From c24a1d2789fcd1d14f8432be8c5437bbfa9a8122 Mon Sep 17 00:00:00 2001 From: ebasseri <39064520+ebasseri@users.noreply.github.com> Date: Mon, 20 Nov 2023 17:06:19 -0800 Subject: [PATCH 01/26] Update managed-policies.md Clarify risk policy --- docs/identity/conditional-access/managed-policies.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/identity/conditional-access/managed-policies.md b/docs/identity/conditional-access/managed-policies.md index b47031c9ff5..2183bf7aebe 100644 --- a/docs/identity/conditional-access/managed-policies.md +++ b/docs/identity/conditional-access/managed-policies.md @@ -53,13 +53,13 @@ This policy targets Microsoft Entra ID P1 and P2 tenants where security defaults This policy covers users with [per-user MFA](/azure/active-directory/authentication/howto-mfa-userstates), a configuration that Microsoft no longer recommends. These users are targeted by Conditional Access and required to perform multifactor authentication for all cloud apps. -This policy targets Microsoft Entra ID P1 and P2 tenants where security defaults aren't enabled and there are less than 500 per-user MFA enabled/enforced users. +This policy targets Microsoft Entra ID P1 and P2 tenants where security defaults aren't enabled and there are less than 500 per-user MFA enabled/enforced users. ### Multifactor authentication and reauthentication for risky sign-ins -This policy covers all users and requires MFA and reauthentication when we detect high-risk sign-in. High-risk in this case means something about the way the user signed in is out of the ordinary. These high-risk sign-ins might include: travel that isn't normal, password spray attacks, or issues with a token. For more information about these risk definitions, see the article [What are risk detections](/entra/id-protection/concept-identity-protection-risks#sign-in-risk-detections). +This policy covers all users and requires MFA and reauthentication when we detect high-risk sign-in. High-risk in this case means something about the way the user signed in is out of the ordinary. These high-risk sign-ins might include: travel that highly abnormal, password spray attacks, or token replay attacks. For more information about these risk definitions, see the article [What are risk detections](/entra/id-protection/concept-identity-protection-risks#sign-in-risk-detections). -This policy targets Microsoft Entra ID P2 tenants where there are enough licenses for each user. +This policy targets Microsoft Entra ID P2 tenants where there are enough licenses for each user. Entra ID does not allow risky users to register for MFA, so to avoid locking them out of the system this policy is only available to organizations where every user is already registered for MFA. ## How do I see the effects? From e7f32954f17a7789af1c806523e0ce63e5dc0b88 Mon Sep 17 00:00:00 2001 From: Shweta Mathur Date: Fri, 24 Nov 2023 15:55:43 +0530 Subject: [PATCH 02/26] Update reference-error-codes.md Updated line 77 and 80 to update error codes AADSTS16000 and AADSTS160021 with correct error message and its solution. --- docs/identity-platform/reference-error-codes.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/identity-platform/reference-error-codes.md b/docs/identity-platform/reference-error-codes.md index a14a0d65887..0059eb432d6 100644 --- a/docs/identity-platform/reference-error-codes.md +++ b/docs/identity-platform/reference-error-codes.md @@ -74,10 +74,10 @@ The `error` field has several possible values - review the protocol documentatio | Error | Description | |---|---| -| AADSTS16000 | SelectUserAccount - This is an interrupt thrown by Microsoft Entra ID, which results in UI that allows the user to select from among multiple valid SSO sessions. This error is fairly common and might be returned to the application if `prompt=none` is specified. | +| AADSTS16000 | InteractionRequired - User account '{EmailHidden}' from identity provider '{idp}' does not exist in tenant '{tenant}' and cannot access the application '{appid}'({appName}) in that tenant. This account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Microsoft Entra user account. This error is fairly common when you try to log in to Microsoft Entra admin center by using personal Microsoft Account and no directory associated with it. | | AADSTS16001 | UserAccountSelectionInvalid - You'll see this error if the user selects on a tile that the session select logic has rejected. When triggered, this error allows the user to recover by picking from an updated list of tiles/sessions, or by choosing another account. This error can occur because of a code defect or race condition. | | AADSTS16002 | AppSessionSelectionInvalid - The app-specified SID requirement wasn't met. | -| AADSTS160021| AppSessionSelectionInvalidSessionNotExist - Application requested a user session which does not exist. | +| AADSTS160021| AppSessionSelectionInvalidSessionNotExist - Application requested a user session which does not exist. This issue can be resolved by creating new Azure account. | | AADSTS16003 | SsoUserAccountNotFoundInResourceTenant - Indicates that the user hasn't been explicitly added to the tenant. | | AADSTS17003 | CredentialKeyProvisioningFailed - Microsoft Entra ID can't provision the user key. | | AADSTS20001 | WsFedSignInResponseError - There's an issue with your federated Identity Provider. Contact your IDP to resolve this issue. | From 6cdae9bce38b28fd855864828422ac4f00bfe83a Mon Sep 17 00:00:00 2001 From: Neha Goel <38259657+negoe@users.noreply.github.com> Date: Sun, 26 Nov 2023 22:08:40 -0800 Subject: [PATCH 03/26] New Error string Added JSON_PARSE_FAILURE --- docs/identity-platform/msal-android-handling-exceptions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/identity-platform/msal-android-handling-exceptions.md b/docs/identity-platform/msal-android-handling-exceptions.md index ef252827226..fe24fc99b33 100644 --- a/docs/identity-platform/msal-android-handling-exceptions.md +++ b/docs/identity-platform/msal-android-handling-exceptions.md @@ -27,7 +27,7 @@ During the sign-in experience, you can encounter errors about consents, Conditio | `MsalUiRequiredException` | | Call `acquireToken()` to prompt the user to enter their username and password, and possibly consent and perform multifactor authentication. | | `MsalDeclinedScopeException` | | The developer should decide whether to continue authentication with the granted scopes or end the authentication process. Option to resubmit the acquire token request only for the granted scopes and provide hints for which permissions have been granted by passing `silentParametersForGrantedScopes` and calling `acquireTokenSilent`. | | `MsalServiceException` |