Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into sdg-master

Author: sdgilley

.markdownlint.json

@@ -40,4 +40,4 @@
     "MD045": false,
     "MD046": false,
     "MD047": false
-}
+}

.openpublishing.redirection.json

@@ -3835,6 +3835,11 @@
       "redirect_url": "/azure/azure-resource-manager/vs-azure-tools-resource-groups-deployment-projects-create-deploy",
       "redirect_document_id": false
     },
+    {
+      "source_path": "articles/vs-azure-tools-resource-groups-ci-in-vsts.md",
+      "redirect_url": "/azure/azure-resource-manager/vs-resource-groups-project-devops-pipelines",
+      "redirect_document_id": false
+    },
     {
       "source_path": "articles/vs-azure-tools-connected-services-add-active-directory.md",
       "redirect_url": "/azure/active-directory/develop/vs-active-directory-add-connected-service",

articles/active-directory-b2c/ropc-custom.md

@@ -251,7 +251,7 @@ Next, update the relying party file that initiates the user journey that you cre
     ```
 
 5. On the **Custom Policies** page in your Azure AD B2C tenant, select **Upload Policy**.
-6. Enable **Overwrite the policy if it exists**, and then browse to and select the *TrustFrameworkExtensions.xml* file.
+6. Enable **Overwrite the policy if it exists**, and then browse to and select the *ROPC_Auth.xml* file.
 7. Click **Upload**.
 
 ## Test the policy

articles/active-directory/authentication/howto-mfa-nps-extension.md

@@ -222,7 +222,7 @@ Look for the self-signed certificate created by the installer in the cert store,
 
 Self-signed certificates generated by the *AzureMfaNpsExtnConfigSetup.ps1* script also have a validity lifetime of two years. When verifying that the certificate is installed, you should also check that the certificate has not expired.
 
--------------------------------------------------------------
+---
 
 ### How can I verify that my client cert is associated to my tenant in Azure Active Directory?
 
@@ -248,13 +248,13 @@ Once you run this command, go to your C drive, locate the file and double-click
 
 Valid-From and Valid-Until timestamps, which are in human-readable form, can be used to filter out obvious misfits if the command returns more than one cert.
 
--------------------------------------------------------------
+---
 
 ### Why cant I sign in?
 
 Check that your password hasn't expired. The NPS Extension does not support changing passwords as part of the sign-in workflow. Contact your organization's IT Staff for further assistance.
 
--------------------------------------------------------------
+---
 
 ### Why are my requests failing with ADAL token error?
 
@@ -265,19 +265,19 @@ This error could be due to one of several reasons. Use these steps to help troub
 3. Verify that the certificate is associated with your tenant on Azure AD.
 4. Verify that https://login.microsoftonline.com/ is accessible from the server running the extension.
 
--------------------------------------------------------------
+---
 
 ### Why does authentication fail with an error in HTTP logs stating that the user is not found?
 
 Verify that AD Connect is running, and that the user is present in both Windows Active Directory and Azure Active Directory.
 
--------------------------------------------------------------
+---
 
 ### Why do I see HTTP connect errors in logs with all my authentications failing?
 
 Verify that https://adnotifications.windowsazure.com is reachable from the server running the NPS extension.
 
--------------------------------------------------------------
+---
 
 ### Why is authentication not working, despite a valid certificate being present?
 

articles/active-directory/conditional-access/howto-baseline-protect-administrators.md

@@ -69,6 +69,9 @@ To enable this policy and protect your administrators:
 1. Add any user exclusions by clicking on **Users** > **Select excluded users** and choosing the users that need to be excluded. Click **Select** then **Done**.
 1. Click **Save**.
 
+> [!WARNING]
+> There was an option **Automatically enable policy in the future** when this policy was in preview. We removed this option to minimize sudden user impact. If you selected this option when it was available, **Do not use policy** is automatically now selected. If they want to use this baseline policy, see steps above to enable it.
+
 ## Next steps
 
 For more information, see:

articles/active-directory/conditional-access/location-condition.md

@@ -54,7 +54,10 @@ A named location has the following components:
 - **Countries/Regions** - This option enables you to select one or more country or region to define a named location.
 - **Include unknown areas** - Some IP addresses are not mapped to a specific country or region. This option allows you to choose if these IP addresses should be included in the named location. Use this setting when the policy using the named location should apply to unknown locations.
 
-The number of named locations you can configure is constrained by the size of the related object in Azure AD. Organizations can configure up to 90 named locations, each configured with up to 1200 IP ranges.
+The number of named locations you can configure is constrained by the size of the related object in Azure AD. You can configure locations based on of the following limitations:
+
+- One named location with up to 1200 IP ranges.
+- A maximum of 90 named locations with one IP range assigned to each of them.
 
 Conditional Access policy applies to IPv4 and IPv6 traffic. Currently named locations do not allow IPv6 ranges to be configured. This limitation causes the following situations:
 

articles/active-directory/devices/concept-primary-refresh-token.md

@@ -60,6 +60,9 @@ The PRT is issued during user authentication on a Windows 10 device in two scena
 
 In these scenarios, the Azure AD WAM plugin is the primary authority for the PRT since Windows logon is not happening with this  Azure AD account.
 
+> [!NOTE]
+> 3rd party identity providers need to support the WS-Trust protocol to enable PRT issuance on Windows 10 devices. Without WS-Trust, PRT cannot be issued to users on Hybrid Azure AD joined or Azure AD joined devices
+
 ## What is the lifetime of a PRT?
 
 Once issued, a PRT is valid for 14 days and is continuously renewed as long as the user actively uses the device.  

articles/active-directory/fundamentals/active-directory-faq.md

@@ -31,7 +31,7 @@ For more information, see:
 
 * [How Azure subscriptions are associated with Azure Active Directory](active-directory-how-subscriptions-associated-directory.md)
 
-- - -
+---
 **Q: What’s the relationship between Azure AD, Office 365, and Azure?**
 
 **A:** Azure AD provides you with common identity and access capabilities to all web services. Whether you are using Office 365, Microsoft Azure, Intune, or others, you're already using Azure AD to help turn on sign-on and access management for all these services.
@@ -40,7 +40,7 @@ All users who are set up to use web services are defined as user accounts in one
 
 Azure AD paid services like Enterprise Mobility + Security complement other web services like Office 365 and Microsoft Azure with comprehensive enterprise-scale management and security solutions.
 
-- - -
+---
 
 **Q:  What are the differences between Owner and Global Administrator?**
 
@@ -52,27 +52,27 @@ By default, the person who signs up for an Azure subscription is assigned the Gl
 
 Additionally, Azure AD paid services like Enterprise Mobility + Security complement other web services, such as Office 365 and Microsoft Azure, with comprehensive enterprise-scale management and security solutions.
 
-- - -
+---
 **Q: Is there a report that shows when my Azure AD user licenses will expire?**
 
 **A:** No.  This is not currently available.
 
-- - -
+---
 
 ## Get started with Hybrid Azure AD
 
 
 **Q: How do I leave a tenant when I am added as a collaborator?**
 
 **A:** When you are added to another organization's tenant as a collaborator, you can use the "tenant switcher" in the upper right to switch between tenants.  Currently, there is no way to leave the inviting organization, and Microsoft is working on providing this functionality.  Until this feature is available, you can ask the inviting organization to remove you from their tenant.
-- - -
+---
 **Q: How can I connect my on-premises directory to Azure AD?**
 
 **A:** You can connect your on-premises directory to Azure AD by using Azure AD Connect.
 
 For more information, see [Integrating your on-premises identities with Azure Active Directory](../hybrid/whatis-hybrid-identity.md).
 
-- - -
+---
 **Q: How do I set up SSO between my on-premises directory and my cloud applications?**
 
 **A:** You only need to set up single sign-on (SSO) between your on-premises directory and Azure AD. As long as you access your cloud applications through Azure AD, the service automatically drives your users to correctly authenticate with their on-premises credentials.
@@ -81,40 +81,40 @@ Implementing SSO from on-premises can be easily achieved with federation solutio
 
 For more information, see [Integrating your on-premises identities with Azure Active Directory](../hybrid/whatis-hybrid-identity.md).
 
-- - -
+---
 **Q: Does Azure AD provide a self-service portal for users in my organization?**
 
 **A:** Yes, Azure AD provides you with the [Azure AD Access Panel](https://myapps.microsoft.com) for user self-service and application access. If you are an Office 365 customer, you can find many of the same capabilities in the [Office 365 portal](https://portal.office.com).
 
 For more information, see [Introduction to the Access Panel](../user-help/active-directory-saas-access-panel-introduction.md).
 
-- - -
+---
 **Q: Does Azure AD help me manage my on-premises infrastructure?**
 
 **A:** Yes. The Azure AD Premium edition provides you with Azure AD Connect Health. Azure AD Connect Health helps you monitor and gain insight into your on-premises identity infrastructure and the synchronization services.  
 
 For more information, see [Monitor your on-premises identity infrastructure and synchronization services in the cloud](../hybrid/whatis-hybrid-identity-health.md).  
 
-- - -
+---
 ## Password management
 **Q: Can I use Azure AD password write-back without password sync? (In this scenario, is it possible to use Azure AD self-service password reset (SSPR) with password write-back and not store passwords in the cloud?)**
 
 **A:** You do not need to synchronize your Active Directory passwords to Azure AD to enable write-back. In a federated environment, Azure AD single sign-on (SSO) relies on the on-premises directory to authenticate the user. This scenario does not require the on-premises password to be tracked in Azure AD.
 
-- - -
+---
 **Q: How long does it take for a password to be written back to Active Directory on-premises?**
 
 **A:** Password write-back operates in real time.
 
 For more information, see [Getting started with password management](../authentication/quickstart-sspr.md).
 
-- - -
+---
 **Q: Can I use password write-back with passwords that are managed by an admin?**
 
 **A:** Yes, if you have password write-back enabled, the password operations performed by an admin are written back to your on-premises environment.  
 
 For more answers to password-related questions, see [Password management frequently asked questions](../authentication/active-directory-passwords-faq.md).
-- - -
+---
 **Q:  What can I do if I can't remember my existing Office 365/Azure AD password while trying to change my password?**
 
 **A:** For this type of situation, there are a couple of options.  Use self-service password reset (SSPR) if it's available.  Whether SSPR works depends on how it's configured.  For more information, see [How does the password reset portal work](../authentication/howto-sspr-deployment.md).
@@ -127,7 +127,7 @@ For Azure AD accounts, admins can reset passwords by using one of the following:
 - [Using PowerShell](/powershell/module/msonline/set-msoluserpassword?view=azureadps-1.0)
 
 
-- - -
+---
 ## Security
 **Q: Are accounts locked after a specific number of failed attempts or is there a more sophisticated strategy used?**
 
@@ -149,7 +149,7 @@ We do have a gateway that filters requests and provides some protection from bot
 
 For a complete list of the pre-integrated applications, see the [Active Directory Marketplace](https://azure.microsoft.com/marketplace/active-directory/).
 
-- - -
+---
 **Q: What if the application I need is not in the Azure AD marketplace?**
 
 **A:** With Azure AD Premium, you can add and configure any application that you want. Depending on your application’s capabilities and your preferences, you can configure SSO and automated provisioning.  
@@ -159,7 +159,7 @@ For more information, see:
 * [Configuring single sign-on to applications that are not in the Azure Active Directory application gallery](../manage-apps/configure-federated-single-sign-on-non-gallery-applications.md)
 * [Using SCIM to enable automatic provisioning of users and groups from Azure Active Directory to applications](../manage-apps/use-scim-to-provision-users-and-groups.md)
 
-- - -
+---
 **Q: How do users sign in to applications by using Azure AD?**
 
 **A:** Azure AD provides several ways for users to view and access their applications, such as:
@@ -171,7 +171,7 @@ For more information, see:
 
 For more information, see [End user experiences for applications](../manage-apps/end-user-experiences.md).
 
-- - -
+---
 **Q: What are the different ways Azure AD enables authentication and single sign-on to applications?**
 
 **A:** Azure AD supports many standardized protocols for authentication and authorization, such as SAML 2.0, OpenID Connect, OAuth 2.0, and WS-Federation. Azure AD also supports password vaulting and automated sign-in capabilities for apps that only support forms-based authentication.  
@@ -182,28 +182,28 @@ For more information, see:
 * [Active Directory authentication protocols](https://msdn.microsoft.com/library/azure/dn151124.aspx)
 * [Single sign-on for applications in Azure AD](../manage-apps/what-is-single-sign-on.md)
 
-- - -
+---
 **Q: Can I add applications I’m running on-premises?**
 
 **A:** Azure AD Application Proxy provides you with easy and secure access to on-premises web applications that you choose. You can access these applications in the same way that you access your software as a service (SaaS) apps in Azure AD. There is no need for a VPN or to change your network infrastructure.  
 
 For more information, see [How to provide secure remote access to on-premises applications](../manage-apps/application-proxy.md).
 
-- - -
+---
 **Q: How do I require multi-factor authentication for users who access a particular application?**
 
 **A:** With Azure AD Conditional Access, you can assign a unique access policy for each application. In your policy, you can require multi-factor authentication always, or when users are not connected to the local network.  
 
 For more information, see [Securing access to Office 365 and other apps connected to Azure Active Directory](../active-directory-conditional-access-azure-portal.md).
 
-- - -
+---
 **Q: What is automated user provisioning for SaaS apps?**
 
 **A:** Use Azure AD to automate the creation, maintenance, and removal of user identities in many popular cloud SaaS apps.
 
 For more information, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../manage-apps/user-provisioning.md).
 
-- - -
+---
 **Q:  Can I set up a secure LDAP connection with Azure AD?**
 
 **A:**  No. Azure AD does not support the Lightweight Directory Access Protocol (LDAP) protocol or Secure LDAP directly. However, it's possible to enable Azure AD Domain Services (Azure AD DS) instance on your Azure AD tenant with properly configured network security groups through Azure Networking to achieve LDAP connectivity. For more information, see https://docs.microsoft.com/azure/active-directory-domain-services/active-directory-ds-admin-guide-configure-secure-ldap.

articles/active-directory/governance/TOC.yml

@@ -46,6 +46,8 @@
       href: entitlement-management-request-access.md
     - name: Approve requests
       href: entitlement-management-request-approve.md
+    - name: Delegate tasks
+      href: entitlement-management-delegate.md
     - name: View reports and logs
       href: entitlement-management-reports.md
     - name: Troubleshoot

articles/active-directory/governance/entitlement-management-access-package-create.md

@@ -125,4 +125,5 @@ On the **Review + create** tab, you can review your settings and check for any v
 ## Next steps
 
 - [Edit and manage an existing access package](entitlement-management-access-package-edit.md)
+- [Add a catalog owner or an access package manager](entitlement-management-delegate.md#add-a-catalog-owner-or-an-access-package-manager)
 - [Create and manage a catalog](entitlement-management-catalog-create.md)