Skip to content

Commit dbf885c

Browse files
v-aljev-alje
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into release-ignite-cosmosdb
2 parents baed396 + aa237cc commit dbf885c

File tree

826 files changed

+6783
-2675
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

826 files changed

+6783
-2675
lines changed

‎.openpublishing.redirection.json

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19196,9 +19196,14 @@
1919619196
},
1919719197
{
1919819198
"source_path": "articles/active-directory/active-directory-passwords.md",
19199-
"redirect_url": "active-directory-passwords-update-your-own-password",
19199+
"redirect_url": "/azure/active-directory/user-help/active-directory-passwords-update-your-own-password",
1920019200
"redirect_document_id": false
1920119201
},
19202+
{
19203+
"source_path": "articles/active-directory/user-help/user-help-reset-password.md",
19204+
"redirect_url": "/azure/active-directory/user-help/active-directory-passwords-update-your-own-password",
19205+
"redirect_document_id": false
19206+
},
1920219207
{
1920319208
"source_path": "articles/active-directory/active-directory-protocols-oauth-code.md",
1920419209
"redirect_url": "/azure/active-directory/develop/active-directory-protocols-oauth-code",
@@ -41935,7 +41940,12 @@
4193541940
},
4193641941
{
4193741942
"source_path": "articles/iot-central/howto-use-device-groups-pnp.md",
41938-
"redirect_url": "/azure/iot-central/core/howto-use-device-groups-pnp/",
41943+
"redirect_url": "/azure/iot-central/core/tutorial-use-device-groups-pnp/",
41944+
"redirect_document_id": true
41945+
},
41946+
{
41947+
"source_path": "articles/iot-central/core/howto-use-device-groups-pnp.md",
41948+
"redirect_url": "/azure/iot-central/core/tutorial-use-device-groups-pnp/",
4193941949
"redirect_document_id": true
4194041950
},
4194141951
{
@@ -43297,6 +43307,11 @@
4329743307
"source_path": "articles/terraform/terraform-vm-msi.md",
4329843308
"redirect_url": "/azure/terraform/terraform-vm-managed-identities-for-azure-resources",
4329943309
"redirect_document_id": true
43310+
},
43311+
{
43312+
"source_path": "articles/active-directory/develop/msal-acquire-token-interactively.md",
43313+
"redirect_url": "/azure/active-directory/develop/msal-acquire-cache-tokens",
43314+
"redirect_document_id": true
4330043315
}
4330143316
]
4330243317
}

‎articles/active-directory-b2c/active-directory-b2c-reference-customize-ui-custom.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ You can provide as many content pages as you like by crafting HTML5/CSS files as
3939
> [!NOTE]
4040
> For security reasons, the use of JavaScript is currently blocked for customization.
4141
42-
In each of your HTML5/CSS templates, you provide an *anchor* element, which corresponds to the required `<div id=”api”>` element in the HTML or the content page as illustrate hereafter. Azure AD B2C requires that all content pages have this specific div.
42+
In each of your HTML5/CSS templates, you provide an *anchor* element, which corresponds to the required `<div id="api">` element in the HTML or the content page as illustrate hereafter. Azure AD B2C requires that all content pages have this specific div.
4343

4444
```
4545
<!DOCTYPE html>

‎articles/active-directory/authentication/TOC.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@
4343
items:
4444
- name: How MFA works
4545
href: concept-mfa-howitworks.md
46+
- name: Enable MFA
47+
href: concept-mfa-get-started.md
4648
- name: License your users
4749
href: concept-mfa-licensing.md
4850
- name: Manage an Auth Provider
@@ -135,6 +137,10 @@
135137
href: howto-authentication-passwordless-deployment.md
136138
- name: Passwordless security keys
137139
href: howto-authentication-passwordless-security-key.md
140+
- name: Passwordless Windows 10
141+
href: howto-authentication-passwordless-security-key-windows.md
142+
- name: Passwordless on-premises
143+
href: howto-authentication-passwordless-security-key-on-premises.md
138144
- name: Passwordless phone sign-in
139145
href: howto-authentication-passwordless-phone.md
140146
- name: Windows Hello for Business

‎articles/active-directory/authentication/concept-authentication-passwordless.md

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@ Multi-factor authentication (MFA) is a great way to secure your organization, bu
2525

2626
Each organization has different needs when it comes to authentication. Microsoft offers three passwordless authentication options:
2727

28-
- Windows Hello for Business
29-
- Microsoft Authenticator app
28+
- Windows Hello for Business
29+
- Microsoft Authenticator app
3030
- FIDO2 security keys
3131

3232
![Authentication: Security versus convenience](./media/concept-authentication-passwordless/passwordless-convenience-security.png)
3333

34-
## Windows Hello for Business
34+
## Windows Hello for Business
3535

36-
Windows Hello for Business is ideal for information workers who have their own designated Windows PC. The biometric and PIN are directly tied to the user's PC, which prevents access from anyone other than the owner. With PKI integration and built-in support for single sign-on (SSO), Windows Hello for Business provides a simple and convenient method for seamlessly accessing corporate resources on-premises and in the cloud.
36+
Windows Hello for Business is ideal for information workers who have their own designated Windows PC. The biometric and PIN are directly tied to the user's PC, which prevents access from anyone other than the owner. With PKI integration and built-in support for single sign-on (SSO), Windows Hello for Business provides a simple and convenient method for seamlessly accessing corporate resources on-premises and in the cloud.
3737

3838
The Windows Hello for Business [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-planning-guide) can be used to help you make decisions on the type of Windows Hello for Business deployment and the options you'll need to consider.
3939

@@ -49,7 +49,7 @@ It turns any iOS or Android phone into a strong, passwordless credential by allo
4949

5050
FIDO2 security keys are an unphishable standards-based passwordless authentication method that can come in any form factor. Fast Identity Online (FIDO) is an open standard for passwordless authentication. It allows users and organizations to leverage the standard to sign in to their resources without a username or password using an external security key or a platform key built into a device.
5151

52-
For public preview, employees can use external security keys to sign in to their Azure Active Directory Joined Windows 10 machines (running version 1809 or higher) and get single-sign on to their cloud resources. They can also sign in to supported browsers.
52+
For public preview, employees can use security keys to sign in to their Azure AD or hybrid Azure AD joined Windows 10 devices and get single-sign on to their cloud and on-premises resources. They can also sign in to supported browsers.
5353

5454
![Sign in to Microsoft Edge with a security key](./media/concept-authentication-passwordless/concept-web-sign-in-security-key.png)
5555

@@ -75,6 +75,9 @@ The following providers offer FIDO2 security keys of different form factors that
7575
| eWBM | [https://www.ewbm.com/page/sub1_5](https://www.ewbm.com/page/sub1_5) |
7676
| AuthenTrend | [https://authentrend.com/about-us/#pg-35-3](https://authentrend.com/about-us/#pg-35-3) |
7777

78+
> [!NOTE]
79+
> If you purchase and plan to use NFC based security keys you will need a supported NFC reader.
80+
7881
If you are a vendor and want to get your device on this list, contact [[email protected]](mailto:[email protected]).
7982

8083
FIDO2 security keys are a great option for enterprises who are very security sensitive or have scenarios or employees who aren’t willing or able to use their phone as a second factor.
@@ -86,7 +89,7 @@ FIDO2 security keys are a great option for enterprises who are very security sen
8689
- End users can register and manage these passwordless authentication methods in their account portal
8790
- End users can sign in with these passwordless authentication methods
8891
- Microsoft Authenticator App: Will work in scenarios where Azure AD authentication is used, including across all browsers, during Windows 10 Out Of Box (OOBE) setup, and with integrated mobile apps on any operating system.
89-
- Security keys: Will work on lock screen for Windows 10 version 1809 or higher and the web in supported browsers like Microsoft Edge.
92+
- Security keys: Will work on lock screen for Windows 10 and the web in supported browsers like Microsoft Edge.
9093

9194
## Next steps
9295

‎articles/active-directory/authentication/concept-mfa-get-started.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: Enable Multi-Factor Authentication for your organization - Azure Active Directory
3+
description: Enable Azure MFA for your organization based on your license
4+
5+
services: multi-factor-authentication
6+
ms.service: active-directory
7+
ms.subservice: authentication
8+
ms.topic: conceptual
9+
ms.date: 10/29/2019
10+
11+
ms.author: joflore
12+
author: MicrosoftGuyJFlo
13+
manager: daveba
14+
ms.reviewer: michmcla
15+
16+
ms.collection: M365-identity-device-management
17+
---
18+
# Enable Multi-Factor Authentication for your organization
19+
20+
There are multiple ways to enable Azure Multi-Factor Authentication (MFA) for your Azure Active Directory (AD) users based on the licenses that your organization owns.
21+
22+
![Investigate signals and enforce MFA if needed](./media/concept-mfa-get-started/verify-signals-and-perform-mfa-if-required.png)
23+
24+
Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.
25+
26+
So how does your organization turn on multi-factor authentication even for free, before becoming a statistic?
27+
28+
## Free option
29+
30+
Customers who are utilizing the free benefits of Azure AD can use [security defaults](../conditional-access/concept-conditional-access-security-defaults.md) to enable multi-factor authentication in their environment.
31+
32+
## Office 365
33+
34+
For customers with Office 365, there are two options:
35+
36+
- [Security defaults](../conditional-access/concept-conditional-access-security-defaults.md) can be enabled through Azure AD to protect all of your users with Azure Multi-Factor Authentication.
37+
- If your organization requires more granularity in providing multi-factor authentication, your Office licenses include [per-user MFA](../authentication/howto-mfa-userstates.md) capabilities. Per-user MFA is enabled and enforced on each user individually by administrators.
38+
39+
## Azure AD Premium P1
40+
41+
For customers with Azure AD Premium P1 or similar licenses that include this functionality such as Enterprise Mobility + Security E3, Microsoft 365 F1, or Microsoft 365 E3:
42+
43+
The recommendation is to use [Conditional Access policies](../conditional-access/concept-conditional-access-policy-common.md) for the best user experience.
44+
45+
## Azure AD Premium P2
46+
47+
For customers with Azure AD Premium P2 or similar licenses that include this functionality such as Enterprise Mobility + Security E5 or Microsoft 365 E5:
48+
49+
The recommendation is to use [Conditional Access policies](../conditional-access/concept-conditional-access-policy-common.md) along with [Identity Protection](../identity-protection/overview-v2.md) risk policies for the best user experience and enforcement flexibility.
50+
51+
## Authentication methods
52+
53+
| | Security defaults | All other methods |
54+
| --- | --- | --- |
55+
| Notification through mobile app | X | X |
56+
| Verification code from mobile app or hardware token | | X |
57+
| Text message to phone | | X |
58+
| Call to phone | | X |
59+
| App passwords | | X** |
60+
61+
** App passwords are only available in per-user MFA with legacy authentication scenarios only if enabled by administrators.
62+
63+
## Next steps
64+
65+
[Azure AD pricing page](https://azure.microsoft.com/pricing/details/active-directory/)

‎articles/active-directory/authentication/concept-mfa-licensing.md

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ services: multi-factor-authentication
66
ms.service: active-directory
77
ms.subservice: authentication
88
ms.topic: conceptual
9-
ms.date: 06/03/2018
9+
ms.date: 10/29/2019
1010

1111
ms.author: joflore
1212
author: MicrosoftGuyJFlo
@@ -24,16 +24,17 @@ When it comes to protecting your accounts, two-step verification should be stand
2424
2525
## Available versions of Azure Multi-Factor Authentication
2626

27-
The following table describes the differences between three versions of multi-factor authentication:
27+
The following table describes the differences between versions of multi-factor authentication:
2828

2929
| Version | Description |
3030
| --- | --- |
31-
| Multi-Factor Authentication for Office 365 <br> Microsoft 365 Business | This version is managed from the Office 365 or Microsoft 365 portal. Administrators can [secure Office 365 resources with two-step verification](https://support.office.com/article/Set-up-multi-factor-authentication-for-Office-365-users-8f0454b2-f51a-4d9c-bcde-2c48e41621c6). This version is part of an Office 365 or Microsoft 365 Business subscription. |
31+
| Free option | Customers who are utilizing the free benefits of Azure AD can use [security defaults](../conditional-access/concept-conditional-access-security-defaults.md) to enable multi-factor authentication in their environment. |
32+
| Multi-Factor Authentication for Office 365 | This version is managed from the Office 365 or Microsoft 365 portal. Administrators can [secure Office 365 resources with two-step verification](https://support.office.com/article/Set-up-multi-factor-authentication-for-Office-365-users-8f0454b2-f51a-4d9c-bcde-2c48e41621c6). This version is part of an Office 365 subscription. |
3233
| Multi-Factor Authentication for Azure AD Administrators | Users assigned the Azure AD Global Administrator role in Azure AD tenants can enable two-step verification at no additional cost. |
33-
| Azure Multi-Factor Authentication | Often referred to as the "full" version, Azure Multi-Factor Authentication offers the richest set of capabilities. It provides additional configuration options via the [Azure portal](https://portal.azure.com), advanced reporting, and support for a range of on-premises and cloud applications. Azure Multi-Factor Authentication is a feature of [Azure Active Directory Premium](https://www.microsoft.com/cloud-platform/azure-active-directory-features). |
34+
| Azure Multi-Factor Authentication | Often referred to as the "full" version, Azure Multi-Factor Authentication offers the richest set of capabilities. It provides additional configuration options via the [Azure portal](https://portal.azure.com), advanced reporting, and support for a range of on-premises and cloud applications. Azure Multi-Factor Authentication is a feature of [Azure Active Directory Premium](https://www.microsoft.com/cloud-platform/azure-active-directory-features) and [Microsoft 365 Business](https://www.microsoft.com/microsoft-365/business). |
3435

3536
> [!NOTE]
36-
> New customers may no longer purchase Azure Multi-Factor Authentication as a standalone offering effective September 1st, 2018. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses.
37+
> New customers may no longer purchase Azure Multi-Factor Authentication as a standalone offering effective September 1st, 2018. Multi-factor authentication will continue to be available as a feature in Azure AD Premium or Microsoft 365 Business licenses.
3738
3839
## Feature comparison of versions
3940

@@ -43,24 +44,24 @@ The following table provides a list of the features that are available in the va
4344
> This comparison table discusses the features that are part of each version of Multi-Factor Authentication. If you have the full Azure Multi-Factor Authentication service, some features may not be available depending on whether you use [MFA in the cloud or MFA on-premises](concept-mfa-whichversion.md).
4445
>
4546
46-
| Feature | Multi-Factor Authentication for Office 365 | Multi-Factor Authentication for Azure AD Administrators | Azure Multi-Factor Authentication |
47-
| --- |:---:|:---:|:---:|
48-
| Protect Azure AD admin accounts with MFA |● |● (Azure AD Global Administrator accounts only) |● |
49-
| Mobile app as a second factor |● |● |● |
50-
| Phone call as a second factor |● |● |● |
51-
| SMS as a second factor |● |● |● |
52-
| App passwords for clients that don't support MFA |● |● |● |
53-
| Admin control over verification methods |● |● |● |
54-
| Protect non-admin accounts with MFA |● | |● |
55-
| PIN mode | | |● |
56-
| Fraud alert | | |● |
57-
| MFA Reports | | |● |
58-
| One-Time Bypass | | |● |
59-
| Custom greetings for phone calls | | |● |
60-
| Custom caller ID for phone calls | | |● |
61-
| Trusted IPs | | |● |
62-
| Remember MFA for trusted devices |● |● |● |
63-
| MFA for on-premises applications | | |● |
47+
| Feature | Multi-Factor Authentication for Office 365 | Multi-Factor Authentication for Azure AD Administrators | Azure Multi-Factor Authentication | Security defaults |
48+
| --- |:---:|:---:|:---:|:---:|
49+
| Protect Azure AD admin accounts with MFA |● |● (Azure AD Global Administrator accounts only) |● |● |
50+
| Mobile app as a second factor |● |● |● |● |
51+
| Phone call as a second factor |● |● |● | |
52+
| SMS as a second factor |● |● |● | |
53+
| App passwords for clients that don't support MFA |● |● |● | |
54+
| Admin control over verification methods |● |● |● | |
55+
| Protect non-admin accounts with MFA |● | |● |● |
56+
| PIN mode | | |● | |
57+
| Fraud alert | | |● | |
58+
| MFA Reports | | |● | |
59+
| One-Time Bypass | | |● | |
60+
| Custom greetings for phone calls | | |● | |
61+
| Custom caller ID for phone calls | | |● | |
62+
| Trusted IPs | | |● | |
63+
| Remember MFA for trusted devices |● |● |● | |
64+
| MFA for on-premises applications | | |● | |
6465

6566
> [!IMPORTANT]
6667
> Starting in March of 2019 the phone call options will not be available to MFA and SSPR users in free/trial Azure AD tenants. SMS messages are not impacted by this change. Phone call will continue to be available to users in paid Azure AD tenants. This change only impacts free/trial Azure AD tenants.
@@ -98,10 +99,8 @@ When using an Azure Multi-Factor Authentication Provider, there are two usage mo
9899
> Today, the Azure MFA service received 3,105 two-step verification requests. Your Azure subscription is billed for 310.5 authentication packs.
99100
>
100101
101-
It's important to note that you can have licenses, but still get billed for consumption-based configuration. If you set up a per-authentication Azure MFA Provider, you are billed for every two-step verification request, even those done by users who have licenses. If you set up a per-user Azure MFA Provider on a domain that isn't linked to your Azure AD tenant, you are billed per enabled user even if your users have licenses on Azure AD.
102+
It's important to note that you can have licenses, but still get billed for consumption-based configuration. If you set up a per-authentication Azure MFA Provider, you are billed for every two-step verification request, even those requests done by users who have licenses. If you set up a per-user Azure MFA Provider on a domain that isn't linked to your Azure AD tenant, you are billed per enabled user even if your users have licenses on Azure AD.
102103

103104
## Next steps
104105

105106
- For more pricing details, see [Azure MFA Pricing](https://azure.microsoft.com/pricing/details/multi-factor-authentication/).
106-
107-
- Choose whether to deploy Azure MFA [in the cloud or on-premises](concept-mfa-whichversion.md)

0 commit comments

Comments
 (0)