Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into net-patch

Author: asudbring

articles/active-directory/develop/TOC.yml

@@ -167,6 +167,8 @@
       href: security-best-practices-for-app-registration.md
   - name: Automatic user provisioning (SCIM)
     href: ../app-provisioning/user-provisioning.md?toc=/azure/active-directory/develop/toc.json&bc=/azure/active-directory/develop/breadcrumb/toc.json
+  - name: Use the Microsoft Graph API
+    href: microsoft-graph-intro.md
 - name: How-to
   items:
   - name: Integrate your app scenario
@@ -560,8 +562,6 @@
       href: howto-add-app-roles-in-azure-ad-apps.md
     - name: Implement RBAC in your application
       href: howto-implement-rbac-for-apps.md
-  - name: Use the Microsoft Graph API
-    href: microsoft-graph-intro.md
   - name: Build for resilience
     items:
     - name: Development Overview

articles/active-directory/develop/microsoft-graph-intro.md

@@ -7,9 +7,9 @@ manager: CelesteDG
 
 ms.service: active-directory
 ms.subservice: develop
-ms.topic: how-to
+ms.topic: conceptual
 ms.workload: identity
-ms.date: 02/13/2020
+ms.date: 10/08/2021
 ms.author: davidmu
 ms.custom: aaddev
 ---
@@ -18,31 +18,34 @@ ms.custom: aaddev
 
 The Microsoft Graph API is a RESTful web API that enables you to access Microsoft Cloud service resources. After you register your app and get authentication tokens for a user or service, you can make requests to the Microsoft Graph API. For more information, see [Overview of Microsoft Graph](/graph/overview).
 
-Microsoft Graph exposes REST APIs and client libraries to access data on the following Microsoft 365 services:
+Microsoft Graph exposes REST APIs and client libraries to access data on the following Microsoft cloud services:
+
 - Microsoft 365 services: Delve, Excel, Microsoft Bookings, Microsoft Teams, OneDrive, OneNote, Outlook/Exchange, Planner, and SharePoint
 - Enterprise Mobility and Security services: Advanced Threat Analytics, Advanced Threat Protection, Azure Active Directory, Identity Manager, and Intune
 - Windows 10 services: activities, devices, notifications
 - Dynamics 365 Business Central
 
 ## Versions
 
-Microsoft Graph currently supports two versions: v1.0 and beta. The v1.0 version includes generally available APIs. Use the v1.0 version for all production apps. The 
-beta includes APIs that are currently in preview. Because we might introduce breaking changes to our beta APIs, we recommend that you use the beta version only to test apps that are in development; do not use beta APIs in your production apps. For more information, see [Versioning, support, and breaking change policies for Microsoft Graph](/graph/versioning-and-support).
+The following versions of the Microsoft Graph API are currently available:
+
+- **Beta version**: The beta version includes APIs that are currently in preview and are accessible in the `https://graph.microsoft.com/beta` endpoint. To start using the beta APIs, see [Microsoft Graph beta endpoint reference](/graph/api/overview?view=graph-rest-beta&preserve-view=true)
+- **v1.0 version**: The v1.0 version includes APIs that are generally available and ready for production use. The v1.0 version is accessible in the `https://graph.microsoft.com/v1.0` endpoint. To start using the v1.0 APIs, see [Microsoft Graph REST API v1.0 reference](/graph/api/overview?view=graph-rest-1.0&preserve-view=true)
 
-To start using the beta APIs, see [Microsoft Graph beta endpoint reference](/graph/api/overview?view=graph-rest-beta&preserve-view=true)
+For more information about Microsoft Graph API versions, see [Versioning, support, and breaking change policies for Microsoft Graph](/graph/versioning-and-support).
 
-To start using the v1.0 APIs, see [Microsoft Graph REST API v1.0 reference](/graph/api/overview?view=graph-rest-1.0&preserve-view=true)
 
 ## Get started
 
-To read from or write to a resource such as a user or an email message, you construct a request that looks like the following:
+To read from or write to a resource such as a user or an email message, you construct a request that looks like the following pattern:
 
 `{HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters}`
 
 For more information about the elements of the constructed request, see [Use the Microsoft Graph API](/graph/use-the-api)
 
 Quickstart samples are available to show you how to access the power of the Microsoft Graph API. The samples that are available access two services with one authentication: Microsoft account and Outlook. Each quickstart accesses information from Microsoft account users' profiles and displays events from their calendar.
 The quickstarts involve four steps:
+
 - Select your platform
 - Get your app ID (client ID)
 - Build the sample
@@ -52,6 +55,13 @@ When you complete the quickstart, you have an app that's ready to run. For more
 
 ## Tools
 
-Microsoft Graph Explorer is a web-based tool that you can use to build and test requests using Microsoft Graph APIs. You can access Microsoft Graph Explorer at: `https://developer.microsoft.com/graph/graph-explorer`.
+**Microsoft Graph Explorer** is a web-based tool that you can use to build and test requests to the Microsoft Graph API. Access Microsoft Graph Explorer at https://developer.microsoft.com/graph/graph-explorer.
+
+**Postman** is another tool you can use for making requests to the Microsoft Graph API. You can download Postman at https://www.getpostman.com. To interact with Microsoft Graph in Postman, use the [Microsoft Graph Postman collection](/graph/use-postman).
+
+## Next steps
+
+For more information about Microsoft Graph, including usage information and tutorials, see:
 
-Postman is a tool that you can also use to build and test requests using the Microsoft Graph APIs. You can download Postman at: `https://www.getpostman.com/`. To interact with Microsoft Graph in Postman, you use the Microsoft Graph collection in Postman. For more information, see [Use Postman with the Microsoft Graph API](/graph/use-postman).
+- [Use the Microsoft Graph API](/graph/use-the-api)
+- [Microsoft Graph tutorials](/graph/tutorials)

articles/active-directory/saas-apps/media/snackmagic-tutorial/account.png

@@ -0,0 +1,147 @@
+---
+title: 'Tutorial: Azure AD SSO integration with Nodetrax Project'
+description: Learn how to configure single sign-on between Azure Active Directory and Nodetrax Project.
+services: active-directory
+author: jeevansd
+manager: CelesteDG
+ms.reviewer: CelesteDG
+ms.service: active-directory
+ms.subservice: saas-app-tutorial
+ms.workload: identity
+ms.topic: tutorial
+ms.date: 10/06/2021
+ms.author: jeedes
+
+---
+
+# Tutorial: Azure AD SSO integration with Nodetrax Project
+
+In this tutorial, you'll learn how to integrate Nodetrax Project with Azure Active Directory (Azure AD). When you integrate Nodetrax Project with Azure AD, you can:
+
+* Control in Azure AD who has access to Nodetrax Project.
+* Enable your users to be automatically signed-in to Nodetrax Project with their Azure AD accounts.
+* Manage your accounts in one central location - the Azure portal.
+
+## Prerequisites
+
+To get started, you need the following items:
+
+* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
+* Nodetrax Project single sign-on (SSO) enabled subscription.
+
+## Scenario description
+
+In this tutorial, you configure and test Azure AD SSO in a test environment.
+
+* Nodetrax Project supports **SP and IDP** initiated SSO.
+
+## Add Nodetrax Project from the gallery
+
+To configure the integration of Nodetrax Project into Azure AD, you need to add Nodetrax Project from the gallery to your list of managed SaaS apps.
+
+1. Sign in to the Azure portal using either a work or school account, or a personal Microsoft account.
+1. On the left navigation pane, select the **Azure Active Directory** service.
+1. Navigate to **Enterprise Applications** and then select **All Applications**.
+1. To add new application, select **New application**.
+1. In the **Add from the gallery** section, type **Nodetrax Project** in the search box.
+1. Select **Nodetrax Project** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
+
+## Configure and test Azure AD SSO for Nodetrax Project
+
+Configure and test Azure AD SSO with Nodetrax Project using a test user called **B.Simon**. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in Nodetrax Project.
+
+To configure and test Azure AD SSO with Nodetrax Project, perform the following steps:
+
+1. **[Configure Azure AD SSO](#configure-azure-ad-sso)** - to enable your users to use this feature.
+    1. **[Create an Azure AD test user](#create-an-azure-ad-test-user)** - to test Azure AD single sign-on with B.Simon.
+    1. **[Assign the Azure AD test user](#assign-the-azure-ad-test-user)** - to enable B.Simon to use Azure AD single sign-on.
+1. **[Configure Nodetrax Project SSO](#configure-nodetrax-project-sso)** - to configure the single sign-on settings on application side.
+    1. **[Create Nodetrax Project test user](#create-nodetrax-project-test-user)** - to have a counterpart of B.Simon in Nodetrax Project that is linked to the Azure AD representation of user.
+1. **[Test SSO](#test-sso)** - to verify whether the configuration works.
+
+## Configure Azure AD SSO
+
+Follow these steps to enable Azure AD SSO in the Azure portal.
+
+1. In the Azure portal, on the **Nodetrax Project** application integration page, find the **Manage** section and select **single sign-on**.
+1. On the **Select a single sign-on method** page, select **SAML**.
+1. On the **Set up single sign-on with SAML** page, click the pencil icon for **Basic SAML Configuration** to edit the settings.
+
+   ![Edit Basic SAML Configuration](common/edit-urls.png)
+
+1. On the **Basic SAML Configuration** section, the user does not have to perform any step as the app is already pre-integrated with Azure.
+
+1. Click **Set additional URLs** and perform the following step if you wish to configure the application in **SP** initiated mode:
+
+    In the **Sign-on URL** text box, type the URL:
+    `https://project.nodetrax.com`
+
+1. Nodetrax Project application expects the SAML assertions in a specific format, which requires you to add custom attribute mappings to your SAML token attributes configuration. The following screenshot shows the list of default attributes.
+
+	![image](common/default-attributes.png)
+
+1. In addition to above, Nodetrax Project application expects few more attributes to be passed back in SAML response which are shown below. These attributes are also pre populated but you can review them as per your requirements.
+	
+	| Name | Source Attribute|
+	| ---------| --------- |
+	| id | user.objectid |
+
+1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section,  find **Certificate (Base64)** and select **Download** to download the certificate and save it on your computer.
+
+	![The Certificate download link](common/certificatebase64.png)
+
+1. On the **Set up Nodetrax Project** section, copy the appropriate URL(s) based on your requirement.
+
+	![Copy configuration URLs](common/copy-configuration-urls.png)
+
+### Create an Azure AD test user
+
+In this section, you'll create a test user in the Azure portal called B.Simon.
+
+1. From the left pane in the Azure portal, select **Azure Active Directory**, select **Users**, and then select **All users**.
+1. Select **New user** at the top of the screen.
+1. In the **User** properties, follow these steps:
+   1. In the **Name** field, enter `B.Simon`.  
+   1. In the **User name** field, enter the [email protected]. For example, `[email protected]`.
+   1. Select the **Show password** check box, and then write down the value that's displayed in the **Password** box.
+   1. Click **Create**.
+
+### Assign the Azure AD test user
+
+In this section, you'll enable B.Simon to use Azure single sign-on by granting access to Nodetrax Project.
+
+1. In the Azure portal, select **Enterprise Applications**, and then select **All applications**.
+1. In the applications list, select **Nodetrax Project**.
+1. In the app's overview page, find the **Manage** section and select **Users and groups**.
+1. Select **Add user**, then select **Users and groups** in the **Add Assignment** dialog.
+1. In the **Users and groups** dialog, select **B.Simon** from the Users list, then click the **Select** button at the bottom of the screen.
+1. If you are expecting a role to be assigned to the users, you can select it from the **Select a role** dropdown. If no role has been set up for this app, you see "Default Access" role selected.
+1. In the **Add Assignment** dialog, click the **Assign** button.
+
+## Configure Nodetrax Project SSO
+
+To configure single sign-on on **Nodetrax Project** side, you need to send the downloaded **Certificate (Base64)** and appropriate copied URLs from Azure portal to [Nodetrax Project support team](mailto:[email protected]). They set this setting to have the SAML SSO connection set properly on both sides.
+
+### Create Nodetrax Project test user
+
+In this section, you create a user called Britta Simon in Nodetrax Project. Work with [Nodetrax Project support team](mailto:[email protected]) to add the users in the Nodetrax Project platform. Users must be created and activated before you use single sign-on.
+
+## Test SSO 
+
+In this section, you test your Azure AD single sign-on configuration with following options. 
+
+#### SP initiated:
+
+* Click on **Test this application** in Azure portal. This will redirect to Nodetrax Project Sign on URL where you can initiate the login flow.  
+
+* Go to Nodetrax Project Sign-on URL directly and initiate the login flow from there.
+
+#### IDP initiated:
+
+* Click on **Test this application** in Azure portal and you should be automatically signed in to the Nodetrax Project for which you set up the SSO. 
+
+You can also use Microsoft My Apps to test the application in any mode. When you click the Nodetrax Project tile in the My Apps, if configured in SP mode you would be redirected to the application sign on page for initiating the login flow and if configured in IDP mode, you should be automatically signed in to the Nodetrax Project for which you set up the SSO. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).
+
+## Next steps
+
+Once you configure Nodetrax Project you can enforce session control, which protects exfiltration and infiltration of your organization’s sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Cloud App Security](/cloud-app-security/proxy-deployment-aad).