Bringing even with master.

Author: v-alje

articles/active-directory/b2b/google-federation.md

@@ -7,7 +7,7 @@ services: active-directory
 ms.service: active-directory
 ms.component: B2B
 ms.topic: conceptual
-ms.date: 08/20/2018
+ms.date: 11/07/2018
 
 ms.author: mimart
 author: msmimart
@@ -42,15 +42,21 @@ First, create a new project in the Google Developers Console to obtain a client
 
    ![Google API credentials](media/google-federation/google-api.png)
 
-4. Choose the **Oauth consent screen** tab and enter a **Product name shown to users**. (Leave the other settings.) Select **Save**.
+4. Choose the **OAuth consent screen** tab and enter an **Application name**. (Leave the other settings.)
 
    ![Google OAuth consent screen](media/google-federation/google-oauth-consent-screen.png)
 
-5. Choose the **Credentials** tab. In the **Create credentials** menu, choose **OAuth client ID**.
+5. Scroll to the **Authorized domains** section and enter microsoftonline.com.
+
+   ![Authorized domains section](media/google-federation/google-oauth-authorized-domains.png)
+
+6. Select **Save**.
+
+7. Choose the **Credentials** tab. In the **Create credentials** menu, choose **OAuth client ID**.
 
    ![Google API credentials](media/google-federation/google-api-credentials.png)
 
-6. Under **Application type**, choose **Web application**, and then under **Authorized redirect URIs**, enter the following URIs:
+8. Under **Application type**, choose **Web application**, and then under **Authorized redirect URIs**, enter the following URIs:
    - `https://login.microsoftonline.com` 
    - `https://login.microsoftonline.com/te/<directory id>/oauth2/authresp` <br>(where `<directory id>` is your directory ID)
 
@@ -59,7 +65,7 @@ First, create a new project in the Google Developers Console to obtain a client
 
    ![Create OAuth client ID](media/google-federation/google-create-oauth-client-id.png)
 
-7. Select **Create**. Copy the client ID and client secret, which you'll use when you add the identity provider in the Azure AD portal.
+9. Select **Create**. Copy the client ID and client secret, which you'll use when you add the identity provider in the Azure AD portal.
 
    ![OAuth client ID and client secret](media/google-federation/google-auth-client-id-secret.png)
 

articles/active-directory/b2b/media/google-federation/google-auth-client-id-secret.png

@@ -150,7 +150,7 @@ To enable / disable a device, you have two options:
 **Remarks:**
 
 - You need to be a global administrator in Azure  AD to enable / disable a device. 
-- Disabling a device prevents a device from accessing your Azure AD resources. 
+- Disabling a device prevents a device from successfully authenticating with Azure AD, therby preventing the device from accessing your Azure AD resources that are guarded by device CA or using your WH4B credentials. 
 
 
 

articles/active-directory/b2b/media/google-federation/google-create-oauth-client-id.png

@@ -18,29 +18,10 @@ ms.author: markvi
 ms.reviewer: jairoc
 
 ---
-# Azure Active Directory device management FAQ
-
-**Q: Can I register Android or iOS BYOD devices?**
-
-**A:** Yes, but only with Azure device registration service and for hybrid customers. It is not supported with on-premises device registration service in AD FS.
-
-**Q: How can I register a macOS device?**
-
-**A:** To register macOS device:
-
-1.	[Create a compliance policy](https://docs.microsoft.com/intune/compliance-policy-create-mac-os)
-2.	[Define a conditional access policy for macOS devices](../active-directory-conditional-access-azure-portal.md) 
 
-**Remarks:**
-
-- The users that are included in your conditional access policy need a [supported version of Office for macOS](../conditional-access/technical-reference.md#client-apps-condition) to access resources. 
-
-- During the first access attempt, your users are prompted to enroll the device using the company portal.
-
----
-
-**Q: I registered the device recently. Why can’t I see the device under my user info in the Azure portal?**
+# Azure Active Directory device management FAQ
 
+**Q: I registered the device recently. Why can’t I see the device under my user info in the Azure portal? Or Why is device owner marked as N/A for hybrid Azure AD joined devices?**
 **A:** Windows 10 devices that are hybrid Azure AD joined do not show up under the USER devices.
 You need to use All devices view in Azure portal. You can also use PowerShell [Get-MsolDevice](/powershell/module/msonline/get-msoldevice?view=azureadps-1.0) cmdlet.
 
@@ -54,15 +35,20 @@ Only the following devices are listed under the USER devices:
 
 **Q: How do I know what the device registration state of the client is?**
 
-**A:** You can use the Azure portal, go to All devices and search for the device using device ID. Check the value under the join type column.
-
-If you want to check the local device registration state from a registered device:
+**A:** You can use the Azure portal, go to All devices and search for the device using device ID. Check the value under the join type column. Sometimes, the device could have been reset or re-imaged. So, it is essential to also check device registration state on the device too:
 
 - For Windows 10 and Windows Server 2016 or later devices, run dsregcmd.exe /status.
 - For down-level OS versions, run "%programFiles%\Microsoft Workplace Join\autoworkplace.exe"
 
 ---
 
+**Q: I see the device record under the USER info in the Azure portal and can see the state as registered on the device. Am I setup correctly for using conditional access?**
+
+**A:** The device join state, reflected by deviceID, must match with that on Azure AD and meet any evaluation criteria for conditional access. 
+For more information, see [Require managed devices for cloud app access with conditional access](../conditional-access/require-managed-devices.md).
+
+---
+
 **Q: I have deleted in the Azure portal or using Windows PowerShell, but the local state on the device says that it is still registered?**
 
 **A:** This is by design. The device will not have access to resources in the cloud. 
@@ -83,25 +69,6 @@ For down-level Windows OS versions that are on-premises AD domain-joined:
 2.	Type `"%programFiles%\Microsoft Workplace Join\autoworkplace.exe /l"`.
 3.	Type `"%programFiles%\Microsoft Workplace Join\autoworkplace.exe /j"`.
 
----
-**Q: How do I unjoin an Azure AD Joined device locally on the device?**
-
-**A:** 
-- For hybrid Azure AD Joined devices, make sure to turn off auto registration so that the scheduled task does not register the device again. Next, open command prompt as an administrator and type `dsregcmd.exe /debug /leave`. Alternatively, this command can be run as a script across multiple devices to unjoin in bulk.
-
-- For pure Azure AD Joined devices, make sure you have an offline local administrator account or create one, as you won't be able to sign in with any Azure AD user credentials. Next, go to **Settings** > **Accounts** > **Access Work or School**. Select your account and click on **Disconnect**. Follow the prompts and provide the local administrator credentials when prompted. Reboot the device to complete the unjoin process.
-
----
-
-**Q: My users cannot search printers from Azure AD Joined devices. How can I enable printing from Azure AD Joined devices ?**
-
-**A:** For deploying printers for Azure AD Joined devices, see [Hybrid cloud print](https://docs.microsoft.com/windows-server/administration/hybrid-cloud-print/hybrid-cloud-print-deploy). You will need an on-premises Windows Server to deploy hybrid cloud print. Currently, cloud-based print service is not available. 
-
----
-
-**Q: How do I connect to a remote Azure AD joined device?**
-**A:** Refer to the article https://docs.microsoft.com/windows/client-management/connect-to-remote-aadj-pc for details.
-
 ---
 
 **Q: Why do I see duplicate device entries in Azure portal?**
@@ -124,7 +91,27 @@ For down-level Windows OS versions that are on-premises AD domain-joined:
 
 >[!Note] 
 >For enrolled devices, we recommend wiping the device to ensure that users cannot access the resources. For more information, see [Enroll devices for management in Intune](https://docs.microsoft.com/intune/deploy-use/enroll-devices-in-microsoft-intune). 
+---
+
+# Azure AD Join FAQ
+
+**Q: How do I unjoin an Azure AD Joined device locally on the device?**
+
+**A:** 
+- For hybrid Azure AD Joined devices, make sure to turn off auto registration so that the scheduled task does not register the device again. Next, open command prompt as an administrator and type `dsregcmd.exe /debug /leave`. Alternatively, this command can be run as a script across multiple devices to unjoin in bulk.
+
+- For pure Azure AD Joined devices, make sure you have an offline local administrator account or create one, as you won't be able to sign in with any Azure AD user credentials. Next, go to **Settings** > **Accounts** > **Access Work or School**. Select your account and click on **Disconnect**. Follow the prompts and provide the local administrator credentials when prompted. Reboot the device to complete the unjoin process.
+
+---
+
+**Q: My users cannot search printers from Azure AD Joined devices. How can I enable printing from Azure AD Joined devices ?**
+
+**A:** For deploying printers for Azure AD Joined devices, see [Hybrid cloud print](https://docs.microsoft.com/windows-server/administration/hybrid-cloud-print/hybrid-cloud-print-deploy). You will need an on-premises Windows Server to deploy hybrid cloud print. Currently, cloud-based print service is not available. 
 
+---
+
+**Q: How do I connect to a remote Azure AD joined device?**
+**A:** Refer to the article https://docs.microsoft.com/windows/client-management/connect-to-remote-aadj-pc for details.
 
 ---
 
@@ -141,13 +128,6 @@ Please evaluate the conditional access policy rules and ensure that the device i
 
 ---
 
-**Q: I see the device record under the USER info in the Azure portal and can see the state as registered on the device. Am I setup correctly for using conditional access?**
-
-**A:** The device join state, reflected by deviceID, must match with that on Azure AD and meet any evaluation criteria for conditional access. 
-For more information, see [Require managed devices for cloud app access with conditional access](../conditional-access/require-managed-devices.md).
-
----
-
 **Q: Why do I get a "username or password is incorrect" message for a device I have just joined to Azure AD?**
 
 **A:** Common reasons for this scenario are:
@@ -156,7 +136,7 @@ For more information, see [Require managed devices for cloud app access with con
 
 - Your computer is unable to communicate with Azure Active Directory. Check for any network connectivity issues.
 
-- Federated logins requires your federation server to support a WS-Trust active endpoint. 
+- Federated logins requires your federation server to support WS-Trust endpoints enabled and accessible. 
 
 - You have enabled Pass through Authentication and the user has a temporary password that needs to be changed on logon.
 
@@ -168,15 +148,16 @@ For more information, see [Require managed devices for cloud app access with con
 
 ---
 
-**Q: Why did my attempt to join a PC fail although I didn't get any error information?**
+**Q: Why did my attempt to Azure AD join a PC fail although I didn't get any error information?**
 
 **A:** A likely cause is that the user is logged in to the device using the local built-in administrator account. 
 Please create a different local account before using Azure Active Directory Join to complete the setup. 
 
-
 ---
 
-**Q: Where can I find troubleshooting information about the automatic device registration?**
+# Hybrid Azure AD Join FAQ
+
+**Q: Where can I find troubleshooting information for diagnosing hybrid Azure AD join failures?**
 
 **A:** For troubleshooting information, see:
 
@@ -187,3 +168,23 @@ Please create a different local account before using Azure Active Directory Join
 
 ---
 
+# Azure AD Register FAQ
+
+**Q: Can I register Android or iOS BYOD devices?**
+
+**A:** Yes, but only with Azure device registration service and for hybrid customers. It is not supported with on-premises device registration service in AD FS.
+
+**Q: How can I register a macOS device?**
+
+**A:** To register macOS device:
+
+1.	[Create a compliance policy](https://docs.microsoft.com/intune/compliance-policy-create-mac-os)
+2.	[Define a conditional access policy for macOS devices](../active-directory-conditional-access-azure-portal.md) 
+
+**Remarks:**
+
+- The users that are included in your conditional access policy need a [supported version of Office for macOS](../conditional-access/technical-reference.md#client-apps-condition) to access resources. 
+
+- During the first access attempt, your users are prompted to enroll the device using the company portal.
+
+---

articles/active-directory/b2b/media/google-federation/google-new-project.png

@@ -128,6 +128,8 @@
       href: directory-assign-admin-roles.md
     - name: View and assign roles   
       href: directory-manage-roles-portal.md
+    - name: Least-privileged roles by task   
+      href: roles-delegate-by-task.md
     - name: Administrator role security    
       items:   
       - name: Role security planning