You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/concept-conditional-access-cloud-apps.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -68,7 +68,7 @@ Administrators can assign a Conditional Access policy to the following cloud app
68
68
69
69
Office 365 provides cloud-based productivity and collaboration services like Exchange, SharePoint, and Microsoft Teams. Office 365 cloud services are deeply integrated to ensure smooth and collaborative experiences. This integration can cause confusion when creating policies as some apps such as Microsoft Teams have dependencies on others such as SharePoint or Exchange.
70
70
71
-
The Office 365 (preview) app makes it possible to target these services all at once. We recommend using the new Office 365 (preview) app, instead of targeting individual cloud apps. Targeting this group of applications helps to avoid issues that may arise due to inconsistent policies and dependencies.
71
+
The Office 365 (preview) app makes it possible to target these services all at once. We recommend using the new Office 365 (preview) app, instead of targeting individual cloud apps to avoid issues with [service dependencies](service-dependencies.md). Targeting this group of applications helps to avoid issues that may arise due to inconsistent policies and dependencies.
72
72
73
73
Administrators can choose to exclude specific apps from policy if they wish by including the Office 365 (preview) app and excluding the specific apps of their choice in policy.
With Conditional Access policies, you can specify access requirements to websites and services. For example, your access requirements can include requiring multi-factor authentication (MFA) or [managed devices](require-managed-devices.md).
22
22
23
-
When you access a site or service directly, the impact of a related policy is typically easy to assess. For example, if you have a policy that requires MFA for SharePoint Online configured, MFA is enforced for each sign-in to the SharePoint web portal. However, it is not always straight-forward to assess the impact of a policy because there are cloud apps with dependencies to other cloud apps. For example, Microsoft Teams can provide access to resources in SharePoint Online. So, when you access Microsoft Teams in our current scenario, you are also subject to the SharePoint MFA policy.
23
+
When you access a site or service directly, the impact of a related policy is typically easy to assess. For example, if you have a policy that requires multi-factor authentication (MFA) for SharePoint Online configured, MFA is enforced for each sign-in to the SharePoint web portal. However, it is not always straight-forward to assess the impact of a policy because there are cloud apps with dependencies to other cloud apps. For example, Microsoft Teams can provide access to resources in SharePoint Online. So, when you access Microsoft Teams in our current scenario, you are also subject to the SharePoint MFA policy.
24
24
25
25
## Policy enforcement
26
26
@@ -35,6 +35,8 @@ The diagram below illustrates MS Teams service dependencies. Solid arrows indica
35
35
36
36
As a best practice, you should set common policies across related apps and services whenever possible. Having a consistent security posture provides you with the best user experience. For example, setting a common policy across Exchange Online, SharePoint Online, Microsoft Teams, and Skype for business significantly reduces unexpected prompts that may arise from different policies being applied to downstream services.
37
37
38
+
A great way to accomplish this with applications in the Office stack is to use the [Office 365 (preview)](concept-conditional-access-cloud-apps.md#office-365-preview) instead of targeting individual applications.
39
+
38
40
The below table lists additional service dependencies, where the client apps must satisfy
39
41
40
42
| Client apps | Downstream service | Enforcement |
Copy file name to clipboardExpand all lines: articles/active-directory/develop/registration-config-how-to.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,5 +29,7 @@ You can find the authentication endpoints for your application in the [Azure por
29
29
30
30
- Use the endpoint specific to the authentication protocol you are using, in conjunction with the application ID to craft the authentication request specific to your application.
31
31
32
+
**National clouds** (for example Azure AD China, Germany, and US Government) have their own app registration portal and Azure AD authentication endpoints. Learn more in the [National clouds overview](authentication-national-cloud.md).
33
+
32
34
## Next steps
33
35
[Azure Active Directory developer's guide](https://docs.microsoft.com/azure/active-directory/develop/active-directory-developers-guide)
Copy file name to clipboardExpand all lines: articles/aks/developer-best-practices-pod-security.md
+11-12Lines changed: 11 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,5 @@
1
1
---
2
-
title: Pod security best practices
3
-
titleSuffix: Azure Kubernetes Service
2
+
title: Developer best practices - Pod security in Azure Kubernetes Services (AKS)
4
3
description: Learn the developer best practices for how to secure pods in Azure Kubernetes Service (AKS)
5
4
services: container-service
6
5
author: zr-msft
@@ -70,7 +69,7 @@ To limit the risk of credentials being exposed in your application code, avoid t
70
69
The following [associated AKS open source projects][aks-associated-projects] let you automatically authenticate pods or request credentials and keys from a digital vault:
71
70
72
71
* Managed identities for Azure resources, and
73
-
* Azure Key Vault FlexVol driver
72
+
* [Azure Key Vault Provider for Secrets Store CSI Driver](https://github.com/Azure/secrets-store-csi-driver-provider-azure#usage)
74
73
75
74
Associated AKS open source projects are not supported by Azure technical support. They are provided to gather feedback and bugs from our community. These projects are not recommended for production use.
76
75
@@ -84,28 +83,28 @@ With a managed identity, your application code doesn't need to include credentia
84
83
85
84
For more information about pod identities, see [Configure an AKS cluster to use pod managed identities and with your applications][aad-pod-identity]
86
85
87
-
### Use Azure Key Vault with FlexVol
86
+
### Use Azure Key Vault with Secrets Store CSI Driver
88
87
89
-
Managed pod identities work great to authenticate against supporting Azure services. For your own services or applications without managed identities for Azure resources, you still authenticate using credentials or keys. A digital vault can be used to store these credentials.
88
+
Using the pod identity project enables authentication against supporting Azure services. For your own services or applications without managed identities for Azure resources, you can still authenticate using credentials or keys. A digital vault can be used to store these secret contents.
90
89
91
-
When applications need a credential, they communicate with the digital vault, retrieve the latest credentials, and then connect to the required service. Azure Key Vault can be this digital vault. The simplified workflow for retrieving a credential from Azure Key Vault using pod managed identities is shown in the following diagram:
90
+
When applications need a credential, they communicate with the digital vault, retrieve the latest secret contents, and then connect to the required service. Azure Key Vault can be this digital vault. The simplified workflow for retrieving a credential from Azure Key Vault using pod managed identities is shown in the following diagram:
92
91
93
-
92
+
94
93
95
-
With Key Vault, you store and regularly rotate secrets such as credentials, storage account keys, or certificates. You can integrate Azure Key Vault with an AKS cluster using a FlexVolume. The FlexVolume driver lets the AKS cluster natively retrieve credentials from Key Vault and securely provide them only to the requesting pod. Work with your cluster operator to deploy the Key Vault FlexVol driver onto the AKS nodes. You can use a pod managed identity to request access to Key Vault and retrieve the credentials you need through the FlexVolume driver.
94
+
With Key Vault, you store and regularly rotate secrets such as credentials, storage account keys, or certificates. You can integrate Azure Key Vault with an AKS cluster using the [Azure Key Vault provider for the Secrets Store CSI Driver](https://github.com/Azure/secrets-store-csi-driver-provider-azure#usage). The Secrets Store CSI driver enables the AKS cluster to natively retrieve secret contents from Key Vault and securely provide them only to the requesting pod. Work with your cluster operator to deploy the Secrets Store CSI Driver onto AKS worker nodes. You can use a pod managed identity to request access to Key Vault and retrieve the secret contents needed through the Secrets Store CSI Driver.
96
95
97
-
Azure Key Vault with FlexVol is intended for use with applications and services running on Linux pods and nodes.
96
+
Azure Key Vault with Secrets Store CSI Driver can be used for Linux nodes and pods which require a Kubernetes version of 1.16 or greater. For Windows nodes and pods a Kubernetes version of 1.18 or greater is required.
98
97
99
98
## Next steps
100
99
101
100
This article focused on how to secure your pods. To implement some of these areas, see the following articles:
102
101
103
102
* [Use managed identities for Azure resources with AKS][aad-pod-identity]
104
-
* [Integrate Azure Key Vault with AKS][aks-keyvault-flexvol]
103
+
* [Integrate Azure Key Vault with AKS][aks-keyvault-csi-driver]
Copy file name to clipboardExpand all lines: articles/azure-monitor/app/powershell.md
+32-16Lines changed: 32 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Automate Azure Application Insights with PowerShell | Microsoft Docs
3
3
description: Automate creating and managing resources, alerts, and availability tests in PowerShell using an Azure Resource Manager template.
4
4
ms.topic: conceptual
5
-
ms.date: 10/17/2019
5
+
ms.date: 05/02/2020
6
6
7
7
---
8
8
@@ -17,10 +17,10 @@ The key to creating these resources is JSON templates for [Azure Resource Manage
17
17
## One-time setup
18
18
If you haven't used PowerShell with your Azure subscription before:
19
19
20
-
Install the Azure Powershell module on the machine where you want to run the scripts:
20
+
Install the Azure PowerShell module on the machine where you want to run the scripts:
21
21
22
22
1. Install [Microsoft Web Platform Installer (v5 or higher)](https://www.microsoft.com/web/downloads/platform.aspx).
23
-
2. Use it to install Microsoft Azure Powershell.
23
+
2. Use it to install Microsoft Azure PowerShell.
24
24
25
25
In addition to using Resource Manager templates, there is a rich set of [Application Insights PowerShell cmdlets](https://docs.microsoft.com/powershell/module/az.applicationinsights), which make it easy to configure Application Insights resources programatically. The capabilities enabled by the cmdlets include:
26
26
@@ -83,20 +83,20 @@ Create a new .json file - let's call it `template1.json` in this example. Copy t
83
83
"defaultValue": 90,
84
84
"allowedValues": [
85
85
30,
86
-
60,
87
-
90,
88
-
120,
89
-
180,
90
-
270,
91
-
365,
92
-
550,
93
-
730
86
+
60,
87
+
90,
88
+
120,
89
+
180,
90
+
270,
91
+
365,
92
+
550,
93
+
730
94
94
],
95
95
"metadata": {
96
96
"description": "Data retention in days"
97
97
}
98
98
},
99
-
"ImmediatePurgeDataOn30Days": {
99
+
"ImmediatePurgeDataOn30Days": {
100
100
"type": "bool",
101
101
"defaultValue": false,
102
102
"metadata": {
@@ -225,7 +225,21 @@ Additional properties are available via the cmdlets:
225
225
226
226
Refer to the [detailed documentation](https://docs.microsoft.com/powershell/module/az.applicationinsights) for the parameters for these cmdlets.
227
227
228
-
## Set the data retention
228
+
## Set the data retention
229
+
230
+
Below are three methods to programmatically set the data retention on an Application Insights resource.
231
+
232
+
### Setting data retention using a PowerShell commands
233
+
234
+
Here's a simple set of PowerShell commands to set the data retention for your Application Insights resource:
To get the current data retention for your Application Insights resource, you can use the OSS tool [ARMClient](https://github.com/projectkudu/ARMClient). (Learn more about ARMClient from articles by [David Ebbo](http://blog.davidebbo.com/2015/01/azure-resource-manager-client.html) and [Daniel Bowbyes](https://blog.bowbyes.co.nz/2016/11/02/using-armclient-to-directly-access-azure-arm-rest-apis-and-list-arm-policy-details/).) Here's an example using `ARMClient`, to get the current retention:
0 commit comments