text:
Azure Applicaiton Gateway V2 Certification Issue

Greetings,
i have configured a Azure Application gateway (v2) and there is one backend servers.
Applicaiton works fine on the backend servers with 443 certificate from Digicert.
When i check health probe details are following:
Message: The root certificate of the server certificate used by the backend does not match the trusted root certificate added to the application gateway. Ensure that you add the correct root certificate to whitelist the backend
Configuration details on Applicaiton Gateway:

There is ROOT certificate on httpsettings. -> it has been taken from application servers by exporting as documented on Microsoft docs for WAF v2.
There is certificate with private key as PFX on listenner settings. -> Same certificate with private key from applicaton server.
All over 443.

i am stuck with that issue, i am thinking maybe it can be a bug but can not be sure.
Thanks in advance.
UPDATE:
Export trusted root certificate (for v2 SKU):
https://docs.microsoft.com/en-us/azure/application-gateway/certificates-for-backend-authentication#export-trusted-root-certificate-for-v2-sku
End-to-end TLS with the v2 SKU
https://docs.microsoft.com/en-us/azure/application-gateway/ssl-overview#end-to-end-tls-with-the-v2-sku

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 77a317f1-deef-4ba7-5839-f39ce3733655
Version Independent ID: d85aa8fe-7270-d073-ea56-d1c0759383b8
Content: Enabling end to end TLS on Azure Application Gateway
Content Source: articles/application-gateway/ssl-overview.md
Service: application-gateway
GitHub Login: @surajmb
Microsoft Alias: victorh

@EmreMARTiN, Thanks for the feedback. However, we need few details. Can you please add reference to relevant Microsoft Docs page you are following? Every documentation page has a feedback section at the bottom. If you create the issue from there, the required details will be auto-populated.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.
ID: <--->
Version Independent ID: <--->
Content: <--->
Content Source:<--->
Service:<--->
Sub-service: <--->
GitHub Login: <--->
Microsoft Alias: <--->

Hi krish-gh,
Export trusted root certificate (for v2 SKU):
https://docs.microsoft.com/en-us/azure/application-gateway/certificates-for-backend-authentication#export-trusted-root-certificate-for-v2-sku
End-to-end TLS with the v2 SKU
https://docs.microsoft.com/en-us/azure/application-gateway/ssl-overview#end-to-end-tls-with-the-v2-sku

@EmreMARTiN , you mentioned your backend certificate is from "Digicert" which is already a well-known trusted CA. Certificates signed by well known CA authorities whose CN matches the host name in the HTTP backend settings do not require any additional step for end to end TLS to work. You should remove the exported trusted root you added in the App Gateway.

@krish-gh actually it was actually what have i tried firstly but sitouiotion was same.

Was the error "exactly" the same before you explicitly added the exported root rather than relying on "Digicert" as known authority? i.e. "The root certificate of the server certificate used by the backend does not match the trusted root certificate added to the application gateway". Otherwise please share the message in that scenario without adding root explicitly.

Yes it was excalty same.

Thanks for clarifying. In that case, I suggest you to create an Azure Support ticket to take a closer look at your issue. Let me know here if you face any issue reaching Azure support.

This error can also occur if the backend server doesn't exchange the complete chain of the cert, including the Root > Intermediate (if applicable) > Leaf during the TLS handshake. To verify, you can use OpenSSL commands from any client and connect to the backend server by using the configured settings in the Application Gateway probe.

For example:
OpenSSL> s_client -connect 10.0.0.4:443 -servername www.example.com -showcerts
If the output doesn't show the complete chain of the certificate being returned, export the certificate again with the complete chain, including the root certificate. Configure that certificate on your backend server.
CONNECTED(00000188)\
  depth=0 OU = Domain Control Validated, CN = \*.example.com\
  verify error:num=20:unable to get local issuer certificate\
  verify return:1\
  depth=0 OU = Domain Control Validated, CN = \*.example.com\
  verify error:num=21:unable to verify the first certificate\
  verify return:1\
  \-\-\-\
  Certificate chain\
   0 s:/OU=Domain Control Validated/CN=*.example.com\
     i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2\
  \-----BEGIN CERTIFICATE-----\
  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\
  \-----END CERTIFICATE-----

with open ssl i should run the command on from local server  ? or from external over WAF ?

@EmreMARTiN you can run openssl from your local machine pointing to your backend, not external over WAF. If your backend is within a VNET not accessible from your local, the you run openssl from a Cloud Shell within VNET. If you are not familiar with Cloud Shell, it allows you to access bash or powershell from your browser to run commands within your Azure subscription https://docs.microsoft.com/en-us/azure/cloud-shell/overview

with open ssl all looks okey i can see all chains.

Can you post the output please after masking any sensitive info?

Hi @krish-gh
output is following (some lines deleted and some changed)
$ openssl s_client -showcerts -connect domain.company.com:443
CONNECTED(000001D8)
Certificate chain
0 s:CN = domain.company.com
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
1 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
Server certificate
subject=CN = domain.company.com
issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018

No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
SSL handshake has read 4909 bytes and written 448 bytes
Verification: OK
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol  : TLSv1.2
Cipher    : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: C13CC80BB9D30775448DA62
Session-ID-ctx:
Master-Key: 2B2D16F4B5F0955017693FD8
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 15 30 14 a5 42 1d 31 92-e2 05 48 58 28 01 88 c9   .0..B.1...HX(...
Start Time: 1600261657
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
verify return:1
depth=0 CN = domain.company.com
verify return:1
010 - 74 a5 89 21 92 29 63 1e-d3 42 f2 31 58 c1 f8 b7   t..!.)c..B.1X...
0020 - 62 4b 21 ea 0e 08 38 81-93 10 4d 32 07 c0 bf 2d   bK!...8...M2...-
0030 - b0 73 4a de f5 cf ee e1-7c 71 69 8b 03 72 6a bf   .sJ.....|qi..rj.
Start Time: 1600261657
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no

depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
verify return:1
depth=0 CN = domain.company.com
verify return:1

$ openssl s_client -showcerts -connect domain.company.com:443
CONNECTED(000001D8)
Certificate chain
0 s:CN = domain.company.com
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
1 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
2 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
Server certificate
subject=CN = domain.company.com
issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018

No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
SSL handshake has read 4909 bytes and written 448 bytes
Verification: OK
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol  : TLSv1.2
Cipher    : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: C13CC80BB9D30775448DA62
Session-ID-ctx:
Master-Key: 2B2D16F4B5F0955017693FD8
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 15 30 14 a5 42 1d 31 92-e2 05 48 58 28 01 88 c9   .0..B.1...HX(...
Start Time: 1600261657
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
verify return:1
depth=0 CN = domain.company.com
verify return:1
010 - 74 a5 89 21 92 29 63 1e-d3 42 f2 31 58 c1 f8 b7   t..!.)c..B.1X...
0020 - 62 4b 21 ea 0e 08 38 81-93 10 4d 32 07 c0 bf 2d   bK!...8...M2...-
Start Time: 1600261657
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = GeoTrust RSA CA 2018
verify return:1
depth=0 CN = domain.company.com
verify return:1

Thanks. The chain looks ok to me. In that case, I suggest you to create an Azure Support ticket to take a closer look at internal diagnostics of your app gateway instance  considering it's still occurring after troubleshooting. I can confirm that it's NOT a general issue or bug of the product. Let me know here if you face any issue reaching Azure support or if you do not have any support plan for your subscription.

i raised ticket to Microsoft. Would you like to involve with it ?

You can refer this github issue reference in your ticket so that the Azure support personnel can see the details without asking you to repeat these steps. Sure I would be glad to get involved if needed. Also, please let me know your ticket number so that I can track it internally.

I will now proceed to close this github issue here since this repo is for MS Docs specifically. I will post the root cause summary once there is an outcome from your open support case. Thanks.

@EmreMARTiN , following up to see if the support case resolved your issue. If you don't mind can you please post the summary of the root here to help people who might face similar issue.

I have the same issue, Root cert is DigiCert. What was the resolution? Thanks.

The issue was on certificate. When we check the certificate with the openssl there were following errors:
-verify error:num=19:self signed certificate in certificate chain
-No client certificate CA names sent
-Verify return code: 19 (self signed certificate in certificate chain)
After CA autohority  re-created the certificate problem was gone.

Client has renewed cert which is issued by GlobalSign and one of the listeners started to fail with same error. How did you verify the cert?

@einarasm read thru the responses from @krish-gh, specifically around leveraging OpenSSL toolkit to query the backend pool for the certificate trust chain, example:
%> openssl  s_client -connect 10.0.0.4:443 -servername www.example.com -showcerts
10.0.0.4 = IP of backend server (if using DNS ensure it points to backend server and not the public IP of appgw). The -servername switch is used in shared hosting environments. The output should show the full certificate chain of trust, importantly, the root certificate which is the one appgw requires. My issue was due to the root certificate not being presented to appgw, and resulted in the error: "The root certificate of the server certificate used by the backend does not match the trusted root certificate added to the application gateway. Ensure that you add the correct root certificate to whitelist the backend". I had to add a directive in the webserver conf file to enable presentation of the full trust chain. Hope this helps.

Thanks! Failing endpoint is missing root CA as working one has it.

authors: EmreMARTiN dbiscontin einarasm krish-gh


text:
Visual studio instructions are outdated

I am using VS 2019 16.7.3. The instructions for the section named Enable Application Insights server-side telemetry (Visual Studio) appear to be outdated - starting with step 2 - there is no  Add Application Insights Telemetry option. Instead there is a Configure Application Insights option. The instructions don't seem to walk you through the current VS dialog from that point on.
One particularly confusing bit is that there are two options in the latest VS Dialog when you choose to configure app insights. There is an "SDK (Local)" option and one without. It would be nice to have clarification on what that is, as discussed in this stackoverflow question:
https://stackoverflow.com/questions/63569032/difference-between-application-insights-sdk-local-and-azure-application-insigh

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 4b88d8c4-0013-70aa-7997-a2203afd9743
Version Independent ID: 0ab99d5e-4ebd-8cb9-3d27-efe58def249f
Content: Azure Application Insights for ASP.NET Core applications - Azure Monitor
Content Source: articles/azure-monitor/app/asp-net-core.md
Service: azure-monitor
Sub-service: application-insights
GitHub Login: @mrbullwinkle
Microsoft Alias: mbullwin

@ryandleHEATR Thank you for bringing this to our notice , assigning this to our document author @mrbullwinkle to further review your feedback and update the document accordingly.

This article has been updated to address this issue.

#sign-off

#please-close

source: gharchive/issue

repo: MicrosoftDocs/azure-docs

license_type: permissive

license_source: github-api


text:
Table 5 - more attributes allowed (?)

Would it be possible also to support the use of attributes like msExchExtensionCustomAttribute1-15 together with the list mentioned in Table 5?

@AlexCesarini Thanks for your comment. Can you please share the document you are following so that I can assign it to respective team ?

@AlexCesarini Can you please provide the document  as requested in my previous comment?

Curious
I thought it was automatically linked to the document that is
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping#table-5-attributes-allowed-as-a-data-source-for-saml-nameid
Sent from Mailhttps://go.microsoft.com/fwlink/?LinkId=550986 for Windows 10
From: SwathiDhanwada-MSFTmailto:notifications@github.com
Sent: Wednesday 30 September 2020 11:53
To: MicrosoftDocs/azure-docsmailto:azure-docs@noreply.github.com
Cc: AlexCesarinimailto:alex_hawk03@hotmail.com; Mentionmailto:mention@noreply.github.com
Subject: Re: [MicrosoftDocs/azure-docs] Table 5 - more attributes allowed (?) (#63528)
@AlexCesarinihttps://github.com/AlexCesarini Thanks for your comment. Can you please share the document you are following so that I can assign it to respective team ?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/MicrosoftDocs/azure-docs/issues/63528#issuecomment-701287940, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AIXQ74WPODXF3WT4JZPAGTLSIL5YDANCNFSM4R632BKQ.

@AlexCesarini  Unfortunately no the  attributes from which you source the NameID and UPN values, and the claims transformations that are permitted, are limited.
Feel free to tag me in your response if you have any questions.


text:
Subscription and Resource IDs

Would it be possible to have this article indicate whether subscription IDs and resource IDs would remain the same during the transfer?
This was a major concern with having to do the manual resource migrations prior to this billing switch.
Thank you.

Document details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 3673197a-4414-5a4c-b717-3aaa7529c5ed
Version Independent ID: 4656d633-57a0-a8b8-29b9-5f5479c5e48a
Content: Get billing ownership of Azure subscriptions for Microsoft Partner Agreement (MPA)
Content Source: articles/cost-management-billing/manage/mpa-request-ownership.md
Service: cost-management-billing
Sub-service: billing
GitHub Login: @amberbhargava
Microsoft Alias: banders

@devan10 Thank you for your query, will be looking into it and get back to you at the earliest.

@amberbhargava  Can you please provide your insights on this and also update the document ?

We can clarify this in the article. @bandersmsft - can you help add FAQs for transfers. But yes, subscriptionID and resource id dont change.

@anuragdalmia @devan10 Updated the article to clarify, as Anurag requested.
#please-close

authors: BharathNimmala-MSFT SwathiDhanwada-MSFT anuragdalmia bandersmsft devan10


text:
STRING

Hi,
I automated the process from kaizala to sharepoint (data storing). Kaizala answer type multiple, picture, location require me to string (answerxx). The problem in sharepoint recorded with
YES

How to a avoid this, the actual answer is just YES.
thank you !
[Enter feedback here]

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 03aa9e88-7fa0-56ab-f794-58f0c37b6d7a
Version Independent ID: 25c5ef5c-6ba4-f5ff-f94b-8f2818ec2feb
Content: Reference guide for functions in expressions - Azure Logic Apps
Content Source: articles/logic-apps/workflow-definition-language-functions-reference.md
Service: logic-apps
GitHub Login: @ecfan
Microsoft Alias: estfan

@JayaChatterjee-MSFT Thank you for your feedback! We will review and update as appropriate.

@khairulizwar7 It looks like you are referring to some other document as I don't see any details mentioned in this on the issue that you are facing. Can you please share the document/steps that you have referred to/followed?

@khairulizwar7 Just following up here to see if you can share more details on the document that you have referred to.

@khairulizwar7 Since we have not heard back from you we will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly reopen the issue and continue the discussion.


text:
The CXWTOOL bot is closing issues that have not been abandoned by the opener

Its closing things that are awaiting response from any owner, member, or contributor.
Its the evil StaleBot/DockerDesktopBot reincarnated, and is community relationship destructive.

@StingyJack -
Thank you for your question.
Can you please share with us the URL of the document that you are having issues with?
Please note that we scope issues on this repo to feedback related to the docs. If you have a product question, please post it on Microsoft QnA or Stack Overflow. Thank you for your understanding.

Its not a document problem its a github-bot-closing-issues-incorrectly problem. Here are three recent closure examples.
https://github.com/MicrosoftDocs/azure-devops-docs/issues/3305#issuecomment-733305120
https://github.com/MicrosoftDocs/azure-devops-docs/issues/7468#issuecomment-733292626
https://github.com/MicrosoftDocs/azure-devops-docs/issues/7510#issuecomment-733292541

@StingyJack - I see that you have opened an issue in the DevOps Repo and looks like you are referring to issues in that repo. I hope you get the solutions for what you are looking for.
At this moment, Since there is no doc update required, We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

@MonikaReddy-MSFT   Yes I did open a duplicate*, but to be totally truthful, I only did that because you were trying to make me a victim of some checklist or policy on this issue report and avoid having to help. This is in addition to already being made a victim of the bug that's in the cxwtool.  Rather than get angry or indignant about your response or handling in the current issue, I've found its more productive for my purpose just to open a duplicate issue so that someone else will handle it. It clogs the system a bit, but what other options do I have?
This bug was also  present in the stalebot that was also stopped from being used for the same defect.
*Its a duplicate because the docs team owns both repos, and this an issue for the docs team and not for a specific article..

authors: MonikaReddy-MSFT StingyJack


text:
Parameter & Pipeline variables naming rules

This document is missing parameter and pipeline variable naming rules.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 65f81ce0-8915-2390-2c8e-53eb8a93180b
Version Independent ID: 49fb5956-019b-0f5a-ebff-1ae19fe87c80
Content: Rules for naming Azure Data Factory entities - Azure Data Factory
Content Source: articles/data-factory/naming-rules.md
Service: data-factory
GitHub Login: @dcstwh
Microsoft Alias: weetok

@kvijaianand - Thanks for your valuable feedback. I am moving it to content author to review.
@dcstwh - Can you please take a look?

@minhe-msft can you help to update the doc for this and include the naming rules for parameters and pipelines? Thank you.

Fixed by adding parameter and variable naming rules.
#please-close

authors: HarithaMaddi-MSFT dcstwh kvijaianand minhe-msft


text:
The status in HCM is never changed to connected

[Enter feedback here]
At the Hybrid Connection Manager section, I Had to do the step 7. It was to restart the local service, "Azure Hybrid Connection Manager Service". Otherwise, It will forever remain not-connected.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 645d01fc-eae4-67c0-ef63-77d34d854d5e
Version Independent ID: 516bc8a7-d927-d080-36a6-69ca95686feb
Content: Hybrid connections - Azure App Service
Content Source: articles/app-service/app-service-hybrid-connections.md
Service: app-service
GitHub Login: @ccompy
Microsoft Alias: ccompy

@takashiuesaka, Thanks for the feedback! We are taking a look into this and will get back to you soon.

@takashiuesaka, Thanks for the feedback! We are taking a look into this and will get back to you soon.

takashiuesaka, Your feedback has been shared with the content owner for further review. I have also raised a PR, once the PR is reviewed by the author and merged, the doc would have a note on this as appropriate I'll close this for now if you have any questions please just let us know.

authors: AjayKumar-MSFT takashiuesaka


text:
More details to open Tickets for paired Regions.

We are mentioning that for certain regions, customers need to create a ticket, but there is no guidance about which team to send to and it ends up going to wrong teams delaying the solution to the customers.
(*) Certain regions are access restricted to support specific customer scenarios, for example in-country disaster recovery. These regions are available only upon request by creating a new support request in the Azure portal.
Can we give more details to our customers about the details on how to fill out the ticket support request?
Regards,
Carlos Prazeres
MS alias: capraz.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 09a788e4-0130-73f2-d985-6fc3aec77974
Version Independent ID: a9f4ec3f-f0a3-b050-020b-f487c74c5179
Content: Ensure business continuity & disaster recovery using Azure Paired Regions
Content Source: articles/best-practices-availability-paired-regions.md
Service: multiple
GitHub Login: @martinekuan
Microsoft Alias: martinek

@capraz19 Thank you for your feedback! We have assigned this issue to the author to review further and take the next course of action.

Certain regions are access restricted to support specific customer scenarios, such as in-country/region disaster recovery. These regions are available only upon request by creating a new support request.
Thank you!
#please-close

authors: anaharris-ms capraz19 mike-urnun-msft


text:
Article dates are misleading

[Enter feedback here]
A consistent issue with B2C documentation is trying to find documentation that is up to date and relevant given there have been so many changes over the last couple of years ... one of the big problems is you don't show the created date for an article (probably showing last updated?)
So I see this article posted here (23rd Nov 2020)

I go here and it says 25th Oct 2021

If i had come direct then I would think this was hot of the press... which it isn't...

Document details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: b98f5208-e200-8174-533f-e8efae372a99
Version Independent ID: 02e5fff0-f572-034c-a337-8b608b29d8cc
Content: Set up the local account identity provider - Azure AD B2C
Content Source: articles/active-directory-b2c/phone-authentication-user-flows.md
Service: active-directory
Sub-service: b2c
GitHub Login: @kengaderdus
Microsoft Alias: kengaderdus

@72gm
Thanks for your feedback! I've assigned this issue to the author who will investigate and update as appropriate.

@72gm Thank you for your feedback. What you see in the Azure portal, the date, is just an announcement when that feature was released e.g. for public preview or general availability. The one you see (date) in docs.microsoft.com is one when the article was updated. Nevertheless, we understand your confusion and we'll do a better job to ensure that does not happen.
#please-close

authors: 72gm JamesTran-MSFT kengaderdus


text:
Static Web App .. API route "Allowed Roles" is not allowing authenticated users to access the function API

This is a continuation of this issue.  I am creating a new issue because a contributor closed the issue and I cannot reopen as asked if needed to.   GitHub Issue #82900.  the other issue had tangents and misconceptions more simplified to just work off of this issue.
===============================================================
My Setup (trying to give as much high level setup as possible)

Static Web App :  Building from GitHub Actions- repository is a Blazor App
Blazor App - Client Side Only ( not a Blazor Server app !!)
Blazor App - Uses Azure AD and MSAL for Authentication.  Can successfully log in and can verify user is in desired roles.
Static Web App: Has Bring Your own Function option hooked up to my own function with 2 Test functions ( ViewSecretTest, and PublicTest )

===============================================================
Both functions can initially be accessed, and are public.
Anyone logged in via MSAL to the blazor app... Or... not logged in can access both functions ( ViewSecretTest and PublicTest)
I want to try and lock down one of the two Functions ( api/ViewSecretTest)
So that only a Logged In User with a certain role can access the "api/ViewSecretTest"
===============================================================
Going to   "staticwebapp.config.json" file.  I add the following code.
"routes": [
    {
      "route": "/api/ViewSecretTest",
      "allowedRoles": [ "authenticated", "AdminSystem" ]
    }
  ],

===========================================================
api/Public Test behaves the same.  Logged in Users or non-logged in people can access the "api/PublicTest" as expected.
The problem I am having is...
"api/ViewSecretTest" is locked down for everybody... even logged in users that can be verified as   userInRole("AdminSystem")=true

@mkarmark , @RyanHill-MSFT  (and @anthonychu )
You two helped me get most of the way there in the other issue 82900.
And.. the problem is simpler than described in that issue.
But the core issue is the same. I cant access a locked down API despite the logged in user being in the necessary role.
the one glaring possibility i can see... and i hope this helps rather than cloud the issue..
but When a user logs into Blazor WASM with AAD/MSAL.
the code   user.IsInRole("AdminSystem") will = false.
even though there is a claim that shows
RolesClaimString:  ["AdminHLCGroups","AdminApp","HLCGroupMember","AdminSystem"]
so following other examples and other issues
I needed to do some code to splice that list, add one per role, and set the role claim manually by doing the following AccountClaimsPrincipalFactoryEx.
// Add MSAL Authentication for Active Directory
builder.Services.AddMsalAuthentication(options =>
{
    builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
    options.ProviderOptions.DefaultAccessTokenScopes.Add("https://graph.microsoft.com/User.Read");
    options.ProviderOptions.DefaultAccessTokenScopes.Add("openid");
    options.ProviderOptions.DefaultAccessTokenScopes.Add("offline_access");
    options.UserOptions.RoleClaim = "role"; // need this to specify claims 'role' instead of 'roles'

}).AddAccountClaimsPrincipalFactory<AccountClaimsPrincipalFactoryEx>();

Notice above the AccountClaimsPrincipalFactoryEx
Also notice we have to set the RoleClaim to be the "role" i am setting in the factory.

 public class AccountClaimsPrincipalFactoryEx : AccountClaimsPrincipalFactory<RemoteUserAccount>
    {
        public AccountClaimsPrincipalFactoryEx(IAccessTokenProviderAccessor accessor) : base(accessor)
        {
        }

        public async override ValueTask<ClaimsPrincipal> CreateUserAsync(RemoteUserAccount account, RemoteAuthenticationUserOptions options)
        {

            var user = await base.CreateUserAsync(account, options);

            // if user is already authenticated return
            if (!user.Identity.IsAuthenticated)
                return user;

            // make a list of the 'roles' AD provides
            var rolesClaimString = ((ClaimsIdentity)user.Identity).FindFirst("roles").Value;
            Console.WriteLine($"RolesClaimString:  {rolesClaimString}");
            List<string> claimsListStrings = rolesClaimString.Split(',').ToList();

            foreach (string roleString in claimsListStrings)
            {
                string cleanNameRoleString = Regex.Replace(roleString, "[^A-Za-z0-9]", ""); // Needed to clean string of nonalpha chars
                if (String.IsNullOrWhiteSpace(cleanNameRoleString))
                    continue;

                // add the role name to the current user
                ((ClaimsIdentity)user.Identity).AddClaim(new Claim("role", cleanNameRoleString));
                Console.WriteLine($"UserRole: {cleanNameRoleString}");
            }

            return user;
        }

    }

================================
After I do all that... then... and only then will the user.IsInRole("AdminSystem") = true.
but I'm suspecting that has something to do with the user not actually being in the role from the point of view of the Static Web App magic controlling the security locked down for    api/ViewSecret
I guess in that case it would be on the MSAL/Blazor Issue...
but I do not feel like i have enough ammo to make that case there.
Can you help connect the dots if it indeed needs to be in their side?
What kind of logging or tests do you need me to do to root out the issue why the StaticWebApp is not allowing access to a route when the user is in the Role specified?

@John-HLC Thank you for reaching out!
@RyanHill-MSFT FYI

Thanks @SadiqhAhmed-MSFT.
@John-HLC I'll reach out to @mkarmark to see what your issue may be. Also, apologies that you couldn't reopen the issue. I'll check to see what's going on with that as well.

No worries Ryan - i took the month off moving everything to VS 2022 and getting Hot Reload and .NET 6 working.. Besides that other thread is polluted with my misconceptions on being new to Static Web App.

@RyanHill-MSFT
Saw something thought i'd ask on..
Today my "bring your own function" is using Azure Functions version 3.x with a target framework of .Net Core 3.1.
After reading this article by @anthonychu Azure Static Web Apps - Full stack on .net 6, I am wondering if I need to update my "bring your own function" to a target Framework of .NET 6, and Function Version 4.x, to solve the setup I'm trying to do.

Static Web apps + Blazor WebAssembly (clinet only) + MSAL + Azure Functions.

By having version 3.x + .net core 3.1 i'm wondering if that might be the cause for the MSAL authentication + routing function apis not working to allow authenticated users to call the function.

Hi @John-HLC, glad to hear you got some time off. I'm sure it was much needed.
In response to your question, MSAL shouldn't be framework dependent. Unless you're utilizing an MSAL feature that is dependent on .NET 6 API set.
What errors are you getting?

@RyanHill-MSFT  - I updated to .NET 6.. and as you said no change.
Thank you for checking in on this every now and then but I've been trying this now for 3 months (since mid October).  I'm about to scrap the whole Static Web App thought and go back to standard hosting in a classic storage account.
I'm thinking it might be a good idea to update the documentation saying Static Web Apps are NOT recommended for Blazor Client side only + AD logging in with MSAL + Bring your own function.... because the function cannot be secured correctly... without locking out everyone (even verified AD users trying to login with MSAL) out of the specified api route.
It has been since mid-October since first started trying to find a solution for this to get it to work.
Sooo close dont want to give up on Static Web Apps.  I want this to work.

Static Web app (works)
With Blazor Client Side Only App (works)
Bring your own function (works)
Locking down the function (does not work)..
Problem with number 4 above is that in trying to lock down the api using a route as shown below..

staticwebapp.config.json
-------------------------
"routes": [
    {
      "route": "/api/ViewSecretTest",
      "allowedRoles": [ "authenticated", "AdminSystem" ]
    }
  ]

Then the function being locked down by is not accessible from a verified MSAL logged in AD user in role "AdminSystem".  Result is a 401 Unauthorized when calling the function from the Blazor Client Side Only app and a logged in MSAL user.  If you notice logging below screen shot indicates my user logged in via MSAL in AD is part of AdminSystem role, but still get the 401 Unauthorized when trying to access api/ViewSecretTest.   If i take off the route above, i can access it no problem.

Is there any way we can connect on Teams for 10 min..  so you can verify this, and bump up the priority to a bug or update documentation to exclude this setup from recommended Static Web Apps?
I keep staring at this part of the documentation,
Bring your own functions to Azure Static Web Apps - part about security
and I think either the documentation needs to be more explicit, or it does not work for the App Stack I'm trying and needs to be updated excluding Blazor Client Side Only + AD/MSAL authentication.

@John-HLC Did you solve this?  I was having a similar problem and found your posts while searching for a solution.  What I concluded was that MSAL (at least using the package as described in https://docs.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/standalone-with-azure-active-directory?view=aspnetcore-6.0 or similar) does not work with Blazor WASM + Azure SWA.  I'm just using the SWA managed function, so I'm not sure about the issues bring-your-own function might bring, but I was having exactly the same experience you were having, even with the managed Function.
Try this:

Go to <your site>/.auth/me  (on the real SWA site, not on your dev machine) and see if you see anything for the clientPrincipal object.  In my case I did not, whether I was supposedly logged in or not (via my login button).  I was baffled because according to https://docs.microsoft.com/en-us/azure/static-web-apps/user-information?tabs=javascript, the contents of /.auth/me was supposed to be related to whether I was logged in or not.

Go to <your site>/.auth/login/aad and log yourself in that way.  Now try going to <your site>/.auth/me  again.  In my case I now saw an object with the correct roles.  If I logged in or out using the login button on my site, which was using MSAL per the instructions, it had no effect on what I saw in /.auth/me.

This also meant that if I made a routing rule for my Function restricting access to a certain role it would just block everyone because no user had any roles according to the SWA framework i.e. /.auth/me.
It turned out that the MSAL method in the instructions was apparently not using the SWA authentication scheme.  When I changed it to be more similar to https://anthonychu.ca/post/blazor-auth-azure-static-web-apps/ (get rid of MSAL and instead use his custom provider, and make the Login button navigate to /.auth/login/aad and logout to /.auth/logout) the behavior completely changed.
I had made a "Profile" page (as suggested here: http://www.mattruma.com/adventures-with-blazor-accessing-claims-in-a-razor-page/) that showed me what the app thought the user info was based on using my login button per the MSAL instructions -- though it sounds like you already have your own version of this.  After I switched to using the "/.auth" paths, that profile now showed me what I expected -- roles = authenticated and anonymous, and it was consistent with what /.auth/me showed, and my routing controlling access based on role finally worked as I expected.
I might be off base but I had a really hard time figuring out that the MSAL samples weren't going to work with Static Web Assembly.  I thought Anthony Chu's post from July 2020 when this was barely supported was obsolete, but it wasn't!  I hope at some point they will make an official sample/template showing Blazor WASM + SWA + authentication that actually works!
I would suggest that to narrow this down (if you haven't solved it already), you should create a SWA using a managed function following the instructions here: https://docs.microsoft.com/en-us/azure/static-web-apps/deploy-blazor.  Then tweak it to enable authentication in the way described here: https://anthonychu.ca/post/blazor-auth-azure-static-web-apps/ . (I didn't include support for github or anything else -- just made a login button that directly went to .auth/login/aad.)  Then see if protecting /api/* via routing for role = authentication works.  If this works then you can figure out how to change it to work with bring-your-own-function.

@RyanHill-MSFT  -   After careful analysis - I have narrowed this down this to a more specific/simplified scope.  And created a new issue request for clarification over on this issue  #85886 .   If we can pick up there, we can close this one out.  I think that issue #85886 is the root cause of my needs on this thread.

authors: John-HLC RyanHill-MSFT SadiqhAhmed-MSFT mkb13


text:
Cannot add IP for azuresigntool beause there is no Access Restrictions thing under Networking

There is no access restrictions under _networking.
The documentation does not match what is actually on the screen -- presumably it is out of date?

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: d90bbf62-44f9-30a6-d6ea-bbf776f6efc5
Version Independent ID: b3961eac-6c70-b345-f48c-e4c0ec67059c
Content: Azure App Service access restrictions - Azure App Service
Content Source: articles/app-service/app-service-ip-restrictions.md
Service: app-service
GitHub Login: @madsd
Microsoft Alias: madsd

Hi @rwb196884 you are right, you have to select the specific web app/function app that you want to add an access restriction to first. I'll take a note to add that step. Thank you.


text:
FAQ Q4 answer is no longer correct.

Q4 answer states:
Q: Can I enable single sign-on for only a subset of my Google Cloud / G Suite Connector by Microsoft users?
A: No, turning on single sign-on immediately requires all your Google Cloud / G Suite Connector by Microsoft users to authenticate with their Azure AD credentials. Because Google Cloud / G Suite Connector by Microsoft doesn't support having multiple identity providers, the identity provider for your Google Cloud / G Suite Connector by Microsoft environment can either be Azure AD or Google -- but not both at the same time.
However, this is no longer correct since SSO profiles can be selected per User, Organisational Unit or Group.

This is obviously beneficial to avoid scenarios where either Azure AD authentication is broken, potentially preventing Super Administrators from logging in, or where different Users, OUs or Groups require different Identity Providers.
In the example below I have a group defined in Google Workspace for which the SSO profile is "none". This prevents members of this (Google Workspace group) from being redirected to Azure AD for logon.

Thanks

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 3fdf59c4-653e-956e-d675-f7e17ed7d488
Version Independent ID: 57b9c048-a938-6e21-633b-e0aabdd59946
Content: Tutorial: Azure AD SSO integration with Google Cloud / G Suite Connector by Microsoft
Content Source: articles/active-directory/saas-apps/google-apps-tutorial.md
Service: active-directory
Sub-service: saas-app-tutorial
GitHub Login: @jeevansd
Microsoft Alias: jeedes

The document was updating with suggested changes.
#please-close

authors: lwsrbrts v-hgampala


text:
"Could not find the Database Engine startup handle" error occur when create SQL Server FCI

Dear admin,
I follow the steps to create a SQL Server FCI with cloud withness these days, but always meet "Could not find the Database Engine startup handle" at the end of the sql server failover cluster installation process, I found the steps were rather simple and don't contain any precaution or requisite in the whole install process, so I can't find solution at all, I also searched over internet for answer but unlucky.
Could you have a look if there's something missing in the doc?
Thank in advance.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 7eeec4bb-b3a7-a307-eced-05bc90339e35
Version Independent ID: df847802-e088-29b9-98d0-0eb4e1da54b9
Content: Create an FCI with a premium file share - SQL Server on Azure VMs
Content Source: azure-sql/virtual-machines/windows/failover-cluster-instance-premium-file-share-manually-configure.md
Service: virtual-machines-sql
Sub-service: hadr
GitHub Login: @adbadram
Microsoft Alias: adbadram

@descartes123
Thanks for reaching out. We will look into this and update you.

Hi @descartes , I tried to look for similar issues across our forums and here is something that might be relevant for your case - stackoverflow.com/questions#44398787. Do let me know if this helps.
We used the azure-docs repository for driving documentation improvements. This query requires troubleshooting, so I would recommend you to post the query on our community forums with the appropriate tag.
https://docs.microsoft.com/en-us/answers/topics/25398/azure-sql-database.html
https://stackoverflow.com/questions/tagged/azure-sql-database
You can add additional tags there as per your requirement.
I am closing out this issue for now. Feel free to reach back incase you want us to make any documentation changes here. Thank You.


text:
Old image at "3. On the Network Connections page, select +Create."

The image on the page at '3. On the Network Connections page, select +Create' is not the same as now it's on the portal. Please replace it with the latest one. See the left side of the picture. Thanks.
[Enter feedback here]

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 164e9763-3194-ec2b-8e67-fa7b46bc6bb0
Version Independent ID: 8dcee57b-ca74-72df-cf65-4cbae62af8ad
Content: Configure the Microsoft Dev Box service
Content Source: articles/dev-box/quickstart-configure-dev-box-service.md
Service: dev-box
GitHub Login: @RoseHJM
Microsoft Alias: rosemalcolm

Thank you @sakaldeepyadav, I will get the image updated.

I've updated the image, so I'm closing this issue.
Thanks again @sakaldeepyadav!

@YashikaTyagi-MSFT - could you close this issue please?

#please-close

authors: RoseHJM sakaldeepyadav


text:
Update infinitecampus-tutorial.md

Clarify source of value used when configuring Campus.  Added indication of need to update "Optional Attribute Name" in Campus to match AAD attribute name. Clarified Campus permissions needed to carry out procedure.  Clarified possible source of SP Metadata.

@martinbherbener : Thanks for your contribution! The author, @jeevansd, has been notified to review your proposed change.

This article does not require any next steps, so I have not added it. SaaS app tutorials are not TOC integrated.
Our toc is here: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-tutorial-list
#sign-off

source: gharchive/pull-request

authors: PRMerger14 jeevansd martinbherbener


text:
Fixed inconsistencies in ILB ASE instructions

Fixed inconsistencies in the App Service Environment step-by-step instructions which might otherwise confuse your readers.

@AzureMentor : Thanks for your contribution! The author, @ccompy, has been notified to review your proposed change.

@ccompy  Please review PR and merge.  Thanks!

@ccompy Please review merge this PR. Thanks!

@ccompy @rjagiewich  Please review and merge this PR. Thanks!

@rjagiewich  Thanks for the suggestion but we have removed the need to set a self signed cert and thus the entire section you submitted the request for.  I really appreciate the contribution and beyond the current updated form of the doc, I am putting out additional changes to reflect the updated UI.

@ccompy - it seems like this PR can be closed. Is that correct? If so can you add - #please-close ?
If not, provide other guidance for this PR:

#sign-off if it's ready to merge
#hold-off if it requires changes before it's ready for sign off

Thanks!

@AzureMentor - Thanks for your contribution. The article was recently updated. The section that you update in your pull request no longer exists. We'll close the PR. Thanks.

authors: AzureMentor Jak-MS PRMerger16 ccompy ktoliver


text:
add note to third party app section of AAD Connect attribute list

Add a link to the SaaS app tutorials, so that customers are aware that if they are synchronizing for in Azure AD Connect for use with 'third party application's they won't get all the attribute mappings they need for popular third party applications - they'll likely need to add more.

@markwahl-msft : Thanks for your contribution! The author(s) have been notified to review your proposed change.

#sign-off

authors: PRMerger7 billmath markwahl-msft


text:
Change MSAL version recommended to v2.+

We have moved major versions with a few changes.  These don't impact the samples,
but it would be good to recommend consistent versions.

@AdamBJohnsonx : Thanks for your contribution! The author(s) have been notified to review your proposed change.

LGTM, thanks @AdamBJohnsonx.
Quick heads-up - since you're MSFT-internal, this PR might get kicked back by the PR review team instructing you to open one instead in the private repo, MicrosoftDocs/azure-docs-pr.
For making quick edits like this in the private repo, I highly recommend this plugin for Chrome/Edgium: https://aka.ms/spineedit - makes is suuuper quick and easy.
#sign-off

authors: AdamBJohnsonx PRMerger13 mmacy


text:
Update device-update-raspberry-pi.md

The agent built into the demo base image seems to have been built with ADUC_CONF_FILE_PATH=/adu/adu-conf.txt causing the agent to look for its config file in /adu/adu-conf.txt.
However, the steps described in this documentation page lead to write the agent config file in /home/root/adu-conf.txt.

@mbenabda : Thanks for your contribution! The author(s) have been notified to review your proposed change. @valls

Can this be closed? These changes are already live now.

authors: PRMerger13 ValOlson mbenabda


text:
Include script to enable SSE+CMK for existing VMSS

Currently there is no document available on how to enable SSE+CMK for existing VMSS. Tested the script and confirmed its working. Kindly check and approve it. FYR - https://github.com/MicrosoftDocs/azure-docs/issues/72294

@samueljamkhandi-MSFT : Thanks for your contribution! The author(s) have been notified to review your proposed change.

@samueljamkhandi-MSFT Thanks for adding this and helping to improve our docs, we appreciate it!
I've shown this to the product team and they've signed off, so I'll sign off here, as well.
#sign-off

@roygara thank you!

authors: PRMerger9 roygara samueljamkhandi-MSFT


text:
Update js sample to fit all 8-channel wav format

Update JS sample to fit all 8-channel wav format

@jimxieJ : Thanks for your contribution! The author(s) have been notified to review your proposed change.

#sign-off

authors: PRMerger3 PatrickFarley jimxieJ


text:
An update to index-overview.md

Minor grammar error fixed "is will" to "will". Line 176

@tatemi29q : Thanks for your contribution! The author(s) have been notified to review your proposed change.

@tatemi29q Looks good; thanks.
Publishing in this repository is suspended until Tuesday, November 2. Merging will resume Tuesday morning, and we'll merge this approved pull request at that time. Thanks.


text:
Typo "Azure Database for Postgres"→"Azure Database for PostgreSQL"

https://docs.microsoft.com/en-us/azure/azure-arc/data/what-is-azure-arc-enabled-postgres-hyperscale
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/azure-arc/data/what-is-azure-arc-enabled-postgres-hyperscale.md
#PingMSFTDocs

@hyoshioka0128 : Thanks for your contribution! The author(s) have been notified to review your proposed change.


text:
quickstart-python fails with read-only key

https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/azure-app-configuration/quickstart-python.md fails to work with a read-only key. There may be other examples. It's difficult to adhere to the guideline of using the least privilege possible when re-using the same included instructions in many different contexts.

@sbonds : Thanks for your contribution! The author(s) have been notified to review your proposed change.

@maud-lv - Can you review this old PR and determine whether it needs to be closed or merged?
IMPORTANT: When the changes are ready for publication, add a #sign-off comment to signal that the PR is ready for the review team to merge.

Hi @ShannonLeavitt , I checked this file again, and since the user reported this issue, the file has been updated. It doesn't mention using a read-only key anymore so I'm not expecting users to have this issue again. Thank you @sbonds for suggesting this update and sorry for the delay in getting back to you.

Closing this PR per @maud-lv's comment.


text:
b2c-support added info for displayname

Added the following <> characters not allowed for Displayname.

Learn Build status updates of commit e5e67e1:
:warning: Validation status: warnings

File
Status
Preview URL
Details

articles/active-directory-b2c/user-profile-attributes.md
:warning:Warning

Details

articles/active-directory-b2c/user-profile-attributes.md

Line 1, Column 1: [Warning: ms-date-missing - See documentation] Missing required attribute: 'ms.date'. A freshness date is required for this content set. Add a date in format MM/DD/YYYY.
Line 1, Column 1: [Warning: ms-topic-missing - See documentation] Missing required attribute: 'ms.topic'. Add a valid value to indicate the article type.
Line 1, Column 1: [Warning: author-missing - See documentation] Missing required attribute: 'author'. Add the current author's GitHub ID.
Line 1, Column 1: [Warning: title-missing - See documentation] Missing required attribute: 'title'. Add a title string to show in search engine results.
Line 1, Column 1: [Warning: ms-author-missing - See documentation] Missing required attribute: 'ms.author'. Add the current author's Microsoft alias.
Line 1, Column 1: [Warning: ms-prod-or-service-missing - See documentation] One of the following attributes is required: 'ms.prod', 'ms.service'. Use ms.prod for on-premise products, or ms.service for cloud services.
Line 14, Column 1: [Warning: yaml-header-syntax-error] While parsing a block mapping, did not find expected key.
Line 1, Column 1: [Suggestion: description-missing - See documentation] Missing required attribute: 'description'.

For more details, please refer to the build report.
If you see build warnings/errors with permission issues, it might be due to single sign-on (SSO) enabled on Microsoft's GitHub organizations. Please follow instructions here to re-authorize your GitHub account to Learn Build.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.
For any questions, please:Try searching the learn.microsoft.com contributor guidesPost your question in the Learn support channel

@kengaderdus

Can you review this PR?
IMPORTANT: When this content is ready to merge, you must add #sign-off in a comment or the approval may get overlooked.

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

Learn Build status updates of commit cead186:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

articles/active-directory-b2c/user-profile-attributes.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching the learn.microsoft.com contributor guidesPost your question in the Learn support channel

Learn Build status updates of commit cead186:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

articles/active-directory-b2c/user-profile-attributes.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching the learn.microsoft.com contributor guidesPost your question in the Learn support channel

#sign-off

Learn Build status updates of commit 01de97f:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

articles/active-directory-b2c/user-profile-attributes.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching the learn.microsoft.com contributor guidesPost your question in the Learn support channel

Due to the upcoming Ignite conference, all merging and publishing is on hold until the morning of October 12.
This PR is ready for merge on 10/12.
This repo is in lockdown for content freeze. If you need to make additional changes to these files, please submit your changes a new PR.
#label:"event-triaged-to-10AM"


text:
Update update-cluster.md

Update-ClusterFunctionalLevel does not require the parameter  = 'true' and should be ran as-is or it will error out in PowerShell.

@JasonGerend
Can you review the proposed changes?
When the changes are ready for publication, add a #sign-off comment to signal that the PR is ready for the review team to merge.
#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

repo: MicrosoftDocs/azure-stack-docs


text:
Documentation of the process taken by the Deploy BizTalk Application pipeline task should be more specific for cases of multiple machines

The documentation at https://docs.microsoft.com/en-us/biztalk/core/feature-pack-add-build-release-definitions does not specify what happens if the Group contains multiple computers. It should also be more explicit about the differences between the three options, as this is not very clearly explained.

@TWolverson You are correct. If you have any additional information to add, it's very welcome. Currently, we have no plans to expand our guidance using VSTS. If you find another resource, such as a VSTS link, we can also add that. Just something to consider in case you have more information.

authors: MandiOhlinger TWolverson

repo: MicrosoftDocs/biztalk-docs


text:
Possible missing part in Scenario 4 diagram

[Thanks for this nicely written document, although it seems that one part is missing within scenario 4  in the diagram. And it is the illustration of vWAN, as it is multiple times referred within this part. I am looking forward to getting your opinion about it. Regards Navisa Saddadi]

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 3ae25fd8-2bb8-0f5c-6f84-b2868862b37b
Version Independent ID: 3ae25fd8-2bb8-0f5c-6f84-b2868862b37b
Content: Enterprise-scale example architectures connectivity to Azure VMware Solution - Cloud Adoption Framework
Content Source: docs/scenarios/azure-vmware/example-architectures.md
Service: cloud-adoption-framework
Sub-service: scenario
GitHub Login: @sablair
Microsoft Alias: janet

Hi @nsaddadi
Sorry for the delay.
The document has changed a lot since the issue was reported. The scenario was deleted
I will close the ticket, but feel free to open a new one if you still have concerns.

authors: nsaddadi v-fearam

repo: MicrosoftDocs/cloud-adoption-framework


text:
Visual C++ 17.0 has unlimited string literals

I believe this was changed while fixing https://developercommunity.visualstudio.com/t/1437715
@cdacamar knows for sure.

@fsb4000 : Thanks for your contribution! The author(s) have been notified to review your proposed change.

Docs Build status updates of commit a0b62f1:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

docs/cpp/string-and-character-literals-cpp.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching the docs.microsoft.com contributor guidesPost your question in the Docs support channel

@corob-msft
Can you review this PR?
IMPORTANT: When this content is ready to merge, you must add #sign-off in a comment or the approval may get overlooked.
#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

There are two independent feedback issues we fixed to address the string size limitation:
https://developercommunity.visualstudio.com/t/__FUNCTIONW__-cannot-handle-long-names-a/1425758
https://developercommunity.visualstudio.com/t/Long-literal-char-arrays-are-not-interpr/1374615
In both cases, after 17.0, the compiler has no limitation on string length emission.  The only remaining limitation is in how large of a string literal the preprocessor can handle--which is not currently documented.

@corob-msft : Thanks for your contribution! The author(s) have been notified to review your proposed change.

Docs Build status updates of commit 1020b7b:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

docs/cpp/string-and-character-literals-cpp.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching the docs.microsoft.com contributor guidesPost your question in the Docs support channel

Docs Build status updates of commit 1020b7b:
:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

docs/cpp/string-and-character-literals-cpp.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: Broken links written as relative paths are included in the above build report. For broken links written as absolute paths or external URLs, see the broken link report.
For any questions, please:Try searching the docs.microsoft.com contributor guidesPost your question in the Docs support channel

Great! Thanks!

repo: MicrosoftDocs/cpp-docs


text:
Where does  new UserAssertion(customerAadWebApplicationToken)).GetAwaiter().GetResult(); come from?

I cannot see where the variable  customerAadWebApplicationToken comes from in:
new UserAssertion(customerAadWebApplicationToken)).GetAwaiter().GetResult();

Could you please elaborate, or am I missing something obvious? If so, apologies.
Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: ee89d0d7-becd-83f4-b862-f39b1c1ad6d4
Version Independent ID: d40d3446-9677-dbdc-faa9-f04a30ffb042
Content: Kusto authenticate with AAD for access - Azure Data Explorer
Content Source: data-explorer/kusto/management/access-control/how-to-authenticate-with-aad.md
Service: data-explorer
GitHub Login: @orspod
Microsoft Alias: orspodek

The sample has a title "Step 2: Perform token exchange in your server code", which indicates this is the token your web app receives for the logged in user.

@vladikbr Thanks for responding. We've submitted a documentation change based on your information, and the updated article should be live by tomorrow.
@bobbytreed If you need to follow up on this issue, leave us a comment with an @mention
#please-close

authors: bobbytreed shsagir vladikbr

repo: MicrosoftDocs/dataexplorer-docs


text:
Question regarding Generate test user request in integration with MTD for VAT (UK)

Good day,
I was trying to Generate a test user request and received the text file as in the document. However, as per the attached image, in my text file I was unable to find any UserID or password or VRN. I tried to go through all the set-up again but still unable to find them. Can somebody please enlighten me? I really appreciate.
image

@LyD001, thanks for contacting us. Unfortunately, we're unable to handle Support requests for the product here. To contact Support, consider one of the options described here: Support contact options. In particular, you might want to go to the Dynamics 365 community page to get help with your questions from the Dynamics community.


text:
"Match all price groups"-feature is not mentioned in the discount documentation

Hi,
This article doesn't yet contain information regarding the "Match all price groups" feature:

Can you please add this to the article?
Thanks and best regards,
Florian

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: aa683505-0769-81b1-0f59-ece418a52f82
Version Independent ID: 3eb28e2d-7329-c35a-fd9d-190d83cf4f40
Content: Define channel-specific discounts - Commerce | Dynamics 365
Content Source: articles/commerce/define-channel-specific-discounts.md
Service: dynamics-365-commerce
Product: ****
Technology: ****
GitHub Login: @scott-tucker
Microsoft Alias: scotttuc

@josaw1, please review.

Hi @mueckeflo -- you can find the information you requested in the topic Retail discounts. Thanks.

authors: josaw1 mueckeflo tonyafehr


text:
Further ahead

[Enter feedback here]
Hi, please could you publish more dates, our customers need to plan the next 12 months and we only have the next 6 months listed. Even if they are subject to change.
thanks

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: e7dcb285-f32c-c92e-fe49-1617f213066b
Version Independent ID: 8f28c1a0-9da5-f853-90ee-d82a4c32df7e
Content: Service update availability - Finance & Operations | Dynamics 365
Content Source: articles/fin-ops-core/fin-ops/get-started/public-preview-releases.md
Service: dynamics-365-cross-app
Product: ****
Technology: ****
GitHub Login: @hmahl
Microsoft Alias: hmahl

Bug 834384 has been logged to address this issue.

@jimwillsher, thank you for your feedback. This article has been updated.

authors: bishalgoswami jimwillsher twheeloc


text:
Error "The token does not contain valid algorithm in header" when setting up a new application

Following all steps from section "Set up a new application and certificate registration" I still get the error "You are not authorized to connect to 'mydomain.sharepoint.com'" on Document management parameters form and error "The token does not contain valid algorithm in header" in event log. We have customers with the same problem, so it seems the issue is general.

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: e1024bd5-7dcd-8666-1198-9ab7813bfd66
Version Independent ID: e1024bd5-7dcd-8666-1198-9ab7813bfd66
Content: Secure one-box development environments - Finance & Operations | Dynamics 365
Content Source: articles/fin-ops-core/dev-itpro/dev-tools/secure-developer-vm.md
Service: dynamics-365-cross-app
GitHub Login: @mnordick
Microsoft Alias: mnordick

@mihavuk,  thanks for contacting us. Unfortunately, we're unable to handle Support requests for the product here. To contact Support, consider one of the options described here: Support contact options. In particular, you might want to go to the Dynamics 365 community page to get help with your questions from the Dynamics community.

The instructions on this page are wrong or insufficient. I have talked with different people and no-one managed to establish SharePoint connectivity. If it is out of you scope then just add a note on the page that it does not work.

authors: mihavuk twheeloc


text:
Timestamp-Link correct?

Hi,
doesn't the timestamp-link has to begin with "http" instead of "https"? Most tools (e.g. Set-AuthenticodeSignature") explicitly expect "http" in the Url.

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 21426684-ae01-f266-f21c-065bb2499692
Version Independent ID: c8058293-0160-a4cf-6706-f904349eb194
Content: Signing an APP Package File - Business Central
Content Source: dev-itpro/developer/devenv-sign-extension.md
Service: dynamics365-business-central
GitHub Login: @SusanneWindfeldPedersen
Microsoft Alias: solsen

Hello, thanks for catching this. Yes, it should be http instead of https - and is probably due to a global search and replace. Thanks, the topic will be fixed with the next refresh.


text:
Create customerPayments - URL on Request Example is wrong

Hi, the URL showing under the Request example is wrong. It reads:
POST https://{businesscentralPrefix}/api/v2.0/companies({id})/customerPayment
It should read:
POST https://{businesscentralPrefix}/api/v2.0/companies({id})/customerPayments
If you use the URL on the current example, you run into the following error message:
"message": "No HTTP resource was found that matches the request URI 'https://api.businesscentral.dynamics.com/v2.0/Production/api/v2.0/companies({companyId})/customerPayment?tenant=msft1a6720t22590909&aid=FIN'."
Rgds.

Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

ID: 3f2f3e63-0613-e710-4fac-029012b3fc29
Version Independent ID: 73c05b65-a95b-8286-8e52-acea522d5bc7
Content: Create customerPayments - Business Central
Content Source: dev-itpro/api-reference/v2.0/api/dynamics_customerPayment_create.md
Service: dynamics365-business-central
GitHub Login: @SusanneWindfeldPedersen
Microsoft Alias: solsen

Thanks for catching this. Will be fixed with the next refresh of the docs.

This was closed but never fixed. Is it still tracked to be fixed? Otherwise, I'll just stop reporting documentation issues. Tks.

authors: SusanneWindfeldPedersen markborges


text:
Branding update

Updated to use the new "Partner Center" branding. (TOC should ideally be updated to match topic title)

:white_check_mark: Validation status: passed

File
Status
Preview URL
Details

microsoft-edge/extensions/guides/packaging/extensions-in-the-windows-dev-center.md
:white_check_mark:Succeeded

For more details, please refer to the build report.
Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.

Thanks @JnHs !

authors: JnHs erikadoyle opbld30

repo: MicrosoftDocs/edge-developer


text:
Typo Error in your Azure Learn website

Link to article:
https://docs.microsoft.com/en-us/learn/modules/tour-azure-services-and-features/2-tour-of-azure-services
Problem:
I was learning Azure via Microsoft Learn and came across a documentation error where it says
"Azure Database for MariaDB" is a "Fully managed and scalable MySQL relational database". This is misleading and causes confusion. Should it not be "Fully managed and scalable MariaDB" ?
If I am wrong, please correct me.

@manickmalai This issue is fixed. Can you double check?

authors: Powerhelmsman manickmalai

repo: MicrosoftDocs/feedback


text:
[VS Code] Starting collaboration session: Zero root directories specifiedParameter name: RootDirectories

Error:
Starting collaboration session: Zero root directories specified
Parameter name: RootDirectories
Steps to Reproduce:
1.
2.

Version Data

extensionName
VSLS

extensionVersion
1.0.869

protocolVersion
2.2

applicationName
VSCode

applicationVersion
1.38.1

platformName
Windows

platformVersion
10.0.18362

@Issac909 thanks for reaching out. Can you give us more details about your scenario? Also, your logs may provide us with helpful information. You can access them via the Live Share: Export Logs command from the command palette (ctrl + shift + p) and attach them to this issue.

Closing this due to inactivity. Please reopen it if you’re still encountering the issue. Thanks!

authors: Issac909 lostintangent setaskin

repo: MicrosoftDocs/live-share


text:
Additional CA policy required to enforce restrictions for unmanaged devices?

I have followed the guide to run through some tests in my lab, but any restriction settings (block, web only) to access from unmanaged devices was ignored.
Is it possible, that an additional step is required to create a cond. acc. policy  with session control to "use app enforced restrictions" for SharePoint online?
Thanks a lot for clarifying and eventually extending the documentation.
Peter
[Enter feedback here]

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 0d40ac52-6f02-b0f3-0c45-9f359473703b
Version Independent ID: 108355a9-05a3-4d17-c417-c4d5664a4506
Content: Use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites - Microsoft 365 Compliance
Content Source: microsoft-365/compliance/sensitivity-labels-teams-groups-sites.md
Service: o365-seccomp
GitHub Login: @cabailey
Microsoft Alias: cabailey

@pmeuser For the unmanaged devices option, we have on this page: "For unmanaged devices (https://docs.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices), allow full access, web only access, or block access completely. If you have configured this setting at the tenant level or for a specific site, the setting you specify here will be applied only if it's more restrictive."
If you follow that link for unmanaged devices, it has the following note:
Blocking or limiting access on unmanaged devices relies on Azure AD conditional access policies. Learn about Azure AD licensing For an overview of conditional access in Azure AD, see Conditional access in Azure Active Directory. For info about recommended SharePoint access policies, see Policy recommendations for securing SharePoint sites and files. If you limit access on unmanaged devices, users on managed devices must use one of the supported OS and browser combinations, or they will also have limited access."
So yes, Azure AD conditional access is a prerequisite for this option and the UI you see offers another window to configure the same settings that you can configure for a SharePoint site. That was the point of the link - it's not an independent setting.

authors: cabailey pmeuser


text:
Broken next step links for multifactor authentication page.

Set up multi-factor authentication
Three of the links listed under next steps are broken:
How to register for their additional verification method
How to deal with situations like a new smart phone
Troubleshoot MFA sign-ins

@Sirkkuw  We have three links in the document which are broken and all are pointing to support.microsoft.com articles. It looks like these documents are broken and we don't have an equivalent document on docs.microsoft.com. Could you please tell us if these links can be removed or is this a temporary issue with some of these support.microsoft.com links?
Three links in question are:

How to register for their additional verification method - https://support.microsoft.com/office/ace1d096-61e5-449b-a875-58eb3d74de14

Troubleshoot MFA sign-ins - https://support.microsoft.com/en-us/office/fix-common-problems-with-multi-factor-authentication-6951be76-af50-49a4-847f-21391eaa59f2

3)How to deal with situations like a new smart phone - https://support.microsoft.com/office/6951be76-af50-49a4-847f-21391eaa59f2
Thanks
Sri

@yogkumgit please take out for now - I am following up with the team as to why these are not redirected.

@Sirkkuw We have removed the links via PR#https://github.com/MicrosoftDocs/microsoft-365-docs/pull/3031
@dahifi Thank you for your feedback. We have found these links to be broken and removed from the document. Once these links are restored, The Author will be updating the document as well.
Thanks
Sri

Can you replace the three with this one for now:
https://support.microsoft.com/en-us/help/4577374/what-is-multifactor-authentication
From: Sriraman M S notifications@github.com
Sent: Tuesday, September 29, 2020 4:01 PM
To: MicrosoftDocs/microsoft-365-docs microsoft-365-docs@noreply.github.com
Cc: Sirkku Willie sirkkuw@microsoft.com; Mention mention@noreply.github.com
Subject: Re: [MicrosoftDocs/microsoft-365-docs] Broken next step links for multifactor authentication page. (#2991)
@Sirkkuwhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FSirkkuw&data=02|01|sirkkuw%40microsoft.com|b3d3d4f9e243470983e308d864cb91ac|72f988bf86f141af91ab2d7cd011db47|0|0|637370172768349156&sdata=kjMVdG63ld2KKQ1NNwdDovUMcIi0PNFHGyenw2Gm1RU%3D&reserved=0 We have three links in the document which are broken and all are pointing to support.microsoft.com articles. It looks like these documents are broken and we don't have an equivalent document on docs.microsoft.com. Could you please tell us if these links can be removed or is this a temporary issue with some of these support.microsoft.com links?
Three links in question are:

How to register for their additional verification method - https://support.microsoft.com/office/ace1d096-61e5-449b-a875-58eb3d74de14https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.microsoft.com%2Foffice%2Face1d096-61e5-449b-a875-58eb3d74de14&data=02|01|sirkkuw%40microsoft.com|b3d3d4f9e243470983e308d864cb91ac|72f988bf86f141af91ab2d7cd011db47|0|0|637370172768349156&sdata=KSYVSwhvveHm37%2B0fZk%2FAySqV544yx8Bc5vIR8Q7v74%3D&reserved=0
Troubleshoot MFA sign-ins - https://support.microsoft.com/en-us/office/fix-common-problems-with-multi-factor-authentication-6951be76-af50-49a4-847f-21391eaa59f2https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Foffice%2Ffix-common-problems-with-multi-factor-authentication-6951be76-af50-49a4-847f-21391eaa59f2&data=02|01|sirkkuw%40microsoft.com|b3d3d4f9e243470983e308d864cb91ac|72f988bf86f141af91ab2d7cd011db47|0|0|637370172768359156&sdata=UtWGczvKGPavTPk8ruBuUvEmBv2txg924aZ82Tb4Ago%3D&reserved=0

3)How to deal with situations like a new smart phone - https://support.microsoft.com/office/6951be76-af50-49a4-847f-21391eaa59f2https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.microsoft.com%2Foffice%2F6951be76-af50-49a4-847f-21391eaa59f2&data=02|01|sirkkuw%40microsoft.com|b3d3d4f9e243470983e308d864cb91ac|72f988bf86f141af91ab2d7cd011db47|0|0|637370172768359156&sdata=xaPFzQZzAXQAG5%2BdfgxCEw6J2tp%2F4KY709B0r3rnqDE%3D&reserved=0
Thanks
Sri
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fmicrosoft-365-docs%2Fissues%2F2991%23issuecomment-701036073&data=02|01|sirkkuw%40microsoft.com|b3d3d4f9e243470983e308d864cb91ac|72f988bf86f141af91ab2d7cd011db47|0|0|637370172768369147&sdata=qeSsbDkgAdGsT1tocwF3PdzwfFRRpySKAe4ICshhIbI%3D&reserved=0, or unsubscribehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAHQPYBA5UGPLNCFCZLEJHW3SIJRLXANCNFSM4R4QGGXQ&data=02|01|sirkkuw%40microsoft.com|b3d3d4f9e243470983e308d864cb91ac|72f988bf86f141af91ab2d7cd011db47|0|0|637370172768369147&sdata=3JUBgdrPQZCDhYPJdF85VJo2rEpoFhcCodXjbRGGbcU%3D&reserved=0.

@Sirkkuw  I have added the URL as per your suggestion.
Thanks
Sri

@msbemba Thank you very much for the contribution and updating the documentation with PR. @dahifi Hope this update is helpful for you. Thanks for taking out some time to open the issue. Appreciate and encourage you to do the same in future also.

authors: Sirkkuw dahifi msbemba yogkumgit


text:
Error results from admin submissions

Hi there,
This seems like it's partially revisiting issue 644 because the rescan results are still ambiguous.
We have a customer who is experiencing an error response when performing Admin Submissions.
I have found nothing about this error when searching, and have never seen it before.
Previous submissions have completed successfully (last year), all of this years' submissions have failed with the error message.
No changes have occurred in the tenancy, and the customer is in their new years change freeze window.
This is the Result Details from the flyout:
Result details
Result
We did not receive the submission, please fix the problem and resubmit.
It could be due to a policy or rule that blocks messages from getting to our service. The list of addresses that need to be reached is located here.
How is one to troubleshoot this error?  There is unlikely to be anything configurable on the client side that is causing this.
There is nothing useful in the link it provides (no list of addresses), perhaps the response is a catch-all that needs to be revised?
Importantly in this case the customer is attempting to report an active phishing campaign from a compromised Microsoft tenancy, once submitted the status changes to "Under investigation" for what seems like a day before failing with the "We did not receive the submission" result.
Can we please have a list of possible Rescan results included in the document and suggestions on "next actions" should the resultant rescan not meet the admin's expectations?
thanks,
Anthony

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 162f11ad-8add-952e-fd64-488e8e3f3b14
Version Independent ID: addf14d5-f1c1-662d-9844-6888df0349bd
Content: Manage submissions - Office 365
Content Source: microsoft-365/security/office-365-security/admin-submission.md
Product: m365-security
Technology: mdo
GitHub Login: @Dansimp
Microsoft Alias: dansimp

@Dansimp Please help us in resolving this issue. Thanks

Hi,
We are have the same issue, is this an New Zealand only problem as I see the first posted is from New Zealand.
Thanks,
Lee

malaysia also having the same problem

same here with a tenant in Austria.
2 submissions were successful, 3 more showed this error, like described above:
Result
We did not receive the submission, please fix the problem and resubmit. It could be due to a policy or rule that blocks messages from getting to our service. The list of addresses that need to be reached is located here.
The  link opens this:
https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl?view=o365-worldwide
I've now tried again to submit a false-positive again, which I already had submitted.
Now I receive this error:
Client Error
Your submission (recipients: user@domain.com) was rejected by the throttling mechanism. Please try again in a few minutes.
New submission, mail with same content like the one before, but other recipient, is successful now.
New submission, mail with same content like the one before, but yet another recipient, is failing now.
Your submission (recipients: user2@domain.com) was rejected by the throttling mechanism. Please try again in a few minutes.
I hope this info is useful.
Thanks, Charly

I'm having the same issue in Canada. This has been happening for a couple of weeks. By this I mean the error message saying "We did not receive the submission, please fix the problem and resubmit" as mentioned by the original poster. No changes in our rules and can't figure out what is wrong.

Noticed this on our tenant in the UK for last 24hrs.  Haven't seen it reported anywhere else.

Quick update - tried a message trace with the addresses found in this page:
https://docs.microsoft.com/en-ca/exchange/security-and-compliance/mail-flow-rules/use-rules-to-see-what-users-are-reporting-to-microsoft?view=o365-worldwide
The addresses are:
junk@office365.microsoft.com
abuse@messaging.microsoft.com
phish@office365.microsoft.com
not_junk@office365.microsoft.com
Found no issues (meaning everything delivered) but noticed that only user submissions appeared in the trace (based on the e-mail subject). I'm not sure if admin submissions use a different e-mail address.
I also tried submitted the message as an EML attachment and received this:
"Your submission (recipients: xxxxx@xxx.xx) was rejected by the throttling mechanism. Please try again in a few minutes"

I'm in Canada and I've been experiencing the same issue since this morning!

Working OK for us today.

It appears to be the case here as well.

Hi all,
Austria: I submitted another false-positive yesterday, which was "pending" for some time, but today it says "completed".
Thus, my submission was successfully processed.
If it hadn't succeeded, I'd had raised a case with MS.
Cheers, Charly

To make it easier for you to submit feedback on articles on learn.microsoft.com, we're transitioning our feedback system from GitHub Issues to a new experience.
As part of the transition, this GitHub Issue will be moved to a private repository. We're moving Issues to another repository so we can continue working on Issues that were open at the time of the transition. When this Issue is moved, you'll no longer be able to access it.
If you want to provide additional information before this Issue is moved, please update this Issue before December 15th, 2023.
With the new experience, you no longer need to sign in to GitHub to enter and submit your feedback. Instead, you can choose directly on each article's page whether the article was helpful. Then you can then choose one or more reasons for your feedback and optionally provide additional context before you select Submit.
Here's what the new experience looks like.
Note: The new experience is being rolled out across learn.microsoft.com in phases. If you don't see the new experience on an article, please check back later.
First, select whether the article was helpful:

Then, choose at least one reason for your feedback and optionally provide additional details about your feedback:

Article was helpful
Article was unhelpful

Finally, select Submit and you're done!

authors: Csarly RoryUK101 andrewwoo0902 anthonynz felipewcb leehoward-eng ocafebabe officedocspr5 yogkumgit


text:
Update attack-surface-reduction-rules-deployment.md

added statement about  Block abuse of exploited vulnerable signed drivers as it is currently available
Fixes https://github.com/MicrosoftDocs/microsoft-365-docs/issues/12414

@JohanFreelancer9 Please copy review


text:
Update manage-industry-news.md

Corrected Typos and dupes

@JohanFreelancer9 Please copy review

Issue#https://github.com/MicrosoftDocs/microsoft-365-docs/issues/3169

@pebaum Please merge this PR. Thanks

authors: msbemba yogkumgit


text:
SCCM licesnse info added

SCCM license info was not added when it comes to Microsoft 365 EMS license. I have added the required information to answer user queries related to SCCM when they buy an EMS/Microsoft 365 license.
Problem: https://github.com/MicrosoftDocs/microsoft-365-docs/issues/332

@nenonix @JohanFreelancer9 - kindly do the copy editor review for this PR. Thanks.

@jasongroce - Can you please assist to check, approve and merge the content for this PR based on issue #332?
Thank you.

Hi @mypil I'm no longer associated with this content. @jdeckerms can you help redirect this request?

@jasongroce - do you happen to know who is the new author for this article? please advise so we can update the metadata. Thank you.

@robmazz @denisebmsft - Do you happen to know who we can reach out to merge the content of this PR based on issue #332? Also, would you know who is the new author for this article? Thank you.

I happened to see mention if this change on Twitter. I'm the lead writer for SCCMDocs. Could you please remove the reference to the KB article, and instead refer to our FAQ on this topic? https://docs.microsoft.com/sccm/core/understand/product-and-licensing-faq#bkmk_csp
In case something changes in the future, I dont want to have to remember to track down this information elsewhere.

@aczechowski - are you the new article author taking over this article? Please advise so we can update the metadata information. Thank you.

@joinimran - please check on the recommendation from @aczechowski  and make the necessary changes to this PR. Thank you.

@mypil no sorry. Just hoping that @joinimran can revise it

@aczechowski I have linked this part to SCCM Faqs.
@mypil FYI Please.

@AndreaBarr - would you be able to merge the content of this PR or do you happen to know who we can reach out to review and merge the content?
Thank you!

Added Sirkku per update on separate thread about ownership.

@Sirkkuw - Can you please assist to check, approve and merge the content for this PR based on issue #332?
Thank you.

@Sirkkuw - I would like to follow up. Can you please assist to check, approve and merge the content for this PR based on issue #332?
Thank you.

@Sirkkuw - Are you the new doc owner of this article? Please confirm so we can update the author metadata of this article. Thank you.

@mypil  I am the author. For some reason @jasongroce added himself in the author field after he suggested edits. Those fields are meant for the writers in the authoring group only.

authors: Sirkkuw aczechowski jasongroce joinimran mypil robmazz


text:
Update the cmdlet map for Get-MsolDirSync*

Add mappings for Get-MsolDirSyncConfiguration and Get-MsolDirSyncFeatures, it seems like this information is now available via Get-MgDirectoryOnPremiseSynchronization.
With the clock really ticking on the MSOnline module having to look up CmdLets is really needed, the map is still missing quite some needed data, let's help closing the gaps.

@matsimon - thank you for your contribution. We'll review and apply accordingly.
@SteveMutungi254 - please review this.

@timayabi2020 - please merge this.

Changes effect in PR #382

Thanks for the update, glad this Cmdlet map was expanded nonetheless. :-)

authors: matsimon msewaweru


text:
old links

[Enter feedback here]

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: bf19b222-f79a-c16b-ab29-f92c05a14651
Version Independent ID: bf19b222-f79a-c16b-ab29-f92c05a14651
Content: HoloLens Emulator archive - Mixed Reality
Content Source: mixed-reality-docs/mr-dev-docs/develop/advanced-concepts/hololens-emulator-archive.md
Product: mixed-reality
Technology: mr-dev
GitHub Login: @hamalawi
Microsoft Alias: moelhama

Hi @a11303, it seems to me that the links are working. Please reopen the issue if you are still experiencing problems.

repo: MicrosoftDocs/mixed-reality


text:
Update Code workflow

Update something

 Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.:x: ninhvuonglinh-linhnv sign nowYou have signed the CLA already but the status is still pending? Let us recheck it.

I'm very sorry, that was my mistake when trying to create PR in my forked repo. Please cancel it.

authors: msftclas ninhvuonglinh-linhnv


text:
Chat history not pulling beyond particular date on Android Teams app

I am having office 365 account and this is for office use.
I am facing an issue where for selected contact, the chat history isn't pulling beyond date feb 27 2020.
I can see the chat history for same contact on desktop teams app or web app but not in Mobile app. Tried signout, sign-in, reinstall the app, clearing cache but issue isn't fixed. When I am searching the old conversation, i can see it in search results but when selecting it, it doesn't pull that conversation, it just keeps loading.
Is this a bug or any resolution available?

@sranvi , Could you please tell us which teams mobile build is running on your device?

Hi,
Please see attached file for full build details.
Version:1416/1.0.0.2020022503
Thank you.
On Tue, Mar 10, 2020, 5:17 PM Trinetra-MSFT notifications@github.com
wrote:

@sranvi https://github.com/sranvi , Could you please tell us which
teams mobile build is running on your device?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/MicrosoftDocs/msteams-docs/issues/1436?email_source=notifications&email_token=AOZCJHEABSVRFGPCKPURT33RGYSGFA5CNFSM4LEYLW52YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEOLCYIA#issuecomment-597044256,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AOZCJHANZCDD46KJBXNIZADRGYSGFANCNFSM4LEYLW5Q
.

@sranvi , We are tracking this issue internally. Thanks for your patience.

@sranvi , Could you please use Report a Problem feature within Teams help section so we can get the logs?

To which email id do you want me to send logs from Teams?

I have sent the mail with logs to notifications@github.com and msteams-docs@noreply.github.com
Please check

@sranvi , Sorry for the delay in response, Could you please send the logs over microsoftteamsdev@microsoft.com ? This will be really helpful for us to mitigate the issue.

@sranvi , This probably a sync issue, Could you please try to refresh cache and try again? However these are known issue with the chat history:
Observed Issues:

The number of chats in the Chat tab is too low and possibly missing some chat conversations
Cannot scroll chat message history for a given chat > than 30 days old (this issue)

Let me know if you are still facing this issue

Hi, I cleared the Teams app cache and started new session of app but I am still facing issue.
This is causing problems for me as this is business account and when m using Teams on mobile and i want to access older messages for some important content, i can not open those messages. I can search for it and it does appear in search result but I can't open that message and it says 'Couldn't find message'. Any solution available?

@sranvi , We are unable to reproduce this issue at our end. Meanwhile could you please help to answer few questions for clarification:
1. Is this happening for just one chat or multiple chats?
2. For which types of chats is this happening?
3. Are the messages they are searching for possibly deleted from the other user?
Version:1416/1.0.0.2020022503, tested:	 We have tested for the same version your teams is running on for 1:1 chats, Group chats, meeting chats

Please feel free to reopen if you have further queries.

authors: Trinetra-MSFT sranvi

repo: MicrosoftDocs/msteams-docs


text:
This page should list breaking changes that are not backwards compatible.

This page should list nodes that are not supported in older versions of the manifest
e.g.
Manifest version 1.12 adds authorization which is not supported in earlier manifest versions. [Enter feedback here]

Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

ID: 0f94a488-d636-92b3-21eb-c88744c8f272
Version Independent ID: 7b3413f4-9ade-accf-5cb2-83fead11a32a
Content: Manifest schema reference - Teams
Content Source: msteams-platform/resources/schema/manifest-schema.md
Product: msteams
GitHub Login: @surbhigupta
Microsoft Alias: lajanuar

We will check on it from our end and act on it accordingly.

@surbhigupta12 - Could you please help us to update the document?
Could please add the Note in Authorization section in below document?
Add Note:- Setting the version property to 1.12  makes your Authorization property incompatible with older manifest version. as they do not support .
Authorization supported to manifest schema version V1.12.
Document:-https://docs.microsoft.com/en-us/microsoftteams/platform/resources/schema/manifest-schema#authorization

@v-shalinirobinson, please look into this.

@v-shalinirobinson -Could you please help us to update the document?

@sayali-MSFT, I am working on it.

authors: TheBluLion sayali-MSFT surbhigupta12 v-abirade v-chetsh


text:
[Doc Improvement][Document localization schema v1.17]

Documents v1.17 of the localization schema.

Acrolinx Scorecards
We currently enforce a minimum score of 80.
Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology:

Article
Score
Issues
Scorecard
Processed

msteams-platform/resources/schema/localization-schema.md
99
3
link
:white_check_mark:

More info about Acrolinx
Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see Use the Visual Studio Code extension to run Acrolinx locally.

Acrolinx Scorecards
We currently enforce a minimum score of 80.
Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology:

Article
Score
Issues
Scorecard
Processed

msteams-platform/resources/schema/localization-schema.md
99
3
link
:white_check_mark:

More info about Acrolinx
Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see Use the Visual Studio Code extension to run Acrolinx locally.

@surbhigupta12 as this is simply a reflection of the already approved/published v1.17 loc schema, could we move forward with publishing? (I verified that it matches the schema XPaths and limits.) Thanks!

Acrolinx Scorecards
We currently enforce a minimum score of 80.
Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology:

Article
Score
Issues
Scorecard
Processed

msteams-platform/resources/schema/localization-schema.md
99
3
link
:white_check_mark:

More info about Acrolinx
Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see Use the Visual Studio Code extension to run Acrolinx locally.

Acrolinx Scorecards
We currently enforce a minimum score of 80.
Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology:

Article
Score
Issues
Scorecard
Processed

msteams-platform/resources/schema/localization-schema.md
99
4
link
:white_check_mark:

More info about Acrolinx
Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see Use the Visual Studio Code extension to run Acrolinx locally.

Acrolinx Scorecards
We currently enforce a minimum score of 80.
Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology:

Article
Score
Issues
Scorecard
Processed

msteams-platform/resources/schema/localization-schema.md
99
4
link
:white_check_mark:

More info about Acrolinx
Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see Use the Visual Studio Code extension to run Acrolinx locally.

Acrolinx Scorecards
We currently enforce a minimum score of 80.
Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology:

Article
Score
Issues
Scorecard
Processed

msteams-platform/resources/schema/localization-schema.md
99
4
link
:white_check_mark:

More info about Acrolinx
Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see Use the Visual Studio Code extension to run Acrolinx locally.