You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: includes/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@ To create a new registration:
36
36
1. Select **Register**.
37
37
1. Note the **ApplicationId/ClientId** of the application.
38
38
39
-
:::image type="content" source="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/register-application.png" alt-text="Screen shot showing how to create a new multi-tenant application registration." lightbox="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/register-application.png" border="true":::
39
+
:::image type="content" source="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/register-application.png" alt-text="Screen shot showing how to create a new multi-tenant application registration." lightbox="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/register-application.png" border="true":::
40
40
41
41
#### The service provider creates a user-assigned managed identity
42
42
@@ -50,7 +50,7 @@ Create a user-assigned managed identity to be used as a federated identity crede
:::image type="content" source="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-user-assigned-managed-identity.png" alt-text="Screen shot showing how to create a resource group and a user-assigned managed identity." lightbox="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-user-assigned-managed-identity.png" border="true":::
53
+
:::image type="content" source="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-user-assigned-managed-identity.png" alt-text="Screen shot showing how to create a resource group and a user-assigned managed identity." lightbox="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-user-assigned-managed-identity.png" border="true":::
54
54
55
55
#### The service provider configures the user-assigned managed identity as a federated credential on the application
56
56
@@ -60,17 +60,17 @@ Configure a user-assigned managed identity as a federated identity credential on
60
60
2. Select **Certificates & secrets**.
61
61
3. Select **Federated credentials**.
62
62
63
-
:::image type="content" source="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/certificates-secrets.png" alt-text="Screen shot showing how to navigate to Certificate and secrets." lightbox="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/certificates-secrets.png" border="true":::
63
+
:::image type="content" source="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/certificates-secrets.png" alt-text="Screen shot showing how to navigate to Certificate and secrets." lightbox="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/certificates-secrets.png" border="true":::
64
64
65
65
4. Select **+ Add credential**.
66
66
5. Under **Federated credential scenario**, select **Customer Managed Keys**.
67
67
6. Click **Select a managed identity**. From the pane, select the subscription. Under **Managed identity**, select **User-assigned managed identity**. In the **Select** box, search for the managed identity you created earlier, then click **Select** at the bottom of the pane.
68
68
69
-
:::image type="content" source="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/select-managed-identity.png" alt-text="Screen shot showing how to select a managed identity." lightbox="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/select-managed-identity.png" border="true":::
69
+
:::image type="content" source="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/select-managed-identity.png" alt-text="Screen shot showing how to select a managed identity." lightbox="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/select-managed-identity.png" border="true":::
70
70
71
71
7. Under **Credential details**, provide a name and optional description for the credential and select **Add**.
72
72
73
-
:::image type="content" source="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/add-credential.png" alt-text="Screen shot showing how to add a credential." lightbox="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/add-credential.png" border="true":::
73
+
:::image type="content" source="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/add-credential.png" alt-text="Screen shot showing how to add a credential." lightbox="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/add-credential.png" border="true":::
74
74
75
75
# [PowerShell](#tab/azure-powershell)
76
76
@@ -258,7 +258,7 @@ To create the key vault, the user's account must be assigned the **Key Vault Con
258
258
1. On the **Access policy** tab, select **Azure role-based access control** for **Permission model**.
259
259
1. Select **Review + create** and then **Create**.
260
260
261
-
:::image type="content" source="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-key-vault.png" alt-text="Screen shot showing how to create a key vault." lightbox="media/active-directory-msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-key-vault.png" border="true":::
261
+
:::image type="content" source="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-key-vault.png" alt-text="Screen shot showing how to create a key vault." lightbox="media/msi-cross-tenant-cmk-create-identities-authorize-key-vault/create-key-vault.png" border="true":::
262
262
263
263
Take note of the key vault name and URI Applications that access your key vault must use this URI.
Copy file name to clipboardExpand all lines: includes/active-directory-msi-cross-tenant-cmk-overview.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ Azure platform services and resources that are owned by the service provider and
18
18
19
19
The image below shows a data encryption at rest with federated identity in a cross-tenant CMK workflow spanning a service provider and its customer.
20
20
21
-
:::image type="content" source="media/active-directory-msi-cross-tenant-cmk-overview/cross-tenant-cmk.png" alt-text="Screenshot showing a cross-tenant CMK with a federated identity." lightbox="media/active-directory-msi-cross-tenant-cmk-overview/cross-tenant-cmk.png" border="true":::
21
+
:::image type="content" source="media/msi-cross-tenant-cmk-overview/cross-tenant-cmk.png" alt-text="Screenshot showing a cross-tenant CMK with a federated identity." lightbox="media/msi-cross-tenant-cmk-overview/cross-tenant-cmk.png" border="true":::
22
22
23
23
In the example above, there are two Azure AD tenants: an independent service provider's tenant (*Tenant1*), and a customer's tenant (*Tenant2*). *Tenant1* hosts Azure platform services and *Tenant2* hosts the customer's key vault.
Copy file name to clipboardExpand all lines: includes/active-directory-msi-tut-disable.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,4 +16,4 @@ ms.custom: include file
16
16
17
17
To disable the system-assigned identity on your VM, set the status of the system-assigned identity to **Off**.
18
18
19
-

19
+

Copy file name to clipboardExpand all lines: includes/active-directory-msi-tut-enable.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.custom: include file
12
12
13
13
Enabling a system-assigned managed identity is a one-click experience. You can either enable it during the creation of a VM or in the properties of an existing VM.
14
14
15
-

15
+

16
16
17
17
18
18
**To enable a system-assigned managed identity on a new VM:**
Copy file name to clipboardExpand all lines: includes/cdn-app-dev-prep.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -58,4 +58,4 @@ If, instead of a service principal, you'd rather have interactive individual use
58
58
3. There is no need to create a **client authentication key**.
59
59
4. Instead of assigning a service principal to the **CDN Profile Contributor** role, we're going to assign individual users or groups. In this example, you can see that I've assigned *CDN Demo User* to the **CDN Profile Contributor** role.
60
60
61
-

61
+

0 commit comments