Azure DW what is it? Is it the same as SQL Azure but bigger?

No. It is kind of…different.

It is a full Cloud Service from Microsoft in the Microsoft Cloud (PaaS), multi-tenant, cloud-based data warehouse ‘Platform as a Service’ offering which elastically scales on demand.

Separates storage and compute for elastic scale requirements regardless of data volume.

You could pauseresume approach for ad-hoc workloads. Summarizing: Azure DW or Cloud Data Warehouse it is a high-end massively parallel processing (MPP) data warehousing, ideal for high-scale or high-performance data marts and EDWs in the Cloud.

So, we are talking about massively parallel processing. How it works?

It is “divide to conquer”.  Azure DW relays in nodes and CPUs, instead in only CPUs to process a task. Our classical SQL divides a task in different CPUs, that is parallel processing. Azure DW process a task in CPUs running in different nodes (computers).

In order to achieve this distributed architecture DW has:

Control node: The Control node manages and optimizes queries. It is the front end that interacts with all applications and connections.

Compute nodes: The Compute nodes serve as the power behind SQL Data Warehouse. They are SQL Databases that store your data and process your query

Storage: Your data is stored in Azure Blob storage. When Compute nodes interact with your data, they write and read directly to and from blob storage

(https://docs.microsoft.com/en-us/azure/sql-data-warehouse/sql-data-warehouse-overview-what-is)

In terms of query that represents segmented data and consequently data movements (DMS).  But what that means?

About SQL DW it is important to have in mind that the data will be spread across node according to distribution columns. So, choosing a good distribution column is an important aspect of achieving storage efficiency and highly performant queries.

Again, as the data is distributed against the nodes, SQL DW can perform some data movement to return the result set, the one responsible for that is the Data Movement Service. Data movement is the way which a query plan operation moves data among the nodes. When this happen, data is always moved into temporary tables. Moving data ensures that data exists on the correct nodes at the correct time to run queries.

Ok. Distribution columns??  What it means?

So first let’s make it clear some key concepts:

Distribution columns:

Behind the scenes, SQL Data Warehouse divides your data into 60 databases. Each individual database is referred to as a distribution. When data is loaded into each table, SQL Data Warehouse has to know how to divide your data across these 60 distributions. (https://docs.microsoft.com/en-gb/azure/sql-data-warehouse/sql-data-warehouse-tables-distribute)

So the column choose as the distribution key will be use to distribute the data across nodes.

We have two types of distribution:

1. Round robin which distribute data evenly but randomly. As the it sounds round robin will work distributing the data in round robin fashion, when the data is loaded, each row is simply sent to the next distribution. For this reason, Round-Robin tables often make good loading targets, but maybe not so good for queries, requiring data movement.
2. Hash Distributed which distributes data based on hashing values from a single column. Hash distributed tables are tables which are divided between the distributed databases using a hashing algorithm on a single column which you select. The hashing algorithm and resulting distribution is deterministic.

Note: to simulate this demo, you will need: an azure account, a SQL DW DB and SSMS studio connected to your DW DB.

More details:

SSMS and azure DB: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-connect-query-ssms

Create SQL DW Azure: https://docs.microsoft.com/en-us/azure/sql-data-warehouse/sql-data-warehouse-get-started-provision

T-SQL Code demo – Creating a table using Hash and Round Robin.

Hash

[sql]

CREATE TABLE Hash_example

(

id int NOT NULL,

lastName varchar(20),

Postcode varchar(6)

)

WITH

(

DISTRIBUTION = HASH ( id ) --hash distribution. Note only one column can be used

CLUSTERED COLUMNSTORE INDEX

)

;

[/sql]

Round Robin

[sql]

CREATE TABLE RoundRobin_example

(

id int NOT NULL,

lastName varchar(20),

Postcode varchar(6)

)

WITH ( CLUSTERED COLUMNSTORE INDEX );

[/sql]

Why that matters? If you join two tables using different distributed columns it could lead to a data movement and that could lead to performance issues.

Speaking in data movement...Some types of Data Movements:

BROADCAST_MOVE - This operation is frequently used when running a distribution incompatible join.

To perform this operation, each distribution broadcasts its rows to all other Compute nodes. The result is that each Compute node uses its own rows plus all the rows it receives from the other Compute nodes to create a replicated table.

SHUFFLE_MOVE - Redistributes a distributed table. The redistributed table has a different distribution column than the original distributed table. This might be used to when running incompatible joins or incompatible aggregations.

To perform this operation, SQL DW will moves each row to the correct Compute node according to distribution column of the destination table. Rows that are already stored on the correct Compute node are not copied during this operation.

How to identify a data movement? Look at the execution plan, use Explain.

Example:

[sql]

EXPLAIN --show the cost of the execution plan

SELECT COUNT(*)

FROM dbo.Hash_example HS

INNER JOIN RoundRobin_example RR

on HS.id = RR.id

[/sql]

For the example above, I used Explain. Explain returns the query plan for a SQL Data Warehouse SQL statement without running the statement. In this case I have 2 tables distributed on the same column with the same datatype, so it seems everything will work as it should, but if I check the XML result for my execution plan I will realize Data movement service (DMS) had to move the data to a temporary place so that means a distribution enters in the scene. But which distribution and why? To discover the distribution, look the operation type inside of the XML ( more details, figure 1), and the reason is because I am using round robin in one of the tables and hash in the other. Remember round robin distribution in the table occurs just as the name says in a round robin fashion, so it was chosen to perform some data movement to execute the join between the columns. When you choose to use Round Robin increases the like hood of  data movement.

Check more about explain: (https://docs.microsoft.com/en-us/sql/t-sql/queries/explain-transact-sql)

Between other things what is most notable in the explain result for the query mentioned is the data movement and the query cost.

Check the results as follow:

Figure 1: Explain Query DW

Note: The data was moved to a temporary place (TEMP_ID_11) to execute the query, that means SQL has to distributed the data in order to return the result set. The operation chosen to perform this distribution  was Shuffle move, you can check this inside of the operation type in the XML result, above. The number of distribution are 60.  Also, note the cost for this query and operations required can be checked by the explain result.

Next post we will discuss  more reasons for data movements and some possible solutions.

Liliam Leme

UK Data Platform PFE

(この記事は 2017 年 7 月 19 日に Office Blogs に投稿された記事 Expanding OneDrive version history support to all file types の翻訳です。最新情報については、翻訳元の記事をご参照ください。)

OneDrive のバージョン履歴機能が拡張され、OneDrive の個人アカウントにおけるあらゆる種類のファイルがサポートされるようになります。これは、ユーザーの皆様から多くのご要望 (英語) を頂いていた機能です。OneDrive チームは、皆様が生産性の向上に専念できるように支援し、編集ミスを気にせず他のユーザーと共同編集が行えるように日々取り組んでいます。

今回のバージョン履歴の機能強化により、OneDrive に格納されているすべてのファイルの過去のバージョンを閲覧、復元できるようになります。以前は Office ファイルのみサポートされていましたが、今後はあらゆる種類のファイルでこの機能が利用できるようになります。PDF や CAD ファイル、さらには写真や動画などを誤って編集し上書き保存してしまっても、いつでも過去のバージョンを復元したりダウンロードしたりすることができます。過去のバージョンのファイルは 30 日間保存されます。バージョン履歴の機能強化は既にロールアウトが始まっており、今夏にはすべてのユーザーにご利用いただけるようになる予定です。

OneDrive のバージョン履歴機能を使用する

バージョン履歴機能は簡単に使用できます。OneDrive.com に移動し、過去のバージョンを復元または閲覧したいファイルを右クリックして、[Version history] をクリックするだけです。

バージョン履歴ウィンドウには、過去のバージョンの更新日時、編集者、サイズが表示されます。

目的のバージョンを選択し、[Open File] をクリックして閲覧するか、[Restore] をクリックして現在のバージョンと置き換えます。

この機能は、OneDrive でユーザーのデータを確実に保護するための、複数ある措置の 1 つです。

バージョン履歴の新しいエクスペリエンスについての皆様のご意見や、OneDrive の改善に関するフィードバックを OneDrive の UserVoice (英語) までぜひお寄せください。

— OneDrive チーム

※ 本情報の内容 (添付文書、リンク先などを含む) は、作成日時点でのものであり、予告なく変更される場合があります。

Largest FREE Microsoft eBook Giveaway! I’m Giving Away MILLIONS of FREE Microsoft eBooks again, including: Windows 10, Office 365, Office 2016, Power BI, Azure, Windows 8.1, Office 2013, SharePoint 2016, SharePoint 2013, Dynamics CRM, PowerShell, Exchange Server, System Center, Cloud, SQL Server and more!

By Liam Westley, Application Architect at Huddle

When you use the word Exception it always sounds scary, but exceptions in .NET are far from scary and are much more useful than the old days of returning error codes and error strings.  There’s no excuse for your methods to provide return values which hide the details of why something went wrong.

The myth that exceptions are slow to throw and hog memory have long been debunked.  If they aren’t used as a standard control flow (see item 2 below) then they will only occur rarely and provide vital information on the state of your application.

Here are my top five tips for handling .NET Exceptions.

1. Maintain your stack trace

When you first start programming in .NET you might think that you catch the exception, try some stuff but rethrow that exception if you couldn’t handle it.  Or, you may have defined your own exception class.  It might have looked like the following code.

In both these cases, you will find that the stack trace provided with your exception will go no further down the call stack than the method PartialStackTrace.

private double PartialStackTrace()
{
  try
  {
       return DivideANumber(1, 0);
  }
  catch (Exception ex)
  {
       throw ex;
  }
}

OR

private double PartialStackTrace()
{
  try
  {
       return DivideANumber(1, 0);
  }
  catch (Exception ex)
  {
       throw new MyAppException(“Ooops!”);
  }
}

You really would like a full stack trace, that reveals that the problem exists in DivideANumber (or further down the call stack).

If you are just re-throwing the exception use throw by itself, and the full stack trace is preserved.

If you define your own exception class, provide the exception you just caught as the InnerException in the constructor.  Job done!

private double FullStackTrace()
{
  try
  {
       return DivideANumber(1, 0);
  }
  catch (Exception ex)
  {
       throw;
  }
}

OR

private double FullStackTrace()
{
  try
  {
       return DivideANumber(1, 0);
  }
  catch (Exception ex)
  {
       throw new MyAppException(“Ooops!”, ex);
  }
}

See also: https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2200-rethrow-to-preserve-stack-details.

2. Keep exceptions exceptional…

This sounds a bit trite, but sometimes you won’t need exceptions as you know there will be times that you will receive data or be in a situation where an exception might occur, and you know how to handle it.

As an example, it is trivial to verify that a key exists in a dictionary prior to attempting to access a value, and save having to wrap dictionary access in a try … catch block.

var alphabet = new Dictionary<int, string>() { { 1, "A" }, { 2, "B" } };

// throws KeyNotFoundException

try
{
    Console.WriteLine($"27th letter of alphabet {alphabet[27]}");
}
catch (KeyNotFoundException kex)
{
    Console.WriteLine("27th letter of alphabet : <not present>");
}

// check first, no try ... catch required
var letter = alphabet.ContainsKey(27) ? alphabet[27] : "<not present>";
Console.WriteLine($"27th letter of alphabet : { letter }");k

Similarly, you might want to check for the existence of a file with the same name before an attempt to copying a new file.  This could be gracefully handled by changing the resulting file name and providing the new file name back as a result.

3. Avoid generic, catch-all exception handling

Not only should you not throw exceptions for conditions that are expected to occur regularly, you should also always aim to catch specific exceptions, rather than generic exceptions.  This has become finer grained in C# 6 as it supports filtering using catch ... when and supplying a suitable predicate.

// handle specific exception differently

try
{
    double result = DivideByZeroCheckForSpecificException();
    Console.WriteLine($"Divide by zero results : {result}n");
}
catch (DivideByZeroException dex)
{
    Console.WriteLine("Divide by zero results : <cannot divide by 0>n");
}
catch (Exception ex)
{
    Console.WriteLine("Unknown exception : nn" + ex.ToString() + "n");
}

// handle exception using a catch ... when predicate

try
{
    double result = DivideByZeroCheckExceptionPredicate();
    Console.WriteLine($"Divide by zero results : {result}");
}
catch (Exception ex) when (ex.InnerException != null)
{
    Console.WriteLine("An InnerException exists : nn" + ex.ToString() + "n");
}

4. Async and exception handling

The world of async has given us a few more things to think about regarding exceptions.  The first is that you will be expected to handle the AggregateException much more often than you may have done previously.  This wrapper could be wrapping several exceptions, or just a single exception.  You have to examine the InnerExceptions property to see if there are underlying exceptions which you could handle.

It should also be noted that methods which are decorated with async will not throw exceptions unless you await them.  This can be easy to miss when creating unit tests with mocks and stubs, and can lead to much frustration as tests suddenly fail due to exceptions not being thrown and handled as expected.

internal static async Task ThrowAnException()
{
    throw new Exception("Throwing from an async decorated method.");
}
private static async Task TestAsyncExceptions()
{

  // No exception will be thrown, we omitted await

  try
  {
    ThrowAnException();
    Console.WriteLine("No exception thrown.");
  }
  catch (Exception ex)
  {
    Console.WriteLine("Exception thrown : nn" + ex.ToString() + "n");
  }

  // Exception will be thrown because we have used await

  try
  {
    await ThrowAnException();
    Console.WriteLine("No exception thrown.");
  }
  catch (Exception ex)
  {
    Console.WriteLine("Exception thrown : nn" + ex.ToString() + "n");
  }
}

5. Don’t rely on exception message content, it could be localised

Even when you do capture on specific exception types, you might find that the exception is ambiguous and doesn’t really inform you of the underlying issue.  It can be tempting to check for a given exception message to really confirm that the exception is something you think you can handle.

try
{ 
  getDocument = DocStore.SingleOrDefault(d => d.SelfLink = doc.SelfLink);
}
catch (System.InvalidOperationException ex)
{   
  if (ex.Message == “Sequence contains more than one matching element”) 
  {    
    CleanUpDuplicates(doc.SelfLink); 
  } 
  else 
  {   
   throw; 
  }
}

The above example works fine if the system on which your software runs uses a English language locale, but if it were, say based in Norway the text ‘Sequence contains more than one matching element” becomes

Sekvensen inneholder mer enn ett samsvarende element

A good solution to this issue is to handle the specific exception but validate that the issue really is more than one item being found.  By counting how many items might be present that match the predicate, we only call CleanUpDuplicates if we actually find duplicates, otherwise we can happily throw as the exception is unexpected.

Summary

So that is my top five tips for handling .NET Exceptions.  I hope you can embrace exceptions and the rich data they provide when trying to debug your applications. With libraries such as Polly utilising your exceptions to implement patterns such as Retry and Circuit Breaker, there’s even more reasons to use exceptions in your code to save time and effort.

Biography

Liam Westley is an ex Microsoft MVP and Application Architect at Huddle where he works with some of the best .NET developers and UX designers to deliver world class collaboration software. He quite likes working just on the edge of The City as there is some fantastic food and coffee to be had within a few minutes walk.

Liam has worked for chellomedia, GMTV, BSkyB, QVC UK and chellomedia. In his time he created the first in house weather system for Sky News using Visual Basic 1.0, acted as architect for two general election systems, project managed the launch of the GMTV web site, was key to delivering the first interactive television chat service in the UK for BSkyB and helped launch the first live shopping channels in the Netherlands.

Liam has a blog at https://blog.liamwestley.co.uk and https://medium.com/@liam.westley and can be found on twitter at @westleyl.

Patch Tuesday this month featured updates to address security issues in Exchange 2010, 2013 and 2016.   Two weeks ago today, July 11th heralded the arrival of Rollup Update Rollup 18 (RU18) for Exchange Server 2010 Service Pack 3 along with updates for Exchange 2013 and 2016.

Exchange 2010 SP3 RU18 is the latest rollup of customer fixes currently available for Exchange Server 2010.  All updates, both security and product fixes, are delivered via a RU for Exchange 2010.  This means that if you want to install a security fix for Exchange 2010 you must install it via a RU.

Exchange 2013 and 2016 have a different servicing strategy, where security updates can be decoupled from the regular product updates.  Exchange 2013 and 2016 utilise Cumulative Updates (CUs) rather than the Rollup Updates (RU/UR) which were used previously.

For a reference point Exchange 2013 CU17 and Exchange 2016 CU6 were previously released in June 2017.

Security updates were released for Exchange 2010, 2013 and Exchange 2016.  The released updates are covered in KB 4018588.  In addition the Microsoft Security Update Guide also provides a mechanism to search and filter on security updates.  Filtering the July 2017 Exchange updates in the Microsoft Security Update Guide shows the below:

Drilling into the table shows that updates are available for all supported versions of Exchange.  Exchange 2007 exited out of extended support in April 2017, thus is not listed in the table.

It is worth drilling into the different versions of Exchange to review how the security fixes are delivered and thus how they are to be applied.

Exchange 2010

Exchange 2010 is serviced by releasing a new Rollup Update (RU).   These security fixes are delivered in Exchange 2010 SP3 RU18.

Please see the installation notes at the bottom of this post.

Exchange 2013

Separate security updates are available for Exchange 2013 SP1 (CU4) and Exchange 2013 CU16.  If you are running one of these CUs then you can download and install the security update from KB 4018588.  In reality though CU4 is a very dated release and you really should be on a current build of Exchange.

Exchange 2013 CU17 already includes these security fixes.

For all other Exchange 2013 CUs the security update is not available.  In order to apply the security update then you must update to a current CU.

Exchange 2016

A separate security update is available for Exchange 2016 CU5.  If you are running CU5 then you can download and install the security update from KB 4018588.

Exchange 2016 CU6 already includes these security fixes.

For all other Exchange 2016 CUs the security update is not available.  In order to apply the update then you must update to a current CU.

Cheers,

Rhoderick

The July release for Dynamics AX 2012 R3 version is now available in LCS on the updates tile inside your R3 project. This update represents a typical collection of smaller functional improvements and technical fixes. Bugs were fixed in all areas with enhancements found in Warehouse & Transportation, Retail, DIXF and Project Accounting. Please see the full list of hotfixes below to search for your specific issue newly included in this release. This release is a cumulative package including all other fixes released in the prior CU12 update. This release is intended to give visibility into fixes recently shipped for R3, including some features and design changes that are newly released in this month.

Here are a few details related to this release:
• Primary Build: 6.3.5000.6242
• Number of Application hotfixes: 111
• Number of Binary hotfixes: 31

Details of the install process can be found here:

What is included in this month’s release?

Design Change Requests, Feature Requests & RegFs

Fixes Released

Please stay tuned for the coming release of Microsoft Dynamics AX R3 Cumulative Update 13 coming in Q3 of 2017.

Todd Sweetser

Hi Cloud Partners!  Wanted to pass along this highly requested capability that has been added to Azure VM Backup.  This info is from the Azure blog: Instant File Recovery from Azure VM backups is now generally available…

We are excited to announce that Instant recovery of files and folders from Azure VM backups by Azure Backup is now generally available (GA). This adds to the repertoire of cloud-first features we have been delivering from Azure Backup. We earlier announced that File-folder recovery from Azure Windows VM backups and Linux VM backups were available in preview. We received great feedback from preview and we have enhanced the feature in terms of customer experience, security, and performance.

Value Proposition Recap

To recap the value proposition, with this file recovery feature, now you can securely

• Recover files instantly – Now instantly recover files from the cloud backups of Azure VMs without any additional infrastructure. Whether it’s accidental file deletion or simply validating the backup, instant restore drastically reduces the time to recover your data.
  
• Open application files without restoring them - Our iSCSI-based approach allows you to open/mount application files directly from cloud recovery points to application instances. You need not restore the entire VM and thus save on time taken for recovery and consumption of bandwidth. For e.g. in case of backup of a Azure Linux VM running MongoDB, you can mount BSON data dumps from the cloud recovery point and quickly validate the backup or retrieve individual items such as tables without having to download the entire data dump.

Related links and additional content

• Want more details about this feature? Check out our Azure Backup File Restore documentation.
• Need help? Reach out to Azure Backup forum for support.
  
• Tell us how we can improve Azure Backup by contributing new ideas and voting up existing ones.
  
• Follow us on Twitter @AzureBackup for the latest news and updates.
  
• If you are new to Azure Backup, sign up for a free Azure trial subscription.
• If you are looking for instant recovery from on-premises refer to Use Instant Restore documentation.

Today's tip...

These articles cover the Semi-annual Channel in Windows and Office, LTSC (previously called LTSB), servicing, and Windows Insider Preview information.

Reference:

• Delivering continuous innovation with Windows Server - https://blogs.technet.microsoft.com/hybridcloud/2017/06/15/delivering-continuous-innovation-with-windows-server/
• Windows Server Semi-annual Channel Overview - https://docs.microsoft.com/en-us/windows-server/get-started/semi-annual-channel-overview
• Overview of the upcoming changes to Office 365 ProPlus update management - https://support.office.com/en-us/article/Overview-of-the-upcoming-changes-to-Office-365-ProPlus-update-management-78B33779-9356-4CDF-9D2C-08350EF05CCA?ui=en-US&rs=en-US&ad=US

213 Microsoft Team blogs searched, 60 blogs have new articles. 573 new articles found searching from 01-Jun-2017 to 30-Jun-2017

BlogMS-Monthly-Report-June-2017

Client created rules, that Auto-Forward email from users mailboxes to an external email address, are becoming an increasingly common and fruitful data exfiltration method being used by bad actors today and something we see quite a lot of in the Office 365 Service.

There are a lot of legitimate reasons for using rules that externally Auto-Forward email, such as mergers an acquisitions etc. However they also represent a risk that needs careful and vigilant management by the admins of your tenant to ensure they are not being misused.

These rules can be created through several interfaces, a desktop client, Outlook Web Access even an admin can use PowerShell to implement via the 'New-InboxRule' cmdlet. Users themselves are often unaware of the rules they have in place (lets face it, who in their desktop client regularly reviews their own rules?) so it is very easy to miss them, either accidentally created rules that Auto-Forward externally or intentionally created rules created by a bad actor after compromising an end users account or breaching a high privileged account such as the tenant admin.

One of the most recent scenarios we have seen, involved a bad actor compromising a tenant admin account, the tenant had Auto-Forward disabled on the default (*) Remote Domain, which offered some protection from client rules externally forwarding email, however the bad actor then created a new Remote Domain, with the namespace of where they wished to exfiltrate data to, enabled the Remote Domain to allow Auto-Forward emails and voila, started to implement client rules that would then Auto-Forward to that namespace.

Mitigation

The Office 365 service, does offer you a myriad of built in ways to control the impact of Auto-Forwarded email to external addresses, like all good security measures, you will likely need a combination of all/some of these to adopt the security posture that your organization feels is appropriate for your needs, defense in depth is key as always:

1. Remote Domains - If you as an Organization do not want to allow Auto-Forward emails at all, ensure the setting 'Allow automatic forwarding' is disabled on your Remote Domain settings, such as 'Set-RemoteDomain Default -AutoForwardEnabled $false' or via the Admin Center.  Also ensure you are reviewing this as part of your scheduled security reviews, you should be checking the Default Remote Domain and other Remote Domains you may have active have your desired settings in place. A compromised tenant admin account, could see these settings altered.
2. Review Client Auto Forwarding Rules - Half the challenge in developing any security posture is understanding your Organizations risk and exposure. Using a script called 'DumpDelegatesandForwardingRules.ps1'from here  https://github.com/OfficeDev/O365-InvestigationTooling will allow you to perform an audit of just how many of your clients have rules that Auto-Forward externally. This script can take a while to complete, as it iterates through each mailbox to check the rules (rules are stored in a users mailbox as a hidden item).
3. RBAC - You can use RBAC to limit the impact as well, by adding a new management role based of the MyBaseOptions and restricting the parameters DeliverToMailboxAndForward, ForwardingAddress, ForwardingSmtpAddress.
4. Transport Rules -  We have another tool at our disposal here, by using a Transport Rule. Implementing a Transport Rule based around the following can stop emails that are set to be Auto-Forwarded to an external address. In summary you create a rule based on the following logic. IF The Sender is located ‘Inside the organization’ AND IF The Recipient is located ‘Outside the organization’ AND IF The message type is ‘Auto-Forward’ THEN Reject the message with the explanation ‘External Email Forwarding via Client Rules is not permitted’. This will stop delivery of the Auto-Forward message and issue an NDR as the cherry on top. There are numerous great blog articles out there on how to achieve this.

How Can Secure Score Help?

Using Secure Score https://securescore.office.com helps increase your organization’s security by encouraging you to use the built-in security features in Office 365 (many of which you already purchased but might not be aware of). We have implemented a new Security Control in Secure Score called 'Client Rules Forwarding Blocks'. It basically takes mitigation 4 from above and turns that into a one click experience, allowing you to quickly implement a Transport Rule to help mitigate client created rules that Auto-Forward to external addresses. By using this control it will allow you create the Transport Rule above, you can then subsequently tweak the rule directly, for example if you wished to change the NDR text. This feature is now live within Secure Score and we have seen already in the few days it has been live, over 6000 tenants enable it.

You can find this Security Control in the Advanced Action section of your queue.

So, there we go some steps you can take to help mitigate the risk of managing Client External Forwarding Rules within your Organization. Remember, a layered approach is key to helping adopt your Organizations security posture.

Symptoms

Log Name:  Application
Source:       FIMSynchronizationService
Event ID:   6801
Task Category: Server
Level:       Error
Computer: <TheSyncServer>
Description:
The extensible extension returned an unsupported error.
The stack trace is:
"System.Net.WebException: The remote server returned an error: (403) Forbidden.
at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)
at System.Net.WebClient.DownloadData(Uri address)
at Microsoft.Office.Server.UserProfiles.ManagementAgent.ProfileImportExportExtension.DownloadPictures(ProfileChangeData[] profiles)
at Microsoft.Office.Server.UserProfiles.ManagementAgent.ProfileImportExportExtension.Microsoft.MetadirectoryServices.IMAExtensibleFileImport.GenerateImportFile(String fileName, String connectTo, String user, String password, ConfigParameterCollection configParameters, Boolean fFullImport, TypeDescriptionCollection types, String& customData)

Cause

Resolution

More Query Words for Bing:

ISSUE:

TECHNICAL DELTAILS:

RESOLUTION:

1. Setup an alert on the site collection for the user

2. Share content specific with the user

I was recently engaged in a long running critical case for a customer that exposed some opportunities for further discussion on SharePoint Add-In Authentication.

Here is the scenario: Your organization leverages a Provider Hosted SharePoint Add-in, whose secret is close to expiring.  Following the documented process for Generating a New Client Secret you create a new client secret.  Hoping to confirm the new secret, you modify the Provider Host Web Application Properties to only use the new secret. When you attempt to use your Add-in, it fails.

Understanding the Add-in Authentication Flow

For the following few paragraphs, it will be helpful to review the documentation on The Context Token OAuth flow for SharePoint Add-Ins.  The important take away is the OAuth flow, which is as follows:

1. User requests the app by clicking on the link in SharePoint.
2. SharePoint will request a token from Azure.
3. Azure will sign the token using the oldest valid client secret associated with the ClientID of the App
4. Azure will pass that token to SPO, which then passes it to the Client.
5. The client will present the token to the Provider Hosted Web App, which uses the stored Client Secret(s) to validate the token.
6. If the Provider Hosted Web App doesn’t have the secret that was used to sign the token, it will fail.

The interesting thing to note here is #3.  Because it uses the oldest eligible token, the Provider Hosted Web Application must know about the expiring secret in order to continue working normally.

In order to verify that the client secret is updated, you can query Azure Active Directory using the following code:

Connect-MSOLService
 $clientId = 'client id of the add-in'
 Get-MsolServicePrincipalCredential -AppPrincipalId $clientid -ReturnKeyValues $true | Where-Object { ($_.Type -ne "Other") -and ($_.Type -ne "Assymetric") }

If you then see 3 entries with an expiration set to a year (or 3, if you decided to create a new secret 3 years in the future) then you have confirmed that the secret is now valid and can update your Provider Host Web Application Properties.

Forcing a cutover

Once you have verified your new secret above, you can safely wait for the current secret to expire and the transition to the new secret should be seamless. If your organization wants to force a cutover, say during a change window, then you can delete the expiring secrets using the following code.

Connect-MSOLService
$clientId = 'client id of the add-in'
$secrets = Get-MsolServicePrincipalCredential -AppPrincipalId $clientid -ReturnKeyValues $true | Where-Object { ($_.Type -ne "Other") -and ($_.Type -ne "Assymetric") }
$secrets

Use the output of the $secrets command to identify the date/time of the expiring secret.  Then use the following code:

$DeleteTheseSecrets = $Secrets | Where-Object { $_.EndDate -like ‘end date of expiring secret’ }
$DeleteTheseSecrets | ForEach-Object {Remove-MSOLServicePrincipalCredential $_.KeyId}

Then remove the old secret from the Provider Host Web Application Properties, and test your App.  Things should smoothly transition to use the new Client Secret.

NOTE: There is no technical reason to engage in a forced cutover. With both client secrets in the Provider Host Web Application Properties, there should be no real need for you to do this.  These steps are provided as a courtesy to customers with strict Change-Control Compliance needs.

In January, we added Quick Create to Hyper-V manager in Windows 10.  Quick Create is a single-page wizard for fast, easy, virtual machine creation.

Starting in the latest fast-track Windows Insider builds (16327+) we’re expanding on that idea in two ways.  Quick Create now includes:

1. A virtual machine gallery with downloadable, pre-configured, virtual machines.
2. A default virtual switch to allow virtual machines to share the host’s internet connection using NAT.

To launch Quick Create, open Hyper-V Manager and click on the “Quick Create…” button (1).

From there you can either create a virtual machine from one of the pre-built images available from Microsoft (2) or use a local installation source.  Once you’ve selected an image or chosen installation media, you’re done!  The virtual machine comes with a default name and a pre-made network connection using NAT (3) which can be modified in the “more options” menu.

Click “Create Virtual Machine” and you’re ready to go – granted downloading the virtual machine will take awhile.

Details about the Default Switch

The switch named “Default Switch” or “Layered_ICS”, allows virtual machines to share the host’s network connection.  Without getting too deep into networking (saving that for a different post), this switch has a few unique attributes compared to other Hyper-V switches:

1. Virtual machines connected to it will have access to the host’s network whether you’re connected to WIFI, a dock, or Ethernet.
2. It’s available as soon as you enable Hyper-V – you won’t lose internet setting it up.
3. You can’t deleted it.
4. It has the same name and device ID (GUID c08cb7b8-9b3c-408e-8e30-5e16a3aeb444) on all Windows 10 hosts so virtual machines on recent builds can assume the same switch is present on all Windows 10 Hyper-V host.

I’m really excited by the work we are doing in this area.  These improvements make Hyper-V a better tool for people running virtual machines on a laptop.  They don’t, however, replace existing Hyper-V tools.  If you need to define specific virtual machine settings, New-VM or the new virtual machine wizard are the right tools.  For people with custom networks or complicated virtual network needs, continue using Virtual Switch Manager.

Also keep in mind that all of this is a work in progress.  There are rough edges for the default switch right now and there aren't many images in the gallery.  Please give us feedback!  Your feedback helps us.  Let us know what images you would like to see and share issues by commenting on this blog or submitting feedback through Feedback Hub.

Cheers,
Sarah

(この記事は 2017 年 7 月21 日にMicrosoft Partner Network blog に掲載された記事 Top 10 Sessions from Microsoft Inspire の翻訳です。最新情報についてはリンク元のページをご参照ください。)

ワシントン D.C. で開催された Microsoft Inspireは、パートナーの皆様のおかげで大成功のうちに幕を閉じました。この活気あふれる有意義なパートナー エコシステムは、パートナー様の存在とパートナー様の革新的なアイデアに支えられています。ご参加いただけなかったパートナー様は、今回のイベントの模様をまとめた以下の動画をぜひご覧ください。

業界のたくさんのソート リーダーやエキスパートにご参加いただいたため、参加したかったすべてのセッションに出られなかったという方もいらっしゃるのではないかと思います。そこでこの記事では、今年の Microsoft Inspire で人気の高かったセッション トップ 10 をご紹介したいと思います。

1. Creating Stories that Bring Home the Bacon (成功を引き寄せるストーリーを作るには)

ストーリーテリングのエキスパートである ResourceiT Consulting Ltd. の Julie Simpson 氏が、インパクトがあって印象に残るようなストーリーをお客様にプレゼンするためのヒントについて説明しました。パートナー ビジネス モデルを採用するすべてのビジネス リーダーを対象としたインタラクティブなセッションであり、ストーリーテリングを駆使してビジネスを成長させ、市場シェアを拡大するために必要な新しい考え方を紹介しました。このセッションの模様はこちら (英語) からご覧いただけます。

2. Building a Successful Cybersecurity Practice with Microsoft (マイクロソフトと共に効果的なサイバーセキュリティの手法を確立する)

このセッションでは、マイクロソフトのワールドワイド サイバーセキュリティ担当バイス プレジデントの Ann Johnson が、マイクロソフトの取り組みには必ずセキュリティが組み込まれていることについて説明しました。このことは、お客様がデジタル改革を進めながら自身の安全を確保するために重要な点です。セッションにご参加の皆様は新しいサイバー セキュリティのアプローチについて学んだほか、自社にしか実現できないソリューションをマイクロソフトと協力して構築する方法について学びました。このセッションの模様はこちら (英語) からご覧いただけます。

3. Grow Your Business with Modern IT (最先端の IT を活用してビジネスを成長させる)

マイクロソフトのエキスパートである Windows 法人向けマーケティング担当ゼネラル マネージャー Bernardo Caldas と、Windows 部門のプログラム管理/エンタープライズ/セキュリティ担当ディレクター Rob Lefferts が、すべてのパートナー様が最先端の IT を活用してビジネスを短期間で成長させられることについて説明しました。企業が自社の製品、ツール、業務を変革するためには、今日のデジタル経済に合わせて構築された世界トップクラスのプラットフォームを活用する必要があります。このセッションでは、Windows 10、Office 365、Microsoft Enterprise Mobility + Security を利用して、高い生産性と安全な IT エクスペリエンスを実現する方法について紹介しました。その模様はこちら (英語) からご覧いただけます。

4. Unlocking Digital Transformation Through SAM (SAM によるデジタル改革の実現)

マイクロソフトの米国/ワールドワイド SAM&C 担当ゼネラル マネージャーの Patama Chantaruck が、デジタル改革と SAM によってパートナー様にもたらされる大規模なビジネス チャンスについて独自の見解を紹介しました。SAM がデジタル改革を推進するしくみと、パートナーの皆様がそれらのビジネス チャンスをどのように活かせるかについてお伝えしました。このセッションの模様はこちら (英語) からご覧いただけます。

5. Microsoft’s FY18 Commercial Sales Strategy: An Update for Partners (マイクロソフトの 2018 年度法人向け営業戦略: パートナー様向け最新情報)

マイクロソフトの法人顧客セグメント担当コーポレート バイス プレジデントの Chris Weber が、2018 年度の法人向け営業戦略について紹介しました。このセッションでは、「今年は何が変わるのか?」、「重要なリソースを投資すべきなのはどの分野か?」といったパートナー様が最も関心を寄せる質問にお答えし、大規模なお客様から小規模なお客様まで、あらゆる規模の企業が活用できる戦略について独自の見解を紹介しました。このセッションの模様はこちら (英語) からご覧ください。

6. The Microsoft Security Strategy (マイクロソフトのセキュリティ戦略)

このセッションでは複数の業界リーダーが登壇し、デジタル セキュリティという重要なトピックについて詳細に掘り下げ、マイクロソフトがセキュリティの研究開発に年間 10 億ドルも投じた背景となる戦略について説明しました。そのようなセキュリティを活用してどのようにお客様のニーズを満たせるのか、また、パートナー様はマイクロソフトの製品を活用してビジネス構築の基盤となる統合ソリューションをどのように形成できるのかについて紹介しました。このセッションのスピーカーは以下のとおりです。

• BUI、ビジネス開発マネージャー、Lizette van Wyk 氏
• マイクロソフト、Office パートナー担当ゼネラル マネージャー、Giovanni Mezgec
• マイクロソフト、Azure + セキュリティ マーケティング担当コーポレート バイス プレジデント、Julia White
• マイクロソフト、One Commercial Partner、クラウド収益性および戦略リード、Melissa Mulholland
• Crayon、バイス プレジデント、Nabil Chebbi 氏
• マイクロソフト、セキュリティ マーケティング担当ディレクター、Ryan McGee

このセッションの模様はこちら (英語) からご覧いただけます。

7. Microsoft 365 Enterprise: A Single, Trusted Solution to Grow Your Managed Services Practice (Microsoft 365 Enterprise: マネージド サービス事業の成長を支援する 1 つの信頼できるソリューション)

マイクロソフトの Office パートナー担当ゼネラル マネージャーの Giovanni Mezgec、Microsoft Office 担当ディレクターの Jack Elmore、マイクロソフトのディレクターの Jeremy Chapman の 3 人が、新しい Microsoft 365 Enterprise によって、企業がスタッフの生産性を向上させ、セキュリティとコンプライアンスの要件をシームレスに満たすソリューションを実現する方法について説明しました。参加したパートナーの皆様には、お客様に新しい付加価値サービスを提供するメリットとビジネス チャンスについてお伝えしました。このセッションの模様はこちら (英語) からご覧いただけます。

8. Empowering Organizations with Microsoft Azure (Microsoft Azure が企業にもたらす力)

このセッションでは、企業が Microsoft Azure を活用してより多くのことを達成できるようにする方法と、パートナー様がそれによるビジネス チャンスを活かすための方法について、複数の業界エキスパートが解説しました。このセッションのスピーカーは以下のとおりです。

• 10th Magnitude、市場開発担当バイス プレジデント、Jason Rook 氏
• Rackspace Hosting、マイクロソフト テクノロジ担当 CTO、Jeff DeVerter 氏
• マイクロソフト、Azure + セキュリティ マーケティング担当コーポレート バイス プレジデント、Julia White
• Chef Software、ビジネス開発担当ディレクター、Michele Todd 氏

このセッションの模様はこちら (英語) からご覧いただけます。

9. Empowering Digital Transformation with Hosting and Managed Service Providers (ホスティングおよびマネージド サービス プロバイダーによるデジタル改革の支援)

マイクロソフトのワールドワイド ホスティング & マネージド サービス プロバイダー担当バイス プレジデントの Aziz Benmalek が、Rackspace Hosting のマイクロソフト テクノロジ担当 CTO の Jeff DeVerter 氏と 451 Research のデータセンター イニシアチブおよびデータ戦略担当シニア バイス プレジデントの Michelle Bailey 氏の 2 人の業界ソート リーダーと共に、マイクロソフトがパートナー様と協力してどのようにデジタル改革を支援しているかについて説明しました。マイクロソフトとサービス プロバイダーが共同で価値提案することに関するビジョンと戦略について独自の見解をお伝えしました。このセッションの模様はこちら (英語) からご覧いただけます。

10. Taking Risks and Failing Fast: Business Leadership Lessons in the Age of Mobile (リスクを恐れず早めに失敗すること: モバイル時代におけるビジネス リーダーシップの教訓)

このセッションでは、マイクロソフトの法人顧客セグメント担当コーポレート バイス プレジデントの Chris Weber が、低迷するビジネスの経営からパートナー様が学べることについて紹介しました。スピーカー自身のリーダーシップ モデルをベースに、要求の厳しい携帯電話事業から学んだ教訓と、その経験によってリーダーシップに対する見解がどのように変わったのかを説明しました。このセッションの模様はこちら (英語) からご覧いただけます。

面白かったセッションや見逃したセッションを観たい方は、Microsoft Inspire のセッション カタログ (英語) で検索できるので、ぜひご利用ください。

今年の Microsoft Inspire はいかがでしたか? 皆様にご満足いただけたようであればとても嬉しいです。来年の Microsoft Inspire はラスベガスで開催されます。参加費は 1,995 ドルとなります。ぜひこちらからお申し込みください (英語)。

先週はワシントン D.C. まで足をお運びいただき誠にありがとうございました! このイベントに関するご感想は、マイクロソフト パートナー コミュニティのこちらのディスカッション ボード (英語) までお寄せください。マイクロソフトや他のパートナーの皆様とお考えをシェアしていただければ幸いです。

『Forza Motorsport 7』に収録される 700 車種以上のクルマのうち、今週は 1950 Alfa Romeo 158、1967 Volkswagen Karmann Ghia、1953 Chevrolet Corvettel などのビンテージカー 60 台を公開。10 月 3 日の発売に向け、収録車種リストを ForzaMotorsport.net で毎週更新。

Forza Motorsport 7 収録車種公開ページ – Week 2 (ForzaMotorsport.net / 英語のみ)

• The Forza Garage Week 2

Forza Motorsport 7 製品ページ

• Forza Motorsport 7 | Xbox

関連情報:

• Forza Garage オープン。『Forza Motorsport 7』収録車種のうち 167 台を公開
• 『Forza Motorsport 7』カバー カー「2018 Porsche 911 GT2 RS」新規スクリーンショット公開
• Xbox One および Windows 10 PC 用レーシング ゲーム『Forza Motorsport 7』を 2017 年 10 月 3 日 (火) に発売、アーリーアクセス付き限定版および予約特典情報を公開

概要：學習縮小是如何統整搜尋結果並讓其變得更好理解。

縮小將紀錄搜尋結果分組來減少雜訊並產生一個統整的視圖。您只需在記錄搜尋的結果上方點選"縮小"，便會縮小搜尋結果。如下圖：

下圖是過去24小時縮小後的事件記錄：

從範例中可以看到縮小出了1272個不同的事件群組。這是一個很好統整結果的方法。

您可以利用選取敏感度的橫桿調整群組中事件的相似程度。敏感度越低，就越多事件會被分類在同一個群組中。然而若是將敏感度調得太低，將可能會把沒什麼關聯性的世間分在同一個群組，導致分組變得無效。

縮小也會偵測您的事件和群組事件中相似的變數，您可以點擊藍色的 "*" 來查看。點擊後您還可以任意點擊一個事件來深入查看其詳細資料。而若要查看所有完整的資料，可以點選上方的 [顯示較多]。

This post is a contribution from Sohail Sayed, an engineer with the SharePoint Developer Support team

We demonstrated creating a custom identity provider and integrating it with SharePoint to achieve single sign on in the blog post https://blogs.technet.microsoft.com/sharepointdevelopersupport/2017/07/07/creating-a-custom-identity-provider-and-integrating-with-sharepoint-to-achieve-single-sign-on-with-fba-across-multiple-web-applications/. In this blog we will demonstrate integrating the custom identity provider with Asp.Net web sites and Provider hosted apps.

Create a new asp.net web site.
We will start by creating a new asp.net web site. In my case I chose the Empty Web Site Template. This will create an empty web site project that will only contain the web.config file. Add a new web form to the site. If you have an existing asp.net site update the Web.Config with the configuration mentioned in the subsequent sections.

Web.Config configuration
The below sections describe the various web.config changes required. Note I am using the configuration for Microsoft.IdentityModel namespace. The same configuration can be done using System.IdentityModel namespace. More information on this can be found at https://docs.microsoft.com/en-us/dotnet/framework/security/namespace-mapping-between-wif-3-5-and-wif-4-5

Define the configSections
We need to first add the configSections that defines the rest of the configuration first. Add the below tags. If your web.config already has a <configSections> element just add the <section> tag.

  <configSections>
    <section name="microsoft.identityModel" type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  </configSections>

Modify the system.web section
Modify the <system.web> section as below. Note the requestValidationType defined in the httpRuntimeElement. This defines a class that will perform validation of the sign in request. This class is invoked by the IsSignInResponse method of the Microsoft.IdentityModel.Web.WSFederationAuthenticationModule. We will define this class in a later section in this blog

  <system.web>
    <compilation targetFramework="4.5" debug="true">
      <assemblies>
        <add assembly="Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
      </assemblies>
    </compilation>
    <authentication mode="None"/>
    <authorization>
      <deny users="?"/>
    </authorization>
    <pages controlRenderingCompatibilityVersion="4.0"/>
    <httpRuntime requestValidationType="SampleRequestValidator"/>
  </system.web>

Define system.webServer section
Add the <system.webServer> section which adds the WSFederationAuthenticationModule. This module is responsible for securing the asp.net site and handling the redirection to the custom identity provider

  <system.webServer>
    <validation validateIntegratedModeConfiguration="false"/>
    <modules>
      <add name="WSFederationAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler"/>
      <add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler"/>
    </modules>
  </system.webServer>

Define the microsoft.identityModel section
Finally add the <microsoft.identityModel> section. This section defines the following

1. 1. Audience Uris indicating the valid audience for the identity provider
   2. Issuer and realm information
   3. Certificate details used for trust and communication

  <microsoft.identityModel>
    <service>
      <audienceUris>
        <add value="https://custom.contoso.com/WebSite1/"/>
      </audienceUris>
      <federatedAuthentication>
        <wsFederation passiveRedirectEnabled="true" issuer="https://custom.contoso.com/customidp/" realm="https://custom.contoso.com/WebSite1/" requireHttps="true"/>
        <cookieHandler requireSsl="false"/>
      </federatedAuthentication>
      <serviceCertificate>
        <certificateReference x509FindType="FindByThumbprint" findValue="88c1d6ea0c3d9ee05459403cc8121e6ace5a7edd" storeLocation="LocalMachine" storeName="My"/>
      </serviceCertificate>
      <applicationService>
        <claimTypeRequired>
          <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="true"/>
          <claimType type="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" optional="true"/>
          <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" optional="true"/>
        </claimTypeRequired>
      </applicationService>
      <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
        <trustedIssuers>
          <add thumbprint="88c1d6ea0c3d9ee05459403cc8121e6ace5a7edd" name="https://custom.contoso.com/customidp/"/>
        </trustedIssuers>
      </issuerNameRegistry>
    </service>
  </microsoft.identityModel>

We need to make the following changes to the above section

• Modify the value in the <audienceUris> and the value of the realm attribute in <wsFederation> tag to the url of the current web site.
• Change the issuer attribute in the <wsFederation> and the name attribute in the <trustedIssuers>/<add> tag to the url of the trusted identity provider
• Update the findValue attribute the <certificateReference> tag and the thumbprint attribute <trustedIssuers>/<add> tag with the thumbprint of the certificate used by the trusted identity provider.

Note when copying the thumbprint from the certificate a special character gets added to the start of the thumbprint. This character is not visible in notepad. To remove this copy the thumbprint to the notepad. Press home key on the keyboard so that the cursor is at the beginning of the thumbprint value. Press delete key twice till the first character of the thumbprint is deleted. Manually type back the character.

Define the SampleRequestValidator class
In the “Modify system.web section” section we had specified the requestValidationType as SampleRequestValidator. We need to define this class now. Add a new class to the project and name it as SampleRequestValidator. Overwrite the code of this class with the below code

using System;
using System.Web;
using System.Web.Util;

using Microsoft.IdentityModel.Protocols.WSFederation;

/// <summary>
/// This SampleRequestValidator validates the wresult parameter of the
/// WS-Federation passive protocol by checking for a SignInResponse message
/// in the form post. The SignInResponse message contents are verified later by
/// the WSFederationPassiveAuthenticationModule or the WIF signin controls.
/// </summary>

public class SampleRequestValidator : RequestValidator
{
    protected override bool IsValidRequestString(HttpContext context, string value, RequestValidationSource requestValidationSource, string collectionKey, out int validationFailureIndex)
    {
        validationFailureIndex = 0;

        if (requestValidationSource == RequestValidationSource.Form && collectionKey.Equals(WSFederationConstants.Parameters.Result, StringComparison.Ordinal))
        {
            SignInResponseMessage message = WSFederationMessage.CreateFromFormPost(context.Request) as SignInResponseMessage;

            if (message != null)
            {
                return true;
            }
        }

        return base.IsValidRequestString(context, value, requestValidationSource, collectionKey, out validationFailureIndex);
    }

}

You can find more information on this class at https://social.technet.microsoft.com/wiki/contents/articles/1725.wif-troubleshooting-a-potentially-dangerous-request-form-value-was-detected-from-the-client.aspx

Read the user value

Finally we need to be able to read the user value and the claims.

Update the code in the default.aspx Page Load method as below

    protected void Page_Load(object sender, EventArgs e)
    {
        if (HttpContext.Current.User.Identity.IsAuthenticated)
        {
            Microsoft.IdentityModel.Claims.ClaimsPrincipal cp = HttpContext.Current.User as Microsoft.IdentityModel.Claims.ClaimsPrincipal;

            if (cp != null)
            {
                foreach (Microsoft.IdentityModel.Claims.Claim claim in cp.Identities[0].Claims)
                {
                    Response.Write(claim.ClaimType + " - " + claim.Value +"<br>");
                }
            }
        }
    }

Browse the page. It should redirect you to the custom identity provider login page if you are not already logged in. After successfully login you should be able to see the claims on the page.

Additional Configuration for Provider hosted add-ins.
Provider hosted apps are asp.net web sites and will use the same configuration as defined above. We need to make some additional changes to be able to make calls into SharePoint.

Firstly you need to configure the Provider hosted add-in to use SAML as mentioned in this blog from Steve Peschka

https://samlman.wordpress.com/2015/03/01/using-sharepoint-apps-with-saml-and-fba-sites-in-sharepoint-2013/

The helper classes mentioned in the above blog are available at the below link

https://samlman.wordpress.com/2015/02/28/an-updated-claimstokenhelper-for-sharepoint-2013-high-trust-apps-and-saml/

By default in this code the RetrieveIdentityForSamlClaimsUser method of the TokenHelper class casts the HttpContext.Current.User object as System.IdentityModel.Claims.ClaimsPrincipal. Since in the web.config we are using the configuration for Microsoft.IdentityModel the above operation will return null. To fix this go to the TokenHelper. RetrieveIdentityForSamlClaimsUser.

Find the line Microsoft.IdentityModel.Claims.ClaimsPrincipal cp = UserPrincipal as System.IdentityModel.Claims.ClaimsPrincipal;

Change this to

Microsoft.IdentityModel.Claims.ClaimsPrincipal cp = UserPrincipal as Microsoft.IdentityModel.Claims.ClaimsPrincipal;

This should now retrieve a valid claims identity.

In addition in the default.aspx use SMTP to retrieve the ClientContext since we are using email address as the identity claim

            var spContext = SharePointContextProvider.Current.GetSharePointContext(Context);

            // using (var clientContext = spContext.CreateUserClientContextForSPHost())
            using (var clientContext = spContext.CreateUserClientContextForSPHost(TokenHelper.IdentityClaimType.SMTP))
            {
                clientContext.Load(clientContext.Web, web => web.Title);
                clientContext.ExecuteQuery();
                Response.Write(clientContext.Web.Title);
            }

If you now deploy the provider hosted add-in you may still get a 401 error. To fix this we need to update the user profile of that user. This is because the user rehydration process in SharePoint will map the identity claim to one of the fields in the user profile. In our case since we are using SMTP in the Provider hosted app when getting the client context we need to ensure the WorkEmail field in the user profile for the current user in SharePoint Central Administration matches the value of the identity claim. The Provider hosted add-in will start working after this change. For more information on user profile configuration with Provider hosted add-ins refer to the below blog

https://samlman.wordpress.com/2015/03/01/oauth-and-the-rehydrated-user-in-sharepoint-2013-howd-they-do-that-and-what-do-i-need-to-know/

Beim Imagine Cup treten seit 15 Jahren Nachwuchs-Entwickler aus der ganzen Welt an, um die Microsoft-Jury von ihren Ideen, Produkten und Lösungen zu überzeugen. Die besten der 350.000 Bewerber stehen jetzt in der Final-Runde in Redmond, darunter auch zwei Teams aus Deutschland.

Wir arbeiten jeden Tag daran, Menschen und Unternehmen dabei zu unterstützen, mehr zu erreichen, möchten durch neue Technologien den Alltag vereinfachen oder neue Erfahrungen ermöglichen. Und weil wir daran glauben, dass Technologie in vielen Bereichen, wie zum Beispiel Nachhaltigkeit, dem Schutz von Menschenrechten, Gleichberechtigung und vielen mehr, die Welt zu einem besseren Ort machen kann, sind Initiativen wie der Imagine Cup auch so wichtig.

Seit 15 Jahren kommen jedes Jahr begabte und engagierte Studenten aus der ganzen Welt zusammen und präsentieren ihre kreativen Ideen und Projekte. Allein in diesem Jahr haben mehr als 350.000 Teilnehmer aus mehr als 180 Ländern an dem internationalen Wettbewerb teilgenommen. 54 Teams konnten sich durchsetzen und zeigen diese Woche in Redmond, was in ihnen - und ihren Projekten – steckt. Auf den Sieger wartet nicht nur ein Preisgeld in der Höhe von 100.000 USD, sondern auch ein Coaching durch Microsoft CEO Satya Nadella sowie ein 125.000 USD Azure Grant und die Teilnahme an der Build Developer Conference im kommenden Jahr.

Zwei Teams aus Deutschland haben sich im nationalen Finale für die Teilnahme qualifiziert und sich auf den Weg nach Seattle gemacht.

Team SmartCase möchte dafür sorgen, dass verlorene Gepäckstücke in Zukunft der Vergangenheit angehören. Das Team vom Karlsruher Institut für Technologie (KIT) hilft mit seiner Lösung, Reisegepäck aufzufinden und gegen Diebstahl zu sichern. Nutzer können ihr Gepäck über GPS orten und über eine App auf dem Smartphone weltweit nachverfolgen.

Team koicode von der Technischen Universität München visualisiert Code. Die verbesserte Lesbarkeit soll Anfängern einen einfacheren Einstieg ins Programmieren ermöglichen. Die Visualisierung zeigt vor allem Schülern und Studenten den Aufbau und die Zusammenhänge von Codes nachvollziehbar auf.

Beide Teams haben innerhalb der ersten Runde im Tech Showcase super Pitches gegenüber den Juroren hingelegt. Team SmartCase konnte sich im ersten Schritt erfolgreich gegen die Konkurrenz behaupten und ist in das Viertelfinale eingezogen, hat dann aber den Einzug ins Halbfinale knapp verpasst. Team koicode konnte im Tech Showcase zwar schon in weiten Teilen begeistern, die Juroren waren aber leider (noch) nicht restlos überzeugt.

Beide Teams haben nun noch die Gelegenheit, im Rahmen der Wildcard-Runde die Chance auf den Einzug in das Halbfinale zu wahren und feilen in der Zwischenzeit an ihrem Elevator-Pitch.

Mehr Informationen gibt es auf der offiziellen Imagine Cup Webseite, via Twitter und natürlich im Live-Stream zum Imagine Cup Finale 2017 am Donnerstag, 27. Juli ab 18:00 Uhr.

Ein Beitrag von Pina Kehren
Communications Manager Mobile Devices, Digital Education & Innovation