You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-fed-management.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -221,7 +221,7 @@ Also, by using **add** and not **issue**, you avoid adding an outgoing issue for
221
221
NOT EXISTS([Type == "http://contoso.com/ws/2016/02/identity/claims/msdsconsistencyguid"])
222
222
=> add(Type = "urn:anandmsft:tmp/idflag", Value = "useguid");
223
223
224
-
This rule defines a temporary flag called **idflag** that is set to **useguid** if there's no **ms-ds-consistencyguid** populated for the user. The logic behind this is the fact that AD FS doesn't allow empty claims. So when you add claims http://contoso.com/ws/2016/02/identity/claims/objectguid and http://contoso.com/ws/2016/02/identity/claims/msdsconsistencyguid in Rule 1, you end up with an **msdsconsistencyguid** claim only if the value is populated for the user. If it isn't populated, AD FS sees that it will have an empty value and drops it immediately. All objects will have **objectGuid**, so that claim will always be there after Rule 1 is executed.
224
+
This rule defines a temporary flag called **idflag** that is set to **useguid** if there's no **ms-ds-consistencyguid** populated for the user. The logic behind this is the fact that AD FS doesn't allow empty claims. So when you add claims `http://contoso.com/ws/2016/02/identity/claims/objectguid` and `http://contoso.com/ws/2016/02/identity/claims/msdsconsistencyguid` in Rule 1, you end up with an **msdsconsistencyguid** claim only if the value is populated for the user. If it isn't populated, AD FS sees that it will have an empty value and drops it immediately. All objects will have **objectGuid**, so that claim will always be there after Rule 1 is executed.
225
225
226
226
**Rule 3: Issue ms-ds-consistencyguid as immutable ID if it's present**
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-install-multiple-domains.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -65,7 +65,7 @@ Another thing that `-SupportMultipleDomain` does is that it ensures that the AD
65
65
66
66
Thus during authentication to Azure AD or Office 365, the IssuerUri element in the user’s token is used to locate the domain in Azure AD. If, a match cannot be found, the authentication will fail.
67
67
68
-
For example, if a user’s UPN is [email protected], the IssuerUri element in the token, AD FS issues, will be set to <http://bmcontoso.com/adfs/services/trust>. This element will match the Azure AD configuration, and authentication will succeed.
68
+
For example, if a user’s UPN is [email protected], the IssuerUri element in the token, AD FS issues, will be set to `http://bmcontoso.com/adfs/services/trust`. This element will match the Azure AD configuration, and authentication will succeed.
69
69
70
70
The following is the customized claim rule that implements this logic:
71
71
@@ -78,7 +78,7 @@ The following is the customized claim rule that implements this logic:
78
78
>
79
79
80
80
## How to update the trust between AD FS and Azure AD
81
-
If you did not set up the federated trust between AD FS and your instance of Azure AD, you may need to re-create this trust. The reason is, when it is originally set up without the `-SupportMultipleDomain` parameter, the IssuerUri is set with the default value. In the screenshot below, you can see the IssuerUri is set to https://adfs.bmcontoso.com/adfs/services/trust.
81
+
If you did not set up the federated trust between AD FS and your instance of Azure AD, you may need to re-create this trust. The reason is, when it is originally set up without the `-SupportMultipleDomain` parameter, the IssuerUri is set with the default value. In the screenshot below, you can see the IssuerUri is set to `https://adfs.bmcontoso.com/adfs/services/trust`.
82
82
83
83
If you have successfully added a new domain in the Azure AD portal and then attempt to convert it using `Convert-MsolDomaintoFederated -DomainName <your domain>`, you will get the following error.
84
84
@@ -123,11 +123,11 @@ Use the following steps to add the new top-level domain using Azure AD Connect.
123
123
5. Click Install
124
124
125
125
### Verify the new top-level domain
126
-
By using the PowerShell command `Get-MsolDomainFederationSettings -DomainName <your domain>`you can view the updated IssuerUri. The screenshot below shows the federation settings were updated on the original domain http://bmcontoso.com/adfs/services/trust
126
+
By using the PowerShell command `Get-MsolDomainFederationSettings -DomainName <your domain>`you can view the updated IssuerUri. The screenshot below shows the federation settings were updated on the original domain `http://bmcontoso.com/adfs/services/trust`
* Is the password a temporary password and must be changed? Is it actually the correct password? Try to sign in to https://login.microsoftonline.com (on another computer than the Azure AD Connect server) and verify the account is usable.
77
+
* Is the password a temporary password and must be changed? Is it actually the correct password? Try to sign in to `https://login.microsoftonline.com` (on another computer than the Azure AD Connect server) and verify the account is usable.
78
78
79
79
### Verify proxy connectivity
80
-
To verify if the Azure AD Connect server has actual connectivity with the Proxy and Internet, use some PowerShell to see if the proxy is allowing web requests or not. In a PowerShell prompt, run `Invoke-WebRequest -Uri https://adminwebservice.microsoftonline.com/ProvisioningService.svc`. (Technically the first call is to https://login.microsoftonline.com and this URI works as well, but the other URI is faster to respond.)
80
+
To verify if the Azure AD Connect server has actual connectivity with the Proxy and Internet, use some PowerShell to see if the proxy is allowing web requests or not. In a PowerShell prompt, run `Invoke-WebRequest -Uri https://adminwebservice.microsoftonline.com/ProvisioningService.svc`. (Technically the first call is to `https://login.microsoftonline.com` and this URI works as well, but the other URI is faster to respond.)
81
81
82
82
PowerShell uses the configuration in machine.config to contact the proxy. The settings in winhttp/netsh should not impact these cmdlets.
83
83
@@ -102,7 +102,7 @@ When Azure AD Connect sends an export request to Azure AD, Azure AD can take up
102
102
## The communication pattern between Azure AD Connect and Azure AD
103
103
If you have followed all these preceding steps and still cannot connect, you might at this point start looking at network logs. This section is documenting a normal and successful connectivity pattern. It is also listing common red herrings that can be ignored when you are reading the network logs.
104
104
105
-
* There are calls to https://dc.services.visualstudio.com. It is not required to have this URL open in the proxy for the installation to succeed and these calls can be ignored.
105
+
* There are calls to `https://dc.services.visualstudio.com`. It is not required to have this URL open in the proxy for the installation to succeed and these calls can be ignored.
106
106
* You see that dns resolution lists the actual hosts to be in the DNS name space nsatc.net and other namespaces not under microsoftonline.com. However, there are not any web service requests on the actual server names and you do not have to add these URLs to the proxy.
107
107
* The endpoints adminwebservice and provisioningapi are discovery endpoints and used to find the actual endpoint to use. These endpoints are different depending on your region.
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/tshoot-connect-sso.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,7 @@ This article helps you find troubleshooting information about common problems re
30
30
- Seamless SSO doesn't work on mobile browsers on iOS and Android.
31
31
- If a user is part of too many groups in Active Directory, the user's Kerberos ticket will likely be too large to process, and this will cause Seamless SSO to fail. Azure AD HTTPS requests can have headers with a maximum size of 50 KB; Kerberos tickets need to be smaller than that limit to accommodate other Azure AD artifacts (typically, 2 - 5 KB) such as cookies. Our recommendation is to reduce user's group memberships and try again.
32
32
- If you're synchronizing 30 or more Active Directory forests, you can't enable Seamless SSO through Azure AD Connect. As a workaround, you can [manually enable](#manual-reset-of-the-feature) the feature on your tenant.
33
-
- Adding the Azure AD service URL (https://autologon.microsoftazuread-sso.com) to the Trusted sites zone instead of the Local intranet zone *blocks users from signing in*.
33
+
- Adding the Azure AD service URL (`https://autologon.microsoftazuread-sso.com`) to the Trusted sites zone instead of the Local intranet zone *blocks users from signing in*.
34
34
- Seamless SSO supports the AES256_HMAC_SHA1, AES128_HMAC_SHA1 and RC4_HMAC_MD5 encryption types for Kerberos. It is recommended that the encryption type for the AzureADSSOAcc$ account is set to AES256_HMAC_SHA1, or one of the AES types vs. RC4 for added security. The encryption type is stored on the msDS-SupportedEncryptionTypes attribute of the account in your Active Directory. If the AzureADSSOAcc$ account encryption type is set to RC4_HMAC_MD5, and you want to change it to one of the AES encryption types, please make sure that you first roll over the Kerberos decryption key of the AzureADSSOAcc$ account as explained in the [FAQ document](how-to-connect-sso-faq.md) under the relevant question, otherwise Seamless SSO will not happen.
35
35
36
36
## Check status of feature
@@ -70,7 +70,7 @@ Use the following checklist to troubleshoot Seamless SSO problems:
70
70
71
71
- Ensure that the Seamless SSO feature is enabled in Azure AD Connect. If you can't enable the feature (for example, due to a blocked port), ensure that you have all the [prerequisites](how-to-connect-sso-quick-start.md#step-1-check-the-prerequisites) in place.
72
72
- If you have enabled both [Azure AD Join](../active-directory-azureadjoin-overview.md) and Seamless SSO on your tenant, ensure that the issue is not with Azure AD Join. SSO from Azure AD Join takes precedence over Seamless SSO if the device is both registered with Azure AD and domain-joined. With SSO from Azure AD Join the user sees a sign-in tile that says "Connected to Windows".
73
-
- Ensure that the Azure AD URL (https://autologon.microsoftazuread-sso.com) is part of the user's Intranet zone settings.
73
+
- Ensure that the Azure AD URL (`https://autologon.microsoftazuread-sso.com`) is part of the user's Intranet zone settings.
74
74
- Ensure that the corporate device is joined to the Active Directory domain. The device _doesn't_ need to be [Azure AD Joined](../active-directory-azureadjoin-overview.md) for Seamless SSO to work.
75
75
- Ensure that the user is logged on to the device through an Active Directory domain account.
76
76
- Ensure that the user's account is from an Active Directory forest where Seamless SSO has been set up.
Copy file name to clipboardExpand all lines: articles/active-directory/manage-apps/application-proxy-connector-installation-problem.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,7 +45,7 @@ When the installation of a connector fails, the root cause is usually one of the
45
45
46
46
2. If any of those ports is not successful, verify that the Firewall or backend proxy has access to the required domains and ports see, [Prepare your on-premises environment](application-proxy-add-on-premises-application.md#prepare-your-on-premises-environment).
47
47
48
-
3. Open a browser (separate tab) and go to the following web page: <https://login.microsoftonline.com>, make sure that you can login to that page.
48
+
3. Open a browser (separate tab) and go to the following web page: `https://login.microsoftonline.com`, make sure that you can login to that page.
49
49
50
50
## Verify Machine and backend components support for Application Proxy trust cert
51
51
@@ -68,9 +68,9 @@ When the installation of a connector fails, the root cause is usually one of the
68
68
69
69
**To verify the credentials are correct:**
70
70
71
-
Connect to <https://login.microsoftonline.com> and use the same credentials. Make sure the login is successful. You can check the user role by going to **Azure Active Directory** ->**Users and Groups** ->**All Users**.
71
+
Connect to `https://login.microsoftonline.com` and use the same credentials. Make sure the login is successful. You can check the user role by going to **Azure Active Directory** ->**Users and Groups** ->**All Users**.
72
72
73
-
Select your user account, then “Directory Role” in the resulting menu. Verify that the selected role is "Application Administrator". If you are unable to access any of the pages along these steps, you do not have the required role.
73
+
Select your user account, then "Directory Role" in the resulting menu. Verify that the selected role is "Application Administrator". If you are unable to access any of the pages along these steps, you do not have the required role.
74
74
75
75
## Next steps
76
76
[Understand Azure AD Application Proxy connectors](application-proxy-connectors.md)
Copy file name to clipboardExpand all lines: articles/active-directory/managed-identities-azure-resources/how-to-use-vm-token.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -72,7 +72,7 @@ GET 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-0
72
72
|`GET`| The HTTP verb, indicating you want to retrieve data from the endpoint. In this case, an OAuth access token. |
73
73
|`http://169.254.169.254/metadata/identity/oauth2/token`| The managed identities for Azure resources endpoint for the Instance Metadata Service. |
74
74
|`api-version`| A query string parameter, indicating the API version for the IMDS endpoint. Please use API version `2018-02-01` or greater. |
75
-
|`resource`| A query string parameter, indicating the App ID URI of the target resource. It also appears in the `aud` (audience) claim of the issued token. This example requests a token to access Azure Resource Manager, which has an App ID URI of https://management.azure.com/.|
75
+
|`resource`| A query string parameter, indicating the App ID URI of the target resource. It also appears in the `aud` (audience) claim of the issued token. This example requests a token to access Azure Resource Manager, which has an App ID URI of `https://management.azure.com/`. |
76
76
|`Metadata`| An HTTP request header field, required by managed identities for Azure resources as a mitigation against Server Side Request Forgery (SSRF) attack. This value must be set to "true", in all lower case. |
77
77
|`object_id`| (Optional) A query string parameter, indicating the object_id of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.|
78
78
|`client_id`| (Optional) A query string parameter, indicating the client_id of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.|
@@ -89,7 +89,7 @@ Metadata: true
89
89
| ------- | ----------- |
90
90
|`GET`| The HTTP verb, indicating you want to retrieve data from the endpoint. In this case, an OAuth access token. |
91
91
|`http://localhost:50342/oauth2/token`| The managed identities for Azure resources endpoint, where 50342 is the default port and is configurable. |
92
-
|`resource`| A query string parameter, indicating the App ID URI of the target resource. It also appears in the `aud` (audience) claim of the issued token. This example requests a token to access Azure Resource Manager, which has an App ID URI of https://management.azure.com/.|
92
+
|`resource`| A query string parameter, indicating the App ID URI of the target resource. It also appears in the `aud` (audience) claim of the issued token. This example requests a token to access Azure Resource Manager, which has an App ID URI of `https://management.azure.com/`. |
93
93
|`Metadata`| An HTTP request header field, required by managed identities for Azure resources as a mitigation against Server Side Request Forgery (SSRF) attack. This value must be set to "true", in all lower case.|
94
94
|`object_id`| (Optional) A query string parameter, indicating the object_id of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.|
95
95
|`client_id`| (Optional) A query string parameter, indicating the client_id of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.|
@@ -374,7 +374,7 @@ This section documents the possible error responses. A "200 OK" status is a succ
|401Unauthorized|unknown_source|UnknownSource*\<URI\>*|VerifythatyourHTTPGETrequestURIisformattedcorrectly. The `scheme:host/resource-path` portionmustbespecifiedas `http://localhost:50342/oauth2/token`. See the "Sample request" in the preceding REST section for an example.|
||unauthorized_client|Theclientisnotauthorizedtorequestanaccesstokenusingthismethod. |Causedbyarequestthatdidn’tuselocalloopbacktocalltheextension, oronaVMthatdoesn’thavemanagedidentitiesforAzureresourcesconfiguredcorrectly. See [ConfiguremanagedidentitiesforAzureresourcesonaVMusingtheAzureportal](qs-configure-portal-windows-vm.md) ifyouneedassistancewithVMconfiguration. |
377
+
||unauthorized_client|Theclientisnotauthorizedtorequestanaccesstokenusingthismethod. |Causedbyarequestthatdidn't use local loopback to call the extension, or on a VM that doesn'thavemanagedidentitiesforAzureresourcesconfiguredcorrectly. See [ConfiguremanagedidentitiesforAzureresourcesonaVMusingtheAzureportal](qs-configure-portal-windows-vm.md) ifyouneedassistancewithVMconfiguration. |
0 commit comments