Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)

Author: tynevi

.openpublishing.redirection.json

@@ -2699,6 +2699,36 @@
       "redirect_url": "/azure/azure-portal/azure-portal-dashboards",
       "redirect_document_id": false
     },
+    {
+      "source_path": "articles/azure-resource-manager/resource-manager-export-template.md",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-portal",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "articles/azure-resource-manager/resource-manager-export-template-cli.md",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-cli",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "articles/azure-resource-manager/resource-manager-export-template-powershell.md",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-powershell",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "articles/azure-resource-manager/resource-group-portal.md",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-portal",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "articles/azure-resource-manager/powershell-azure-resource-manager.md",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-powershell",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "articles/azure-resource-manager/cli-azure-resource-manager.md",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-cli",
+      "redirect_document_id": false
+    },
     {
       "source_path": "articles/azure-resource-manager/create-resource-group-in-template.md",
       "redirect_url": "/azure/azure-resource-manager/deploy-to-subscription",
@@ -2961,7 +2991,7 @@
     },
     {
       "source_path": "articles/powershell-azure-resource-manager.md",
-      "redirect_url": "/azure/azure-resource-manager/powershell-azure-resource-manager",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-powershell.md",
       "redirect_document_id": false
     },
     {
@@ -3411,12 +3441,12 @@
     },
     {
       "source_path": "articles/xplat-cli-azure-resource-manager.md",
-      "redirect_url": "/azure/azure-resource-manager/cli-azure-resource-manager",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-cli",
       "redirect_document_id": false
     },
     {
       "source_path": "articles/azure-resource-manager/xplat-cli-azure-resource-manager.md",
-      "redirect_url": "/azure/azure-resource-manager/cli-azure-resource-manager",
+      "redirect_url": "/azure/azure-resource-manager/manage-resources-cli",
       "redirect_document_id": false
     },
     {
@@ -14466,6 +14496,11 @@
       "redirect_url": "/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-portal-classic",
       "redirect_document_id": false
     },
+    {
+      "source_path": "articles/vpn-gateway/vpn-gateway-plan-design.md",
+      "redirect_url": "/azure/vpn-gateway/vpn-gateway-about-vpngateways",
+      "redirect_document_id": false
+    },
     {
       "source_path": "articles/virtual-network/virtual-networks-create-nsg-arm-pportal.md",
       "redirect_url": "/azure/virtual-network/tutorial-filter-network-traffic",

articles/active-directory/b2b/google-federation.md

@@ -99,8 +99,8 @@ You can delete your Google federation setup. If you do so, Google guest users wh
 ### To delete Google federation in the Azure AD portal: 
 1. Go to the [Azure portal](https://portal.azure.com). In the left pane, select **Azure Active Directory**. 
 2. Select **Organizational Relationships**.
-3. Select **Identity providers**, and then click the **Google** button.
-4. Select **Google**, and then select **Delete**. 
+3. Select **Identity providers**.
+4. On the **Google** line, select the context menu (**...**) and then select **Delete**. 
 
    ![Deleted the social identity provider](media/google-federation/google-social-identity-providers.png)
 

articles/active-directory/manage-apps/application-sign-in-problem-federated-sso-gallery.md

@@ -157,7 +157,7 @@ Azure AD doesn’t support the SAML request sent by the application for single s
 
 The application vendor should validate that they support the Azure AD SAML implementation for single sign-on.
 
-## No resource in requiredResourceAccess list
+## Misconfigured application
 
 *Error AADSTS650056: Misconfigured application. This could be due to one of the following: The client has not listed any permissions for 'AAD Graph' in the requested permissions in the client's application registration. Or, The admin has not consented in the tenant. Or, Check the application identifier in the request to ensure it matches the configured client application identifier. Please contact your admin to fix the configuration or consent on behalf of the tenant.*.
 
@@ -234,6 +234,33 @@ Azure AD wasn’t able to identify the SAML request within the URL parameters in
 
 The application needs to send the SAML request encoded into the location header using HTTP redirect binding. For more information about how to implement it, read the section HTTP Redirect Binding in the [SAML protocol specification document](https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf).
 
+## Azure AD is sending the token to an incorrect endpoint
+
+**Possible cause**
+
+During single sign-on, if the sign-in request does not contain an explicit reply URL (Assertion Consumer Service URL) then Azure AD will select any of the configured rely URLs for that application. Even if the application has an explicit reply URL configured, the user may be to redirected https://127.0.0.1:444. 
+
+When the application was added as a non-gallery app, Azure Active Directory created this reply URL as a default value. This behavior has changed and Azure Active Directory no longer adds this URL by default. 
+
+**Resolution**
+
+Delete the unused reply URLs configured for the application.
+
+1.  Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator** or **Co-admin**.
+
+2.  Open the **Azure Active Directory Extension** by selecting **All services** at the top of the main left-hand navigation menu.
+
+3.  Type **“Azure Active Directory"** in the filter search box and select the **Azure Active Directory** item.
+
+4.  Select **Enterprise Applications** from the Azure Active Directory left-hand navigation menu.
+
+5.  Select **All Applications** to view a list of all your applications.
+
+	If you do not see the application you want show up here, use the **Filter** control at the top of the **All Applications List** and set the **Show** option to **All Applications**.
+
+6.  Select the application you want to configure for single sign-on.
+
+7.  Once the application loads, open **Basic SAML configuration**. In the **Reply URL (Assertion Consumer Service URL)**, delete unused or default Reply URLs created by the system. For example, `https://127.0.0.1:444/applications/default.aspx`.
 
 ## Problem when customizing the SAML claims sent to an application
 

articles/active-directory/manage-apps/application-sign-in-problem-federated-sso-non-gallery.md

@@ -23,13 +23,10 @@ ms.collection: M365-identity-device-management
 
 # Problems signing in to a non-gallery application configured for federated single sign-on
 
-To troubleshoot your problem, you need to verify the application configuration in Azure AD as follow:
+To troubleshoot the sign-in issues below, we recommend you follow these suggestion to get better diagnosis and automate the resolution steps:
 
--   You have followed all the configuration steps for the Azure AD gallery application.
-
--   The Identifier and Reply URL configured in AAD match they expected values in the application
-
--   You have assigned users to the application
+- Install the [My Apps Secure Browser Extension](access-panel-extension-problem-installing.md) to help Azure Active Directory (Azure AD) to provide better diagnosis and resolutions when using the testing experience in the Azure portal.
+- Reproduce the error using the testing experience in the app configuration page in the Azure portal. Learn more on [Debug SAML-based single sign-on applications](../develop/howto-v1-debug-saml-sso-issues.md)
 
 ## Application not found in directory
 
@@ -41,7 +38,7 @@ The Issuer attribute sends from the application to Azure AD in the SAML request
 
 **Resolution**
 
-Ensure that the Issuer attribute in the SAML request it’s matching the Identifier value configured in Azure AD:
+Ensure that the `Issuer` attribute in the SAML request matches the Identifier value configured in Azure AD. If you use the [testing experience](../develop/howto-v1-debug-saml-sso-issues.md) in the Azure portal with the My Apps Secure Browser Extension, you don't need to manually follow these steps.
 
 1.  Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator** or **Co-admin.**
 
@@ -59,9 +56,7 @@ Ensure that the Issuer attribute in the SAML request it’s matching the Identif
 
 7.  Once the application loads, click the **Single sign-on** from the application’s left-hand navigation menu.
 
-8.  <span id="_Hlk477190042" class="anchor"></span>Go to **Domain and URLs** section. Verify that the value in the Identifier textbox is matching the value for the identifier value displayed in the error.
-
-After you have updated the Identifier value in Azure AD and it’s matching the value sends by the application in the SAML request, you should be able to sign in to the application.
+8.  Once the application loads, open **Basic SAML configuration**. Verify that the value in the Identifier textbox matches the value for the identifier value displayed in the error.
 
 ## The reply address does not match the reply addresses configured for the application. 
 
@@ -73,7 +68,7 @@ The AssertionConsumerServiceURL value in the SAML request doesn't match the Repl
 
 **Resolution** 
 
-Ensure that the AssertionConsumerServiceURL value in the SAML request it's matching the Reply URL value configured in Azure AD. 
+Ensure that the `Issuer` attribute in the SAML request matches the Identifier value configured in Azure AD. If you use the [testing experience](../develop/howto-v1-debug-saml-sso-issues.md) in the Azure portal with the My Apps Secure Browser Extension, you don't need to manually follow these steps.
 
 1.  Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator** or **Co-admin.** 
 
@@ -91,11 +86,9 @@ Ensure that the AssertionConsumerServiceURL value in the SAML request it's match
 
 7.  Once the application loads, click the **Single sign-on** from the application’s left-hand navigation menu.
 
-8.  Go to **Domain and URLs** section. Verify or update the value in the Reply URL textbox to match the AssertionConsumerServiceURL value in the SAML request.
-
-  * If you don't see the Reply URL textbox, select the **Show advanced URL settings** checkbox. 
-
-After you have updated the Reply URL value in Azure AD and it’s matching the value sends by the application in the SAML request, you should be able to sign in to the application.
+8.  Once the application loads, open **Basic SAML configuration**. Verify or update the value in the Reply URL textbox to match the `AssertionConsumerServiceURL` value in the SAML request. 	
+	
+After you've updated the Reply URL value in Azure AD, and it matches the value sent by the application in the SAML request, you should be able to sign in to the application.
 
 ## User not assigned a role
 
@@ -107,7 +100,7 @@ The user has not been granted access to the application in Azure AD.
 
 **Resolution**
 
-To assign one or more users to an application directly, follow the steps below:
+To assign one or more users to an application directly, follow the steps below. If you use the [testing experience](../develop/howto-v1-debug-saml-sso-issues.md) in the Azure portal with the My Apps Secure Browser Extension, you don't need to manually follow these steps.
 
 1.  Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator.**
 
@@ -165,39 +158,35 @@ Azure AD doesn’t support the SAML Request sent by the application for Single S
 
     -   [Azure AD Single Sign-on SAML protocol requirements](https://docs.microsoft.com/azure/active-directory/develop/active-directory-single-sign-on-protocol-reference)
 
-They should validate they support the Azure AD SAML implementation for Single Sign-on.
+The application vendor should validate that they support the Azure AD SAML implementation for single sign-on.
 
-## No resource in requiredResourceAccess list
+## Misconfigured application
 
-*Error AADSTS65005: The client application has requested access to resource '00000002-0000-0000-c000-000000000000'. This request has failed because the client has not specified this resource in its requiredResourceAccess list*.
+*Error AADSTS650056: Misconfigured application. This could be due to one of the following: The client has not listed any permissions for 'AAD Graph' in the requested permissions in the client's application registration. Or, The admin has not consented in the tenant. Or, Check the application identifier in the request to ensure it matches the configured client application identifier. Please contact your admin to fix the configuration or consent on behalf of the tenant.*.
 
 **Possible cause**
 
-The application object is corrupted.
+The `Issuer` attribute sent from the application to Azure AD in the SAML request doesn’t match the Identifier value configured for the application in Azure AD.
 
 **Resolution**
 
-To solve the problem, remove the application from the directory. Then, add and reconfigure the application, follow the steps below:
+Ensure that the `Issuer` attribute in the SAML request matches the Identifier value configured in Azure AD. If you use the [testing experience](../develop/howto-v1-debug-saml-sso-issues.md) in the Azure portal with the My Apps Secure Browser Extension, you don't need to manually follow these steps:
 
-1.  Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator** or **Co-admin.**
-
-2.  Open the **Azure Active Directory Extension** by clicking **All services** at the top of the main left-hand navigation menu.
-
-3.  Type in **“Azure Active Directory**” in the filter search box and select the **Azure Active Directory** item.
+1.  Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator** or **Co-admin**.
 
-4.  click **Enterprise Applications** from the Azure Active Directory left-hand navigation menu.
+1.  Open the **Azure Active Directory Extension** by selecting **All services** at the top of the main left-hand navigation menu.
 
-5.  click **All Applications** to view a list of all your applications.
+1.  Type **“Azure Active Directory"** in the filter search box and select the **Azure Active Directory** item.
 
-  * If you do not see the application you want show up here, use the **Filter** control at the top of the **All Applications List** and set the **Show** option to **All Applications.**
+1.  Select **Enterprise Applications** from the Azure Active Directory left-hand navigation menu.
 
-6.  Select the application you want to configure single sign-on.
+1.  Select **All Applications** to view a list of all your applications.
 
-7.  Click **Delete** at the top-left of the application **Overview** pane.
+	If you do not see the application you want show up here, use the **Filter** control at the top of the **All Applications List** and set the **Show** option to **All Applications**.
 
-8.  Refresh Azure AD and Add the application from the Azure AD gallery. Then, Configure the application again.
+1.  Select the application you want to configure for single sign-on.
 
-After reconfiguring the application, you should be able to sign in to the application.
+1.  Once the application loads, open **Basic SAML configuration**. Verify that the value in the Identifier textbox matches the value for the identifier value displayed in the error.
 
 ## Certificate or key not configured
 
@@ -235,6 +224,48 @@ To delete and create a new certificate, follow the steps below:
 
 11. Under the **SAML Signing Certificate** section, click **remove** to remove the **Unused** certificate.
 
+## SAML Request not present in the request
+
+*Error AADSTS750054: SAMLRequest or SAMLResponse must be present as query string parameters in HTTP request for SAML Redirect binding.*
+
+**Possible cause**
+
+Azure AD wasn’t able to identify the SAML request within the URL parameters in the HTTP request. This can happen if the application is not using HTTP redirect binding when sending the SAML request to Azure AD.
+
+**Resolution**
+
+The application needs to send the SAML request encoded into the location header using HTTP redirect binding. For more information about how to implement it, read the section HTTP Redirect Binding in the [SAML protocol specification document](https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf).
+
+## Azure AD is sending the token to an incorrect endpoint
+
+**Possible cause**
+
+During single sign-on, if the sign-in request does not contain an explicit reply URL (Assertion Consumer Service URL) then Azure AD will select any of the configured rely URLs for that application. Even if the application has an explicit reply URL configured, the user may be to redirected https://127.0.0.1:444. 
+
+When the application was added as a non-gallery app, Azure Active Directory created this reply URL as a default value. This behavior has changed and Azure Active Directory no longer adds this URL by default. 
+
+**Resolution**
+
+Delete the unused reply URLs configured for the application.
+
+1.  Open the [**Azure portal**](https://portal.azure.com/) and sign in as a **Global Administrator** or **Co-admin**.
+
+2.  Open the **Azure Active Directory Extension** by selecting **All services** at the top of the main left-hand navigation menu.
+
+3.  Type **“Azure Active Directory"** in the filter search box and select the **Azure Active Directory** item.
+
+4.  Select **Enterprise Applications** from the Azure Active Directory left-hand navigation menu.
+
+5.  Select **All Applications** to view a list of all your applications.
+
+	If you do not see the application you want show up here, use the **Filter** control at the top of the **All Applications List** and set the **Show** option to **All Applications**.
+
+6.  Select the application you want to configure for single sign-on.
+
+7.  Once the application loads, open **Basic SAML configuration**. In the **Reply URL (Assertion Consumer Service URL)**, delete unused or default Reply URLs created by the system. For example, `https://127.0.0.1:444/applications/default.aspx`.
+
+
+
 ## Problem when customizing the SAML claims sent to an application
 
 To learn how to customize the SAML attribute claims sent to your application, see [Claims mapping in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-claims-mapping) for more information.