Merge branch 'main' into ubuntu-update

.github/actions/devcontainer_run_command/action.yml

@@ -132,7 +132,7 @@ runs:
         echo "AZURE_ENVIRONMENT=$azure_env" >> $GITHUB_ENV
 
     - name: Azure Login
-      uses: azure/login@v1
+      uses: azure/login@v2
       if: contains(inputs.COMMAND, 'bootstrap') != true
       with:
         creds: ${{ inputs.AZURE_CREDENTIALS }}

.github/workflows/build_docker_images.yml

@@ -21,18 +21,18 @@ jobs:
     steps:
       - name: Upload Event File
         # this step is required to publish test results from forks
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: Event File
           path: ${{ github.event_path }}
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       - name: Filter changes
-        uses: dorny/paths-filter@v2
+        uses: dorny/paths-filter@v3
         id: filter
         with:
           filters: |
@@ -93,7 +93,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       # Unit Tests are executed by calling the 'test-results' target in the
       # Dockerfile's. Test runner exit codes must be swallowed (and kept) so we
@@ -105,7 +105,7 @@ jobs:
         if: |
           (steps.filter.outputs.api == 'true'
           || github.event_name == 'workflow_dispatch')
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./api_app/
           file: ./api_app/Dockerfile
@@ -116,7 +116,7 @@ jobs:
 
       - name: "Check pytest failure file existence"
         id: check_api_test_result
-        uses: andstor/file-existence-action@v2
+        uses: andstor/file-existence-action@v3
         with:
           files: "test-results/pytest_api_unit_failed"
 
@@ -125,7 +125,7 @@ jobs:
           (steps.filter.outputs.api == 'true'
           || github.event_name == 'workflow_dispatch')
           && steps.check_api_test_result.outputs.files_exists == 'false'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./api_app/
           file: ./api_app/Dockerfile
@@ -136,7 +136,7 @@ jobs:
         if: |
           (steps.filter.outputs.resource_processor == 'true'
           || github.event_name == 'workflow_dispatch')
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./resource_processor
           file: ./resource_processor/vmss_porter/Dockerfile
@@ -147,7 +147,7 @@ jobs:
         if: |
           (steps.filter.outputs.guacamole_server == 'true'
           || github.event_name == 'workflow_dispatch')
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./templates/workspace_services/guacamole/guacamole-server
           file: ./templates/workspace_services/guacamole/guacamole-server/docker/Dockerfile
@@ -158,7 +158,7 @@ jobs:
 
       - name: "Check maven failure file existence"
         id: check_maven_test_result
-        uses: andstor/file-existence-action@v2
+        uses: andstor/file-existence-action@v3
         with:
           files: "test-results/guacamole_package_failed"
 
@@ -167,7 +167,7 @@ jobs:
           (steps.filter.outputs.guacamole_server == 'true'
           || github.event_name == 'workflow_dispatch')
           && steps.check_maven_test_result.outputs.files_exists == 'false'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./templates/workspace_services/guacamole/guacamole-server
           file: ./templates/workspace_services/guacamole/guacamole-server/docker/Dockerfile
@@ -178,7 +178,7 @@ jobs:
         if: |
           (steps.filter.outputs.gitea == 'true'
           || github.event_name == 'workflow_dispatch')
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./templates/shared_services/gitea/docker
           file: ./templates/shared_services/gitea/docker/Dockerfile
@@ -195,7 +195,7 @@ jobs:
         if: |
           (steps.filter.outputs.airlock_processor == 'true'
           || github.event_name == 'workflow_dispatch')
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./airlock_processor/
           file: ./airlock_processor/Dockerfile
@@ -206,7 +206,7 @@ jobs:
 
       - name: "Check pytest failure file existence"
         id: check_airlock_processor_test_result
-        uses: andstor/file-existence-action@v2
+        uses: andstor/file-existence-action@v3
         with:
           files: "test-results/pytest_airlock_processor_unit_failed"
 
@@ -215,7 +215,7 @@ jobs:
           (steps.filter.outputs.airlock_processor == 'true'
           || github.event_name == 'workflow_dispatch')
           && steps.check_airlock_processor_test_result.outputs.files_exists == 'false'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./airlock_processor/
           file: ./airlock_processor/Dockerfile
@@ -224,7 +224,7 @@ jobs:
 
       - name: Upload Unit Test Results
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: test-results
           path: test-results

.github/workflows/build_docs.yml

@@ -6,7 +6,7 @@ on:
     types: [published]
   push:
     paths:
-      - 'docs/**'
+      - "docs/**"
       - mkdocs.yml
     branches:
       - main
@@ -14,20 +14,22 @@ jobs:
   deploy:
     name: Deploy Documentation
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout main
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           persist-credentials: true
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: 3.x
       - name: Install Dependencies
         run: |
           pip install -r docs/requirements.txt
       - name: Configure Git User
-      # Required by mike for the commit it does to the gh-pages branch
+        # Required by mike for the commit it does to the gh-pages branch
         run: |
           git config user.name "ci-docs"
           git config user.email "ci-docs@dummy.com"

.github/workflows/build_validation_develop.yml

@@ -19,14 +19,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Full git history is needed to get a proper list of
           # changed files within `super-linter`
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: dorny/paths-filter@v2
+      - uses: dorny/paths-filter@v3
         id: filter
         with:
           filters: |

.github/workflows/clean_validation_envs.yml

@@ -14,14 +14,14 @@ jobs:
     environment: CICD
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           # This is CRITICAL since we're making decisions based on branch existence
           fetch-depth: 0
           persist-credentials: false
 
       - name: Azure Login
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           environment: ${{ (secrets.AZURE_ENVIRONMENT != '' && secrets.AZURE_ENVIRONMENT) || 'AzureCloud' }}

.github/workflows/cli-package.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout (GitHub)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Build and run dev container task
         uses: ./.github/actions/devcontainer_run_command
@@ -50,7 +50,7 @@ jobs:
           AZURE_ENVIRONMENT: ${{ secrets.AZURE_ENVIRONMENT }}
 
       - name: Upload Wheel as artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: tre-cli
           path: dist/tre-*.whl

.github/workflows/deploy_tre_reusable.yml

@@ -185,7 +185,7 @@ jobs:
           details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -193,10 +193,10 @@ jobs:
           ref: ${{ inputs.prRef }}
 
       - name: Set up Docker BuildKit
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Azure Login
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           environment: ${{ (vars.AZURE_ENVIRONMENT != '' && vars.AZURE_ENVIRONMENT) || 'AzureCloud' }}
@@ -274,7 +274,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -298,7 +298,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -322,7 +322,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -408,7 +408,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -454,7 +454,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -500,7 +500,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -560,7 +560,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -609,7 +609,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -643,7 +643,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -692,7 +692,7 @@ jobs:
     environment: ${{ inputs.environmentName }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -723,7 +723,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -752,7 +752,7 @@ jobs:
 
       - name: Upload Test Results
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: E2E Test (Smoke) Results
           path: "./e2e_tests/pytest_e2e_smoke.xml"
@@ -766,7 +766,7 @@ jobs:
     timeout-minutes: 300
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
           # if the following values are missing (i.e. not triggered via comment workflow)
@@ -796,7 +796,7 @@ jobs:
 
       - name: Upload Test Results
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: E2E Test Results
           path: "./e2e_tests/pytest_e2e_custom.xml"
@@ -811,8 +811,11 @@ jobs:
     if: always()
     environment: ${{ inputs.environmentName }}
     steps:
-      - uses: technote-space/workflow-conclusion-action@v3
-
+      # - uses: technote-space/workflow-conclusion-action@v3 (removed due to archived repo and deprecated node.js version)
+      - uses: im-open/workflow-conclusion@v2.2.2
+        id: conclusion
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
       # For PR builds triggered from comment builds, the GITHUB_REF is set to main
       # so the checks aren't automatically associated with the PR
       # If prHeadSha is specified then explicity mark the checks for that SHA
@@ -845,12 +848,12 @@ jobs:
           timezone: Europe/Zurich
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           path: artifacts
 
       - name: Publish E2E Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@v2.16.1
         with:
           junit_files: "artifacts/**/*.xml"
           check_name: "E2E Test Results"

.github/workflows/flag_external_pr.yml

@@ -15,13 +15,13 @@ jobs:
     steps:
       # Ensure we have the script file for the github-script action to use
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       - id: check_command
         name: Check for a command using GitHub script
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           result-encoding: string
           script: |

.github/workflows/lets_encrypt.yml

@@ -23,12 +23,12 @@ jobs:
     environment: CICD
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       - name: Install Terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.2.9
           terraform_wrapper: false

.github/workflows/pr_comment_bot.yml

@@ -32,14 +32,14 @@ jobs:
     steps:
       # Ensure we have the script file for the github-script action to use
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       # Determine whether the comment is a command
       - id: check_command
         name: Check for a command using GitHub script
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           script: |
             const script = require('./.github/scripts/build.js')
@@ -79,13 +79,13 @@ jobs:
     steps:
       # Ensure we have the script files
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       # Perform az login for destroy env script to be able to run
       - name: Azure Login
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           environment: ${{ (vars.AZURE_ENVIRONMENT != '' && vars.AZURE_ENVIRONMENT) || 'AzureCloud' }}
@@ -115,13 +115,13 @@ jobs:
     steps:
       # Ensure we have the script files
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           persist-credentials: false
 
       # Perform az login for destroy env script to be able to run
       - name: Azure Login
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           environment: ${{ (vars.AZURE_ENVIRONMENT != '' && vars.AZURE_ENVIRONMENT) || 'AzureCloud' }}

README.md

@@ -22,7 +22,7 @@ Core features include:
 - Self-service provisioning of research tooling for research teams
 - Package and repository mirroring - PyPi, R-CRAN, Apt and more.
 - Extensible architecture - build your own service templates as required
-- Azure Active Directory integration
+- Microsoft Entra ID integration
 - Airlock - import and export
 - Cost reporting
 - Ready to workspace templates including:  

api_app/.env.sample

@@ -4,7 +4,7 @@
 # LOGGING_LEVEL can be set to DEBUG, INFO, WARNING, ERROR or CRITICAL
 LOGGING_LEVEL="INFO"
 
-# OAUTH information - client ids etc. for the AAD Apps
+# OAUTH information - client ids etc. for the Microsoft Entra ID Apps
 # ----------------------------------------------------
 # The AppId for the API service principal (TRE API)
 API_CLIENT_ID=__CHANGE_ME__
@@ -12,7 +12,7 @@ API_CLIENT_ID=__CHANGE_ME__
 API_CLIENT_SECRET=__CHANGE_ME__
 # The AppId for the Swagger service principal (TRE Swagger UI)
 SWAGGER_UI_CLIENT_ID=__CHANGE_ME__
-# The Azure AD tenant
+# The Microsoft Entra Workforce tenant
 AAD_TENANT_ID=__CHANGE_ME__
 
 # API parameters

api_app/_version.py

@@ -1 +1 @@
-__version__ = "0.18.5"
+__version__ = "0.18.6"

docs/azure-tre-overview/airlock.md

@@ -117,7 +117,7 @@ Whenever the airlock process changes to a state of **Draft**, **Submitted**, **A
 When the state changes to `In-progress` the Workspace Owner (Airlock Manager) gets notified.
 
 > * The Notification mechanism is also data-driven, allowing an organization to extend the notifications behavior. The mechanism is exemplified with a Logic App determining the notifications logic.
-> * Notifications will work with All TRE users being AAD users (guests or not), with email defined – if not, notifications will not be sent.
+> * Notifications will work with All TRE users being Microsoft Entra ID users (guests or not), with email defined – if not, notifications will not be sent.
 
 ## Architecture
 

docs/azure-tre-overview/architecture.md

@@ -8,7 +8,7 @@ All traffic has to be explicitly allowed by the Application Gateway or the Firew
 
 [![Architecture overview](../assets/archtecture-overview.png)](../assets/archtecture-overview.png)
 
-The Azure resources outside the network boundries of the Azure TRE are Azure Active Directory, Microsoft Graph and TRE Management. TRE Management are resources used during deployment.
+The Azure resources outside the network boundries of the Azure TRE are Microsoft Entra ID, Microsoft Graph and TRE Management. TRE Management are resources used during deployment.
 
 The Azure TRE core plane consists of two groups of components:
 

docs/azure-tre-overview/tre-resources-breakdown.md

@@ -36,10 +36,10 @@ Once an Azure TRE has been [provisioned](../../tre-admins/setup-instructions/pre
 | fw-dsk-{TRE_ID} | Azure Firewall | [Azure TRE Firewall](../networking) restricts external outbound traffic from all TRE resources | [Azure Firewall](https://docs.microsoft.com/en-us/azure/firewall/overview)
 | kv-{TRE_ID} | Azure Key Vault | Management of TRE secrets & certificates | [Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/general/overview)
 | log-{TRE_ID} | Log Analytics Workspace | Azure Monitor Logs store for all TRE resources | [Log Analytics](https://docs.microsoft.com/en-us/azure/azure-monitor/logs/data-platform-logs#log-analytics-workspaces)
-| id-agw-{TRE_ID} | Managed Identity | User-managed identity for TRE Application Gateway | [Managed Identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
-| id-api-{TRE_ID} | Managed Identity | User-managed identity for TRE API App Service | [Managed Identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
-| id-gitea-{TRE_ID} | Managed Identity | User-managed identity for TRE Gitea App Service | [Managed Identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
-| id-vmss-{TRE_ID} | Managed Identity | User-managed identity for TRE Resource Processer (VMSS) | [Managed Identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
+| id-agw-{TRE_ID} | Managed Identity | User-managed identity for TRE Application Gateway | [Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)
+| id-api-{TRE_ID} | Managed Identity | User-managed identity for TRE API App Service | [Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)
+| id-gitea-{TRE_ID} | Managed Identity | User-managed identity for TRE Gitea App Service | [Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)
+| id-vmss-{TRE_ID} | Managed Identity | User-managed identity for TRE Resource Processer (VMSS) | [Managed Identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)
 | sb-{TRE_ID} | Service Bus Namespace | Messaging for TRE API | [Service Bus](https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messaging-overview)
 | stappinsights{TRE_ID} | Storage Account | Storage for TRE Application Insights telemetry logs | [Storage Blobs](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-overview)
 | stg{TRE_ID} | Storage Account | Files shares for TRE services such as Gitea, Nexus | [Storage Files](https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction)

docs/index.md

@@ -20,7 +20,7 @@ Core features include:
 - Self-service for research teams – research tooling creation and administration
 - Package and repository mirroring
 - Extensible architecture - build your own service templates as required
-- Azure Active Directory integration
+- Microsoft Entra ID integration
 - Airlock
 - Cost reporting
 - Ready to workspace templates including:

docs/tre-admins/auth.md

@@ -1,21 +1,21 @@
 # Introduction to Authentication and Authorization
 
-[Azure Active Directory (AAD)](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis) is the backbone of Authentication and Authorization in the Trusted Research Environment. AAD holds the identities of all the TRE/workspace users, including administrators, and connects the identities with applications which define the permissions for each user role.
+[Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/whatis) is the backbone of Authentication and Authorization in the Trusted Research Environment. Microsoft Entra ID holds the identities of all the TRE/workspace users, including administrators, and connects the identities with applications which define the permissions for each user role.
 
-It is common that the Azure Administrator is not necessarily the Azure Active Directory Administrator. Due to this, this step may have to be carried out by a different individual/team. We have automated this into a simple command, but should you wish, you can run these steps manually.
+It is common that the Azure Administrator is not necessarily the Microsoft Entra ID Administrator. Due to this, this step may have to be carried out by a different individual/team. We have automated this into a simple command, but should you wish, you can run these steps manually.
 
 This page describes the automated Auth setup for TRE.
 
 ## Pre-requisites
-The automation utilises a `make` command, which reads a few environment variables and creates the AAD assets. The following values are needed to be in place before you run the creation process. (`/config.yaml`)
+The automation utilises a `make` command, which reads a few environment variables and creates the Microsoft Entra ID assets. The following values are needed to be in place before you run the creation process. (`/config.yaml`)
 
 | Key | Description |
 | ----------- | ----------- |
 |TRE_ID|This is used to build up the name of the identities|
-|AAD_TENANT_ID|The tenant id of where your AAD identities will be placed. This can be different to the tenant where your Azure resources are created.|
-| LOCATION | Where your Azure assets will be provisioned (eg. westeurope). This is used to add a redirect URI from the Swagger UI to the API Application.
-|AUTO_WORKSPACE_APP_REGISTRATION| Default of `false`. Setting this to true grants the `Application.ReadWrite.All` and `Directory.Read.All` permission to the *Application Admin* identity. This identity is used to manage other AAD applications that it owns, e.g. Workspaces. If you do not set this, the identity will have `Application.ReadWrite.OwnedBy`. Further information can be found [here](./identities/application_admin.md).
-|AUTO_WORKSPACE_GROUP_CREATION| Default of `false`. Setting this to true grants the `Group.ReadWrite.All` permission to the *Application Admin* identity. This identity can then create security groups aligned to each applciation role. Active Directory licencing implications need to be considered as Group assignment is a [premium feature](https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles#roles-using-azure-ad-app-roles).
+|AAD_TENANT_ID|The tenant id of where your Microsoft Entra ID identities will be placed. This can be different to the tenant where your Azure resources are created.|
+| LOCATION | Where your Azure assets will be provisioned (eg. westeurope). This is used to add a redirect URI from the Swagger UI to the API Application.|
+|AUTO_WORKSPACE_APP_REGISTRATION| Default of `false`. Setting this to true grants the `Application.ReadWrite.All` and `Directory.Read.All` permission to the *Application Admin* identity. This identity is used to manage other Microsoft Entra ID applications that it owns, e.g. Workspaces. If you do not set this, the identity will have `Application.ReadWrite.OwnedBy`. Further information can be found [here](./identities/application_admin.md).|
+|AUTO_WORKSPACE_GROUP_CREATION| Default of `false`. Setting this to true grants the `Group.ReadWrite.All` permission to the *Application Admin* identity. This identity can then create security groups aligned to each applciation role. Microsoft Entra ID licencing implications need to be considered as Group assignment is a [premium feature](https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles#roles-using-azure-ad-app-roles).|
 
 ## Create Authentication assets
 You can build all of the Identity assets by running the following at the command line
@@ -28,8 +28,8 @@ The contents of your authentication section in `config.yaml` file should contain
 
   | Variable | Description |
   | -------- | ----------- |
-  | `APPLICATION_ADMIN_CLIENT_ID`| This client will administer AAD Applications for TRE |
-  | `APPLICATION_ADMIN_CLIENT_SECRET`| This client will administer AAD Applications for TRE |
+  | `APPLICATION_ADMIN_CLIENT_ID`| This client will administer Microsoft Entra ID Applications for TRE |
+  | `APPLICATION_ADMIN_CLIENT_SECRET`| This client will administer Microsoft Entra ID Applications for TRE |
   | `TEST_ACCOUNT_CLIENT_ID`| This will be created by default, but can be disabled by editing `/devops/scripts/create_aad_assets.sh`. This is the user that will run the tests for you |
   | `TEST_ACCOUNT_CLIENT_SECRET` | This will be created by default, but can be disabled by editing `/devops/scripts/create_aad_assets.sh`. This is the user that will run the tests for you |
   | `API_CLIENT_ID` | API application (client) ID. |
@@ -38,16 +38,16 @@ The contents of your authentication section in `config.yaml` file should contain
   | `WORKSPACE_API_CLIENT_ID` | Each workspace is secured behind it's own AD Application|
   | `WORKSPACE_API_CLIENT_SECRET` | Each workspace is secured behind it's own AD Application. This is the secret for that application.|
 
-### Using a separate Azure Active Directory tenant
+### Using a separate Microsoft Entra ID tenant
 
 !!! caution
-    This section is only relevant it you are setting up a separate Azure Active Directory tenant for use.
-    This is only recommended for development environments when you don't have the required permissions to register applications in Azure Active Directory.
-    Using a separate Azure Active Directory tenant will prevent you from using certain Azure Active Directory integrated services.
-    For production deployments, work with your Azure Active Directory administrator to perform the required registration
+    This section is only relevant it you are setting up a separate Microsoft Entra ID tenant for use.
+    This is only recommended for development environments when you don't have the required permissions to register applications in Microsoft Entra ID.
+    Using a separate Microsoft Entra ID tenant will prevent you from using certain Microsoft Entra ID integrated services.
+    For production deployments, work with your Microsoft Entra ID administrator to perform the required registration
 
-1. Create an Azure Active Directory tenant
-    To create a new Azure Active Directory tenant, [follow the steps here](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant)
+1. Create an Microsoft Entra ID tenant
+    To create a new Microsoft Entra ID tenant, [follow the steps here](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-create-new-tenant)
 
 1. Follow the steps outlined above. `make auth` should logon to the correct tenant. Make sure you logon back to the correct tenant before running `make all`.
 
@@ -56,23 +56,23 @@ The contents of your authentication section in `config.yaml` file should contain
 
 App registrations (represented by service principals) define the various access permissions to the TRE system. There are a total of five main Applications of interest.
 
-| AAD Application | Description |
+| Microsoft Entra ID Application | Description |
 | ----------- | ----------- |
 | TRE API application | This is the main application and used to secure access to the [TRE API](../tre-developers/api.md). |
 | TRE UX | This is the client application that will authenticate to the TRE/Workspace APIs. |
-| Application Admin | There are times when workspace services need to update the AAD Application. For example, Guacamole needs to add a redirect URI to the Workspace AAD Application. This identity is used to manage AAD Applications.
+| Application Admin | There are times when workspace services need to update the Microsoft Entra ID Application. For example, Guacamole needs to add a redirect URI to the Workspace Microsoft Entra ID Application. This identity is used to manage Microsoft Entra ID Applications. |
 | Automation App | This application is created so that you can run the tests or any CI/CD capability without the need to divulge a user password. This is particularly important if your tenant is MFA enabled. |
 | Workspace API | Typically you would have an application securing one or more workspaces that are created by TRE. |
 
-Some of the applications require **admin consent** to allow them to validate users against the AAD. Check the Microsoft Docs on [Configure the admin consent workflow](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow) on how to request admin consent and handle admin consent requests.
+Some of the applications require **admin consent** to allow them to validate users against the Microsoft Entra ID. Check the Microsoft Docs on [Configure the admin consent workflow](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow) on how to request admin consent and handle admin consent requests.
 
-We strongly recommend that you use `make auth` to create the AAD assets as this has been tested extensively. Should you wish to create these manually via the [Azure Portal](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app); more information can be found [here](./identities/auth-manual.md).
+We strongly recommend that you use `make auth` to create the Microsoft Entra ID assets as this has been tested extensively. Should you wish to create these manually via the [Azure Portal](https://learn.microsoft.com/en-gb/entra/identity-platform/quickstart-register-app); more information can be found [here](./identities/auth-manual.md).
 
 ### Enabling users
 
 For a user to gain access to the system, they have to:
 
-1. Have an identity in Azure AD
+1. Have an identity in Microsoft Entra ID
 1. Be linked with an app registration and assigned a role
 
 When these requirements are met, the user can sign-in using their credentials and use their privileges to use the API, login to workspace environment etc. based on their specific roles.

docs/tre-admins/environment-variables.md

@@ -15,7 +15,7 @@
 | `ARM_SUBSCRIPTION_ID` | *Optional for manual deployment. If not specified the `az cli` selected subscription will be used.* The Azure subscription ID for all resources. |
 | `ARM_CLIENT_ID` | *Optional for manual deployment without logged-in credentials.* The client whose azure identity will be used to deploy the solution. |
 | `ARM_CLIENT_SECRET` | *Optional for manual deployment without logged-in credentials.* The password of the client defined in `ARM_CLIENT_ID`. |
-| `ARM_TENANT_ID` | *Optional for manual deployment. If not specified the `az cli` selected subscription will be used.* The AAD tenant of the client defined in `ARM_CLIENT_ID`. |
+| `ARM_TENANT_ID` | *Optional for manual deployment. If not specified the `az cli` selected subscription will be used.* The Microsoft Entra ID tenant of the client defined in `ARM_CLIENT_ID`. |
 
 ## For Azure TRE instance in `/config.yaml`
 
@@ -43,8 +43,8 @@
 
   | Variable | Description |
   | -------- | ----------- |
-  | `APPLICATION_ADMIN_CLIENT_ID`| This client will administer AAD Applications for TRE |
-  | `APPLICATION_ADMIN_CLIENT_SECRET`| This client will administer AAD Applications for TRE |
+  | `APPLICATION_ADMIN_CLIENT_ID`| This client will administer Microsoft Entra ID Applications for TRE |
+  | `APPLICATION_ADMIN_CLIENT_SECRET`| This client will administer Microsoft Entra ID Applications for TRE |
   | `TEST_ACCOUNT_CLIENT_ID`| This will be created by default, but can be disabled by editing `/devops/scripts/create_aad_assets.sh`. This is the user that will run the tests for you |
   | `TEST_ACCOUNT_CLIENT_SECRET` | This will be created by default, but can be disabled by editing `/devops/scripts/create_aad_assets.sh`. This is the user that will run the tests for you |
   | `API_CLIENT_ID` | API application (client) ID. |

docs/tre-admins/identities/api.md

@@ -1,10 +1,10 @@
 # The API Identity
 
 ## Name
-The API Identity is typically called `<TRE_ID> API` within the AAD Portal.
+The API Identity is typically called `<TRE_ID> API` within the Microsoft Entra ID Portal.
 
 ## Purpose
-This identity's credentials are stored in the `core` Key Vault and mandatory for the running of the Trusted Research Environment (TRE). It is required for the API Application, hosted in Azure App Service, to authenticate to Azure Active Directory and authorize the various operations.
+This identity's credentials are stored in the `core` Key Vault and mandatory for the running of the Trusted Research Environment (TRE). It is required for the API Application, hosted in Azure App Service, to authenticate to Microsoft Entra ID and authorize the various operations.
 
 ## Application Roles
 
@@ -49,7 +49,7 @@ Below is a sample where `TRE_ID` has value `mytre`:
 | -------- | ----------- |
 | `--name` | The prefix of the name of the app registrations. `TRE` will give you `TRE API`. |
 | `--tre-url` | Used to construct auth redirection URLs for the UI and Swagger app. Use the values of the [environment variables](../environment-variables.md) `TRE_ID` and `LOCATION` in the URL. Reply URL for the localhost, `http://localhost:8000/api/docs/oauth2-redirect`, will be added by default. |
-| `--admin-consent` | Grants admin consent for the app registrations. This is required for them to function properly, but requires AAD admin privileges. |
+| `--admin-consent` | Grants admin consent for the app registrations. This is required for them to function properly, but requires Microsoft Entra ID admin privileges. |
 | `--automation-clientid` | This is an optional parameter but will grant TREAdmin permission to the Service Principal of the Automation Admin.|
 | `--reset-password` | Optional, default is 0. When run in a headless fashion, 1 is passed in to always reset the password. |
 
@@ -60,7 +60,7 @@ Below is a sample where `TRE_ID` has value `mytre`:
 
 You can create an automation account which will aid your development flow, if you don't want to do this you can omit the `--automation-clientid` switch.
 
-You can run the script without the `--admin-consent` and ask your admin to grant consent. If you don't have permissions and just want to create a development environment then skip this step and see the steps in the "Using a separate Azure Active Directory tenant) below.
+You can run the script without the `--admin-consent` and ask your admin to grant consent. If you don't have permissions and just want to create a development environment then skip this step and see the steps in the "Using a separate Microsoft Entra ID tenant) below.
 
 ## Environment Variables
 | Variable | Description | Location |

docs/tre-admins/identities/application_admin.md

@@ -1,7 +1,7 @@
 # The Application Administrator Identity
 
 ## Purpose
-This identity's credentials are stored in the core key vault and are used when you wish to update AAD Applications. For instance, when you add Guacamole as a Workspace Service, you would need to add the URI of the Guacamole Service as a Redirect URI to the Workspace App to complete the login flow.
+This identity's credentials are stored in the core key vault and are used when you wish to update Microsoft Entra ID Applications. For instance, when you add Guacamole as a Workspace Service, you would need to add the URI of the Guacamole Service as a Redirect URI to the Workspace App to complete the login flow.
 
 ## Application Roles
 This application does not have any roles defined.
@@ -9,10 +9,10 @@ This application does not have any roles defined.
 ## Microsoft Graph Permissions
 | Name | Type* | Admin consent required |  TRE usage |
 | --- | -- | -----| --------- |
-| Application.ReadWrite.OwnedBy | Application | Yes | This user has `Application.ReadWrite.OwnedBy` as a minimum permission for it to function. If the tenant is managed by a customer administrator, then this user must be added to the **Owners** of every workspace that is created. This will allow TRE to manage the AAD Application. This will be a manual process for the Tenant Admin. |
-| Application.ReadWrite.All | Application | Yes | This permission is required to create workspace applications and administer any applications in the tenant. This is needed if the AAD Administrator has delegated AAD administrative operations to the TRE. There will be no need for the Tenant Admin to manually create workspace applications in the Tenant. |
-| Directory.Read.All | Application | Yes | This permission is required to read User details from Azure Active Directory. This is needed if the AAD Administrator has delegated AAD administrative operations to the TRE. |
-| Group.ReadWrite.All | Application | Yes | This permission is required to create and update Azure AD groups. This is requried if Azure AD groups are to be created automatically by the TRE. |
+| Application.ReadWrite.OwnedBy | Application | Yes | This user has `Application.ReadWrite.OwnedBy` as a minimum permission for it to function. If the tenant is managed by a customer administrator, then this user must be added to the **Owners** of every workspace that is created. This will allow TRE to manage the Microsoft Entra ID Application. This will be a manual process for the Tenant Admin. |
+| Application.ReadWrite.All | Application | Yes | This permission is required to create workspace applications and administer any applications in the tenant. This is needed if the Microsoft Entra ID Administrator has delegated Microsoft Entra ID administrative operations to the TRE. There will be no need for the Tenant Admin to manually create workspace applications in the Tenant. |
+| Directory.Read.All | Application | Yes | This permission is required to read User details from Microsoft Entra ID. This is needed if the Microsoft Entra ID Administrator has delegated Microsoft Entra ID administrative operations to the TRE. |
+| Group.ReadWrite.All | Application | Yes | This permission is required to create and update Microsoft Entra ID groups. This is requried if Microsoft Entra ID groups are to be created automatically by the TRE. |
 
 '*' See the difference between [delegated and application permission](https://docs.microsoft.com/graph/auth/auth-concepts#delegated-and-application-permissions) types. See [Microsoft Graph permissions reference](https://docs.microsoft.com/graph/permissions-reference) for more details.
 
@@ -28,7 +28,7 @@ This user is currently only used from the Porter bundles hosted on the Resource
 | Argument | Description |
 | -------- | ----------- |
 | `--name` | This is used to put a friendly name to the Application that can be seen in the portal. It is typical to use the name of your TRE instance. |
-| `--admin-consent` | If you have the appropriate permission to grant admin consent, then pass in this argument. If you do not, you will have to ask an AAD Admin to consent after you have created the identity. Consent is required for this permission. |
+| `--admin-consent` | If you have the appropriate permission to grant admin consent, then pass in this argument. If you do not, you will have to ask an Microsoft Entra ID Admin to consent after you have created the identity. Consent is required for this permission. |
 | `--application-permission` | This  is a comma seperated list of the permissions that need to be assigned. For exampler `Application.ReadWrite.All,Directory.Read.All,Group.ReadWrite.All` |
 | `--reset-password` | Optional, default is 0. When run in a headless fashion, 1 is passed in to always reset the password. |
 

docs/tre-admins/identities/auth-manual.md

@@ -1,4 +1,4 @@
-# Manually creating AAD identities
+# Manually creating Microsoft Entra ID identities
 
 This guide is here if you wanted to create these Application Registrations manually.
 

docs/tre-admins/identities/client.md

@@ -1,7 +1,7 @@
 # TRE Client UX
 
 ## Name
-The Client Identity is typically called `<TRE_ID> UX` within the AAD Portal.
+The Client Identity is typically called `<TRE_ID> UX` within the Microsoft Entra ID Portal.
 
 ## Purpose
 This identity is used by any public facing client application so that user impersonation can occur to the Core API and any Workspace Applications.
@@ -38,9 +38,9 @@ Example on how to run the script:
 | -------- | ----------- |
 | `--name` | The prefix of the name of the app registrations. `TRE` will give you `TRE API`. |
 | `--tre-url` | Used to construct auth redirection URLs for the UI and Swagger app. Use the values of the [environment variables](../environment-variables.md) `TRE_ID` and `LOCATION` in the URL. Reply URL for the localhost, `http://localhost:8000/api/docs/oauth2-redirect`, will be added by default. |
-| `--admin-consent` | Grants admin consent for the app registrations. This is required for them to function properly, but requires AAD admin privileges. |
+| `--admin-consent` | Grants admin consent for the app registrations. This is required for them to function properly, but requires Microsoft Entra ID admin privileges. |
 | `--automation-clientid` | This is an optional parameter but will create an application with test users with permission to use the `TRE API` and `TRE Swagger UI` |
-| `--reset-password` | Optional, default is 0. This flag has no relevance when creating the UX as there is no password for the AAD Application. |
+| `--reset-password` | Optional, default is 0. This flag has no relevance when creating the UX as there is no password for the Microsoft Entra ID Application. |
 
 
 ## Redirect URLs

docs/tre-admins/identities/test-account.md

@@ -1,7 +1,7 @@
 # TRE Automation Admin Application
 
 ## Name
-The Automation Application is typically called `<TRE_ID> Automation Admin` within the AAD Portal.
+The Automation Application is typically called `<TRE_ID> Automation Admin` within the Microsoft Entra ID Portal.
 
 ## Purpose
 This application is used to authorize end-to-end test scenarios.
@@ -48,10 +48,10 @@ Example on how to run the script:
 
 
 ### Create this application from the portal (optional)
-To create an application registration for automation, open the Azure Active Directory tenant for your TRE in the portal and navigate to "App Registrations".
+To create an application registration for automation, open the Microsoft Entra ID tenant for your TRE in the portal and navigate to "App Registrations".
 Click "New registration" as shown in the image below.
 
-![Screenshot of Azure portal showing "New registration" in Azure Active Directory](../../assets/tre-automation-new-app-registration.png)
+![Screenshot of Azure portal showing "New registration" in Microsoft Entra ID](../../assets/tre-automation-new-app-registration.png)
 
 Enter a name for the application registration and click "Register".
 

docs/tre-admins/identities/workspace.md

@@ -25,7 +25,7 @@ This identity should only be used by the API Application.
 
 ## How to create
 There are two mechanisms for creating Workspace Applications
-- Manually by your AAD Tenant Admin (default)
+- Manually by your Microsoft Entra ID Tenant Admin (default)
 - Automatically by TRE. Please see this [guide](./application_admin.md) if you wish this to be automatic.
 
 !!! caution
@@ -46,9 +46,9 @@ Example on how to run the script:
 | -------- | ----------- |
 | `--name` | The name of the application. This will be suffixed with 'API' by the script. |
 | `--ux-clientid` | This value is one of the outputs when you first ran the script. It is mandatory if you use admin-consent. |
-| `--admin-consent` | Grants admin consent for the app registrations. This is required for them to function properly, but requires AAD admin privileges. |
+| `--admin-consent` | Grants admin consent for the app registrations. This is required for them to function properly, but requires Microsoft Entra ID admin privileges. |
 | `--automation-clientid` | This is an optional parameter but will grant the Automation App (created in step 1) permission to the new workspace app. |
-| `--application-admin-clientid` | This is a required parameter , and should be a client id that will be added to the Owners of the AAD Application so that it can be administered within TRE. |
+| `--application-admin-clientid` | This is a required parameter , and should be a client id that will be added to the Owners of the Microsoft Entra ID Application so that it can be administered within TRE. |
 | `--reset-password` | Optional, default is 0. When run in a headless fashion, 1 is passed in to always reset the password. |
 
 
@@ -64,4 +64,4 @@ If you do not wish to grant the Automation App permission to your workspace, jus
 |WORKSPACE_API_CLIENT_SECRET|The client secret|`./config.yaml`|
 
 ## Comments
-When the Workspace AAD app is registered by running `make auth`, the `Workspace Scope Id` is the same as the Client Id. When the Workspace AAD app is created by the base workspace, the `Workspace Scope Id` will be in this format `api://<TRE_ID>_ws_<WORKSPACE_SHORT_IDENTIFIER>`
+When the Workspace Microsoft Entra ID app is registered by running `make auth`, the `Workspace Scope Id` is the same as the Client Id. When the Workspace Microsoft Entra ID app is created by the base workspace, the `Workspace Scope Id` will be in this format `api://<TRE_ID>_ws_<WORKSPACE_SHORT_IDENTIFIER>`

docs/tre-admins/setup-instructions/ad-tenant-choices.md

@@ -1,4 +1,4 @@
-# Azure Active Directory Tenant Choices
+# Microsoft Entra ID Tenant Choices
 
 ## Dedicated Tenant for TRE
 
@@ -10,13 +10,13 @@ Users from your corporate tenant can be guested into this new TRE tenant.
 
 ## Corporate Tenant
 
-It is possible to use your corporate tenant for TRE. This does have the advantage of only managing a single tenant, but your AAD Tenant Admin must be aware of what TRE brings to your organization and must be prepared to carry out some admin tasks, like creating an AAD Application every time a new Workspace is created.
+It is possible to use your corporate tenant for TRE. This does have the advantage of only managing a single tenant, but your Microsoft Entra ID Tenant Admin must be aware of what TRE brings to your organization and must be prepared to carry out some admin tasks, like creating an Microsoft Entra ID Application every time a new Workspace is created.
 
 [![TRE Tenant](../../assets/corp-tenant.png)](../../assets/corp-tenant.png)
 
-## Create Dedicated Azure Active Directory Tenant
+## Create Dedicated Microsoft Entra ID Tenant
 
-Follow [this guide](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant) to create new dedicated tenant.
+Follow [this guide](https://learn.microsoft.com/en-us/entra/fundamentals/create-new-tenant) to create new dedicated tenant.
 
 ## Next steps
 

docs/tre-admins/setup-instructions/cicd-pre-deployment-steps.md

@@ -92,8 +92,8 @@ In a previous [Setup Auth configuration](./setup-auth-entities.md) step authenti
   | Secret Name | Description |
   | -------- | ----------- |
   | `AAD_TENANT_ID` | Tenant id against which auth is performed. |
-  | `APPLICATION_ADMIN_CLIENT_ID`| This client will administer AAD Applications for TRE |
-  | `APPLICATION_ADMIN_CLIENT_SECRET`| This client will administer AAD Applications for TRE |
+  | `APPLICATION_ADMIN_CLIENT_ID`| This client will administer Microsoft Entra ID Applications for TRE |
+  | `APPLICATION_ADMIN_CLIENT_SECRET`| This client will administer Microsoft Entra ID Applications for TRE |
   | `TEST_ACCOUNT_CLIENT_ID`| This will be created by default, but can be disabled by editing `/devops/scripts/create_aad_assets.sh`. This is the user that will run the tests for you |
   | `TEST_ACCOUNT_CLIENT_SECRET` | This will be created by default, but can be disabled by editing `/devops/scripts/create_aad_assets.sh`. This is the user that will run the tests for you |
   | `API_CLIENT_ID` | API application (client) ID. |

docs/tre-admins/setup-instructions/installing-base-workspace.md

@@ -29,7 +29,7 @@ As explained in the [auth guide](../auth.md), every workspace has a correspondin
 ```
 
 !!! caution
-    If you're using a separate tenant for AAD app registrations to the one where you've deployed the TRE infrastructure resources, ensure you've signed into that tenant in the `az cli` before running the above command. See **Using a separate Azure Active Directory tenant** in [Setup Auth configuration](setup-auth-entities.md) for more details.
+    If you're using a separate tenant for Microsoft Entra ID app registrations to the one where you've deployed the TRE infrastructure resources, ensure you've signed into that tenant in the `az cli` before running the above command. See **Using a separate Microsoft Entra ID tenant** in [Setup Auth configuration](setup-auth-entities.md) for more details.
 
 Running the script will report `workspace_api_client_id` and `workspace_api_client_secret` for the generated app. Add these under the authenrication section in `/config.yaml` so that automated testing will work. You also need to use `workspace_api_client_id` in the POST body below.
 

docs/tre-admins/setup-instructions/prerequisites.md

@@ -3,7 +3,7 @@
 To deploy an Azure TRE instance, the following assets and tools are required:
 
 * [Azure subscription](https://azure.microsoft.com)
-* [Azure Active Directory (AAD)](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) tenant in which you can create application registrations
+* [Microsoft Entra ID](https://learn.microsoft.com/en-gb/entra/fundamentals/whatis) tenant in which you can create application registrations
 * Git client such as [Git](https://git-scm.com/) or [GitHub Desktop](https://desktop.github.com/)
 * [Docker Desktop](https://www.docker.com/products/docker-desktop)
 

docs/tre-admins/setup-instructions/setup-auth-entities.md

@@ -19,9 +19,9 @@ Next, you will set the configuration variables for the specific Azure TRE instan
 
     The rest of the variables can have their default values.
 
-1. Decide on a name for your `tre_id` ID for the Azure TRE instance. The value will be used in various Azure resources and AAD application names. It **needs to be globally unique and less than 12 characters in length**. Use **only** lowercase alphanumerics. Choose wisely!
+1. Decide on a name for your `tre_id` ID for the Azure TRE instance. The value will be used in various Azure resources and Microsoft Entra ID application names. It **needs to be globally unique and less than 12 characters in length**. Use **only** lowercase alphanumerics. Choose wisely!
 1. Once you have decided on which AD Tenant paradigm, then you should be able to set `aad_tenant_id` in the authentication section in your `config.yaml` file.
-1. Your AAD Tenant Admin can now use the terminal window in Visual Studio Code to execute the following script from within the development container to create all the AAD Applications that are used for TRE. The details of the script are covered in the [auth document](../auth.md).
+1. Your Microsoft Entra ID Tenant Admin can now use the terminal window in Visual Studio Code to execute the following script from within the development container to create all the Microsoft Entra ID Applications that are used for TRE. The details of the script are covered in the [auth document](../auth.md).
 
    ```bash
    make auth
@@ -33,7 +33,7 @@ Next, you will set the configuration variables for the specific Azure TRE instan
       In case you have several subscriptions and would like to change your default subscription use `az account set --subscription <desired subscription ID>`
 
   !!! note
-      The full functionality of the script requires directory admin privileges. You may need to contact your friendly Azure Active Directory admin to complete this step. The app registrations can be created manually in Azure Portal too. For more information, see [Authentication and authorization](../auth.md).
+      The full functionality of the script requires directory admin privileges. You may need to contact your friendly Microsoft Entra ID admin to complete this step. The app registrations can be created manually in Azure Portal too. For more information, see [Authentication and authorization](../auth.md).
   
 
 All other variables can have their default values for now.

docs/tre-admins/setup-instructions/ui-install-base-workspace.md

@@ -57,7 +57,7 @@ As explained in the [auth guide](../auth.md), every workspace has a correspondin
 ```
 
 !!! caution
-    If you're using a separate tenant for AAD app registrations to the one where you've deployed the TRE infrastructure resources, ensure you've signed into that tenant in the `az cli` before running the above command. See **Using a separate Azure Active Directory tenant** in [Setup Auth configuration](./setup-auth-entities.md) for more details.
+    If you're using a separate tenant for Microsoft Entra ID app registrations to the one where you've deployed the TRE infrastructure resources, ensure you've signed into that tenant in the `az cli` before running the above command. See **Using a separate Microsoft Entra ID tenant** in [Setup Auth configuration](./setup-auth-entities.md) for more details.
 
 Running the script will report `WORKSPACE_API_CLIENT_ID` and `WORKSPACE_API_CLIENT_SECRET` for the generated app. Set these under authentication section in `config.yaml` so that automated testing will work. You also need to use `WORKSPACE_API_CLIENT_ID` and `WORKSPACE_API_CLIENT_SECRET` in the form.
 

docs/tre-admins/setup-instructions/workflows.md

@@ -74,7 +74,7 @@ Configure the TRE API and Swagger UI repository secrets
 
 | <div style="width: 230px">Secret name</div> | Description |
 | ----------- | ----------- |
-| `AAD_TENANT_ID` | The tenant ID of the Azure AD. |
+| `AAD_TENANT_ID` | The tenant ID of the Microsoft Entra ID. |
 | `SWAGGER_UI_CLIENT_ID` | The application (client) ID of the TRE Swagger UI app. |
 | `API_CLIENT_ID` | The application (client) ID of the TRE API app. |
 | `API_CLIENT_SECRET` | The application password (client secret) of the TRE API app. |

docs/tre-developers/api.md

@@ -144,7 +144,7 @@ make auth
 ```
 
 Alternatively, in Azure Portal you can add the redirect URL to the App Registration.
-Under AAD, find App Registrations, and find the App Registration with the ID shown in the error message.
+Under Microsoft Entra ID, find App Registrations, and find the App Registration with the ID shown in the error message.
 There, go to Redirect URL and add the URL given to you by the error message (it will have a form of
 `https://${TRE_ID}.westeurope.cloudapp.azure.com/api/docs/oauth2-redirect`).
 

docs/tre-developers/ui.md

@@ -8,7 +8,7 @@ The UI is built upon several popular web frameworks:
   - Typescript
   - React Router v6 for client side routing
 - Fluent UI [Fluent UI Docs](https://developer.microsoft.com/en-us/fluentui#/controls/web)
-- MSAL v2: AAD authentication [msal-react docs](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-react)
+- MSAL v2: Microsoft Entra ID authentication [msal-react docs](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/lib/msal-react)
 
 
 ### Folder structure
@@ -27,7 +27,7 @@ ui
 ### AuthN + AuthZ
 For further details on the auth setup, see [Auth](../tre-admins/auth.md).
 
-As stated above, AAD is used for Authentication and Authorization. There are 3 AAD apps involved here:
+As stated above, Microsoft Entra ID is used for Authentication and Authorization. There are 3 Microsoft Entra ID apps involved here:
 - **TRE UX**. This is the app that the user authenticates against. Once authenticated, the client will request an access token for the `TRE Api`.
 - **TRE Api**. In the access token response from this app we get the user's role membership for TRE-level roles (`TREAdmin` / `TREUser`). Based on these role memberships, aspects of the UI will be made available. If the user is in a `TREAdmin` role, they will see buttons to create workspaces for instance.
 When the user navigates into a Workspace, the client will request an access token for that `Workspace App`.
@@ -39,7 +39,7 @@ From this access token we can find the Workspace-level roles the user is in (`Wo
 ### React Contexts
 The React Context API is a clean way to handle a limited amount of global state, and is used for a few scenarios in this project:
 - TRE Roles Context: A context provides details of the base TRE roles a user is in, which can be consumed anywhere throughout the app
-- Workspace Context: Tracks the currently selected Workspace, and the roles the user is in for that Workspace. This context is used for nested components to be able to authenticate against the correct AAD App via `workspaceCtx.workspaceApplicationIdURI`.
+- Workspace Context: Tracks the currently selected Workspace, and the roles the user is in for that Workspace. This context is used for nested components to be able to authenticate against the correct Microsoft Entra ID App via `workspaceCtx.workspaceApplicationIdURI`.
 - Create Form Context: A context to control the Create / Update form behaviour.
 - Notifications Context: Tracks all the in-progress operations currently running. For each operation, the Notifications panel also uses this context to broadcast Component 'actions' which are subscribed to by downstream components. This way, a resource component does not have to track it's own changes, and can be 'told' by the Notifications Context whether it should refresh / lock etc.
 

docs/tre-templates/shared-services/gitea.md

@@ -44,7 +44,7 @@ Gitea needs to be able to access the following resource outside the Azure TRE VN
 
 | Service Tag / Destination | Justification |
 | --- | --- |
-| AzureActiveDirectory | Authorize the signed in user against Azure Active Directory. |
+| AzureActiveDirectory | Authorize the signed in user against Microsoft Entra ID. |
 | AzureContainerRegistry | Pull the Gitea container image, as it is located in Azure Container Registry.  |
 | (www.)github.com | Allows Gitea to mirror any repo on GitHub |
 

docs/tre-templates/shared-services/nexus.md

@@ -63,7 +63,7 @@ Nexus Shared Service requires access to resources outside of the Azure TRE VNET.
 
 | Service Tag / Destination | Justification |
 | --- | --- |
-| AzureActiveDirectory | Authorize the signed in user against Azure Active Directory. |
+| AzureActiveDirectory | Authorize the signed in user against Microsoft Entra ID. |
 | AzureContainerRegistry | Pull the Nexus container image, as it is located in Azure Container Registry.  |
 | pypi.org, *.pypi.org | Enables Nexus to "proxy" python packages to use inside of workspaces. |
 | repo.anaconda.com | Enables Nexus to "proxy" conda packages to use inside of workspaces. |

docs/tre-templates/workspace-services/gitea.md

@@ -7,7 +7,7 @@ See: [https://gitea.io/](https://gitea.io)
 The Gitea worskpace service opens outbound access to:
 
 - AzureActiveDirectory
-- Azure AD CDN - `https://aadcdn.msftauth.net`
+- Microsoft Entra ID CDN - `https://aadcdn.msftauth.net`
 
 ## Prerequisites
 

docs/tre-workspace-authors/authoring-workspace-templates.md

@@ -27,9 +27,9 @@ The manifest of a workspace bundle is the `porter.yaml` file (see [Author Bundle
 
 A workspace bundle requires the following [credentials](https://porter.sh/author-bundles/#credentials) to provision resources in Azure:
 
-* [Azure tenant ID](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-to-find-tenant)
+* [Azure tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant)
 * Azure subscription ID
-* The client ID of a [service principal](https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals) with privileges to provision resources
+* The client ID of a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser) with privileges to provision resources
 * The client secret (password) of a service principal
 
 The credentials are provided as environment variables by the deployment runner. The bundle author must use the following environment variable names:

docs/using-tre/local-development/local-development.md

@@ -9,7 +9,7 @@ This guide will cover how to setup local development environment to add custom t
 To deploy an Azure TRE instance, the following assets and tools are required:
 
 * [Azure subscription](https://azure.microsoft.com)
-* [Azure Active Directory (AAD)](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) tenant in which you can create application registrations
+* [Microsoft Entra ID](https://learn.microsoft.com/en-gb/entra/fundamentals/whatis) tenant in which you can create application registrations
 * Git client such as [Git](https://git-scm.com/) or [GitHub Desktop](https://desktop.github.com/)
 * [Docker Desktop](https://www.docker.com/products/docker-desktop)
 

e2e_tests/.env.sample

@@ -18,7 +18,7 @@ TEST_WORKSPACE_APP_SECRET=<workspace app registration client secret>
 WORKSPACE_APP_SERVICE_PLAN_SKU="P1v2"
 
 TEST_WORKSPACE_ID=<ID of pre-created workspace>
-TEST_AAD_WORKSPACE_ID=ID of pre-created AAD workspace>
+TEST_AAD_WORKSPACE_ID=ID of pre-created Microsoft Entra ID workspace>
 
 # Run tests sequentially. Change this value if you want to run tests in parallel locally
 E2E_TESTS_NUMBER_PROCESSES=1

templates/workspaces/airlock-import-review/.env.sample

@@ -4,14 +4,14 @@ ARM_TENANT_ID="__CHANGE_ME__"
 ARM_SUBSCRIPTION_ID="__CHANGE_ME__"
 AUTH_TENANT_ID="__CHANGE_ME__"
 
-# These are passed in if Terraform will create the Workspace AAD Application
+# These are passed in if Terraform will create the Workspace Microsoft Entra ID Application
 REGISTER_AAD_APPLICATION=true
 CREATE_AAD_GROUPS=true
 AUTH_CLIENT_ID="__CHANGE_ME__"
 AUTH_CLIENT_SECRET="__CHANGE_ME__"
 WORKSPACE_OWNER_OBJECT_ID="__CHANGE_ME__"
 
-# These are passed in if you register the Workspace AAD Application before hand
+# These are passed in if you register the Workspace Microsoft Entra ID Application before hand
 # REGISTER_AAD_APPLICATION=false
 # CLIENT_ID="__CHANGE_ME__"
 # CLIENT_SECRET="__CHANGE_ME__"

templates/workspaces/base/.env.sample

@@ -4,14 +4,14 @@ ARM_TENANT_ID="__CHANGE_ME__"
 ARM_SUBSCRIPTION_ID="__CHANGE_ME__"
 AUTH_TENANT_ID="__CHANGE_ME__"
 
-# These are passed in if Terraform will create the Workspace AAD Application
+# These are passed in if Terraform will create the Workspace Microsoft Entra ID Application
 REGISTER_AAD_APPLICATION=true
 CREATE_AAD_GROUPS=true
 AUTH_CLIENT_ID="__CHANGE_ME__"
 AUTH_CLIENT_SECRET="__CHANGE_ME__"
 WORKSPACE_OWNER_OBJECT_ID="__CHANGE_ME__"
 
-# These are passed in if you register the Workspace AAD Application before hand
+# These are passed in if you register the Workspace Microsoft Entra ID Application before hand
 # REGISTER_AAD_APPLICATION=false
 # CLIENT_ID="__CHANGE_ME__"
 # CLIENT_SECRET="__CHANGE_ME__"

templates/workspaces/unrestricted/.env.sample

@@ -4,14 +4,14 @@ ARM_TENANT_ID="__CHANGE_ME__"
 ARM_SUBSCRIPTION_ID="__CHANGE_ME__"
 AUTH_TENANT_ID="__CHANGE_ME__"
 
-# These are passed in if Terraform will create the Workspace AAD Application
+# These are passed in if Terraform will create the Workspace Microsoft Entra ID Application
 REGISTER_AAD_APPLICATION=true
 CREATE_AAD_GROUPS=true
 AUTH_CLIENT_ID="__CHANGE_ME__"
 AUTH_CLIENT_SECRET="__CHANGE_ME__"
 WORKSPACE_OWNER_OBJECT_ID="__CHANGE_ME__"
 
-# These are passed in if you register the Workspace AAD Application before hand
+# These are passed in if you register the Workspace Microsoft Entra ID Application before hand
 # REGISTER_AAD_APPLICATION=false
 # CLIENT_ID="__CHANGE_ME__"
 # CLIENT_SECRET="__CHANGE_ME__"

ui/README.md

@@ -7,7 +7,7 @@ The UI was built using Create React App and Microsoft Fluent UI. Further details
 ## Run the UI
 - Ensure `deploy_ui=false` is not set in your `./config.yaml` file
 - In the root of the repo, run `make tre-deploy`. This will provision the necessary resources in Azure, build and deploy the UI to Azure blob storage, behind the App Gateway used for the API. The deployment process will also create the necessary `config.json`, using the `config.source.json` as a template.
-- In Azure AD, locate the TRE Client Apps app (possibly called Swagger App). In the Authentication section add reply URIs for:
+- In Microsoft Entra ID, locate the TRE Client Apps app (possibly called Swagger App). In the Authentication section add reply URIs for:
   - `http://localhost:3000` (if wanting to run locally)
   - Your deployed App Url - `https://{TRE_ID}.{LOCATION}.cloudapp.azure.com`.
 

ui/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tre-ui",
-  "version": "0.5.21",
+  "version": "0.5.22",
   "private": true,
   "dependencies": {
     "@azure/msal-browser": "^2.35.0",

ui/app/yarn.lock

@@ -3955,10 +3955,10 @@ cookie-signature@1.0.6:
   resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.6.tgz#e303a882b342cc3ee8ca513a79999734dab3ae2c"
   integrity sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==
 
-cookie@0.5.0:
-  version "0.5.0"
-  resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.5.0.tgz#d1f5d71adec6558c58f389987c366aa47e994f8b"
-  integrity sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==
+cookie@0.6.0:
+  version "0.6.0"
+  resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.6.0.tgz#2798b04b071b0ecbff0dbb62a505a8efa4e19051"
+  integrity sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==
 
 core-js-compat@^3.31.0, core-js-compat@^3.34.0:
   version "3.36.0"
@@ -5141,16 +5141,16 @@ expect@^29.0.0:
     jest-util "^29.7.0"
 
 express@^4.17.3:
-  version "4.18.3"
-  resolved "https://registry.yarnpkg.com/express/-/express-4.18.3.tgz#6870746f3ff904dee1819b82e4b51509afffb0d4"
-  integrity sha512-6VyCijWQ+9O7WuVMTRBTl+cjNNIzD5cY5mQ1WM8r/LEkI2u8EYpOotESNwzNlyCn3g+dmjKYI6BmNneSr/FSRw==
+  version "4.19.2"
+  resolved "https://registry.yarnpkg.com/express/-/express-4.19.2.tgz#e25437827a3aa7f2a827bc8171bbbb664a356465"
+  integrity sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==
   dependencies:
     accepts "~1.3.8"
     array-flatten "1.1.1"
     body-parser "1.20.2"
     content-disposition "0.5.4"
     content-type "~1.0.4"
-    cookie "0.5.0"
+    cookie "0.6.0"
     cookie-signature "1.0.6"
     debug "2.6.9"
     depd "2.0.0"
@@ -5323,9 +5323,9 @@ flatted@^3.2.9:
   integrity sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==
 
 follow-redirects@^1.0.0:
-  version "1.15.5"
-  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.5.tgz#54d4d6d062c0fa7d9d17feb008461550e3ba8020"
-  integrity sha512-vSFWUON1B+yAw1VN4xMfxgn5fTUiaOzAJCKBwIIgT/+7CuGy9+r+5gITvP62j3RmaD5Ph65UaERdOSRGUzZtgw==
+  version "1.15.6"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.6.tgz#7f815c0cda4249c74ff09e95ef97c23b5fd0399b"
+  integrity sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==
 
 for-each@^0.3.3:
   version "0.3.3"
@@ -11320,9 +11320,9 @@ webidl-conversions@^6.1.0:
   integrity sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==
 
 webpack-dev-middleware@^5.3.1:
-  version "5.3.3"
-  resolved "https://registry.yarnpkg.com/webpack-dev-middleware/-/webpack-dev-middleware-5.3.3.tgz#efae67c2793908e7311f1d9b06f2a08dcc97e51f"
-  integrity sha512-hj5CYrY0bZLB+eTO+x/j67Pkrquiy7kWepMHmUMoPsmcUaeEnQJqFzHJOyxgWlq746/wUuA64p9ta34Kyb01pA==
+  version "5.3.4"
+  resolved "https://registry.yarnpkg.com/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz#eb7b39281cbce10e104eb2b8bf2b63fce49a3517"
+  integrity sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==
   dependencies:
     colorette "^2.0.10"
     memfs "^3.4.3"