Merge pull request #199623 from MicrosoftDocs/main

Merge Main to Live, 4 AM

Author: PMEds28

articles/active-directory/enterprise-users/domains-verify-custom-subdomain.md

@@ -64,7 +64,7 @@ Because subdomains inherit the authentication type of the root domain by default
 Use the following command to promote the subdomain:
 
 ```http
-POST https://graph.microsoft.com/v1.0/domains/foo.contoso.com/promote
+POST https://graph.windows.net/{tenant-id}/domains/foo.contoso.com/promote
 ```
 
 ### Promote command error conditions
@@ -114,4 +114,4 @@ Invoking API with a federated verified subdomain with user references | POST | 4
 
 - [Add custom domain names](../fundamentals/add-custom-domain.md?context=azure%2factive-directory%2fusers-groups-roles%2fcontext%2fugr-context)
 - [Manage domain names](domains-manage.md)
-- [ForceDelete a custom domain name with Microsoft Graph API](/graph/api/domain-forcedelete)
+- [ForceDelete a custom domain name with Microsoft Graph API](/graph/api/domain-forcedelete)

articles/active-directory/saas-apps/timeclock-365-saml-tutorial.md

@@ -1,5 +1,5 @@
 ---
-title: 'Tutorial: Azure Active Directory single sign-on (SSO) integration with Timeclock 365 SAML | Microsoft Docs'
+title: 'Tutorial: Azure AD SSO integration with Timeclock 365 SAML'
 description: Learn how to configure single sign-on between Azure Active Directory and Timeclock 365 SAML.
 services: active-directory
 author: jeevansd
@@ -9,12 +9,12 @@ ms.service: active-directory
 ms.subservice: saas-app-tutorial
 ms.workload: identity
 ms.topic: tutorial
-ms.date: 09/02/2021
+ms.date: 05/27/2022
 ms.author: jeedes
 
 ---
 
-# Tutorial: Azure Active Directory single sign-on (SSO) integration with Timeclock 365 SAML
+# Tutorial: Azure AD SSO integration with Timeclock 365 SAML
 
 In this tutorial, you'll learn how to integrate Timeclock 365 SAML with Azure Active Directory (Azure AD). When you integrate Timeclock 365 SAML with Azure AD, you can:
 
@@ -34,7 +34,7 @@ To get started, you need the following items:
 In this tutorial, you configure and test Azure AD SSO in a test environment.
 
 * Timeclock 365 SAML supports **SP** initiated SSO.
-* Timeclock 365 SAML supports [Automated user provisioning](timeclock-365-provisioning-tutorial.md).
+* Timeclock 365 SAML supports [Automated user provisioning](timeclock-365-saml-provisioning-tutorial.md).
 
 ## Adding Timeclock 365 SAML from the gallery
 
@@ -141,7 +141,7 @@ In this section, you'll enable B.Simon to use Azure single sign-on by granting a
 1. Click on **Create** button to create the test user.
 
 > [!NOTE]
-> Timeclock 365 SAML also supports automatic user provisioning, you can find more details [here](./timeclock-365-provisioning-tutorial.md) on how to configure automatic user provisioning.
+> Timeclock 365 SAML also supports automatic user provisioning, you can find more details [here](./timeclock-365-saml-provisioning-tutorial.md) on how to configure automatic user provisioning.
 
 ## Test SSO 
 

articles/active-directory/saas-apps/toc.yml

@@ -3009,6 +3009,8 @@
         href: webroot-security-awareness-training-provisioning-tutorial.md
       - name: WEDO
         href: wedo-provisioning-tutorial.md
+      - name: Whimsical
+        href: whimsical-provisioning-tutorial.md
       - name: Workday to Active Directory
         href: workday-inbound-tutorial.md
       - name: Workday to Azure AD

articles/active-directory/saas-apps/whimsical-provisioning-tutorial.md

@@ -0,0 +1,132 @@
+---
+title: 'Tutorial: Configure Whimsical for automatic user provisioning with Azure Active Directory | Microsoft Docs'
+description: Learn how to automatically provision and de-provision user accounts from Azure AD to Whimsical.
+services: active-directory
+author: twimmers
+writer: twimmers
+manager: beatrizd
+ms.assetid: 4457a724-ed81-4f7b-bb3e-70beea80cb51
+ms.service: active-directory
+ms.subservice: saas-app-tutorial
+ms.workload: identity
+ms.topic: tutorial
+ms.date: 05/11/2022
+ms.author: thwimmer
+---
+
+# Tutorial: Configure Whimsical for automatic user provisioning
+
+This tutorial describes the steps you need to perform in both Whimsical and Azure Active Directory (Azure AD) to configure automatic user provisioning. When configured, Azure AD automatically provisions and de-provisions users and groups to [Whimsical](https://service-portaltest.benq.com/login) using the Azure AD Provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory](../app-provisioning/user-provisioning.md).
+
+## Capabilities Supported
+> [!div class="checklist"]
+> * Create users in Whimsical
+> * Remove users in Whimsical when they do not require access anymore
+> * Keep user attributes synchronized between Azure AD and Whimsical
+> * [Single sign-on](benq-iam-tutorial.md) to Whimsical (recommended)
+
+## Prerequisites
+
+The scenario outlined in this tutorial assumes that you already have the following prerequisites:
+
+* [An Azure AD tenant](../develop/quickstart-create-new-tenant.md) 
+* A user account in Azure AD with [permission](../roles/permissions-reference.md) to configure provisioning (e.g. Application Administrator, Cloud Application administrator, Application Owner, or Global Administrator).
+* To use SCIM, SAML has to be enabled and correctly configured.
+
+## Step 1. Plan your provisioning deployment
+1. Learn about [how the provisioning service works](../app-provisioning/user-provisioning.md).
+2. Determine who will be in [scope for provisioning](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).
+3. Determine what data to [map between Azure AD and Whimsical](../app-provisioning/customize-application-attributes.md).
+
+## Step 2. Configure Whimsical to support provisioning with Azure AD
+1. To enable SCIM, you must first set up SAML SSO with AAD.
+1. Go to "Workspace Settings", which you'll find under your workspace name in the top left.
+1. Enable SCIM provisioning and click "Reveal" to retrieve the token.
+1. In the "Provisioning" tab in AAD, set "Provisioning Mode" to "Automatic", and paste "https://whimsical.com/public-api/scim-v2/?aadOptscim062020" into "Tenant URL"
+
+## Step 3. Add Whimsical from the Azure AD application gallery
+
+Add Whimsical from the Azure AD application gallery to start managing provisioning to Whimsical. If you have previously setup Whimsical for SSO you can use the same application. However it is recommended that you create a separate app when testing out the integration initially. Learn more about adding an application from the gallery [here](../manage-apps/add-application-portal.md). 
+
+## Step 4. Define who will be in scope for provisioning 
+
+The Azure AD provisioning service allows you to scope who will be provisioned based on assignment to the application and or based on attributes of the user / group. If you choose to scope who will be provisioned to your app based on assignment, you can use the following [steps](../manage-apps/assign-user-or-group-access-portal.md) to assign users and groups to the application. If you choose to scope who will be provisioned based solely on attributes of the user or group, you can use a scoping filter as described [here](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md). 
+
+* When assigning users and groups to Whimsical, you must select a role other than **Default Access**. Users with the Default Access role are excluded from provisioning and will be marked as not effectively entitled in the provisioning logs. If the only role available on the application is the default access role, you can [update the application manifest](../develop/howto-add-app-roles-in-azure-ad-apps.md) to add additional roles. 
+
+* Start small. Test with a small set of users and groups before rolling out to everyone. When scope for provisioning is set to assigned users and groups, you can control this by assigning one or two users or groups to the app. When scope is set to all users and groups, you can specify an [attribute based scoping filter](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md). 
+
+## Step 5. Configure automatic user provisioning to Whimsical 
+
+This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users and/or groups in TestApp based on user and/or group assignments in Azure AD.
+
+### To configure automatic user provisioning for Whimsical in Azure AD:
+
+1. Sign in to the [Azure portal](https://portal.azure.com). Select **Enterprise Applications**, then select **All applications**.
+
+	![Enterprise applications blade](common/enterprise-applications.png)
+
+2. In the applications list, select **Whimsical**.
+
+	![The Whimsical link in the Applications list](common/all-applications.png)
+
+3. Select the **Provisioning** tab.
+
+	![Provision tab](common/provisioning.png)
+
+4. Set the **Provisioning Mode** to **Automatic**.
+
+	![Provisioning tab](common/provisioning-automatic.png)
+
+5. Under the **Admin Credentials** section, input your Whimsical Tenant URL and Secret Token. Click **Test Connection** to ensure Azure AD can connect to Whimsical. If the connection fails, ensure your Whimsical account has Admin permissions and try again.
+
+ 	![Token](common/provisioning-testconnection-tenanturltoken.png)
+
+6. In the **Notification Email** field, enter the email address of a person or group who should receive the provisioning error notifications and select the **Send an email notification when a failure occurs** check box.
+
+	![Notification Email](common/provisioning-notification-email.png)
+
+7. Select **Save**.
+
+8. Under the **Mappings** section, select **Synchronize Azure Active Directory Users to Whimsical**.
+
+9. Review the user attributes that are synchronized from Azure AD to Whimsical in the **Attribute-Mapping** section. The attributes selected as **Matching** properties are used to match the user accounts in Whimsical for update operations. If you choose to change the [matching target attribute](../app-provisioning/customize-application-attributes.md), you will need to ensure that the Whimsical API supports filtering users based on that attribute. Select the **Save** button to commit any changes.
+
+   |Attribute|Type|Supported for filtering|
+   |---|---|---|
+   |userName|String|✓
+   |externalId|String|
+   |active|Boolean|
+   |displayName|String|
+
+10. To configure scoping filters, refer to the following instructions provided in the [Scoping filter tutorial](../app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).
+
+11. To enable the Azure AD provisioning service for Whimsical, change the **Provisioning Status** to **On** in the **Settings** section.
+
+	![Provisioning Status Toggled On](common/provisioning-toggle-on.png)
+
+12. Define the users and/or groups that you would like to provision to Whimsical by choosing the desired values in **Scope** in the **Settings** section.
+
+	![Provisioning Scope](common/provisioning-scope.png)
+
+13. When you are ready to provision, click **Save**.
+
+	![Saving Provisioning Configuration](common/provisioning-configuration-save.png)
+
+This operation starts the initial synchronization cycle of all users and groups defined in **Scope** in the **Settings** section. The initial cycle takes longer to perform than subsequent cycles, which occur approximately every 40 minutes as long as the Azure AD provisioning service is running. 
+
+## Step 6. Monitor your deployment
+Once you've configured provisioning, use the following resources to monitor your deployment:
+
+1. Use the [provisioning logs](../reports-monitoring/concept-provisioning-logs.md) to determine which users have been provisioned successfully or unsuccessfully
+2. Check the [progress bar](../app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user.md) to see the status of the provisioning cycle and how close it is to completion
+3. If the provisioning configuration seems to be in an unhealthy state, the application will go into quarantine. Learn more about quarantine states [here](../app-provisioning/application-provisioning-quarantine-status.md).  
+
+## Additional resources
+
+* [Managing user account provisioning for Enterprise Apps](../app-provisioning/configure-automatic-user-provisioning-portal.md)
+* [What is application access and single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md)
+
+## Next steps
+
+* [Learn how to review logs and get reports on provisioning activity](../app-provisioning/check-status-user-account-provisioning.md)

articles/advisor/advisor-release-notes.md

@@ -8,6 +8,22 @@ ms.date: 01/03/2022
 
 Learn what's new in the service. These items may be release notes, videos, blog posts, and other types of information. Bookmark this page to stay up to date with the service.
 
+## May 2022
+
+### Unlimited number of subscriptions
+It is easier now to get an overview of optimization opportunities available to your organization – no need to spend time and effort to apply filters and process subscription in batches.
+
+To learn more, visit [Get started with Azure Advisor](advisor-get-started.md).
+
+### Tag filtering
+
+You can now get Advisor recommendations scoped to a business unit, workload, or team. Filter recommendations and calculate scores using tags you have already assigned to Azure resources, resource groups and subscriptions. Apply tag filters to:
+
+* Identify cost saving opportunities by business units
+* Compare scores for workloads to optimize critical ones first
+
+To learn more, visit [How to filter Advisor recommendations using tags](advisor-tag-filtering.md).
+
 ## January 2022
 
 [**Shutdown/Resize your virtual machines**](advisor-cost-recommendations.md#optimize-virtual-machine-spend-by-resizing-or-shutting-down-underutilized-instances) recommendation was enhanced to increase the quality, robustness, and applicability.

articles/advisor/advisor-tag-filtering.md

@@ -0,0 +1,50 @@
+---
+title: Review optimization opportunities by workload, environment or team
+description: Review optimization opportunities by workload, environment or team
+ms.topic: article
+ms.custom: tags
+ms.date: 05/25/2022
+---
+
+# Review optimization opportunities by workload, environment or team
+
+You can now get Advisor recommendations and scores scoped to a workload, environment, or team  using resource tag filters. Filter recommendations and calculate scores using tags you have already assigned to Azure resources, resource groups and subscriptions. Use tag filters to:
+
+* Identify cost saving opportunities by team
+* Compare scores for workloads to optimize the critical ones first
+
+> [!TIP]
+> For more information on how to use resource tags to organize and govern your Azure resources, please see the [Cloud Adoption Framework’s guidance](/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging) and [Build a cloud governance strategy on Azure](/learn/modules/build-cloud-governance-strategy-azure/).
+
+## How to filter recommendations using tags
+
+1.	Sign in to the [Azure portal](https://portal.azure.com/).
+1.	Search for and select [Advisor](https://aka.ms/azureadvisordashboard) from any page.
+1.	On the Advisor dashboard, click on the **Add Filter** button.
+1.	Select the tag in the **Filter** field and value(s).
+1.	Click **Apply**. Summary tiles will be updated to reflect the filter.
+1.	Click on any of the categories to review recommendations.
+ 
+    [ ![Screenshot of the Azure Advisor dashboard that shows count of recommendations after tag filter is applied.](./media/tags/overview-tag-filters.png) ](./media/tags/overview-tag-filters.png#lightbox)
+ 
+ 
+## How to calculate scores using resource tags
+
+1.	Sign in to the [Azure portal](https://portal.azure.com/).
+1.	Search for and select [Advisor](https://aka.ms/azureadvisordashboard) from any page.
+1.	Select **Advisor score (preview)** from the navigation menu on the left.
+1.	Click on the **Add Filter** button.
+1.	Select the tag in the **Filter** field and value(s).
+1.	Click **Apply**. Advisor score will be updated to only include resources impacted by the filter. 
+1.	Click on any of the categories to review recommendations.
+ 
+    [ ![Screenshot of the Azure Advisor score dashboard that shows score and recommendations after tag filter is applied.](./media/tags/score-tag-filters.png) ](./media/tags/score-tag-filters.png#lightbox)
+
+> [!NOTE]
+> Not all capabilities are available when tag filters are used. For example, tag filters are not supported for security score and score history. 
+
+## Next steps
+
+To learn more about tagging, see: 
+- [Define your tagging strategy - Cloud Adoption Framework](/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging)
+- [Tag resources, resource groups, and subscriptions for logical organization - Azure Resource Manager](/azure/azure-resource-manager/management/tag-resources?tabs=json)

articles/advisor/media/tags/overview-tag-filters.png

@@ -40,10 +40,12 @@
     href: ./resource-graph-samples.md
 - name: How-to guides
   items:
-  - name: Security
-    href: advisor-security-recommendations.md
   - name: Optimize costs
     href: advisor-cost-recommendations.md
+  - name: Improve security
+    href: advisor-security-recommendations.md
+  - name: Use tags to filter recommendations and score
+    href: advisor-tag-filtering.md
   - name: Configure recommendations
     href: view-recommendations.md
   - name: Permissions and blocked actions

articles/advisor/media/tags/score-tag-filters.png

@@ -3,7 +3,7 @@ title: Use Azure tags in Azure Kubernetes Service (AKS)
 description: Learn how to use Azure provider tags to track resources in Azure Kubernetes Service (AKS).
 services: container-service
 ms.topic: article
-ms.date: 02/08/2022
+ms.date: 05/26/2022
 ---
 
 # Use Azure tags in Azure Kubernetes Service (AKS)
@@ -42,6 +42,13 @@ When you create or update an AKS cluster with the `--tags` parameter, the follow
 * The public IP that's associated with the cluster
 * The network security group that's associated with the cluster
 * The virtual network that's associated with the cluster
+* The AKS managed kubelet msi associated with the cluster
+* The AKS managed addon msi associated with the cluster
+* The private DNS zone associated with the private cluster
+* The private endpoint associated with the private cluster
+
+> [!NOTE]
+> Azure Private DNS only supports 15 tags. [tag resources](../azure-resource-manager/management/tag-resources.md). 
 
 To create a cluster and assign Azure tags, run `az aks create` with the `--tags` parameter, as shown in the following command. Running the command creates a *myAKSCluster* in the *myResourceGroup* with the tags *dept=IT* and *costcenter=9999*.
 
@@ -203,4 +210,4 @@ parameters:
 > 
 > Any updates that you make to tags through Kubernetes will retain the value that's set through Kubernetes. For example, if your disk has tags *dept=IT* and *costcenter=5555* set by Kubernetes, and you use the portal to set the tags *team=beta* and *costcenter=3333*, the new list of tags would be *dept=IT*, *team=beta*, and *costcenter=5555*. If you then remove the disk through Kubernetes, the disk would have the tag *team=beta*.
 
-[install-azure-cli]: /cli/azure/install-azure-cli
+[install-azure-cli]: /cli/azure/install-azure-cli