Even though Microsoft retired the MS600 exam and the associated Microsoft 365 Developer Certification in March 2023, you can still use the free self-paced resources that they provided to learn how to build solutions with Microsoft Identity and Azure AD. In this video, I'm giving you my entire guide that walks you through these free resources, including lectures, hands-on labs, and videos. Hi, I'm Andrew Coll, and if you're new here, be sure to hit that subscribe button to stay up to date on all my videos for web and cloud developers on Microsoft 365 and related topics. And while you're at it, make sure you subscribe to my newsletter to get insights and the latest news in the world of Microsoft 365 for web and cloud developers. I've got a link to it here and the one in the description below. Before we get started with this, I wanna set some context on what this video is going to cover. And while this only takes a moment, if you're familiar with the history of my MS600 exam prep for self-paced learning about building apps that leverage Microsoft Identity or more specifically Azure AD for self-paced learning on Office Add-In Development. I've got chapters for everything. I created an exam prep course for the MS600 exam building applications and solutions with Microsoft 365 core services that hundreds of developers had used to prepare for and pass the exam. Microsoft used the exam to measure a developer's knowledge around a few Microsoft 365 workloads, things like SharePoint, Microsoft Teams, Azure AD, Microsoft Graph and Office Add-Ins. But when Microsoft retired the exam in March 2023, I was left with this course that served as a guide for all those free self-paced study resources that developers could use to prepare for the exam. I can't sell that. No one could buy it would buy that course or more importantly, I can in good conscience sell it because the exam doesn't exist anymore. But here's the thing, the course content is all still valid. It's a self-paced guide on how to learn various things. Like what you need to know to be a qualified developer building apps that leverage Microsoft Identity and Azure AD. So I've decided to release the chapters for each of the different workloads here on my channel. That's what you're about to watch. Note that there are parts of the video where I refer to the exam. Just know that the exam, I'm referring to the MS600 exam. That's retired at this point and it's no longer available to take. Also throughout this video, I'm going to reference a lot of online resources like documentation, training modules, videos, hands on labs. The links are all in the video but I've also compiled them in a single downloadable PDF and you can get this from the link in the description below the video. It's all on my site. Okay, enough with the explanation out of the way. Let's dive into learning about the free self-paced resources for learning about building apps that leverage Microsoft Identity or more specifically, Azure AD. Microsoft Identity is the marketing label that Microsoft uses for the entire identity platform from Microsoft. And it includes the following things. It supports authentication for MSA accounts which are Microsoft personal accounts including those that you use to log in to things like Skype, Xbox and Outlook.com. Azure Active Directory, which is also referred to as Azure AD or AAD and these are commonly referred to as work and school accounts and then Azure AD B2C which is also referred to as business to consumer or business to customer. It also implements OAuth2 and OpenID Connect to help support different multiple authentication scenarios. It also includes open source libraries with multiple variations of these different open source libraries. The most current version is the Microsoft authentication library also known as MSAL. MSAL replaced the previous library which is Azure AD authentication library which we knew of as ADAL. I'll talk more about MSAL later in this chapter. The identity management portal is located at HTTPS, colon whack whack, aad.portal.azure.com and it's the same management portal for Azure AD that you've accessed to within an Azure subscription except they wanted to make it available to anyone who can manage the tenant without needing a full blown Azure subscription so they created this extra little interface. Microsoft Identity also includes an API, PowerShell Commandlets and commands in the Azure CLI that enabled the creation, management and all the configuration of Azure AD applications. And finally, Microsoft Identity also includes loads of developer content such as documentation, a glossary of terms, quick starts and plenty of tutorials used to educate developers on the platform. Now let's take a minute to explore what lessons that you're gonna find in this chapter so that you can know what to expect as you proceed through the Microsoft Identity chapter. In this current overview lesson, you've learned what the Microsoft Identity workload is all about. On the next slide, I'm gonna wrap up this lesson with some additional learning resources and be sure to check the notes on this lesson under the video below for a collection of all the external resources and references that I'm gonna use throughout this chapter. The Microsoft Identity workload is huge, but you don't need to know everything about this topic in order to pass the exam. So in the next lesson, I'm gonna call out specific things that you need to focus on as well as things that you can ignore as they aren't relevant to the exam. In the next two lessons, I'm gonna go through all the various core identity topics and authentication flows that are supported by Azure AD that you should be prepared to answer questions about on the exam. Next, we'll look at how you can create and configure Azure AD apps using the Azure AD portal. This lesson will cover how to manage who has access to the app using things like users, groups, and app roles. One component or one key component of Microsoft Identity and apps are the different types of permissions as well as the consent framework. Now I explain this in this lesson what you need to know about these different topics. And in the last lesson, you're gonna learn what you need to know when it comes to configuring custom apps and APIs that you're gonna build to be secured and leverage Azure AD at least to the extent that you're gonna be tested on the M65 exam. And just like all the other chapters in this course, I'm keeping the depth of the explanation to the level that you need to know in order to pass the exam. I'm not trying to go too deep with my explanations because this is an exam prep course. It's intended to teach you, it's not intended to teach you everything about each one of these different topics. There are plenty of other resources that are available to you that you can leverage if you are familiar with a particular topic. And when I cover something in the course, you may think, okay, I got it. I'm comfortable with my knowledge on this topic. But if you think to yourself, I don't get it. Or if you are familiar with a process or an API that I cover, then you should go read up on the official documentation or study one of the multiple resources that I'm referencing throughout this course to make sure that you are adequately familiar with the topic prior to taking the exam. Now reference specific resources throughout the course, but like I said before, be sure to check the notes for this lesson under the video below for a collection of all the external resources that I use throughout this entire chapter. But on this slide, I want to quickly run through the Microsoft learning resources that I'm providing and explain what's in each one of these things. The first group of links are around Microsoft learning and they have learning paths and modules and a learning path is a collection of modules that have been strung together. The learning path for Microsoft identity is called implement Microsoft identity associate and it contains the modules used for self-paced study to study for the exam. And then we have five modules that cover various topics that I'll reference throughout this chapter. All of these modules contain hands-on labs. So if you want to practice some of the topics like if you need to be more familiar with them prior to the exam, then that's a great place for you to use a great resources for you. These modules are as follows. Getting started with Microsoft identity, application types in Microsoft identity, permissions and consent framework, secure custom APIs with Microsoft identity and then finally work with users, groups and roles and custom apps and APIs. Now Microsoft identity contains a ton of documentation as well on their site. The two links that I want to call out here is the homepage that's titled what is the Microsoft identity platform and the glossary of terms. Okay, that wraps up the overview lesson. In this lesson, we're going to tackle some of the core identity topics. It's sort of a random grab bag of terms of things that you need to understand. You need to know the difference and the relationships between the application object and the service principle. When you create an application in Azure AD, you're creating an application object under the covers. This object resides within the Azure AD tenant where the application was registered and this is also known as the application's home tenant. The application object is used as the template to create service principles and this object describes three aspects of an application. It includes, number one, how it can issue tokens in order to access the application. Number two, resources the application might need to access and number three, actions the application can take. The application object is the global representation of your application for use across all tenants. Now, the service principle object is created in every tenant where the application is actually used. To access resources secured by Azure AD tenants, the entity that wants to access must be represented by a security principle. For users, these are user principles while applications are represented by these service principles. Now, it defines the access policy and the permissions for the application within the Azure AD tenant. A service principle is the local representation or the application instance of a global application object in a single tenant or a directory. This relationship between the application object and the service principle object can be thought of as similar to traditional OOP concepts or object oriented programming concepts. The application object is like a class while the service principle object is an instance of the class. Now, let's look at an example for a second here. Now, this picture is going to represent both a single tenant app or a multi-tenant app. So let's just focus on the single tenant app first. So that's the top part that you see there on the slide, just the boxes that are covered in like a blueish green. We're in a tenant called the addendum tenant, all right? And we have an application that we've defined called the HR app. Now, that app when it was created, got its own application object. That's like the definition of the application, the name, some permissions that it needs, et cetera, all those kinds of things and the different configuration settings on it. When I created the application inside my tenant, it automatically also created a service principle because an application can always be used by the people in the tenant where the application was actually registered. So you see there I have a service principle as well and this application is going to access the sum resource. Now, let's just say that this was a single tenant app. No other tenant or another way to say it is that no other users in any other tenant are going to be able to log in and use this application. Only users in the addendum tenant are going to be able to use it. But if when I registered this application, I registered it as a multi-tenant application, then what happens is that when I go to use the application in another tenant, like you see there at the bottom from Contoso or Fabrican, what Azure AD is going to do is that when I grant the permission access or permissions inside of my tenant, Microsoft is going to create a service principle which is like a copy of the application definition inside of these other tenants. So it's not getting a copy of the application definition, it's actually getting a service principle which is like a representation or use the application definition as the template in a way to create the service principle. The service principle is the thing that is actually going to be defining the permissions and stuff that say what we can actually do or the fact that it's been consented to be able to be used inside of this tenant. Now let's talk about OpenID Connect. This is an authentication protocol that is built on top of the OAuth2 protocol. This allows you to implement a single sign-on using OAuth. And this is made possible because the OpenID Connect extends the OAuth2 authorization protocol for use as an authentication protocol. It introduces the concept of an ID token that's used to identify a user. You should be familiar with OpenID Connect for the exam but you don't need to know all the parts of the protocol. Just understand how it fits into the picture with respect to Microsoft identity, how it's used to implement SSO and what ID tokens are. Let's take a look at the sequence diagram, the UML sequence diagram of what OpenID Connect looks like. So you see here we have the browser which think of that as like the user. I'm sitting on my laptop and I've got the browser open and I wanna go access some website. So that's at the web server on the far right. Well in the middle is Azure AD. So that's the authorization endpoint that you see there on the dotted vertical line right down the middle. So let's say I wanna use this application. So first step, I'm gonna navigate to some web app that's over on that web server. The web server is gonna notice you're not logged in. So I need to know who you are. And so what it's gonna do is it's going to send a response back to the browser that says you need to go log in which is really just a redirect back to send me back to the authorization endpoint to go log on using the Microsoft identity platform. So I enter in my username and my password and if I've got it set up, multi factor off as well. Maybe I'm using a security token, bunch of different options there. And if I've never used the app, I'm gonna have to go consent to the permissions that the app is gonna be requesting. And we'll look at that when we talk about permissions and consent in a later lesson. Once I successfully log in, Azure AD is gonna redirect, is gonna send a response back to me, back to my browser that's gonna say you need to be redirected back to the web server. But when it does that, it's gonna include the ID token. And that ID token is gonna be sent over to the web server where I'm being redirected to. The web server can then use that ID token to figure out things like what's my name, what's my email address, simple stuff like that to where I can then create an account and render a page that's a secure page back to the user. Maybe it needs additional permissions, maybe it needs additional data. That can all be done using an access token, but this is just the ID token that just identifies who the user is that they've actually signed in based on what Azure AD knows about this user. Now let's talk about resource servers and resource owners. The resource owner is an entity that is capable of granting access to a protected resource. So for example, I am the resource owner of my Microsoft 365 mailbox in Exchange Online. My mailbox in Exchange Online, that's the resource. Now resource server is gonna host the protected resource. So for example, the Microsoft Graph API is a resource server that provides access to my Exchange Online mailbox, which is the resource. That's the thing that contains my email and my calendar. Now let's talk about different types of security tokens that are involved in Azure AD applications. None of these are defined by Azure AD or Microsoft. Rather, they are all defined as part of the different authentication protocols and specifications as defined in the OAuth2 spec. Now all tokens in the Microsoft Identity Platform are implemented as JSON web tokens. This is also referred to as JWTs or Jot Tokens is how they're pronounced. These token contains claims which are assertions or name value pairs about an identity such as the resource owner. They're relied on for multiple use cases. Security tokens are relied on within Microsoft Identity for multiple things. Applications can validate tokens, identify the tenant the token is intended for, which we also refer to as the audience of the token, to display user information or to determine what the user can do. Now let's look at a few different types of tokens. Access tokens are issued by authorization servers and used by applications to determine access to a protected resource. They contain claims that define what the user has been granted and consented to do within a resource. So for example, one claim contains the scopes or permissions, a user has been granted to Microsoft Graph such as mail.read. You commonly see these referred to as user plus app or app only access tokens, depending on the scenario where they're being used. And as I previously covered, the ID token that's defined by open ID connect, it contains the claims pertaining to the authentication of an end user. And unlike an access token, these aren't used for purposes related to resource access and access control. Now a refresh token, now that's issued by an authorization server and it's used by an application to request a new access token. This is commonly done prior to the access tokens expiration date. Unlike access tokens, refresh tokens, they can be revoked. Now an authorization code, these are short-lived strings. They're created by the authorization endpoints and they're used in the authorization code flow for the OAuth2 authorization grants, something we're gonna look at in a later lesson. Now while it's not really a token, you can think of them as a kind of a token because these are short-lived strings that are returned to client apps in response to an authentication process. They indicate that the resource owner has delegated authorization to access the requested resource. The application commonly redeems this code with the token endpoint in exchange for an access token. There are two types of clients defined in the OAuth2, confidential and public clients. And the difference between the two is really defined by the client's ability to maintain the confidentiality of the app's credentials. Now Azure AD application credentials consist of an ID like a login name for a user and either a secret or certificate like a password for users. Now the most common example of a confidential client is like a web application. And in this scenario, the application code runs on a web server that's not accessible by the end user. Within server side code, the application can keep the clients or web applications credentials private. The client's ID is not necessarily a secret and it needs to be protected, but the client's secret or certificate should be. Confidential clients can keep these secrets. Well, they can keep them confidential, hence the name. Now on the other hand, public clients can't keep the app's secrets confidential. Some examples of these include single-page applications also known as desktop or mobile apps. Now the reason these are considered public clients is because the code for the application runs on the user's device. And so it's not fully protected. It's not fully secure because it can't be in full control of the device developer or the application owner. In the case of a single-page app, that's the user's browser. Or if it's a native app, that's the user's desktop or laptop or tablet or phone. Okay, so that wraps up some of the core identity topics that you're gonna need to know. In this lesson, we're gonna take a look at the OAuth 2 authorization flows supported by Azure AD. Now you should be familiar with all of these, how they work, compare and contrast them as well as what app scenarios they would make the most sense for. Now one point before I get started, remember what I said in the previous lesson that Microsoft learning modules don't cover these topics because the Microsoft Identity team didn't think developers should focus on these, rather they should focus just on the MSAL and Microsoft Identity.Web libraries. But if you weren't familiar with anything in this lesson, please refer to the links in the lesson notes for details on these topics because you will get questions that are related to the actual flows and you really should know how these flows work and the differences between them. You also need to understand about the different endpoints as well and that's what we're gonna go into on this slide. Before we dive into the OAuth 2 flows, we need to touch on these two endpoints. Now these endpoints implement the authentication flows defined in the OAuth 2 protocol specifications. There are two different endpoints. The authorization endpoint is used to interact with the resource owner to provide an authorization grant during the OAuth 2 authorization grant flow. Depending on the authorization grant flow used, the grant provided can either be an authorization code or it can be a security token. Now in most cases, this is the first stop in an interactive application authorization flow where a user authenticates with Azure AD using their credentials. The token endpoint is used by a user or an application to acquire an access token, a refresh token or an ID token. The admin consent endpoint, and this one's special, because tenant administrators are gonna be able to use this so that they can consent to the administrative permission request for an application. And I'm gonna talk more about admin consent in the lesson on permissions and consent framework later in this chapter. Now let's look at the different authentication flows. Now I'm gonna go over each one of these at a high level. Again, if you aren't familiar with them, I suggest you read up on them and the links I provide in the lesson notes. The authentication flows are the implicit flow, the authorization code grant flow, the device code flow, the client credentials flow, and then one called the on behalf of or OBO flow. Now let's take a few minutes to look at each one of these different things. The implicit flow is for single page applications and these type of applications run entirely in the browser and are considered public clients. What makes this flow unique is that the tokens, including the ID tokens and the access tokens are returned directly from the authorization endpoint that we covered previously instead of the token endpoint. Now remember, you're tested on the implicit flow, but the guidance today is to use the authorization code grant flow when you're doing a single page app. I'm gonna repeat something I said previously in this chapter. Remember that I said the implicit flow is no longer recommended by Microsoft and instead developers should implement the authorization code grant flow that has been updated to support single page apps. The reason is because the implicit flow relies on third party cookies. Many browsers are removing support for or blocking third party cookies and so because of this, the implicit flow is really no longer reliable. However, only MSalJSv2 supports the updated authorization code grant flow for single page apps. The MS600 exam at the present time still questions you on the MSalJSv1 release which still relies on the implicit flow. It doesn't understand how to use the authorization code grant flow in a single page app scenario. Now the authorization code grant flow, this code, this flow is used in apps that are installed on a device to gain access to protected APIs. These types of applications are usually considered confidential clients and this flow enables applications to securely acquire access tokens that can be used to access Azure AD secured resources, obtain refresh tokens and ID tokens for the current user. Now while you won't be tested on it due to the MSalJSv2 requirement that I mentioned with the implicit grant flow on the last slide, this flow has been updated to support something called proof key for code exchange, PKCE when this code is used in public clients such as single page apps or native client apps that is only supported in MSalJSv2. Now the next kind of flow, this is the device code grant flow. This is gonna enable an application to support a multiple device sign in process because the application using this flow runs on a user's device and this flow is commonly used only on public clients. The way that this one works, in this scenario, an application can pause for authentication to happen on another device. So like for example, when you log into the Azure CLI or input constrained devices like smart TVs or printers or IoT devices, the device will provide a URL and a code for the user to open on their phone, tablet or any other device. And while the user is going through the authentication process, the application is pulling the token endpoint for necessary tokens. If the user hasn't completed the authentication process, the token endpoint will tell the application how long it should wait before asking for the requested tokens again. But once the user completes the sign in process on the other device, the original application will receive the access token, the refresh token and the ID token. Now the next one is the client credentials grant flow. This is also referred to as two-legged OAuth which is used to access web-hosted resources by authenticating with just the identity of the application. Now unlike the other grant flows, the client credentials grant flow doesn't use an authorization endpoint, rather it goes straight to the token endpoint by providing its client ID in secret or certificate to obtain an access token. Also unlike the other flows, it only obtains an access token. You cannot get a refresh token in this scenario. This grant flow is commonly used in public clients specifically for applications that have no user interaction. For example, they are popular with primarily with services or daemon style applications. And because these applications use client credentials grant flow don't involve interactive users, they only really are only gonna really apply to application permissions, not delegated permissions. Don't worry, we'll talk about what those are and the differences between them in a later lesson. So this is what the UML sequence diagram looks like for a client credentials grant flow. You notice that it goes right past the authorization endpoint. It's not even listed here on the UML sequence diagram. You can see that it's just going straight to the token endpoint to obtain its credentials. Again, of course, it does have to go through and grant permissions and it does that using the admin consent endpoint. Something we'll talk about later when we talk about permissions, the different types of permissions. Now the last type of OAuth flow that's covered in the MS600 exam is the on behalf of flow. This flow, also referred to as OBO, addresses the scenario where an application is gonna call a service or an API that in turn needs to call another service or an API. So for example, let's say I have a web app that calls a custom API that is then gonna call Microsoft Graph. What this is gonna enable is propagating the authenticated user's identity through the entire chain of calls so the user's identity is delegated to the middle tier application or API. In order for this to work, the middle tier app request, the middle tier app requests an access token from the token endpoint using a specific grant type that's requested. And then it's gonna specify the client credentials for the middle tier app using like say a client ID and a client secret or certificate. Next, it's gonna enter the access token in the middle tier application received from the client. And then finally, it's gonna how the request should be processed. In this case here, we're specifying that it should be used on behalf of flow. Okay, so that's gonna wrap up my lesson on authentication flows that you need to know. And in this lesson, we're going to take a look at Azure AD applications, specifically the registration process, account types, securing them and how to manage access to these applications. So let's get started. Now, so far in this chapter, I've talked a lot about the different aspects with Microsoft identity core concepts related to identity and the various OAuth2 flows that Microsoft identity supports. But the centerpiece in Microsoft identity is the application. The application is what enables users or other applications to use the resource the application is associated with. Now, based on the permissions and other settings defined within the app's registration. Now applications are managed using the Azure AD management portal. And originally, this was only available to users with an Azure AD subscription through the portal. But today, you can also manage your Azure AD tenant through a limited version of the Azure AD portal. You can get it through the portal.azure.com or you can get it through aad.portal.azure.com. The second one is the more limited version of the portal of the Azure AD portal. Or really, it's just the Azure AD portal. It just doesn't include any of the other Azure resources. You need to go to the main Azure management portal to get to all of your resources there. Now, one important point that you must understand for the exam is the different application or account types. I talked a little bit about this in a previous lesson. I'm gonna go into a little more depth in it here on what the single tenant multi-tenant means. The two options relevant for Microsoft 365 and the exam are single tenant and multi-tenant. And this is the very first decision that you're gonna face when registering a new application. Well, okay, the second, the first one is what's the name of the app? It specifies if people within your organization can or can't use the application. A single tenant application is an application where only the users that belong to the same Azure AD tenant where the application is registered can use the app. The other option, multi-tenant, these are those applications that will allow any user with any Azure AD account, specifically a work and school account, can use the application, including different tenants. Remember the discussion on application objects and service principles earlier? This is where these come into play. For single tenant apps, both the application object and the service principle live in the same Azure AD tenant. But with a multi-tenant app, the application object resides in the Azure AD tenant where the application was registered, the home tenant. And then any other Azure AD tenant that has granted consent to the application is also gonna have a service principle in it that points back to the application object in the tenant where the application was registered that includes both the home tenant and any of the other tenants that are using that application. You need to be familiar with single tenant and multi-tenant accounts. The relationship of the application object and service principle with respect to the different types of accounts. The next thing you need to be familiar with is securing an app. You can secure it with a secret, which is just a string similar to a password that a custom app can use to define themselves and authenticate with Microsoft identity. I think of this like a user's password, but it's for the app. When you create the secret, you set an expiration duration for it, and then the Azure AD portal shows it just one time. If you fail to copy the secret, your only recourse is to create a new one as the secret is never shown again. The other option is to secure an application is using a certificate. And this is the recommended way that you should secure applications, especially production apps, because they can be better protected than secrets can. In addition to the client certificates, you should also be familiar with how to store and obtain certificates from Azure Key Vault. While developers can securely store secrets in Azure Key Vault, services need a way to access Azure Key Vault. Managed identities provide an automatically managed identity in Azure Active Directory for applications to use when connecting to resources that support Azure AD authentication. Applications can then use managed identities to obtain Azure AD tokens without having to manage any credentials. In the next lesson, we're gonna cover permissions and the consent framework that goes into a little bit more depth when it talks about secrets and the different types of apps. But first, let's talk about how we can manage access to your Azure AD applications with Azure AD. Microsoft Identity provides a few different ways that you can do this. So who can use the application? Let's start out there. By default, applications registered in Azure AD are available to all successfully authenticated users of the tenant where they were registered. In multi-tenant scenarios, all users in the tenant where the app is provisioned can access the application once they successfully authenticate with their respective tenants. Now administrators can limit access to the application in one of three different ways. You should be familiar with all three of these for the MS600 exam. First, administrators who are global admins in the tenant can limit the application access to specific users. This is done in the Azure AD portal and this is done by first going to the application in the Azure AD portal and then selecting the users who are permitted to use the application. If you aren't familiar with this process, refer to the Microsoft Learning Module referenced in the lesson notes for a hands-on lab that walks you through this process. Managing application access with individual users can be a very tedious process, especially if you've got a lot of users. So another option is to create a security group and grant access to that group. Using this approach, all users assigned to that group will get access to the application. Like managing access with users, if you aren't familiar with this process, refer to Microsoft Learning Modules that I referenced in the notes for this lesson for hands-on lab that walks you through the process. A popular way to also enforce authorization in an application is with role-based access control, also known as RBAC. RBAC enables an administrator to grant permissions to specific roles, not to users and groups. The roles are then assigned to users or groups to control access. And this approach enables admins to manage access to applications with much less effort instead of going and using users and groups. Now, the way this works is that you first define the roles for an application and while the Azure AD portal does contain a user experience for this, it doesn't exist when the exam was created. So you should be familiar with adding roles to the application's manifest file. If you aren't familiar with this process, refer to the Microsoft Learning Module referenced in the lesson notes for hands-on lab process that walks you through this. You then gonna assign a role to users or groups and then to leverage these roles within your application's custom code, you can check to see if the user has been assigned a specific role. While groups and app roles sound similar, there are some important differences and you should be familiar with these differences prior to taking the exam. For example, when an app registration is removed, it also removes its app roles that are assigned to users and groups. However, groups always remain intact if the app is removed. Application roles are specific to an application as they are defined within the app registration but groups, they're not related to apps, they only are associated with an Azure AD tenant. Those are two big differences. Okay, so that wraps up my lesson on Azure AD apps where we talked about app registration, securing apps, securing access to, in this lesson, we're gonna explore two more important concepts in Microsoft Identity, permissions and the consent framework. So let's get started. When it comes to permissions, there are a few simple concepts that you need to be familiar with with respect to the MS600 exam. Let's start with two different types of permissions that are supported by Microsoft Identity. The first type are delegated permissions and these are permissions that have something to do with a specific user. A delegated permission is used by an app that has a signed in user present. Think of it like if you're delegating an app to act on your behalf using your permissions. So for example, you have access to read and send emails from your mailbox. You can delegate an app, the permission mail.read to read the emails in your mailbox but not mail.send. This way, the app will only be able to read but not send emails because you've only delegated one of those permissions to the app, that's the reason why. Delegated permissions can be granted to an application by a user or an administrator can grant them on behalf of all other users in the organization. Some delegated permissions also require an administrator to grant those permissions. So think about it a little bit like this. I've got this app right here, it's a phone but let's just call it an app. So I have permissions to both send and read email. This app, when someone created this app, they said that it can do the mail.read permission. So it can't send mail but it can read mail. Now this app all by itself, it can't go access my mailbox. But what I can do is I can delegate my mail.read permission to this app. So that now once I do that, once I consent to this app being allowed to have that mail.read permission, this app can then go read my mail. When I talked about it a second ago as well an administrator can do this, an administrator can go grab this app and it can go on behalf of all the people in my organization and it can say that all of those people grant that app that permission. Sometimes that's done when you have like an enterprise based app that you wanna give, make sure that everybody in the organization can use and not have to send instructions to everybody saying, hey, you're gonna get this prompt when you first log in, you're gonna have to give it this permission. Global admins have the ability to do that. The second type of permission are application permissions. And unlike delegated permissions, an app permission can use the application permissions without a signed in user present. These types of permissions are usually used in an automated process like a service or a daemon. Application permissions can only be granted by an administrator. So again, let's use our same example. Mail.read and Mail.send, this app has those two permissions and they're administrative permissions or they're application permissions. Now by themselves, this app can't just go do those things until a administrator in your tenant goes through the administrative consent with this app and says, now you can go do that. When that happens, the app doesn't have to have a person present. It can just go do that for anybody in the organization. So application permissions are very, very sweeping. They're very wide scope and they're very permissive. So you wanna be careful about those while a lot of organizations don't allow them. Now there's another permission concept that you need to be aware of, but it's not really a permission type, it's just a concept. The effective permissions are the permissions an app has. They are best explained with a couple different examples. So when you look at a delegated permission, the effective permission an app has is the least privileged intersection of all the delegated permissions an app has been granted for a signed in user. For example, I don't have permissions to send email. If I don't have those permissions, I can't grant them to this app. Consider another example. Let's assume that your app has been granted the permission user.readwrite.all, which is a delegated permission that grants an app the ability to read and update the profile of any user in the organization. If the currently signed in user is an administrator who also has that permission, then the app can read and update profiles of any user in the org. However, if the user that is currently signed in is a normal user and the app will only be able to update that user's profile, not everybody's profile, because only that user that normal user has rights to their own profile. They don't have rights to update other people's profiles. When you look at application permissions, the effective permission is really all of those that the app has been granted to as there's no signed in user that's applicable here. Signing users are applicable to application permissions. Maybe a picture helps. So here you can see on the right-hand side, you've got all the users that have permissions for operations managed by their organization where on the left-hand side, these are all the apps that have been granted all these permissions to do all these different things. The effective permissions are the ones that is the intersection between the two. What has the app been granted access to do and what has the currently signed in user been granted access to do? But then again, that only applies to delegated permissions. Remember, application permissions doesn't need a user presence. So that right-hand side doesn't even matter. Now, to prepare for the MS-600 exam, you should be familiar with how to read permissions as well as these special open ID connect permissions or scopes, things such as open ID, email profile and offline access. These are all common scopes here. You should refer to the documentation that are provided in the notes to read up on these different scopes. Now, one more special permission that you should be familiar with is the default scope. Your application request this, can request this scope. Now, I receive all the permissions when I do this. My application receives all the permissions or all the scopes that have been assigned to the app in the Azure AD portal. So for example, a request to graph.microsoft.com slash dot default will return all Microsoft graph related scopes that have been assigned to the app. Now, this scope can only be used with any OAuth2 flow but it's required when you are using the on behalf of and client credentials flows. Okay, now let's talk about consent. The consent framework is how permissions or scopes are granted or consented to an application. There are a few aspects about the consent framework that you should be familiar with prior to taking the MS-600 exam. Individual consent is the process of prompting a user to grant or consent an app a delegated permission. While Microsoft's identity SDK is simplified this process, you should read the documentation and understand how this works in detail. But let me give you a bit of an overview. Let's say your application needs you to delegate the calendars dot read permission to it. The app would provide you the following URL. So here's what you're gonna see. This is the URL that's gonna come back to the app from the app to the browser.  Let's look at this at a few of these pieces in this URL. So refer to the different OAuth2 flow documentation for details on each one of these different properties. We're just gonna pick apart a couple of them. The client ID tells Azure AD which registered app is requesting the permission. While the redirect URI, it has to match a redirect URL that is entered when the application was registered in Azure AD. This is where the user is gonna be sent after they complete the authentication and the consent process. The scope property is the space delimited list of all the scopes the app is requesting consent for. When you navigate to this URL, which is the authorization endpoint that I previously covered, you're gonna be prompted to first log in. And then if you haven't already granted this permission to the app or if an administrator hasn't consented to them on your behalf, Microsoft Identity will display a prompt with information about the application and which permission you need you to consent to. So in this case here, I've got an app called Identity Exercise 01. And it's asking for me to consent to permissions of sign in and request your profile, read your mail and maintain access to data that I've given it access to. In addition to individual user consent, an app can prompt the user to grant consent for all users in the organization. And this is useful in scenarios where an organization purchases a subscription to an application and proactively wants to set it up for everyone. And this is done by requesting delegated permissions for all users of the tenant using the admin consent endpoint, something that I've already discussed. Now, notice how the prompt looks a little bit different from the individual user consent one. Notice that it's got like that checkbox at the bottom. It says consent on behalf of your organization. So here, if I check that box, that's gonna allow me to go consent on behalf of everybody in the organization. Now, the last type of consent is the admin consent. This is used when granting delegated permissions to all users in an organization or when granting application permissions to an app. Now, refer to the previous lesson on OAuth2 authentication for the discussion on the admin endpoint. So here's what this consent looks like. Notice here that it's asking me to accept the or consent to permissions on behalf of the organization. And notice that it says things a little bit differently. Instead of saying, read your mail, it's saying, read user mail or sign in and read users profiles. And notice there's a little bit more information at the bottom of this dialogue. If you accept this, the applicant access to specified resources for all users in your organization, no one else is gonna be prompted for this. So it's giving you a pretty good warning of what this is going to do because this is a pretty big permission you're granting. Now, another concept that you should be familiar with is static versus dynamic consent. Static consent is when you specify all the permissions and application needs within the Azure AD admin portal. This is commonly done for application permissions. You can use this process for delegated permissions as well as those scenarios when your application needs the user to consent to all the permissions upfront. Dynamic consent is different in the sense that your application only requests from the user to consent to permission requests at the time the app needs them. So consider a really complicated application like a big CRM app that implements a lot of features and it each needs different permissions to access your data in Microsoft 365. A user may only be interested in 10 to 20% of the capabilities of an application, but when they log in, if the app requests the user to consent to 15 permission requests, that can cause the user to pause and wonder why they've gotta give it so many permissions to their information to the app for something that they may never use. So instead, your app can request permissions at the time the user goes to use this particular feature that it needs permissions for. Dynamic consent can complicate your application development, but it can lead to a better experience for your user. So you need to know it's an option that's supported by Microsoft Identity and just decide if it makes sense in your scenario. Okay, so that wraps up my lesson on Microsoft Identity Permissions and the Consent Framework. Now in this lesson, we're gonna take a look at addressing how developers leverage all the things that we've discussed throughout this chapter within their custom apps and APIs. So let's get started. Now, unlike the other lessons which focused on concepts, this lesson is a little bit shorter and it's gonna call out the aspects of different SDKs that you should be familiar with prior to taking the exam. Now, first and foremost, remember what I talked about in the introductory chapter of this course as well as the overview lesson in this course, in this chapter. Please make sure that you only focus on preparing for things that you're gonna be tested on, not on what you may not be tested on. Of course, if you wanna learn more, go for it. But if you're just focusing on passing the exam, I wanna focus just on what you need to know here. Now, while not something that you use to configure and implement authentication for in your apps, refer to the lesson on OAuth 2 authentication flows to make sure that you're familiar with the different endpoints. There are questions on the Microsoft Identity Pool of questions that are gonna ask about the endpoints as well as the SDKs. When it comes to the SDKs, you only really need to be familiar with two of them. You need to be familiar with the .NET implementation of MSAL and how you use it and configure it for things like ASP.NET apps, also API-based projects or web API-based projects and console apps that you would use to implement like a service or a daemon. When server-side coding is gonna be applicable, you only need to be familiar with the language C-sharp. The other implementation that you need to be familiar with is MSAL.js. The only type of application the exam is gonna test you on is a single-page app when it comes to MSAL.js. And the only languages that you need to be familiar with are JavaScript and TypeScript. So now let's look at the different things that you need to be familiar with with respect to the exam. Let's first look at MSAL.js. So as I stated previously, you only need to concern yourself with using MSAL.js in a single-page application, which is also referred to as a SPA or an SPA. When it comes to SPA, the only identity thing that you need to be familiar with is how to configure MSAL.js. Once the user is authenticated and he calls to register endpoints or monitor by MSAL.js, which will add the necessary HTTP authorization header values to the request for you when the token is obtained for the app. The configuration of MSAL.js is really simple and very straightforward. So again, refer to the links in the lesson notes below the video for documentation links in a hands-on lab and creating and setting up a single-page app that uses MSAL.js. Now let's look at MSAL.for.net. There's a good bit more you need to be familiar with when it comes to MSAL configuration and usage. A lot of the work has been simplified with the Microsoft Identity.Web Library, but again, as I mentioned previously in this chapter, that's not covered on the exam. So first let's look at when you'd use MSAL.net SDK. Think about all the different options you'd need to implement related to Microsoft 365. You could create web applications that leverage Microsoft Graph to display user data or custom components for Microsoft Teams and SharePoint or Office that maybe they need to call another API that you create. This API that you create may also need to call Microsoft Graph or another Azure AD secured endpoint. So back to when you use MSAL.net, well, Microsoft Teams apps and Office add-ins are really just web applications that you house and are surfaced in the clients within an iframe.  So you should be familiar about using Microsoft's identity to secure those APIs or to create scheduled services or things that need to run without interactive user contacts such as a console app or a daemon. MSAL.net configuration is probably the biggest thing you need to be familiar with because when it comes to ASP.net apps and web APIs, you need to understand how to hook up MSAL.net with the ASP.net middleware in a few different ways such as like acquiring access tokens as well. You should also be familiar with how to obtain tokens using both client secrets and client certificates. Finally, you should also be familiar with the differences between the two most common methods from obtaining access tokens, either using acquire token or the acquire token silent method. Now, let's look at a few specific implementations that you should be familiar with prior to taking the exam. The easiest one is MSAL.js for single page apps. For this, there's only one option. It's the OAuth2 implicit grant flow. Again, while the current recommendation from Microsoft has used MSAL.js v2 and the OAuth2 authorization code grant flow with PKECE support, when it comes to web applications, you should be familiar with how to configure MSAL.net for the OAuth2 authorization code grant flow. This includes both configuring it to support users logging in but also to trigger the common consent framework in obtaining the different tokens needed to identify users and call APIs. For web APIs, there are a few things needed that you need to be familiar with. This is one of the more complicated ones because you need to not only know how to secure an API with MSAL.net, but also how to implement the on behalf of OAuth2 flow so that your API can leverage the user's identity when it calls the downstream service. So this has been moved over to the Microsoft Identity Workload, even though these are exclusively Microsoft Teams-related topics. The Microsoft Learning Module on Single Sign-On for Microsoft Teams apps covers Single Sign-On, otherwise known as SSO, for both tabs and bots, including the setup process. And I wrote that module and I can assure you that it's a good prep for this topic on the exam. And I've also included links to the Microsoft Teams documentation on these two topics as well if you need more resources. And then finally, you need to be familiar with how to secure a console app using the OAuth2 client credentials flow so that the application can authenticate and obtain an access token with no signed in user. All right, so that's everything you need to know to be prepared for the Microsoft Identity Workload portion of the exam. If you have any questions about what I've covered here, please drop a comment below or let me know if you wanna see more videos about Azure AD development or something else. If you have any questions about what I've conveyed here, please drop a comment below or let me know if you wanna see more videos about Office Add-In Development. If you like this video, please give me a thumbs up and subscribe by smashing that big red subscribe button below the video so you'll see when I publish more videos for web and cloud developers on Microsoft 365 and Microsoft Azure topics. I'm Andrew Connell again, thanks for watching. I hope to see you next time.


What according to you is The source of defects in our civilization. I can put it up put it this way quoting quoting Friedrich Nietzsche To live is to be unjust There is a kind of Fisher that runs through every human deed every every human heart Which leaves a stain in the world every act of human beings is Projected into the world that is always already stained we as human beings We as beings in time beings of transcendence We are so to speak irreparable to our to ourselves and I think the great challenge that we face is Not so much how to save the world But how to make all life flourish in the world that cannot be saved. Okay, this is this is all too metaphysical for me I want to get physical really one definition of the world is the physical nature of the planet The first thing that Donald Trump says he will do is abandon the climate change a call But you only came into being last week sort of amazing to me that actually if we're talking about saving the world The first thing is actually doing something about arresting the The appallingly threatening atrocity of climate change the fact that Donald Trump It's not a problem for him actually that he could and someone who by the way has a large house in Florida Where slimy inundation is already lapping at the foundations can do this Means that actually reason is dead to the entirety of the election campaign was a victory of lies falsehood Irrationality over reason so the first thing we have to ask ourselves is how do we actually? Develop a form of communication, which is not intellectual exactly. I'm so interested in your in your out brilliantly outrageous interpolation, how do we actually How do we actually make reason entertaining?  I couldn't see you anyway, right, okay okay not enough of you showed up to vote in Minnesota and Arizona and and This is you know if we start with a basic question of how to save the planet earth Then we get to the question of how do we find a language that deals with the entertainment of unreason right But I still want you to elaborate on your opening statement that On the Enlightenment which was killed by amusement or right Why why your faith in the Enlightenment why? Miroslav was talking about The false beliefs of the Enlightenment well I have very low threshold of acceptability for the Enlightenment. I'm not talking Dr. Pangloss here I'm just saying the possibility of affecting a political decision by distinguishing lies from truth That's you know kind of ground zero of the Enlightenment really things follow from that that has been essentially Confounded it didn't matter that you know when Donald Trump was caught out of the lie He'd as we say in America double down on the lie That seems to be something the marquee at a condor say could probably not to anticipate it fascism Totalitarianism Authoritarianism in America This is too much so It's unproductive and It may not be true Let's be calm and affirm our values this I'm just gonna say is unproductive language right now Let me ask you. How is it working for you?  Are you winning? Are you is that a good strategy days to try it? You know was that a good way barely at strategic operational planning? Was that a good strategy to ruin this election is surrender? I think calmness is capitulation Calm did not work in 1933. It will not work now. We need excitement but seemed also important to me is that We in the Western and Increasingly in the broader than Western culture have invested all of our energies To speak in biblical traditions in turning stones into bread into kind of economic activity that Organizes entirety of our personal but also political I think outing lives But the result of that is always proving to be disappointing that the levels of happiness have not matched the levels of of increase in wealth increased in sense of also physical well-being and I think there's a kind of crisis of meaning that's that's Haunting the world today


Ladies and gentlemen, the President of the United States. Thank you. Thank you very much. Please. It's easy. Well, good afternoon. Most bill signing ceremonies are happy occasions. This one is not. This is a bill that I'll sign with great reluctance. And this is a bill that does not do justice to the American people. The bill contains two main provisions. The first provision extends the federal government's authority to borrow funds. This is an action that we must take to prevent the government from defaulting on its obligations. And I have no objection whatsoever to doing so. In short, this extension of the debt limit is necessary and unavoidable. But the second provision is one to which it's my duty as President to voice the strongest possible objection. This second provision involves a so-called fix of the Graham-Rudman Hollings Deficit Reduction Law, a fix that doesn't fix things in the right way, putting the country on a reliable track to lower deficits and eventually a balanced budget. Well, that's my goal. Unfortunately, the majority in Congress have already shown the inability to make the tough choices to reach those goals. This administration's tax cuts fostered economic growth so that over a five-year period, federal revenues have actually gone up more than 25 percent. During the same period, federal spending went up 46 percent. From 1982 to 1987, for every dollar cut from the defense budget, Congress added $2, and I repeat, $2 to domestic spending. Work barrel spending, spending for pressure groups, spending without a real responsibility, that is the main cause of the federal deficit. And now Congress sends me this bill, a bill that I must sign to keep the federal government from default. The Graham-Rudman Hollings fix is different from the original version. This measure says that if by a certain date, Congress and the administration have failed to agree upon a budget that cuts the federal deficit by $23 billion, then that amount, $23 billion, will automatically be sequestered, a fancy term for an across-the-board budget cut. The catch is this. In this version, even larger portions of the domestic budget will be exempt. This means that the cuts in the defense budget will be deep, very deep. Our nation's security would be undermined, and my hand in dealing with the Soviets would be weakened at a time when we're engaged with the Soviets in sensitive and significant nuclear arms reduction talks. With this bill, then, Congress is telling me that we must pay for its uncontrolled domestic spending by endangering our national security or by raising your taxes, or both. Under their arrangement, the bill would go directly to the American people. But I will not allow the American people to be blackmailed into higher taxes.  But while I'm reminded of a story, it's a true story. It concerns an American commander during the Second World War. In the Battle of the Bulbs, the enemy entered the American perimeter with surrender all to made him. They demanded this surrender, and the commander sent back a response that consisted of only one word. The word was nuts. To those who say we must weaken America's defenses, they're nuts. To those who say we must raise the tax burden on the American people, they too are nuts. Or there's a third choice, the right choice. It's the choice I campaigned for in 80 and again in 84. It's the choice embodied in the Economic Bill of Rights that I proposed this past 4th of July weekend. It is to cut the excesses from the domestic budget to impose upon the domestic budget once and for all a sense of responsibility and the national good. The whole notion of fair treatment that forms such an essential part of our national character, the whole notion of fair treatment that demands that if defense spending is reduced, then a wider range of domestic accounts must be reduced as well. Responsibility is on the shoulders of the majority in Congress. And I'm directing my cabinet and my staff to do everything they can to cooperate and to reduce unnecessary spending on domestic programs. America can avoid a fiscal disaster, but Congress will not do it by putting their hand in your pocket or with a get soft defense program. There are some in Congress who support our goals to reduce the deficit. And let's take a pledge today to stand together with a common goal, a common purpose to reject those who continue to want to spend more, tax more, and defend less to protect America's interests and not the special interests. Yes, I'll sign this bill. As I do so from this moment on, the big spenders in Congress will have a fight on their hands. No, not here. Not here. Any big spenders up here. Not here. No. If you want to show your pleasure with what I said, give them a hand. They're on our side. An embargo on Iranian... President Dole. Do you remember Dole? What do you think of it, sir?


Listening Library presents Who Was Thomas Jefferson? by Dennis Brindale Fraudden Read for you by Kevin Parasso Who Was Thomas Jefferson? Thomas Jefferson is pictured on U.S. Nichols. He is also portrayed on the giant Mount Rushmore sculpture in South Dakota. The Jefferson Memorial is a popular landmark in Washington, D.C. Jefferson City, Missouri, and Mount Jefferson in Oregon are among the many places named for him. Why is Thomas Jefferson honored in all these ways? He wrote The Declaration of Independence. This paper announced the birth of the United States in 1776. Its stirring words, such as all men are created equal, have inspired people for more than 225 years. Jefferson was a giant in many fields. A great statesman, he was our third president. A gifted architect, he designed Virginia's Statehouse and the University of Virginia campus. People called him Mr. Mammoth because he collected prehistoric bones. His book collection became the core of the Library of Congress. Despite his many public triumphs, Jefferson's private life was often sad. His wife, Martha, died at the age of only 33. Only two of Thomas and Martha's six children lived to adulthood. Jefferson also felt guilty that he didn't live by his own words. The man who wrote All Men Are Created Equal owned hundreds of slaves. And toward the end of his life, the former president landed deeply in debt. This is the true story of a man with many sides, Thomas Jefferson. Chapter one, Tall Tom.


Hey, we're back. We're live. I'm Jay Fidel. This is Think Tech Hawaii. And it's a Monday morning at 10 a.m., and we're doing life in the law because we like lawyers. We like life in the law. We think it's important for the community.  Better be there. These three guys are going to tell us about it. We're calling this show Elder Law and Appellate Mediation and Pro Bono Programs. It's like a scrambled egg kind of program. We get everything. So let's see where we begin. Let's begin with Ann Marie. Good morning, Ann Marie. Thank you for joining us on Think Tech. Good morning, J.N. Thank you for having us. Thank you for recognizing our Appellate Mediators at the Appellate Mediation Program. Well, let's talk about that.  There are a lot of appeals. There's the Intermediate Court Appeals and there's the Supreme Court of Appeals, if you will. And those are hard fought cases. Obviously, somebody is unhappy with the result below. Usually, it snows to nose and there ain't no love there. On the other hand, in mediation, you try to make some love. You try to bring it together and make people see that the greater good. And you're running that program. Tell us about it. Well, the program started in 1995 and it was actually to rebuild confidence in the court system. And we need that now as much today as we did that many years ago. So it is also put into place to bring, to offer more access to justice because it's a different sort of access to justice. We're giving people a chance for a more, a process that they are involved in the outcome. And so they have a chance to work with mediators who are experienced, mediators who can actually provide suggestions and look at options that they may have thought of to settle the case out of court. So it's without the cost of litigation. And when I say cost, I mean emotional cost, financial cost, time, all of the resources that go into that. Yeah, people don't realize that writing a brief ain't cheap. We should have somebody doing it as a favor. But if you have to pay for a brief and then a second brief and a pellet argument, that's complicated, takes a lot of time. And it's always a bit of a deep breathing exercise when you get the bill. So this avoids all of that, am I right? Yeah, it supports all of that. And when you talk about the briefs, if you think about the cases that go into the program too, as you mentioned, once they're in the program, positions are pretty entrenched. You don't get to an appeal without thinking that you're right or somebody else is wrong or the court's already made a mistake. And so we step in and give them an alternative to going back to that process. We give them a different kind of process. And it takes a little bit of trust building to get them into that. But again, with our skilled mediators and the level of experience and credential they can bring to it, hopefully we can sort of move them from that impasse into something a little bit different. Yeah, so this is, we've talked about mediation in general here with Tracy Wilton and the like and the Mediation Center Pacific. And I'm sure there'll be some discussion of that in the program on October 9th, which is a webinar that ThinkTech is producing, I want to say at 10 o'clock in the morning. So the question, the question, the question really is, how does it differ? How does appellate mediation differ from the regular kind of mediation where you're in court and you haven't, you don't have a result from the court, you don't have an appeal pending, you're just slugging it out? Well, it differs. First of all, we have the ability to stay the process. We stay the briefing process, we stay the jurisdictional statements, we can stay and slow things down so people have a little bit more time to resolve the issues without the pressures of those deadlines. And there also it takes the focus off of the brief, which is who's right, how right am I, and how wrong was the judge in this case and how wrong is the other side. So we reshift the focus. We present them with, again, highly skilled mediators. And we, the biggest difference I would say between the lower court cases or the pre-mediation, pre-court cases, because a lot of the cases that eventually end up in appellate mediation, if they are settled at a lower court level, it's done. We never see it, right? And some of the cases in mediation, if you look at mediation settlement statistics across the United States, there are 75%, sometimes up to 90% settlement rates with some of the mediators that have the opportunity to help people settle cases. That's all great, but those are the cases that settle. So it's the ones that don't settle in mediation or that eventually make it up to our level that it's the level of difficulty.  It's a matter of, okay, I have to go. I am convinced that I'm right. I've come this far. So we need a lot of unconventional thinking through the mediators. That's one of the things they can bring to the table. I wouldn't say the process is different at all. As a matter of fact, our mediators are trained at the Mediation Center of the Pacific for the most part. So they're trained in the exact same process, but it's the level of difficulty and how unconventional and outside the box you can think about the settlement and what other resources they have access to. We saw a list of them. Are they all pro bono or do you have to pay them? They are all pro bono. And if you see that list, you can see the level of mediators. And we're providing people that can, you know, and do serve in other ways. They are commercial mediators through other non institutions, but through commercial organizations that make that available to people. So they serve the court. It's at the pleasure of the Supreme Court is how it's worded, but they really do feel a commitment to the community and a commitment to the courts. And having been in the court system and part of that institution, they see the value of taking some of these cases out of appeal and settling them to reserve the time for the cases that have to stay on appeal. Do I have to? Do I have to do mediation? Can I say, you know, Anne Marie, thank you very much, but no thank you. We can mandate it. So it's rare that if somebody said, I absolutely don't want to do it, that I would put it through, but we can mandate it. It is up to our program to decide whether or not the case should be mediated. But we do an extensive intake process to make sure that the people coming to the table, the council and the parties are coming in good faith to settle. And part of that is because we're taking the time of mediators who can be doing a number of other things in their lives, and they really are doing this out of passion. What percentage of the cases settle in mediation? In our program, we settle about 50. We're at 53% right now. And we have had over the course of the program, 750 cases come in, about an average of 30 cases per year. And 52% settlement actually nationwide is pretty high. We're quite proud of that. Do the parties ever misuse the system? For example, a brief is due tomorrow, and somebody says, hey, let's do mediation so I can get more time on my brief. And then we'll drop out of it later and say we can't make a deal. That ever happen? Let's give everybody the benefit of the doubt and say, I hope it doesn't. I'm assuming it doesn't. I think people will find different ways to use the system. But for the most part, we have people who really do enter in good faith. And that's part of my job doing the intake to make sure that they are. Because if I can do that, and I hate to be judgmental in advance, but sometimes you can sense it. And it's why waste a mediator's time. They're valuable. And one last question before we go to Lance, and that is, aren't you taking the opportunity of the appellate court away from making precedent? Suppose the appellate court is sitting there sort of rubbing its hands against you, oh, this is going to be a great case for important Hawaii state president. And you're depriving them of that. What about that consideration? That's an excellent question, Jay. And those cases we do not bring into the program. We approve those cases for the courts to determine what is necessary. Very good, very good. So there's good discretion there. Lance, go to you. What do you do in connection with appellate mediation? Well, actually, I'm the volunteer program coordinator for the appellate pro bono program, which almost all of the cases never go into appellate mediation. But actually, while Anne-Marie was speaking, it occurred to me that in the pro bono appeal in the program that I did before I became coordinator, that actually did go into the mediation program. So I was like, oh, yeah, actually, that's not true that they're completely exclusive of each other. But it's not always likely because the appellate pro bono program, which used to be a project that was started by Judge Copeland, the purpose of it was to allow prosa appellants and appellies to be represented by counsel so that they could be assisted in presenting their issues to the appellate court in a way that would allow them to have a fully meaningful appeal. So your function isn't exactly the same. You're not necessarily directed at mediation. You're trying to help people provide pro bono appellate counsel for them. That's right. Okay, now suppose I'm a million billionaire, okay, and I'm really unhappy with what happened in the court below. And I called you up and said, Lance, I like pro bono appellate counsel because I don't really want to spend any money on this. What do you say to me? Well, so the first part is you have to do, you have to qualify. And so there's a form that Voluntary Legal Services Hawaii has all interested persons do. And I think a millionaire would immediately be disqualified on income grounds. So it really is for people who cannot afford appellate counsel. That's one, that's one requirement. And then the other requirement is that it has to be the type of case that is within the program. So, you know, just because you have a case and you don't have enough money to hire appellate counsel doesn't mean that you can come into the program. So the most of the cases have to do with family law. But the case that I and Bianca Isaki, we were co-counsel on that was a foreclosure case. I think we've had a couple of unemployment cases come through the program. So they're usually the types of cases where it's not just somebody has some abstract theoretical interest in whatever the outcome is, but in fact that they really do have a need for an advocate and they just don't can't afford one. And it would also benefit the courts to have an advocate more carefully go through the issues in the record. Sure, let him do the research for her as a case may be. So what about criminal stuff seems to me that most people who've been convicted of crimes don't have a lot of money and they're going to come to you and say, Lance, can you give us appellate counsel because we think they've done us wrong in the court below? What about the, you know, the public defender? What about the federal public defender? Don't you point them to organizations which are dedicated to, you know, defending criminals or do you provide counsel for the appeal? So this project program now was a project that's become a permanent program of the Supreme Court. It only deals with civil cases. So the criminal side is left to the current structure, the public defender, or occasionally other entities do that sort of thing or court appointed. There's quite a bit of court appointed, you know, appellate advocacy for criminal defendants. They work for free. I mean, we've seen a list and they work for free. And, you know, sometimes an appeal can be very time consuming, a lot of legal research. A hole in the law into which you port time, so to speak. That's right. So where do you get them from and how well qualified are they? So most of the people who are currently on our volunteer list are also members of the appellate section of the Hawaii State Bar Association, although any attorney that's watching that is interested in being a pro bono appellate advocate can email us and I'll add you to the list. One of the benefits is, and this is not a rule, but one of the benefits is that most of the cases that are briefed by somebody in the program eventually will end up getting an oral argument. But that's not always true. But the appellate courts have shown a strong preference for allowing oral argument. And of course, as you may know, the ICA, just because of the sheer caseload that they have has very few oral arguments. And so that's definitely a benefit for people who may not have a lot of appellate experience and want to get more experience or don't have any experience with oral argument before the appellate courts. And so that's sort of a little bit of a benefit or a reward for somebody who is willing to put in the time to go through the record and do the research of the case law. You talk about appellate argument going to intermediate court, or if you can get appellate argument in the intermediate court, the Supreme Court, in the time of COVID, let's try to make this relevant to the times in which we live. What happens these days? Is it done by Zoom? Is it done by WebEx? FaceTime? Or is it in person? Yeah, so I actually, not in the program, but I actually just did an oral argument, a pro bono oral argument before the Supreme Court, and they are doing it by WebEx, and it is streamed live over YouTube. And I have to say between doing it in person and doing it in WebEx, WebEx has some way to come to be similar to in person. I definitely would prefer to do an oral argument in person, but the truth is that it's much better to do it on WebEx than to have me have to fly over to Honolulu. I understand right now out of necessity, and it is sufficient for what's minimum needed in an oral argument, but definitely I think in person, unless WebEx can change how it presents itself, I definitely think that in person it's still better. Yeah, well, better for who though? Better for the winner. You think this is going to stick going forward?  Wouldn't it be better to just make this permanent and allow it in all cases? Well, I definitely think in the trial courts, I have found that in hearings that I've had that it seems for the kinds of cases that I have that it's much, the online format is much more suitable than having to go in person. But when you have to check out the body language of five people and make sure that you are really hearing what they have to say and all the nonverbal nuances, it's a little bit more difficult. But maybe I needed to get a bigger screen. I see Chief Justice Rechtenwald has a giant mega screen. I took a picture of him being sworn in on his retention, and I didn't realize, but he's got this 50-inch or bigger screen, and maybe that was my mistake that I just used my computer screen. So quite possibly. Are you saying that he was sworn in by remote? No, I think he was sworn in in person, but they showed that the bench of the Supreme Court, and right in front of him was a giant, giant screen. And so I realized at that point, like, oh, I should have gotten a big screen when I did my oral argument that may have made it easier. So when you engage somebody for, you know, for the group as an appellate pro bono, appellate lawyer, what are you looking for? I like to just remark that I think that appellate lawyers are different. It's a different practice. It's a different personality type. You know, for example, a jury trial lawyer, he's got this kind of crick in his neck because he's always looking at the jury. No matter what he says, he's turning over his shoulder, looking to see how the jury is reacting. The appellate lawyer has to learn how to say, yes, your honor, but... Yes, well, actually, the most important thing I think between the trial advocate and an appellate advocate is being able to recognize that the appellate judges are not jurors. And I think if you can grasp that and not treat appellate judges as jurors, you'll probably do just fine. But what we do first is we first put it out to the list and see if anybody... We give the facts of the case and just see if anybody is interested. Usually there is, but there's a few times where we don't get any responses. And then I actually go through and try to match people and see, okay, no, you didn't answer the call out, but I thought this might be something that would interest you. And so that's how it's gone. And I think there's only been one case so far as long as I've been the program coordinator that has come in that we haven't been able to partner somebody with. But otherwise, every case that comes in we've been able to find. And actually, I think it was now two months ago, they just had an oral argument where both sides, the mother and the father, were both represented by people in the program. That must have been interesting. Well, the people who argued had never argued before the Hawaii Supreme Court before. So I definitely think it was all the way around. It was a great experience. And I think it was very helpful for the parents because there's no way that if they were to argue in front of the Supreme Court, some of the very narrow and obscure areas of civil procedure, I think, would have totally been lost on the parents if they had to argue themselves. Let's move to Jim Peach. Jim, thank you for being so patient today. You're actually the guest today that's closest to where I am in my life because I'm getting older already. I know that doesn't happen to you or any of the others here today, but I want to know what you do in terms of helping people like me. Well, I'm the director of the University of Hawaii Elder Law Program. So we help a lot of different people in different age categories. We have several components to our Elder Law Program. And I thank you for having me on this morning because we're going to celebrate our 30th anniversary at the law school next year. So we're grateful to the community. We're grateful to the funders and we're grateful to the university, of course. Part of our program is teaching at the law school. We have several courses, Law Aging and Medicine, which is a basic overview of legal issues pertaining to older persons. Then we have a healthcare bioethics course, which is open to other professionals, including doctor of nurse practice students. So we'd like to help. Could you cover things like checking yourself out of the hospital when 57 doctors tell you that you should stay in the hospital for a few more days? You cover those ethical issues? Well, we do under the chapter of autonomy, self-determination, versus best interests and protection. So yes, we do. I think you're going to have some practical cases coming up here, at least in the newspaper. But let me ask, you know, what's the difference? Why do you draw a line between elder and non-elder? Isn't the law the same for everybody? Well, the law is the same for everybody, although there are programs that involve older persons, such as benefits for older persons, social security, Medicare, Medicaid. And so there are certain distinctions. But it's the impact of aging very often that we see in certain areas, such as diminished capacity, abuse, neglect, exploitation, disappointment at the end of life. COVID-19 has had a huge impact on the aging, as you know. And it's more dangerous, even rising to the highest levels of government. And those who can afford it the most, they still are impacted by it. But you can imagine the most vulnerable of our population are even more impacted, not only for health care, but also for assistance with issues relating to abuse, neglect, and exploitation. Because there's a lot of hidden things going on due to the isolation of older persons. Isolation of the elderly is one of the greatest causes of that can lead to abuse and neglect. I can imagine that's happening now, more now than the time of COVID. And it must be a real burden on some people. It is. And trying to get in contact with individuals who want help or need help, Zoom is great for our courses, for example. We even have an elder law clinic that we conduct via Zoom. And we've had several clients Zoom in, but it's not always very easy. And those were the younger old people, mostly, who were able to Zoom in. Although we did have a couple in their 90s who Zoomed in, and they were more technically adept in some of our law students. So it's a mix. The problem that I see, let me sort of throw this at you to see what the environment is like. It surprised me a few years ago to find that there were not enough geriatric doctors around town. And that if you wanted to find one to help you in a geriatric area of medical practice, it was hard to find one. And then I kind of surmised that that's the same thing for lawyers who specialize in elder law. They're not that many lawyers who are around, who you can look them up in the yellow pages. I mean, not a geriatric lawyer. That's a no. Well, there's some of us around that fit that description. Gotcha. But an elder law lawyer, right? So it's not in a phone book. And furthermore, query whether you can make a decent living as an elder law lawyer. And maybe not. And so I would guess, just a guess, that there's a shortage of them too. Well, we have a very vigorous elder law section in the Hawaii State Bar Association. And we're trying to get it more into their telephone book when people are asking for referrals. Because the elder law, the concept of elder law is still evolving. And you have a lot of people in elder law who make a very good living, but they seem to specialize in the area of benefits and getting access, but not only access but qualifying for benefits. And so the reputation in the past for some folks in this area hasn't been too good where they are gaming the system, more or less, to qualify for Medicaid transfers of assets and such. But everybody should in the area of estate planning family should, family law should be an elder law attorney, because that's the demographic. That's the fastest rising group of clients that they have. So that's why we teach elder law at the university. But we do have marvelous elder law attorneys in the system. As far as geriatric medicine, I do teach geriatric fellows at the medical school. And we have one of the finest geriatric medicine training programs, but it's about money. As you mentioned for lawyers, but it's also about money for geriatricians. We train the highest quality geriatricians in the world. And then many of them leave to go to other places where they can where where they can afford to live and where the reimbursement may be a little better. But yes, there's a lot of work to be done in enhancing legal access and healthcare access for older persons. Couldn't the organizations that support the medical expenses and for that matter the legal expenses for doctors and lawyers that provide elder advice and representation, couldn't they have an effect on this? For example, I remember that if you have a claim under social security, your client wants you to make a claim with social security. The lawyer gets either little or none. And you cannot take money from the client. You have you have very limited opportunity to recover your time. And so the lawyers won't do that. They won't they won't represent people in social security claims. If you ease that up, you would by definition allow more service just by by easing it up. Well, it has been eased up considerably over the years. One example is for veterans claims. In the past, it used to be the your fee was limited to $10 or something of that nature, ranging way back in time. But now with equal access to justice on the appellate level, especially, you're finding that more people do have access to legal services that just a few years ago, they wouldn't have had. So there's a growing bar of social security and elder and veterans law individuals in the bar who have gathered together and they have quite quite a large bar association, for example, with the Court of Appeals for Veterans Claims Bar Association, a very large organization. So little by little, because of the EJA, the Equal Access to Justice Act, which makes it tolerable for attorneys to wait long periods until they get paid. But eventually, if they do win or there is some positive aspect about their case. So for example, remand back to the to the agency, then it is getting better. But you're absolutely right. And that's why we rely a lot on our pro bono colleagues in the community, such as the volunteer legal services Hawaii, the then money is not an object, and you don't get hung up on that. That's right. And we do have excellent legal services partners in the community, including the Legal Aid Society. Now, the Legal Aid Society took over our traditional main funding source. I won't get into that, the city of County of Honolulu unexpectedly and suddenly just cancelled our contract with them. But luckily, it went to the Legal Aid Society. And they have individuals who are skilled in such federal benefit areas as social security. Let's move to Ann Marie for a minute because we don't have much time left. Ann Marie, I think what we're all talking about here today is not equal justice under the law, but equal access to justice under the law. It's a refinement of the slogan over the over the years, Supreme Court Courthouse, which says equal justice under the law. And you guys are directly involved in that. I mean, all three of you were involved in that. And for that matter, let me say that the Bar Association, although it's not a perfect picture, is involved in that because that's where you get your your balance of your lawyers from. Can you comment on how that affects you and your way of thinking? How it affects your organization, you know, the mission of providing equal access? Well, there's a couple of things I wanted to bring up regarding this because it's important. The access to justice and one of them is directly related to the technology and what COVID has provided as a benefit, I suppose, is that we're all forced to use something different to reach out to the other islands. So our neighbor island access is so much better now, giving access to those people statewide through our program. Now we do have mediators statewide so they can help, but we might have four mediators on the entire big island and I have 35 mediators here on Oahu so I can give access to excellent mediation through the technology we have. On the other hand, I just did a mediation last week and it involved people statewide and even some people on the mainland. It was beautiful that we could use Zoom to bring them together, but what's missing is some of the body language and also it sort of highlighted the inability for some people on the big island, say, that don't have the hardware. They can't afford the hardware. They don't have the band with so it also highlights the inability to really give equal access. One suggestion that came up in an earlier program on this series is to have the judiciary provide what do you want to call it, access rooms. Rooms with a laptop, sort of a duty laptop where a member of the public who has no equipment can come in and use it and that equalizes that level to playing field. Let me move to Lance, to take a pivot on what Emery was saying. What about the community? What about the quality of life, the quality of justice as it appears to the ordinary person in the street in Hawaii? Are we providing adequate access to justice here? How far does these programs go? How far does your program go in order to make the average person feel that he or she has access? Yeah, I think that the Access to Justice Commission has done a remarkable job with what is available. I think to echo something a little bit of what Jim said, over the last seven or 10 years, the amount of funding from all state sources for legal service providers has been cut more than half. And so what's happened is that all of the legal service providers in the state have had to basically maintain their level of services with half the amount of money and that has had an impact. So yeah, I do think that to the extent that we're able to do these free things, we're doing it, but really that the legislature does need to consider, reconsider how legal services are funded, these kinds of cases, especially with unemployment is a great example. I mean, I do the self-help center every week on Maui for an hour and every week there's at least one person that is calling to ask about how to do an unemployment appeal. I have 100,000 people who are applying for claims. There's no way that all of these people are going to know what they're doing. And so that's just an area where it's like. Well, I hear you and that's going to be helpful. You go forward. I predict you're going to have more business. And so you, Anne-Marie, let's go to James for the final word. Okay. I give you Charles Dickens and the Christmas Carol. I give you the ghost of Christmas future. I give you the end of all these programs. They are defunded in the time of COVID. There's no money to pay for them and they're over. Okay. What happens to our society then? Well, our society is going to be judged on how we, how we help the most vulnerable, including older persons. We already see that over across the nation that people are saying, well, if the elderly die, they die or keep them locked up so we can go about doing our own business. But that's not equal access for older persons to society. And you can't just keep them locked up in a nursing home or in their homes. So I would say that much benefit, we will see much benefit from technology. Our website, even if we can't be there at all times, hopefully our websites will continue. And we've added quite a lot, including about COVID-19 on our website. What is your website, Jim? Our website is the Hawaii, University of Hawaii website, Hawaii.edu, and then a slash U-H-E-L-P, University of Hawaii Elder Law Program. And we have... Okay. Anne-Marie, we're at a time. What's your website? Just Google ACR, or you can do ACR Hawaii, C-A-D-R Hawaii in the court system. It's very long because it has to do with the dot gov and courts and everything. Okay. Well, listen to what you're saying over and over again and write it down. Lance, what's your website? Tell us. Sure. So if attorneys are interested, they can email me directly. I'm in the bar directory. But if somebody wants to seek the services of the program, they can email appellate at v-l-s-h dot o-r-g, Volunteer Legal Services Hawaii dot org. Lance Collins, James Peach, Anne-Marie Smoke. Thank you very much for joining us this morning. Aloha. Thank you.


Good day fellow investors! Now I have received some comments about the iron ore investments stocks like Vale, Rio, PHP and so and I want to discuss here in this video the iron ore sector. I wait for the situation in the sector to be perfect before buying so first look at the sector and then if interested looking at the stock I'll start with looking at the sector of iron ore. You might be tempted to invest in those companies because the price earnings ratio are low now and the dividends are high and the profits are high and you might say oh that's a good dividend investment. However the stock prices are very high if you look at the chart what happened in the last year and a half all those stocks have really recovered and especially Vale the Brazilian iron ore mine. However we have to look at iron prices and also iron prices have recovered from the lows that we have seen just a year and a half ago around 40-50 were stable and now they have spiked up. Iron ore prices have spiked up because China increased steel production now they have retreated a bit and iron ore prices have started declining again due to pollution reason. However to determine whether an iron ore investment is good now you have to find a balance price for iron ore see if it will go much higher or it will go lower. For that this is the UBS research report and you can see that the balance price is around 60. The current iron ore price per ton is around 75 but with the balance price at 60 we had to expect much lower prices especially if there is a slowdown in China. So for me iron ore now is too risky. I'll show you another two charts this is the Pilbara Rio Tinto mine in Australia cash cost units and those are below $14 per ton. So when you compare it to the current iron ore price of 70 yes Rio is extremely profitable but I think future iron ore prices will stabilize at a lower price. Then when you look at Vales new S11D projects has even lower costs and expected to be at $8 per ton then I think in the future we'll see much lower iron ore prices as all those companies will ramp up production in order to make more profit. So they will be profitable yes but those are cyclical companies that have to be bought at the down part of the cycle when iron ore prices hit 30 or 40 again and don't worry there will be gluts in the iron ore industry if just those ramp up a bit production then you have oversupply and iron ore prices fall. So if you want to invest in a margin of safety invest when iron ore is cheap. In the short term anything can happen you can bet on higher iron ore prices keep the high dividend but don't expect stability for their long term. So for now I'll leave iron miners aside and when the iron ore prices drops below 50 I'm sure to take a look at them. So consider subscribing as we constantly analyze sector countries and we look where there is an investment with a margin of safety cheap in relation to mining costs other costs productivity growth and so on. That's the best way to invest with low risk and high returns. Thank you for watching click like if you like the content and I'll see you in the next video