Skip to content

Commit d4a3242

Browse files
tynevitynevi
authored
Merge pull request #88402 from tysonn/master
pulled public over
2 parents 1f6b0bd + ca8e913 commit d4a3242

30 files changed

+208
-153
lines changed

‎articles/active-directory/develop/tutorial-v2-javascript-spa.md

Lines changed: 106 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -114,49 +114,49 @@ This guide uses the following library:
114114

115115
Add the following code to your `index.html` file within the `<script></script>` tags:
116116

117-
```javascript
118-
var msalConfig = {
119-
auth: {
120-
clientId: "Enter_the_Application_Id_here"
121-
authority: "https://login.microsoftonline.com/Enter_the_Tenant_Info_Here"
122-
},
123-
cache: {
124-
cacheLocation: "localStorage",
125-
storeAuthStateInCookie: true
126-
}
127-
};
128-
129-
var graphConfig = {
130-
graphMeEndpoint: "https://graph.microsoft.com/v1.0/me"
131-
};
132-
133-
// this can be used for login or token request, however in more complex situations
134-
// this can have diverging options
135-
var requestObj = {
117+
```JavaScript
118+
var msalConfig = {
119+
auth: {
120+
clientId: "Enter_the_Application_Id_here",
121+
authority: "https://login.microsoftonline.com/Enter_the_Tenant_Info_Here"
122+
},
123+
cache: {
124+
cacheLocation: "localStorage",
125+
storeAuthStateInCookie: true
126+
}
127+
};
128+
129+
var graphConfig = {
130+
graphMeEndpoint: "https://graph.microsoft.com/v1.0/me"
131+
};
132+
133+
// this can be used for login or token request, however in more complex situations
134+
// this can have diverging options
135+
var requestObj = {
136136
scopes: ["user.read"]
137-
};
137+
};
138138

139-
var myMSALObj = new Msal.UserAgentApplication(msalConfig);
140-
// Register Callbacks for redirect flow
141-
myMSALObj.handleRedirectCallback(authRedirectCallBack);
139+
var myMSALObj = new Msal.UserAgentApplication(msalConfig);
140+
// Register Callbacks for redirect flow
141+
myMSALObj.handleRedirectCallback(authRedirectCallBack);
142142

143143

144-
function signIn() {
144+
function signIn() {
145145

146-
myMSALObj.loginPopup(requestObj).then(function (loginResponse) {
147-
//Login Success
148-
showWelcomeMessage();
149-
acquireTokenPopupAndCallMSGraph();
150-
}).catch(function (error) {
151-
console.log(error);
152-
});
153-
}
146+
myMSALObj.loginPopup(requestObj).then(function (loginResponse) {
147+
//Login Success
148+
showWelcomeMessage();
149+
acquireTokenPopupAndCallMSGraph();
150+
}).catch(function (error) {
151+
console.log(error);
152+
});
153+
}
154154

155-
function acquireTokenPopupAndCallMSGraph() {
156-
//Always start with acquireTokenSilent to obtain a token in the signed in user from cache
157-
myMSALObj.acquireTokenSilent(requestObj).then(function (tokenResponse) {
155+
function acquireTokenPopupAndCallMSGraph() {
156+
//Always start with acquireTokenSilent to obtain a token in the signed in user from cache
157+
myMSALObj.acquireTokenSilent(requestObj).then(function (tokenResponse) {
158158
callMSGraph(graphConfig.graphMeEndpoint, tokenResponse.accessToken, graphAPICallback);
159-
}).catch(function (error) {
159+
}).catch(function (error) {
160160
console.log(error);
161161
// Upon acquireTokenSilent failure (due to consent or interaction or login required ONLY)
162162
// Call acquireTokenPopup(popup window)
@@ -167,92 +167,92 @@ Add the following code to your `index.html` file within the `<script></script>`
167167
console.log(error);
168168
});
169169
}
170-
});
171-
}
170+
});
171+
}
172172

173173

174-
function graphAPICallback(data) {
175-
document.getElementById("json").innerHTML = JSON.stringify(data, null, 2);
176-
}
174+
function graphAPICallback(data) {
175+
document.getElementById("json").innerHTML = JSON.stringify(data, null, 2);
176+
}
177177

178178

179-
function showWelcomeMessage() {
180-
var divWelcome = document.getElementById('WelcomeMessage');
181-
divWelcome.innerHTML = 'Welcome ' + myMSALObj.getAccount().userName + "to Microsoft Graph API";
182-
var loginbutton = document.getElementById('SignIn');
183-
loginbutton.innerHTML = 'Sign Out';
184-
loginbutton.setAttribute('onclick', 'signOut();');
185-
}
179+
function showWelcomeMessage() {
180+
var divWelcome = document.getElementById('WelcomeMessage');
181+
divWelcome.innerHTML = 'Welcome ' + myMSALObj.getAccount().userName + "to Microsoft Graph API";
182+
var loginbutton = document.getElementById('SignIn');
183+
loginbutton.innerHTML = 'Sign Out';
184+
loginbutton.setAttribute('onclick', 'signOut();');
185+
}
186186

187187

188-
//This function can be removed if you do not need to support IE
189-
function acquireTokenRedirectAndCallMSGraph() {
190-
//Always start with acquireTokenSilent to obtain a token in the signed in user from cache
191-
myMSALObj.acquireTokenSilent(requestObj).then(function (tokenResponse) {
192-
callMSGraph(graphConfig.graphMeEndpoint, tokenResponse.accessToken, graphAPICallback);
193-
}).catch(function (error) {
194-
console.log(error);
195-
// Upon acquireTokenSilent failure (due to consent or interaction or login required ONLY)
196-
// Call acquireTokenRedirect
197-
if (requiresInteraction(error.errorCode)) {
198-
myMSALObj.acquireTokenRedirect(requestObj);
199-
}
200-
});
201-
}
202-
203-
204-
function authRedirectCallBack(error, response) {
205-
if (error) {
188+
//This function can be removed if you do not need to support IE
189+
function acquireTokenRedirectAndCallMSGraph() {
190+
//Always start with acquireTokenSilent to obtain a token in the signed in user from cache
191+
myMSALObj.acquireTokenSilent(requestObj).then(function (tokenResponse) {
192+
callMSGraph(graphConfig.graphMeEndpoint, tokenResponse.accessToken, graphAPICallback);
193+
}).catch(function (error) {
206194
console.log(error);
207-
}
208-
else {
209-
if (response.tokenType === "access_token") {
210-
callMSGraph(graphConfig.graphEndpoint, response.accessToken, graphAPICallback);
211-
} else {
212-
console.log("token type is:" + response.tokenType);
195+
// Upon acquireTokenSilent failure (due to consent or interaction or login required ONLY)
196+
// Call acquireTokenRedirect
197+
if (requiresInteraction(error.errorCode)) {
198+
myMSALObj.acquireTokenRedirect(requestObj);
213199
}
214-
}
215-
}
216-
217-
function requiresInteraction(errorCode) {
218-
if (!errorCode || !errorCode.length) {
219-
return false;
220-
}
221-
return errorCode === "consent_required" ||
222-
errorCode === "interaction_required" ||
223-
errorCode === "login_required";
224-
}
225-
226-
// Browser check variables
227-
var ua = window.navigator.userAgent;
228-
var msie = ua.indexOf('MSIE ');
229-
var msie11 = ua.indexOf('Trident/');
230-
var msedge = ua.indexOf('Edge/');
231-
var isIE = msie > 0 || msie11 > 0;
232-
var isEdge = msedge > 0;
233-
//If you support IE, our recommendation is that you sign-in using Redirect APIs
234-
//If you as a developer are testing using Edge InPrivate mode, please add "isEdge" to the if check
235-
// can change this to default an experience outside browser use
236-
var loginType = isIE ? "REDIRECT" : "POPUP";
237-
238-
if (loginType === 'POPUP') {
200+
});
201+
}
202+
203+
204+
function authRedirectCallBack(error, response) {
205+
if (error) {
206+
console.log(error);
207+
}
208+
else {
209+
if (response.tokenType === "access_token") {
210+
callMSGraph(graphConfig.graphEndpoint, response.accessToken, graphAPICallback);
211+
} else {
212+
console.log("token type is:" + response.tokenType);
213+
}
214+
}
215+
}
216+
217+
function requiresInteraction(errorCode) {
218+
if (!errorCode || !errorCode.length) {
219+
return false;
220+
}
221+
return errorCode === "consent_required" ||
222+
errorCode === "interaction_required" ||
223+
errorCode === "login_required";
224+
}
225+
226+
// Browser check variables
227+
var ua = window.navigator.userAgent;
228+
var msie = ua.indexOf('MSIE ');
229+
var msie11 = ua.indexOf('Trident/');
230+
var msedge = ua.indexOf('Edge/');
231+
var isIE = msie > 0 || msie11 > 0;
232+
var isEdge = msedge > 0;
233+
//If you support IE, our recommendation is that you sign-in using Redirect APIs
234+
//If you as a developer are testing using Edge InPrivate mode, please add "isEdge" to the if check
235+
// can change this to default an experience outside browser use
236+
var loginType = isIE ? "REDIRECT" : "POPUP";
237+
238+
if (loginType === 'POPUP') {
239239
if (myMSALObj.getAccount()) {// avoid duplicate code execution on page load in case of iframe and popup window.
240240
showWelcomeMessage();
241241
acquireTokenPopupAndCallMSGraph();
242242
}
243-
}
244-
else if (loginType === 'REDIRECT') {
245-
document.getElementById("SignIn").onclick = function () {
243+
}
244+
else if (loginType === 'REDIRECT') {
245+
document.getElementById("SignIn").onclick = function () {
246246
myMSALObj.loginRedirect(requestObj);
247-
};
248-
if (myMSALObj.getAccount() && !myMSALObj.isCallback(window.location.hash)) {// avoid duplicate code execution on page load in case of iframe and popup window.
247+
};
248+
if (myMSALObj.getAccount() && !myMSALObj.isCallback(window.location.hash)) {// avoid duplicate code execution on page load in case of iframe and popup window.
249249
showWelcomeMessage();
250250
acquireTokenRedirectAndCallMSGraph();
251251
}
252-
} else {
253-
console.error('Please set a valid login type');
254-
}
255-
```
252+
} else {
253+
console.error('Please set a valid login type');
254+
}
255+
```
256256

257257
<!--start-collapse-->
258258
### More information

‎articles/active-directory/hybrid/reference-connect-version-history.md

Lines changed: 43 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,49 @@ Download| [Download Azure AD Connect](https://go.microsoft.com/fwlink/?LinkId=61
3838
While we go through this process, the version number of the release will be shown with an "X" in the minor release number position, as in "1.3.X.0" - this indicates that the release notes in this document are valid for all versions beginning with "1.3.". As soon as we have finalized the release process the release version number will be updated to the most recently released version and the release status will be updated to "Released for download and auto upgrade".
3939
Not all releases of Azure AD Connect will be made available for auto upgrade. The release status will indicate whether a release is made available for auto upgrade or for download only. If auto upgrade was enabled on your Azure AD Connect server then that server will automatically upgrade to the latest version of Azure AD Connect that is released for auto upgrade. Note that not all Azure AD Connect configurations are eligible for auto upgrade. Please follow this link to read more about [auto upgrade](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-install-automatic-upgrade)
4040

41+
## 1.4.X.0
42+
43+
### Release status
44+
9/10/2019: Released for auto-upgrade only
45+
46+
### New features and improvements
47+
- New troubleshooting tooling helps troubleshoot "user not syncing", "group not syncing" or "group member not syncing" scenarios.
48+
- Add support for national clouds in AAD Connect troubleshooting script
49+
- Customers should be informed that the deprecated WMI endpoints for MIIS_Service have now been removed. Any WMI operations should now be done via PS cmdlets.
50+
- Security improvement by resetting constrained delegation on AZUREADSSOACC object
51+
- When adding/editing a sync rule, if there are any attributes used in the rule that are in the connector schema but not added to the connector, the attributes automatically added to the connector. The same is true for the object type the rule affects. If anything is added to the connector, the connector will be marked for full import on the next sync cycle.
52+
- Using an Enterprise or Domain admin as the connector account is no longer supported.
53+
- In the Synchronization Manager a full sync is run on rule creation/edit/deletion. A popup will appear on any rule change notifying the user if full import or full sync is going to be run.
54+
- Added mitigation steps for password errors to 'connectors > properties > connectivity' page
55+
- Added a deprecation warning for the sync service manager on the connector properties page. This warning notifies the user that changes should be made through the AADC wizard.
56+
- Added new error for issues with a user's password policy.
57+
- Prevent misconfiguration of group filtering by domain and OU filters. Group filtering will show an error when the domain/OU of the entered group is already filtered out and keep the user from moving forward until the issue is resolved.
58+
- Users can no longer create a connector for Active Directory Domain Services or Windows Azure Active Directory in the old UI.
59+
- Fixed accessibility of custom UI controls in the Sync Service Manager
60+
- Enabled six federation management tasks for all sign-in methods in Azure AD Connect. (Previously, only the “Update AD FS SSL certificate” task was available for all sign-ins.)
61+
- Added a warning when changing the sign-in method from federation to PHS or PTA that all Azure AD domains and users will be converted to managed authentication.
62+
- Removed token-signing certificates from the “Reset Azure AD and AD FS trust” task and added a separate sub-task to update these certificates.
63+
- Added a new federation management task called “Manage certificates” which has sub-tasks to update the SSL or token-signing certificates for the AD FS farm.
64+
- Added a new federation management sub-task called “Specify primary server” which allows administrators to specify a new primary server for the AD FS farm.
65+
- Added a new federation management task called “Manage servers” which has sub-tasks to deploy an AD FS server, deploy a Web Application Proxy server, and specify primary server.
66+
- Added a new federation management task called “View federation configuration” that displays the current AD FS settings. (Because of this addition, AD FS settings have been removed from the “Review your solution” page.)
67+
68+
### Fixed issues
69+
- Resolved sync error issue for the scenario where a user object taking over its corresponding contact object has a self-reference (e.g. user is their own manager).
70+
- Help popups now show on keyboard focus.
71+
- For Auto upgrade, if any conflicting app is running from 6 hours, kill it and continue with upgrade.
72+
- Limit the number of attributes a customer can select to 100 per object when selecting directory extensions. This will prevent the error from occurring during export as Azure has a maximum of 100 extension attributes per object.
73+
- Fixed a bug to make the AD Connectivity script more robust
74+
- Fixed a bug to make AADConnect install on a machine using an existing Named Pipes WCF service more robust.
75+
- Improved diagnostics and troubleshooting around group policies that do not allow the ADSync service to start when initially installed.
76+
- Fixed a bug where display name for a Windows computer was written incorrectly.
77+
- Fix a bug where OS type for a Windows computer was written incorrectly.
78+
- Fixed a bug where non-Windows 10 computers were syncing unexpectedly. Note that the effect of this change is that non-Windows-10 computers that were previously synced will now be deleted. This does not affect any features as the sync of Windows computers is only used for Hybrid Azure AD domain join, which only works for Windows-10 devices.
79+
- Fix a bug where display name for a Windows computer was written incorrectly.
80+
- Fix a bug where OS type for a Windows computer was written incorrectly.
81+
- Added several new (internal) cmdlets to the ADSync PowerShell module.
82+
83+
4184
## 1.3.21.0
4285
>[!IMPORTANT]
4386
>There is a known issue with upgrading Azure AD Connect from an earlier version to 1.3.21.0 where the O365 portal does not reflect the updated version even though Azure AD Connect upgraded successfully.
@@ -48,13 +91,10 @@ Not all releases of Azure AD Connect will be made available for auto upgrade. Th
4891
>2. Run `Import-Module "ADSync"`
4992
>3. Run `Set-ADSyncDirSyncConfiguration -AnchorAttribute ""`
5093
51-
52-
5394
### Release status
5495

5596
05/14/2019: Released for download
5697

57-
5898
### Fixed issues
5999

60100
- Fixed an elevation of privilege vulnerability that exists in Microsoft Azure Active Directory Connect build 1.3.20.0. This vulnerability, under certain conditions, may allow an attacker to execute two powershell cmdlets in the context of a privileged account, and perform privileged actions. This security update addresses the issue by disabling these cmdlets. For more information see [security update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1000).
@@ -90,7 +130,6 @@ Not all releases of Azure AD Connect will be made available for auto upgrade. Th
90130

91131
### Fixed issues
92132

93-
94133
- Fix the SQL reconnect logic for ADSync service
95134
- Fix to allow clean Install using an empty SQL AOA DB
96135
- Fix PS Permissions script to refine GWB permissions

‎articles/active-directory/managed-identities-azure-resources/known-issues.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ No. Managed identities do not currently support cross-directory scenarios.
7979

8080
### What Azure RBAC permissions are required to managed identity on a resource?
8181

82-
- System-assigned managed identity: You need write permissions over the resource. For exampl, for virtual machines you need Microsoft.Compute/virtualMachines/write. This action is included in resource specific built-in roles like [Virtual Machine Contributor](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#virtual-machine-contributor).
82+
- System-assigned managed identity: You need write permissions over the resource. For example, for virtual machines you need Microsoft.Compute/virtualMachines/write. This action is included in resource specific built-in roles like [Virtual Machine Contributor](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#virtual-machine-contributor).
8383
- User-assigned managed identity: You need write permissions over the resource. For example, for virtual machines you need Microsoft.Compute/virtualMachines/write. In addition to [Managed Identity Operator](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#managed-identity-operator) role assignment over the managed identity.
8484

8585
### How do you restart the managed identities for Azure resources extension?

‎articles/active-directory/reports-monitoring/concept-provisioning-logs.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ This enables you to display additional fields or remove fields that are already
8181

8282
Select an item in the list view to get more detailed information.
8383

84-
![Detailed information](./media/concept-provisioning-logs/detailed-information.png "Detailed information")
84+
![Detailed information](./media/concept-provisioning-logs/steps.png "Filter")
8585

8686

8787
## Filter provisioning activities

‎articles/app-service/app-service-web-app-cloning.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Using the `New-AzWebApp` command, you can create the new app in the North Centra
4646
$destapp = New-AzWebApp -ResourceGroupName DestinationAzureResourceGroup -Name dest-webapp -Location "North Central US" -AppServicePlan DestinationAppServicePlan -SourceWebApp $srcapp
4747
```
4848

49-
To clone an existing app including all associated deployment slots, you need to use the `IncludeSourceWebAppSlots` parameter. The following PowerShell command demonstrates the use of that parameter with the `New-AzWebApp` command:
49+
To clone an existing app including all associated deployment slots, you need to use the `IncludeSourceWebAppSlots` parameter. Note that the `IncludeSourceWebAppSlots` parameter is only supported for cloning an entire app including all of its slots. The following PowerShell command demonstrates the use of that parameter with the `New-AzWebApp` command:
5050

5151
```powershell
5252
$destapp = New-AzWebApp -ResourceGroupName DestinationAzureResourceGroup -Name dest-webapp -Location "North Central US" -AppServicePlan DestinationAppServicePlan -SourceWebApp $srcapp -IncludeSourceWebAppSlots

0 commit comments

Comments
 (0)