Merge pull request #217205 from MicrosoftDocs/main

Publish to live, Friday 4 AM PST 11/04

Author: Maggiemouse1

.openpublishing.redirection.azure-productivity.json

@@ -29,6 +29,11 @@
           "source_path_from_root": "/articles/devtest-labs/scripts/set-allowed-vm-sizes-in-lab.md",
           "redirect_url": "/azure/devtest-labs/samples-powershell",
           "redirect_document_id": false
-        }
+        },
+        {
+          "source_path": "articles/dev-box/tutorial-connect-to-dev-box-with-remote-desktop-app.md",
+          "redirect_url": "/azure/dev-box/quickstart-connect-to-dev-box-with-remote-desktop-app",
+          "redirect_document_id": false
+      }
     ]
 }

articles/active-directory/develop/msal-ios-shared-devices.md

@@ -9,20 +9,20 @@ ms.service: active-directory
 ms.subservice: develop
 ms.topic: conceptual
 ms.workload: identity
-ms.date: 03/31/2020
+ms.date: 11/03/2022
 ms.author: brandwe
 ms.reviewer: brandwe
 ms.custom: aaddev
 ---
 
 # Shared device mode for iOS devices
 
->[!IMPORTANT]
+> [!IMPORTANT]
 > This feature [!INCLUDE [PREVIEW BOILERPLATE](../../../includes/active-directory-develop-preview.md)]
 
 Frontline workers such as retail associates, flight crew members, and field service workers often use a shared mobile device to perform their work. These shared devices can present security risks if your users share their passwords or PINs, intentionally or not, to access customer and business data on the shared device.
 
-Shared device mode allows you to configure an iOS 13 or higher device to be more easily and securely shared by employees. Employees can sign in and access customer information quickly. When they're finished with their shift or task, they can sign out of the device and it's immediately ready for use by the next employee.
+Shared device mode allows you to configure an iOS 13 or higher device to be more easily and securely shared by employees. Employees can sign in and access customer information quickly. When they're finished with their shift or task, they can sign out of the device, and it's immediately ready for use by the next employee.
 
 Shared device mode also provides Microsoft identity-backed management of the device.
 
@@ -32,13 +32,13 @@ This feature uses the [Microsoft Authenticator app](https://support.microsoft.co
 
 To create a shared device mode app, developers and cloud device admins work together:
 
-1. **Application developers** write a single-account app (multiple-account apps are not supported in shared device mode) and write code to handle things like shared device sign-out.
+1. **Application developers** write a single-account app (multiple-account apps aren't supported in shared device mode) and write code to handle things like shared device sign-out.
 
 1. **Device administrators** prepare the device to be shared by using a mobile device management (MDM) provider like Microsoft Intune to manage the devices in their organization. The MDM pushes the Microsoft Authenticator app to the devices and turns on "Shared Mode" for each device through a profile update to the device. This Shared Mode setting is what changes the behavior of the supported apps on the device. This configuration from the MDM provider sets the shared device mode for the device and enables the [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md) which is required for shared device mode.
 
 1. [**Required during Public Preview only**] A user with [Cloud Device Administrator](../roles/permissions-reference.md#cloud-device-administrator) role must then launch the [Microsoft Authenticator app](https://support.microsoft.com/account-billing/how-to-use-the-microsoft-authenticator-app-9783c865-0308-42fb-a519-8cf666fe0acc) and join their device to the organization.
 
-    To configure the membership of your organizational roles in the Azure portal: **Azure Active Directory** > **Roles and Administrators** > **Cloud Device Administrator**
+   To configure the membership of your organizational roles in the Azure portal: **Azure Active Directory** > **Roles and Administrators** > **Cloud Device Administrator**
 
 The following sections help you update your application to support shared device mode.
 
@@ -51,40 +51,40 @@ Your device needs to be configured to support shared device mode. It must have i
 
 1. In the Intune Configuration Portal, tell the device to enable the [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md) with the following configuration:
 
-    - **Type**: Redirect
-    - **Extension ID**: com.microsoft.azureauthenticator.ssoextension
-    - **Team ID**: (this field is not needed for iOS)
-    - **URLs**:   
-        - `https://login.microsoftonline.com`
-        - `https://login.microsoft.com`
-        - `https://sts.windows.net`
-        - `https://login.partner.microsoftonline.cn`
-        - `https://login.chinacloudapi.cn`
-        - `https://login.microsoftonline.de`
-        - `https://login.microsoftonline.us`
-        - `https://login.usgovcloudapi.net`
-        - `https://login-us.microsoftonline.com`
-    - **Additional Data to configure**:
-      - Key: sharedDeviceMode
-      - Type: Boolean
-      - Value: true
-
-    For more information about configuring with Intune, see the [Intune configuration documentation](/intune/configuration/ios-device-features-settings).
+   - **Type**: Redirect
+   - **Extension ID**: com.microsoft.azureauthenticator.ssoextension
+   - **Team ID**: (this field isn't needed for iOS)
+   - **URLs**:
+     - `https://login.microsoftonline.com`
+     - `https://login.microsoft.com`
+     - `https://sts.windows.net`
+     - `https://login.partner.microsoftonline.cn`
+     - `https://login.chinacloudapi.cn`
+     - `https://login.microsoftonline.de`
+     - `https://login.microsoftonline.us`
+     - `https://login.usgovcloudapi.net`
+     - `https://login-us.microsoftonline.com`
+   - **Additional Data to configure**:
+     - Key: sharedDeviceMode
+     - Type: Boolean
+     - Value: true
+
+   For more information about configuring with Intune, see the [Intune configuration documentation](/intune/configuration/ios-device-features-settings).
 
 1. Next, configure your MDM to push the Microsoft Authenticator app to your device through an MDM profile.
 
-    Set the following configuration options to turn on Shared Device mode:
+   Set the following configuration options to turn on Shared Device mode:
 
-    - Configuration 1:
-      - Key: sharedDeviceMode
-      - Type: Boolean
-      - Value: true
+   - Configuration 1:
+     - Key: sharedDeviceMode
+     - Type: Boolean
+     - Value: true
 
 ## Modify your iOS application to support shared device mode
 
 Your users depend on you to ensure their data isn't leaked to another user. The following sections provide helpful signals to indicate to your application that a change has occurred and should be handled.
 
-You are responsible for checking the state of the user on the device every time your app is used, and then clearing the previous user's data. This includes if it is reloaded from the background in multi-tasking.
+You're responsible for checking the state of the user on the device every time your app is used, and then clearing the previous user's data. This includes if it's reloaded from the background in multi-tasking.
 
 On a user change, you should ensure both the previous user's data is cleared and that any cached data being displayed in your application is removed. We highly recommend you and your company conduct a security review process after updating your app to support shared device mode.
 
@@ -128,7 +128,7 @@ application.getDeviceInformation(with: nil, completionBlock: { (deviceInformatio
 
 ### Get the signed-in user and determine if a user has changed on the device
 
-Another important part of supporting shared device mode is determining the state of the user on the device and clearing application data if a user has changed or if there is no user at all on the device. You are responsible for ensuring data isn't leaked to another user.
+Another important part of supporting shared device mode is determining the state of the user on the device and clearing application data if a user has changed or if there's no user at all on the device. You're responsible for ensuring data isn't leaked to another user.
 
 You can use `getCurrentAccountWithParameters:completionBlock:` API to query the currently signed-in account on the device.
 
@@ -175,31 +175,27 @@ parameters.loginHint = self.loginHintTextField.text;
 
 ### Globally sign out a user
 
-The following code removes the signed-in account and clears cached tokens from not only the app, but also from the device that's in shared device mode. It does not, however, clear the *data* from your application. You must clear the data from your application, as well as clear any cached data your application may be displaying to the user.
-
-#### Clear browser state
-
-> [!NOTE]
-> The following step is required only during public preview.
-
-In this public preview version, the [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md) clears state only for applications. It does not clear state on the Safari browser. We recommend you manually clear browser session to ensure no traces of user state are left behind. You can use the optional `signoutFromBrowser` property shown below to clear any cookies. This will cause the browser to briefly launch on the device.
+The following code removes the signed-in account and clears cached tokens from not only the app, but also from the device that's in shared device mode. It doesn't, however, clear the _data_ from your application. You must clear the data from your application, as well as clear any cached data your application may be displaying to the user.
 
 #### Swift
 
 ```swift
 let account = .... /* account retrieved above */
 
 let signoutParameters = MSALSignoutParameters(webviewParameters: self.webViewParamaters!)
-signoutParameters.signoutFromBrowser = true // Only needed for Public Preview.
+signoutParameters.signoutFromBrowser = true // To trigger a browser signout in Safari.
 
 application.signout(with: account, signoutParameters: signoutParameters, completionBlock: {(success, error) in
-
     if let error = error {
+
         // Signout failed
+
         return
+
     }
 
     // Sign out completed successfully
+
 })
 ```
 
@@ -209,22 +205,77 @@ application.signout(with: account, signoutParameters: signoutParameters, complet
 MSALAccount *account = ... /* account retrieved above */;
 
 MSALSignoutParameters *signoutParameters = [[MSALSignoutParameters alloc] initWithWebviewParameters:webViewParameters];
-signoutParameters.signoutFromBrowser = YES; // Only needed for Public Preview.
+
+signoutParameters.signoutFromBrowser = YES; // To trigger a browser signout in Safari.
 
 [application signoutWithAccount:account signoutParameters:signoutParameters completionBlock:^(BOOL success, NSError * _Nullable error)
+
 {
+
     if (!success)
+
     {
+
         // Signout failed
+
         return;
+
     }
 
     // Sign out completed successfully
+
 }];
 ```
 
+The [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md) clears state only for applications. It doesn't clear state on the Safari browser. You can use the optional signoutFromBrowser property shown in code snippets above to trigger a browser signout in Safari. This will cause the browser to briefly launch on the device.
+
+### Receive broadcast to detect global sign out initiated from other applications
+
+To receive the account change broadcast, you'll need to register a broadcast receiver. When an account change broadcast is received, immediately [get the signed in user and determine if a user has changed on the device](#get-the-signed-in-user-and-determine-if-a-user-has-changed-on-the-device). If a change is detected, initiate data cleanup for previously signed-in account. It's recommended to properly stop any operations and do data cleanup.
+
+The following code snippet shows how you could register a broadcast receiver.
+
+```objectivec
+NSString *const MSID_SHARED_MODE_CURRENT_ACCOUNT_CHANGED_NOTIFICATION_KEY = @"SHARED_MODE_CURRENT_ACCOUNT_CHANGED";
+
+- (void) registerDarwinNotificationListener 
+
+{ 
+
+   CFNotificationCenterRef center =
+
+   CFNotificationCenterGetDarwinNotifyCenter(); 
+
+   CFNotificationCenterAddObserver(center, nil,
+
+   sharedModeAccountChangedCallback,
+
+   (CFStringRef)MSID_SHARED_MODE_CURRENT_ACCOUNT_CHANGED_NOTIFICATION_KEY, 
+
+   nil, CFNotificationSuspensionBehaviorDeliverImmediately); 
+
+} 
+
+// CFNotificationCallbacks used specifically for Darwin notifications leave userInfo unused 
+
+void sharedModeAccountChangedCallback(CFNotificationCenterRef center, void * observer, CFStringRef name, void const * object, __unused CFDictionaryRef userInfo) 
+
+{ 
+
+    // Invoke account cleanup logic here 
+
+} 
+```
+
+For more information about the available options for CFNotificationAddObserver or to see the corresponding method signatures in Swift, see:
+
+- [CFNotificationAddObserver](https://developer.apple.com/documentation/corefoundation/1543316-cfnotificationcenteraddobserver?language=objc)
+- [CFNotificationCallback](https://developer.apple.com/documentation/corefoundation/cfnotificationcallback?language=objc)
+
+For iOS, your app will require a background permission to remain active in the background and listen to Darwin notifications. The background capability must be added to support a different background operation – your app may be subject to rejection from the Apple App Store if it has a background capability only to listen for Darwin notifications. If your app is already configured to complete background operations, you can add the listener as part of that operation. For more information about iOS background capabilities, see [Configuring background execution modes](https://developer.apple.com/documentation/xcode/configuring-background-execution-modes)
+
 ## Next steps
 
 To see shared device mode in action, the following code sample on GitHub includes an example of running a frontline worker app on an iOS device in shared device mode:
 
-[MSAL iOS Swift Microsoft Graph API Sample](https://github.com/Azure-Samples/ms-identity-mobile-apple-swift-objc)
+[MSAL iOS Swift Microsoft Graph API Sample](https://github.com/Azure-Samples/ms-identity-mobile-apple-swift-objc)

articles/active-directory/develop/tutorial-v2-shared-device-mode.md

@@ -9,7 +9,7 @@ ms.service: active-directory
 ms.subservice: develop
 ms.topic: tutorial
 ms.workload: identity
-ms.date: 1/15/2020
+ms.date: 11/03/2022
 ms.author: henrymbugua
 ms.reviewer: brandwe
 ms.custom: aaddev, identityplatformtop40
@@ -22,13 +22,14 @@ In this tutorial, Android developers and Azure Active Directory (Azure AD) tenan
 In this tutorial:
 
 > [!div class="checklist"]
-> * Download a code sample
-> * Enable and detect shared-device mode
-> * Detect single or multiple account mode
-> * Detect a user switch, and enable global sign-in and sign-out
-> * Set up tenant and register the application in the Azure portal
-> * Set up an Android device in shared-device mode
-> * Run the sample app
+>
+> - Download a code sample
+> - Enable and detect shared-device mode
+> - Detect single or multiple account mode
+> - Detect a user switch, and enable global sign-in and sign-out
+> - Set up tenant and register the application in the Azure portal
+> - Set up an Android device in shared-device mode
+> - Run the sample app
 
 ## Prerequisites
 
@@ -64,21 +65,21 @@ Here's an example of the auth_config.json file included in the **app**>**main**>
 
 ```json
 {
- "client_id":"Client ID after app registration at https://aka.ms/MobileAppReg",
- "authorization_user_agent":"DEFAULT",
- "redirect_uri":"Redirect URI after app registration at https://aka.ms/MobileAppReg",
- "account_mode":"SINGLE",
- "broker_redirect_uri_registered": true,
- "shared_device_mode_supported": true,
- "authorities":[
-  {
-   "type":"AAD",
-   "audience":{
-     "type": "AzureADandPersonalMicrosoftAccount",
-     "tenant_id":"common"
-   }
-  }
- ]
+  "client_id": "Client ID after app registration at https://aka.ms/MobileAppReg",
+  "authorization_user_agent": "DEFAULT",
+  "redirect_uri": "Redirect URI after app registration at https://aka.ms/MobileAppReg",
+  "account_mode": "SINGLE",
+  "broker_redirect_uri_registered": true,
+  "shared_device_mode_supported": true,
+  "authorities": [
+    {
+      "type": "AAD",
+      "audience": {
+        "type": "AzureADandPersonalMicrosoftAccount",
+        "tenant_id": "common"
+      }
+    }
+  ]
 }
 ```
 
@@ -88,7 +89,7 @@ Shared-device mode allows you to configure Android devices to be shared by multi
 
 Use `isSharedDevice()` to determine if an app is running on a device that is in shared-device mode. Your app could use this flag to determine if it should modify UX accordingly.
 
-Here's a code snippet that shows how you could use `isSharedDevice()`.  It's from the `SingleAccountModeFragment` class in the sample app:
+Here's a code snippet that shows how you could use `isSharedDevice()`. It's from the `SingleAccountModeFragment` class in the sample app:
 
 ```Java
 deviceModeTextView.setText(mSingleAccountApp.isSharedDevice() ? "Shared" : "Non-Shared");
@@ -204,6 +205,31 @@ private void onSignOutClicked()
 }
 ```
 
+### Receive broadcast to detect global sign out initiated from other applications
+
+To receive the account change broadcast, you'll need to register a broadcast receiver.  It’s recommended to register your broadcast receiver via the [Context-registered receivers](https://developer.android.com/guide/components/broadcasts#context-registered-receivers).
+
+When an account change broadcast is received, immediately [get the signed in user and determine if a user has changed on the device](#get-the-signed-in-user-and-determine-if-a-user-has-changed-on-the-device). If a change is detected, initiate data cleanup for previously signed-in account. It is recommended to properly stop any operations and do data cleanup.
+
+The following code snippet shows how you could register a broadcast receiver.
+
+```java
+private static final String CURRENT_ACCOUNT_CHANGED_BROADCAST_IDENTIFIER = "com.microsoft.identity.client.sharedmode.CURRENT_ACCOUNT_CHANGED";
+private BroadcastReceiver mAccountChangedBroadcastReceiver;
+private void registerAccountChangeBroadcastReceiver(){
+    mAccountChangedBroadcastReceiver = new BroadcastReceiver() {
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            //INVOKE YOUR PRIOR ACCOUNT CLEAN UP LOGIC HERE      
+        }
+    };
+    IntentFilter filter = new
+
+    IntentFilter(CURRENT_ACCOUNT_CHANGED_BROADCAST_IDENTIFIER);
+    this.registerReceiver(mAccountChangedBroadcastReceiver, filter);
+}
+```
+
 ## Administrator guide
 
 The following steps describe setting up your application in the Azure portal and putting your device into shared-device mode.
@@ -257,7 +283,7 @@ The device is now in shared mode.
 
 :::image type="content" source="media/tutorial-v2-shared-device-mode/shared-device-mode-screen.png" alt-text="App screen showing shared device mode enabled":::
 
- Any sign-ins and sign-outs on the device will be global, meaning they apply to all apps that are integrated with MSAL and Microsoft Authenticator on the device. You can now deploy applications to the device that use shared-device mode features.
+Any sign-ins and sign-outs on the device will be global, meaning they apply to all apps that are integrated with MSAL and Microsoft Authenticator on the device. You can now deploy applications to the device that use shared-device mode features.
 
 ## View the shared device in the Azure portal