You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
text: Application user and role provisioning documentation
221
-
## BAND 5 - ADDITIONAL CONTENT END ##########################################################################################################################
221
+
## BAND 5 - ADDITIONAL CONTENT END ##########################################################################################################################
| city |Any string value or *null*|(user.city -eq "value")|
94
-
| country |Any string value or *null*|(user.country -eq "value")|
95
-
| companyName | Any string value or *null*|(user.companyName -eq "value")|
96
-
| department |Any string value or *null*|(user.department -eq "value")|
97
-
| displayName |Any string value |(user.displayName -eq "value")|
98
-
| employeeId |Any string value |(user.employeeId -eq "value")<br>(user.employeeId -ne *null*)|
99
-
| facsimileTelephoneNumber |Any string value or *null*|(user.facsimileTelephoneNumber -eq "value")|
100
-
| givenName |Any string value or *null*|(user.givenName -eq "value")|
101
-
| jobTitle |Any string value or *null*|(user.jobTitle -eq "value")|
102
-
| mail |Any string value or *null* (SMTP address of the user) |(user.mail -eq "value")|
103
-
| mailNickName |Any string value (mail alias of the user) |(user.mailNickName -eq "value")|
104
-
| memberOf | Any string value (valid group object ID) |(device.memberof -any (group.objectId -in ['value'])) |
105
-
| mobile |Any string value or *null*|(user.mobile -eq "value")|
106
-
| objectId |GUID of the user object |(user.objectId -eq "11111111-1111-1111-1111-111111111111")|
107
-
| onPremisesDistinguishedName (preview)| Any string value or *null*|(user.onPremisesDistinguishedName -eq "value")|
108
-
| onPremisesSecurityIdentifier | On-premises security identifier (SID) for users who were synchronized from on-premises to the cloud. |(user.onPremisesSecurityIdentifier -eq "S-1-1-11-1111111111-1111111111-1111111111-1111111")|
| city |Any string value or *null*|user.city -eq "value" |
94
+
| country |Any string value or *null*|user.country -eq "value" |
95
+
| companyName | Any string value or *null*| user.companyName -eq "value" |
96
+
| department |Any string value or *null*|user.department -eq "value" |
97
+
| displayName |Any string value |user.displayName -eq "value" |
98
+
| employeeId |Any string value |user.employeeId -eq "value"<br>user.employeeId -ne *null*|
99
+
| facsimileTelephoneNumber |Any string value or *null*|user.facsimileTelephoneNumber -eq "value" |
100
+
| givenName |Any string value or *null*|user.givenName -eq "value" |
101
+
| jobTitle |Any string value or *null*|user.jobTitle -eq "value" |
102
+
| mail |Any string value or *null* (SMTP address of the user) |user.mail -eq "value" |
103
+
| mailNickName |Any string value (mail alias of the user) |user.mailNickName -eq "value" |
104
+
| memberOf | Any string value (valid group object ID) |user.memberof -any (group.objectId -in ['value']) |
105
+
| mobile |Any string value or *null*|user.mobile -eq "value" |
106
+
| objectId |GUID of the user object |user.objectId -eq "11111111-1111-1111-1111-111111111111" |
107
+
| onPremisesDistinguishedName (preview)| Any string value or *null*|user.onPremisesDistinguishedName -eq "value" |
108
+
| onPremisesSecurityIdentifier | On-premises security identifier (SID) for users who were synchronized from on-premises to the cloud. |user.onPremisesSecurityIdentifier -eq "S-1-1-11-1111111111-1111111111-1111111111-1111111" |
managementType | MDM (for mobile devices) | (device.managementType -eq "MDM")
397
-
memberOf | Any string value (valid group object ID) | (user.memberof -any (group.objectId -in ['value']))
398
-
deviceId | a valid Azure AD device ID | (device.deviceId -eq "d4fe7726-5966-431c-b3b8-cddc8fdb717d")
399
-
objectId | a valid Azure AD object ID | (device.objectId -eq "76ad43c9-32c5-45e8-a272-7b58b58f596d")
400
-
devicePhysicalIds | any string value used by Autopilot, such as all Autopilot devices, OrderID, or PurchaseOrderID | (device.devicePhysicalIDs -any _ -contains "[ZTDId]") (device.devicePhysicalIds -any _ -eq "[OrderID]:179887111881") (device.devicePhysicalIds -any _ -eq "[PurchaseOrderId]:76222342342")
401
-
systemLabels | any string matching the Intune device property for tagging Modern Workplace devices | (device.systemLabels -contains "M365Managed")
enrollmentProfileName | Apple Device Enrollment Profile name, Android Enterprise Corporate-owned dedicated device Enrollment Profile name, or Windows Autopilot profile name | device.enrollmentProfileName -eq "DEP iPhones"
395
+
isRooted | true false | device.isRooted -eq true
396
+
managementType | MDM (for mobile devices) | device.managementType -eq "MDM"
397
+
memberOf | Any string value (valid group object ID) | device.memberof -any (group.objectId -in ['value'])
398
+
deviceId | a valid Azure AD device ID | device.deviceId -eq "d4fe7726-5966-431c-b3b8-cddc8fdb717d"
399
+
objectId | a valid Azure AD object ID | device.objectId -eq "76ad43c9-32c5-45e8-a272-7b58b58f596d"
400
+
devicePhysicalIds | any string value used by Autopilot, such as all Autopilot devices, OrderID, or PurchaseOrderID | device.devicePhysicalIDs -any _ -contains "[ZTDId]"<br>(device.devicePhysicalIds -any _ -eq "[OrderID]:179887111881"<br>(device.devicePhysicalIds -any _ -eq "[PurchaseOrderId]:76222342342"
401
+
systemLabels | any string matching the Intune device property for tagging Modern Workplace devices | device.systemLabels -contains "M365Managed"
402
402
403
403
> [!NOTE]
404
404
> For the deviceOwnership when creating Dynamic Groups for devices you need to set the value equal to "Company". On Intune the device ownership is represented instead as Corporate. Refer to [OwnerTypes](/intune/reports-ref-devices#ownertypes) for more details.
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/cross-cloud-settings.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,6 +34,9 @@ To set up B2B collaboration between partner organizations in different Microsoft
34
34
35
35
After each organization has completed these steps, Azure AD B2B collaboration between the organizations is enabled.
36
36
37
+
> [!NOTE]
38
+
> B2B direct connect is not supported for collaboration with Azure AD tenants in a different Microsoft cloud.
39
+
37
40
## Before you begin
38
41
39
42
-**Obtain the partner's tenant ID.** To enable B2B collaboration with a partner's Azure AD organization in another Microsoft Azure cloud, you'll need the partner's tenant ID. Using an organization's domain name for lookup isn't available in cross-cloud scenarios.
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/cross-tenant-access-overview.md
+3Lines changed: 3 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -69,6 +69,9 @@ To set up B2B collaboration, both organizations configure their Microsoft cloud
69
69
- Use B2B collaboration to invite a user in the partner tenant to access resources in your organization, including web line-of-business apps, SaaS apps, and SharePoint Online sites, documents, and files.
70
70
- Apply Conditional Access policies to the B2B collaboration user and opt to trust device claims (compliant claims and hybrid Azure AD joined claims) from the user’s home tenant.
71
71
72
+
> [!NOTE]
73
+
> B2B direct connect is not supported for collaboration with Azure AD tenants in a different Microsoft cloud.
74
+
72
75
For configuration steps, see [Configure Microsoft cloud settings for B2B collaboration (Preview)](cross-cloud-settings.md).
Copy file name to clipboardExpand all lines: articles/active-directory/hybrid/how-to-connect-install-prerequisites.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -51,7 +51,7 @@ For more information on setting the PowerShell execution policy, see [Set-Execut
51
51
### Azure AD Connect server
52
52
The Azure AD Connect server contains critical identity data. It's important that administrative access to this server is properly secured. Follow the guidelines in [Securing privileged access](/windows-server/identity/securing-privileged-access/securing-privileged-access).
53
53
54
-
The Azure AD Connect server must be treated as a Tier 0 component as documented in the [Active Directory administrative tier model](/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material). We recommend hardening the Azure AD Connect server as a Control Plane asset by following the guidance provided in [Secure Privileged Access](https://docs.microsoft.com/security/compass/overview)
54
+
The Azure AD Connect server must be treated as a Tier 0 component as documented in the [Active Directory administrative tier model](/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material). We recommend hardening the Azure AD Connect server as a Control Plane asset by following the guidance provided in [Secure Privileged Access](/security/compass/overview)
55
55
56
56
To read more about securing your Active Directory environment, see [Best practices for securing Active Directory](/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory).
57
57
@@ -73,7 +73,7 @@ To read more about securing your Active Directory environment, see [Best practic
73
73
### Harden your Azure AD Connect server
74
74
We recommend that you harden your Azure AD Connect server to decrease the security attack surface for this critical component of your IT environment. Following these recommendations will help to mitigate some security risks to your organization.
75
75
76
-
- We recommend hardening the Azure AD Connect server as a Control Plane (formerly Tier 0) asset by following the guidance provided in [Secure Privileged Access](https://docs.microsoft.com/security/compass/overview) and [Active Directory administrative tier model](/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material).
76
+
- We recommend hardening the Azure AD Connect server as a Control Plane (formerly Tier 0) asset by following the guidance provided in [Secure Privileged Access](/security/compass/overview) and [Active Directory administrative tier model](/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material).
77
77
- Restrict administrative access to the Azure AD Connect server to only domain administrators or other tightly controlled security groups.
78
78
- Create a [dedicated account for all personnel with privileged access](/windows-server/identity/securing-privileged-access/securing-privileged-access). Administrators shouldn't be browsing the web, checking their email, and doing day-to-day productivity tasks with highly privileged accounts.
79
79
- Follow the guidance provided in [Securing privileged access](/windows-server/identity/securing-privileged-access/securing-privileged-access).
0 commit comments