You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In response to developer feedback, Azure AD Premium P2 subscribers can now perform complex queries on Azure AD Identity Protection's risk detection data by using the new riskDetection API for Microsoft Graph. The existing [identityRiskEvent](/graph/api/resources/identityriskevent?view=graph-rest-beta&preserve-view=true) API beta version will stop returning data around **January 10, 2020**. If your organization is using the identityRiskEvent API, you should transition to the new riskDetection API.
3160
+
In response to developer feedback, Azure AD Premium P2 subscribers can now perform complex queries on Azure AD Identity Protection's risk detection data by using the new riskDetection API for Microsoft Graph. The existing [identityRiskEvent](/graph/api/resources/identityprotection-root) API beta version will stop returning data around **January 10, 2020**. If your organization is using the identityRiskEvent API, you should transition to the new riskDetection API.
3161
3161
3162
3162
For more information about the new riskDetection API, see the [Risk detection API reference documentation](/graph/api/resources/riskdetection).
3163
3163
@@ -4586,7 +4586,7 @@ For more information about how create an access review using Azure AD Access Rev
4586
4586
4587
4587
In February 2019, we've added these 27 new apps with Federation support to the app gallery:
For more information about the apps, see [SaaS application integration with Azure Active Directory](../saas-apps/tutorial-list.md). For more information about listing your application in the Azure AD app gallery, see [List your application in the Azure Active Directory application gallery](../develop/v2-howto-app-gallery-listing.md).
4592
4592
@@ -4708,7 +4708,7 @@ For more information about the new cookies, see [Cookie settings for accessing o
4708
4708
4709
4709
In January 2019, we've added these 35 new apps with Federation support to the app gallery:
For more information about the apps, see [SaaS application integration with Azure Active Directory](../saas-apps/tutorial-list.md). For more information about listing your application in the Azure AD app gallery, see [List your application in the Azure Active Directory application gallery](../develop/v2-howto-app-gallery-listing.md).
Copy file name to clipboardExpand all lines: articles/active-directory/managed-identities-azure-resources/managed-identity-best-practice-recommendations.md
+17-2Lines changed: 17 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,15 +4,15 @@ description: Recommendations on when to use user-assigned versus system-assigned
4
4
services: active-directory
5
5
documentationcenter:
6
6
author: barclayn
7
-
manager: daveba
7
+
manager: karenh444
8
8
editor:
9
9
ms.service: active-directory
10
10
ms.subservice: msi
11
11
ms.devlang:
12
12
ms.topic: conceptual
13
13
ms.tgt_pltfrm:
14
14
ms.workload: identity
15
-
ms.date: 05/21/2021
15
+
ms.date: 10/15/2021
16
16
ms.author: barclayn
17
17
---
18
18
@@ -79,6 +79,21 @@ In the example below, “Virtual Machine 4” has both a user-assigned identity,
79
79
View the limits for [managed identities](../../azure-resource-manager/management/azure-subscription-service-limits.md#azure-rbac-limits)
80
80
and for [custom roles and role assignments](../../azure-resource-manager/management/azure-subscription-service-limits.md#azure-rbac-limits).
81
81
82
+
## Follow the principle of least privilege when granting access
83
+
84
+
When granting any identity, including a managed identity, permissions to access services, always grant the least permissions needed to perform the desired actions. For example, if a managed identity is used to read data from a storage account, there is no need to allow that identity permissions to also write data to the storage account. Granting extra permissions, for example, making the managed identity a contributor on an Azure subscription when it’s not needed, increases the security blast radius associated with the identity. One must always minimize the security blast radius so that compromising that identity causes minimum damage.
85
+
86
+
### Consider the effect of assigning managed identities to Azure resources
87
+
88
+
It is important to note that when an Azure resource, such as an Azure Logic App, an Azure function, or a Virtual Machine, etc. is assigned a managed identity, all the permissions granted to the managed identity are now available to the Azure resource. This is particularly important because if a user has access to install or execute code on this resource, then the user has access to all the identities assigned/associated to the Azure resource. The purpose of managed identity is to give code running on an Azure resource access to other resources, without developers needing to handle or put credentials directly into code to get that access.
89
+
90
+
For example, if a managed Identity (ClientId = 1234) has been granted read/write access to ***StorageAccount7755*** and has been assigned to ***LogicApp3388***, then Alice, who does not have any direct permissions over the managed identity or the storage account but has permission to execute code within ***LogicApp3388*** can also read/write data to/from ***StorageAccount7755*** by executing the code that uses the managed identity.
In general, when granting a user administrative access to a resource that can execute code (such as a Logic App) and has a managed identity, consider if the role being assigned to the user can install or run code on the resource, and if yes only assign that role if the user really needs it.
95
+
96
+
82
97
## Maintenance
83
98
84
99
System-assigned identities are automatically deleted when the resource is deleted, while the lifecycle of a user-assigned identity is independent of any resources with which it's associated.
Copy file name to clipboardExpand all lines: articles/availability-zones/az-region.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -67,7 +67,7 @@ In the Product Catalog, always-available services are listed as "non-regional" s
67
67
|**Products**|**Resiliency**|
68
68
| --- | --- |
69
69
|[Azure Application Gateway (V2)](../application-gateway/application-gateway-autoscaling-zone-redundant.md)||
70
-
|[Azure Backup](/architecture/backup/backup-create-rs-vault#set-storage-redundancy.md)||
70
+
|[Azure Backup](/azure/backup/backup-create-rs-vault)||
71
71
|[Azure Cosmos DB](../cosmos-db/high-availability.md#availability-zone-support)||
72
72
|[Azure Data Lake Storage Gen 2](../storage/blobs/data-lake-storage-introduction.md)||
73
73
|[Azure DNS: Azure DNS Private Zones](../dns/private-dns-getstarted-portal.md)||
@@ -206,6 +206,6 @@ You can access Azure availability zones by using your Azure subscription. To lea
206
206
207
207
## Next steps
208
208
209
-
-[Building solutions for high availability using availability zones](/architecture/high-availability/building-solutions-for-high-availability)
210
-
-[High availability with Azure services](/architecture/framework/resiliency/overview)
211
-
-[Design patterns for high availability](/architecture/framework/resiliency/app-design)
209
+
-[Building solutions for high availability using availability zones](/azure/architecture/high-availability/building-solutions-for-high-availability)
210
+
-[High availability with Azure services](/azure/architecture/framework/resiliency/overview)
211
+
-[Design patterns for high availability](/azure/architecture/framework/resiliency/app-design)
0 commit comments