tenant-synchronization"
45+
When Azure AD is the source system, [user and group assignments](../manage-apps/assign-user-or-group-access-portal.md) are the most common method for determining which users are in scope for provisioning. Reducing the number of users in scope improves performance and synchronizing assigned users and groups instead of synchronizing all users and groups is recommended.
46+
47+
Scoping filters can be used optionally, in addition to scoping by assignment. A scoping filter allows the Azure AD provisioning service to include or exclude any users who have an attribute that matches a specific value. For example, when provisioning users from a sales team, you can specify that only users with a "Department" attribute of "Sales" should be in scope for provisioning.
48+
::: zone-end
3349

3450
## Scoping filter construction
3551

@@ -56,19 +72,36 @@ According to this scoping filter, users must satisfy the following criteria to b
5672
Scoping filters are configured as part of the attribute mappings for each Azure AD user provisioning connector. The following procedure assumes that you already set up automatic provisioning for [one of the supported applications](../saas-apps/tutorial-list.md) and are adding a scoping filter to it.
5773

5874
### Create a scoping filter
59-
1. In the [Azure portal](https://portal.azure.com), go to the **Azure Active Directory** > **Enterprise Applications** > **All applications** section.
6075

61-
2. Select the application for which you have configured automatic provisioning: for example, "ServiceNow".
76+
1. Sign in to the [Azure portal](https://portal.azure.com).
77+
78+
::: zone pivot="app-provisioning"
79+
2. Go to the **Azure Active Directory** > **Enterprise applications** > **All applications**.
80+
81+
3. Select the application for which you have configured automatic provisioning: for example, "ServiceNow".
82+
::: zone-end
83+
84+
::: zone pivot="cross-tenant-synchronization"
85+
2. Go to **Azure Active Directory** > **Cross-tenant Synchronization** > **Configurations**
86+
87+
3. Select your configuration.
88+
::: zone-end
89+
90+
4. Select the **Provisioning** tab.
6291

63-
3. Select the **Provisioning** tab.
92+
::: zone pivot="app-provisioning"
93+
5. In the **Mappings** section, select the mapping that you want to configure a scoping filter for: for example, "Synchronize Azure Active Directory Users to ServiceNow".
94+
::: zone-end
6495

65-
4. In the **Mappings** section, select the mapping that you want to configure a scoping filter for: for example, "Synchronize Azure Active Directory Users to ServiceNow".
96+
::: zone pivot="cross-tenant-synchronization"
97+
5. In the **Mappings** section, select the mapping that you want to configure a scoping filter for: for example, "Provision Azure Active Directory Users".
98+
::: zone-end
6699

67-
5. Select the **Source object scope** menu.
100+
6. Select the **Source object scope** menu.
68101

69-
6. Select **Add scoping filter**.
102+
7. Select **Add scoping filter**.
70103

71-
7. Define a clause by selecting a source **Attribute Name**, an **Operator**, and an **Attribute Value** to match against. The following operators are supported:
104+
8. Define a clause by selecting a source **Attribute Name**, an **Operator**, and an **Attribute Value** to match against. The following operators are supported:
72105

73106
a. **EQUALS**. Clause returns "true" if the evaluated attribute matches the input string value exactly (case sensitive).
74107

0 commit comments

Comments
 (0)