Merge pull request #13346 from MicrosoftDocs/main

Merge main into live

Author: ghogen

docs/debugger/remote-debugging-aspnet-on-a-remote-iis-7-5-computer.md

@@ -136,6 +136,9 @@ When you're ready, switch to a debug configuration.
 1. Select **Save** and then republish the app.
 ::: moniker-end
 
+> [!WARNING]
+> In a production environment, using username and password credentials (basic authentication) is not the most secure method of authentication. Whenever possible, use alternative methods. For example, consider publishing to a package from Visual Studio, and then use *WebDeploy.exe* from a command line to deploy the package. With that method, you can use IIS Manager to configure authorized Windows users who can publish to the web server, and run *WebDeploy.exe* under that Windows user account. See [Installing and Configuring Web Deploy on IIS 8.0 or Later](/iis/install/installing-publishing-technologies/installing-and-configuring-web-deploy-on-iis-80-or-later). If you do use password credentials, be sure to use a strong password, and secure the password from being leaked or shared.
+
 ## (Optional) Deploy by publishing to a local folder
 
 You can use this option to deploy your app if you want to copy the app to IIS using PowerShell, RoboCopy, or you want to manually copy the files.
@@ -156,7 +159,12 @@ You can use this option to deploy your app if you want to copy the app to IIS us
 
 7. Under **Connections**, select **Application Pools**. Open **DefaultAppPool** and set the Application pool field to **ASP.NET v4.0** (ASP.NET 4.5 isn't an option for the Application pool).
 
-8. With the site selected in the IIS Manager, choose **Edit Permissions**, and make sure that IUSR, IIS_IUSRS, or the user configured for the Application Pool is an authorized user with Read & Execute rights. If none of these users are present, add IUSR as a user with Read & Execute rights.
+8. With the site selected in the IIS Manager, choose **Edit Permissions**, and make sure that IUSR, IIS_IUSRS, or the user configured for the Application Pool is an authorized user with Read & Execute rights.
+
+   If you don't see one of these users with access, go through steps to add IUSR as a user with Read & Execute rights.
+
+> [!IMPORTANT]
+> For security information related to the built-in accounts, see [Understanding Built-In User and Group Accounts in IIS 7](/iis/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis).
 
 ### Publish and Deploy the app by publishing to a local folder from Visual Studio
 

docs/debugger/remote-debugging-aspnet-on-a-remote-iis-computer.md

@@ -136,6 +136,9 @@ When you're ready, switch to a debug configuration.
 1. Select a **Debug** configuration, and then select **Remove additional files at destination** under the **File Publish** options.
 ::: moniker-end
 
+> [!WARNING]
+> Using username and password credentials (basic authentication) is not the most secure method of authentication. Whenever possible, use alternative methods. For example, consider publishing to a package from Visual Studio, and then use *WebDeploy.exe* from a command line to deploy the package. With that method, you can use IIS Manager to configure authorized Windows users who can publish to the web server, and run *WebDeploy.exe* under that Windows user account. See [Installing and Configuring Web Deploy on IIS 8.0 or Later](/iis/install/installing-publishing-technologies/installing-and-configuring-web-deploy-on-iis-80-or-later). If you do use password credentials, be sure to use a strong password, and secure the password from being leaked or shared.
+
 ## (Optional) Deploy by publishing to a local folder
 
 You can use this option to deploy your app if you want to copy the app to IIS using PowerShell, RoboCopy, or you want to manually copy the files.
@@ -160,6 +163,9 @@ You can use this option to deploy your app if you want to copy the app to IIS us
 
    If you don't see one of these users with access, go through steps to add IUSR as a user with Read & Execute rights.
 
+> [!IMPORTANT]
+> For security information related to the built-in accounts, see [Understanding Built-In User and Group Accounts in IIS 7](/iis/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis).
+
 ### Publish and Deploy the app by publishing to a local folder from Visual Studio
 
 You can also publish and deploy the app using the file system or other tools.

docs/debugger/remote-debugging-azure.md

@@ -146,6 +146,9 @@ When you're ready, switch to a debug configuration.
 1. Select a **Debug** configuration, and then select **Remove additional files at destination** under the **File Publish** options.
 ::: moniker-end
 
+> [!WARNING]
+> Using username and password credentials (basic authentication) is not the most secure method of authentication. Whenever possible, use alternative methods. For example, consider publishing to a package from Visual Studio, and then use *WebDeploy.exe* from a command line to deploy the package. With that method, you can use IIS Manager to configure authorized Windows users who can publish to the web server, and run *WebDeploy.exe* under that Windows user account. See [Installing and Configuring Web Deploy on IIS 8.0 or Later](/iis/install/installing-publishing-technologies/installing-and-configuring-web-deploy-on-iis-80-or-later). If you do use password credentials, be sure to use a strong password, and secure the password from being leaked or shared.
+
 ## (Optional) Deploy by publishing to a local folder
 
 You can use this option to deploy your app if you want to copy the app to IIS using PowerShell, RoboCopy, or you want to manually copy the files.
@@ -164,6 +167,9 @@ If you're importing publish settings, you can skip this section.
 
    If you don't see one of these users with access, go through steps to add IUSR as a user with Read & Execute rights.
 
+> [!IMPORTANT]
+> For security information related to the built-in accounts, see [Understanding Built-In User and Group Accounts in IIS 7](/iis/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis).
+
 ### (Optional) Publish and Deploy the app by publishing to a local folder from Visual Studio
 
 If you're not using Web Deploy, you must publish and deploy the app using the file system or other tools. You can start by creating a package using the file system, and then either deploy the package manually or use other tools like PowerShell, Robocopy, or XCopy. In this section, we assume you're manually copying the package if you aren't using Web Deploy.