| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| active-directory-b2c | Manage User Access | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory-b2c/manage-user-access.md | When you develop your application, you ordinarily capture users' acceptance of t The following steps describe how you can manage terms of use: -1. Record the acceptance of the terms of use and the date of acceptance by using the Graph API and extended attributes. You can do so by using both built-in and custom user flows. We recommend that you create and use the **extension_termsOfUseConsentDateTime** and **extension_termsOfUseConsentVersion** attributes. +1. Record the acceptance of the terms of use and the date of acceptance by using the Graph API and extended attributes. You can do so by using both built-in user flows and custom policies. We recommend that you create and use the **extension_termsOfUseConsentDateTime** and **extension_termsOfUseConsentVersion** attributes. -2. Create a required check box labeled "Accept Terms of Use," and record the result during sign-up. You can do so by using both built-in and custom user flows. +2. Create a required check box labeled "Accept Terms of Use," and record the result during sign-up. You can do so by using both built-in user flows and custom policies. -3. Azure AD B2C stores the terms of use agreement and the user's acceptance. You can use the Graph API to query for the status of any user by reading the extension attribute that's used to record the response (for example, read **termsOfUseTestUpdateDateTime**). You can do so by using both built-in and custom user flows. +3. Azure AD B2C stores the terms of use agreement and the user's acceptance. You can use the Graph API to query for the status of any user by reading the extension attribute that's used to record the response (for example, read **termsOfUseTestUpdateDateTime**). You can do so by using both built-in user flows and custom policies. 4. Require acceptance of updated terms of use by comparing the date of acceptance to the date of the latest version of the terms of use. You can compare the dates only by using a custom user flow. Use the extended attribute **extension_termsOfUseConsentDateTime**, and compare the value to the claim of **termsOfUseTextUpdateDateTime**. If the acceptance is old, force a new acceptance by displaying a self-asserted screen. Otherwise, block access by using policy logic. |
| active-directory | Concept Mfa Data Residency | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/authentication/concept-mfa-data-residency.md | -Azure Active Directory (Azure AD) stores customer data in a geographical location based on the address an organization provides when subscribing to a Microsoft online service such as Microsoft 365 or Azure. For information on where your customer data is stored, see [Where is your data located?](https://www.microsoft.com/trustcenter/privacy/where-your-data-is-located) in the Microsoft Trust Center. +Azure Active Directory (Azure AD) stores customer data in a geographical location based on the address an organization provides when subscribing to a Microsoft online service such as Microsoft 365 or Azure. For information on where your customer data is stored, see [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) in the Microsoft Trust Center. Cloud-based Azure AD multifactor authentication and MFA Server process and store personal data and organizational data. This article outlines what and where data is stored. |
| active-directory | Concept Mfa Licensing | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/authentication/concept-mfa-licensing.md | If you don't want to enable Azure AD Multi-Factor Authentication for all users, * For more information on costs, see [Azure AD pricing](https://www.microsoft.com/security/business/identity-access-management/azure-ad-pricing). * [What is Conditional Access](../conditional-access/overview.md)+* [What is Identity Protection?](../identity-protection/overview-identity-protection.md) * MFA can also be [enabled on a per-user basis](howto-mfa-userstates.md) |
| active-directory | Howto Mfa Nps Extension | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/authentication/howto-mfa-nps-extension.md | The NPS extension acts as an adapter between RADIUS and cloud-based Azure AD Mul When you use the NPS extension for Azure AD Multi-Factor Authentication, the authentication flow includes the following components: 1. **NAS/VPN Server** receives requests from VPN clients and converts them into RADIUS requests to NPS servers.-2. **NPS Server** connects to Active Directory Domain Services (AD DS) to perform the primary authentication for the RADIUS requests and, upon success, passes the request to any installed extensions.   +2. **NPS Server** connects to Active Directory Domain Services (AD DS) to perform the primary authentication for the RADIUS requests and, upon success, passes the request to any installed extensions. 3. **NPS Extension** triggers a request to Azure AD Multi-Factor Authentication for the secondary authentication. Once the extension receives the response, and if the MFA challenge succeeds, it completes the authentication request by providing the NPS server with security tokens that include an MFA claim, issued by Azure STS. >[!NOTE] >Users must have access to their default authentication method to complete the MFA requirement. They cannot choose an alternative method. Their default authentication method will be used even if it's been disabled in the tenant authentication methods and MFA policies. There are two factors that affect which authentication methods are available wit > When you deploy the NPS extension, use these factors to evaluate which methods are available for your users. If your RADIUS client supports PAP, but the client UX doesn't have input fields for a verification code, then phone call and mobile app notification are the two supported options. > > Also, regardless of the authentication protocol that's used (PAP, CHAP, or EAP), if your MFA method is text-based (SMS, mobile app verification code, or OATH hardware token) and requires the user to enter a code or text in the VPN client UI input field, the authentication might succeed. *But* any RADIUS attributes that are configured in the Network Access Policy are *not* forwarded to the RADIUS client (the Network Access Device, like the VPN gateway). As a result, the VPN client might have more access than you want it to have, or less access or no access.+ > + > As a workaround, you can run the [CrpUsernameStuffing script](https://github.com/OneMoreNate/CrpUsernameStuffing) to forward RADIUS attributes that are configured in the Network Access Policy and allow MFA when the user's authentication method requires the use of a One-Time Passcode (OTP), such as SMS, a Microsoft Authenticator passcode, or a hardware FOB. + * The input methods that the client application (VPN, Netscaler server, or other) can handle. For example, does the VPN client have some means to allow the user to type in a verification code from a text or mobile app? |
| active-directory | Concept How It Works | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/cloud-sync/concept-how-it-works.md | +- **Provisioning agent**: The Azure AD Connect cloud provisioning agent is the same agent as Workday inbound and built on the same server-side technology as app proxy and Pass Through Authentication. It requires an outbound connection only and agents are auto-updated. - **Provisioning service**: Same provisioning service as outbound provisioning and Workday inbound provisioning which uses a scheduler-based model. In case of cloud sync, the changes are provisioned every 2 mins. |
| active-directory | Concept Conditional Access Conditions | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/conditional-access/concept-conditional-access-conditions.md | The device state condition can be used to exclude devices that are hybrid Azure For example, *All users* accessing the *Microsoft Azure Management* cloud app including **All device state** excluding **Device Hybrid Azure AD joined** and **Device marked as compliant** and for *Access controls*, **Block**. - This example would create a policy that only allows access to Microsoft Azure Management from devices that are either hybrid Azure AD joined or devices marked as compliant. -The above scenario, can be configured using *All users* accessing the *Microsoft Azure Management* cloud app excluding **Filter for devices** condition with the following rule **device.trustType -ne "ServerAD" -or device.isCompliant -ne True** and for *Access controls*, **Block**. -- This example would create a policy that only allows access to Microsoft Azure Management from devices that are either hybrid Azure AD joined or devices marked as compliant.+The above scenario, can be configured using *All users* accessing the *Microsoft Azure Management* cloud app with **Filter for devices** condition in include mode using the following rule **device.trustType -ne "ServerAD" -or device.isCompliant -ne True** and for *Access controls*, **Block**. +- This example would create a policy that blocks access to Microsoft Azure Management cloud app from unmanaged or non-compliant devices. > [!IMPORTANT] > Device state and filters for devices cannot be used together in Conditional Access policy. Filters for devices provides more granular targeting including support for targeting device state information through the `trustType` and `isCompliant` property. |
| active-directory | Concept Continuous Access Evaluation | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/conditional-access/concept-continuous-access-evaluation.md | Exchange Online, SharePoint Online, Teams, and MS Graph can synchronize key Cond This process enables the scenario where users lose access to organizational files, email, calendar, or tasks from Microsoft 365 client apps or SharePoint Online immediately after network location changes. > [!NOTE]-> Not all app and resource provider combination are supported. See table below. Office refers to Word, Excel, and PowerPoint. +> Not all client app and resource provider combinations are supported. See table below. The first column of this table refers to web applications launched via web browser (i.e. PowerPoint launched in web browser) while the remaining four columns refer to native applications running on each platform described. Additionally, references to "Office" encompass Word, Excel, and PowerPoint. | | Outlook Web | Outlook Win32 | Outlook iOS | Outlook Android | Outlook Mac | | : | :: | :: | :: | :: | :: | |
| active-directory | Terms Of Use | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/conditional-access/terms-of-use.md | Azure AD terms of use policies have the following capabilities: - Require employees or guests to accept your terms of use policy before getting access. - Require employees or guests to accept your terms of use policy on every device before getting access. - Require employees or guests to accept your terms of use policy on a recurring schedule.-- Require employees or guests to accept your terms of use policy prior to registering security information in Azure AD Multi-Factor Authentication (MFA).-- Require employees to accept your terms of use policy prior to registering security information in Azure AD self-service password reset (SSPR).+- Require employees or guests to accept your terms of use policy before registering security information in Azure AD Multi-Factor Authentication (MFA). +- Require employees to accept your terms of use policy before registering security information in Azure AD self-service password reset (SSPR). - Present a general terms of use policy for all users in your organization. - Present specific terms of use policies based on a user attributes (such as doctors versus nurses, or domestic versus international employees) by using [dynamic groups](../enterprise-users/groups-dynamic-membership.md)). - Present specific terms of use policies when accessing high business impact applications, like Salesforce. - Present terms of use policies in different languages. - List who has or hasn't accepted to your terms of use policies.-- Assist in meeting privacy regulations.+- Help meeting privacy regulations. - Display a log of terms of use policy activity for compliance and audit. - Create and manage terms of use policies using [Microsoft Graph APIs](/graph/api/resources/agreement). Azure AD terms of use policies use the PDF format to present content. The PDF fi ## Add terms of use -Once you have finalized your terms of use policy document, use the following procedure to add it. +Once you've completed your terms of use policy document, use the following procedure to add it. 1. Sign in to Azure as a Global Administrator, Security Administrator, or Conditional Access Administrator. 1. Navigate to **Terms of use** at [https://aka.ms/catou](https://aka.ms/catou). Once you have finalized your terms of use policy document, use the following pro 1. In the **Display name** box, enter a title that users see when they sign in. 1. For **Terms of use document**, browse to your finalized terms of use policy PDF and select it. 1. Select the language for your terms of use policy document. The language option allows you to upload multiple terms of use policies, each with a different language. The version of the terms of use policy that an end user will see will be based on their browser preferences.-1. To require end users to view the terms of use policy prior to accepting them, set **Require users to expand the terms of use** to **On**. -1. To require end users to accept your terms of use policy on every device they are accessing from, set **Require users to consent on every device** to **On**. Users may be required to install additional applications if this option is enabled. For more information, see [Per-device terms of use](#per-device-terms-of-use). -1. If you want to expire terms of use policy consents on a schedule, set **Expire consents** to **On**. When set to On, two additional schedule settings are displayed. +1. To require end users to view the terms of use policy before accepting them, set **Require users to expand the terms of use** to **On**. +1. To require end users to accept your terms of use policy on every device they're accessing from, set **Require users to consent on every device** to **On**. Users may be required to install other applications if this option is enabled. For more information, see [Per-device terms of use](#per-device-terms-of-use). +1. If you want to expire terms of use policy consents on a schedule, set **Expire consents** to **On**. When set to On, two more schedule settings are displayed.  Once you have finalized your terms of use policy document, use the following pro | Today's date | Monthly | Starting today, users must accept the terms of use policy and then reaccept every month. | | Date in the future | Monthly | Starting today, users must accept the terms of use policy. When the future date occurs, consents will expire and then users must reaccept every month. | - For example, if you set the expire starting on date to **Jan 1** and frequency to **Monthly**, here is how expirations might occur for two users: + For example, if you set the expire starting on date to **Jan 1** and frequency to **Monthly**, this is how expirations might occur for two users: | User | First accept date | First expire date | Second expire date | Third expire date | | | | | | | | Alice | Jan 1 | Feb 1 | Mar 1 | Apr 1 | | Bob | Jan 15 | Feb 1 | Mar 1 | Apr 1 | -1. Use the **Duration before reacceptance requires (days)** setting to specify the number of days before the user must reaccept the terms of use policy. This allows users to follow their own schedule. For example, if you set the duration to **30** days, here is how expirations might occur for two users: +1. Use the **Duration before re-acceptance required (days)** setting to specify the number of days before the user must reaccept the terms of use policy. This allows users to follow their own schedule. For example, if you set the duration to **30** days, this is how expirations might occur for two users: | User | First accept date | First expire date | Second expire date | Third expire date | | | | | | | | Alice | Jan 1 | Jan 31 | Mar 2 | Apr 1 | | Bob | Jan 15 | Feb 14 | Mar 16 | Apr 15 | - It is possible to use the **Expire consents** and **Duration before reacceptance requires (days)** settings together, but typically you use one or the other. + It is possible to use the **Expire consents** and **Duration before re-acceptance required (days)** settings together, but typically you use one or the other. 1. Under **Conditional Access**, use the **Enforce with Conditional Access policy template** list to select the template to enforce the terms of use policy. Once you have finalized your terms of use policy document, use the following pro | Template | Description | | | | | **Access to cloud apps for all guests** | A Conditional Access policy will be created for all guests and all cloud apps. This policy impacts the Azure portal. Once this is created, you might be required to sign out and sign in. |- | **Access to cloud apps for all users** | A Conditional Access policy will be created for all users and all cloud apps. This policy impacts the Azure portal. Once this is created, you will be required to sign out and sign in. | + | **Access to cloud apps for all users** | A Conditional Access policy will be created for all users and all cloud apps. This policy impacts the Azure portal. Once this is created, you'll be required to sign out and sign in. | | **Custom policy** | Select the users, groups, and apps that this terms of use policy will be applied to. | | **Create Conditional Access policy later** | This terms of use policy will appear in the grant control list when creating a Conditional Access policy. | The Terms of use blade shows a count of the users who have accepted and declined ## View Azure AD audit logs -If you want to view additional activity, Azure AD terms of use policies includes audit logs. Each user consent triggers an event in the audit logs that is stored for **30 days**. You can view these logs in the portal or download as a .csv file. +If you want to view more activity, Azure AD terms of use policies include audit logs. Each user consent triggers an event in the audit logs that is stored for **30 days**. You can view these logs in the portal or download as a .csv file. To get started with Azure AD audit logs, use the following procedure: To get started with Azure AD audit logs, use the following procedure:  - If you click a log, a pane appears with additional activity details. + If you click a log, a pane appears with more activity details.  The following screen shows how a ToU policy looks on mobile devices.  -Users are only required to accept the terms of use policy once and they will not see the terms of use policy again on subsequent sign-ins. +Users are only required to accept the terms of use policy once, and they won't see the terms of use policy again on later sign-ins. ### How users can review their terms of use -Users can review and see the terms of use policies that they have accepted by using the following procedure. +Users can review and see the terms of use policies that they've accepted by using the following procedure. 1. Sign in to [https://myaccount.microsoft.com/](https://myaccount.microsoft.com/). 1. Select **Settings & Privacy**. You can edit some details of terms of use policies, but you can't modify an exis 1. Select the terms of use policy you want to edit. 1. Click **Edit terms**. 1. In the Edit terms of use pane, you can change the following:- - **Name** ΓÇô this is the internal name of the ToU that is not shared with end users + - **Name** ΓÇô this is the internal name of the ToU that isn't shared with end users - **Display name** ΓÇô this is the name that end users can see when viewing the ToU - **Require users to expand the terms of use** ΓÇô Setting this to **On** will force the end user to expand the terms of use policy document before accepting it. - (Preview) You can **update an existing terms of use** document You can edit some details of terms of use policies, but you can't modify an exis  -1. Once you are done, click **Save** to save your changes. +1. Once you're done, click **Save** to save your changes. ## Update the version or pdf of an existing terms of use You can edit some details of terms of use policies, but you can't modify an exis  5. In the pane on the right, upload the pdf for the new version-6. There is also a toggle option here **Require reaccept** if you want to require your users to accept this new version the next time they sign in. If you require your users to reaccept, next time they try to access the resource defined in your conditional access policy they will be prompted to accept this new version. If you donΓÇÖt require your users to reaccept, their previous consent will stay current and only new users who have not consented before or whose consent expires will see the new version. Until the session expires, **Require reaccept** not require users to accept the new TOU. If you want to ensure reaccept delete and recreate or create a new TOU for this case. +6. There's also a toggle option here **Require reaccept** if you want to require your users to accept this new version the next time they sign in. If you require your users to reaccept, next time they try to access the resource defined in your conditional access policy they'll be prompted to accept this new version. If you donΓÇÖt require your users to reaccept, their previous consent will stay current and only new users who haven't consented before or whose consent expires will see the new version. Until the session expires, **Require reaccept** not require users to accept the new TOU. If you want to ensure reaccept, delete and recreate or create a new TOU for this case.  -7. Once you have uploaded your new pdf and decided on reaccept, click Add at the bottom of the pane. -8. You will now see the most recent version under the Document column. +7. Once you've uploaded your new pdf and decided on reaccept, click Add at the bottom of the pane. +8. You'll now see the most recent version under the Document column. ## View previous versions of a ToU You can edit some details of terms of use policies, but you can't modify an exis ## See who has accepted each version 1. Sign in to Azure and navigate to **Terms of use** at https://aka.ms/catou.-2. To see who has currently accepted the ToU click on the number under the **Accepted** column for the ToU you want. +2. To see who has currently accepted the ToU, click on the number under the **Accepted** column for the ToU you want. 3. By default, the next page will show you the current state of each users acceptance to the ToU 4. If you would like to see the previous consent events, you can select **All** from the **Current State** drop-down. Now you can see each users events in details about each version and what happened. 5. Alternatively, you can select a specific version from the **Version** drop-down to see who has accepted that specific version. The following procedure describes how to add a ToU language. 1. Select the terms of use policy you want to edit. 1. Click **Edit Terms** 1. Click **Add language** at the bottom of the page.-1. In the Add terms of use language pane, upload your localized PDF and select the language. +1. In the Add terms of use language pane, upload your localized PDF, and select the language.  The following procedure describes how to add a ToU language. ## Per-device terms of use -The **Require users to consent on every device** setting enables you to require end users to accept your terms of use policy on every device they are accessing from. The end user will be required to register their device in Azure AD. When the device is registered, the device ID is used to enforce the terms of use policy on each device. +The **Require users to consent on every device** setting enables you to require end users to accept your terms of use policy on every device they're accessing from. The end user will be required to register their device in Azure AD. When the device is registered, the device ID is used to enforce the terms of use policy on each device. -Here is a list of the supported platforms and software. +Supported platforms and software. > [!div class="mx-tableFixed"] > | | iOS | Android | Windows 10 | Other | Per-device terms of use has the following constraints: - A device can only be joined to one tenant. - A user must have permissions to join their device.-- The Intune Enrollment app is not supported. Ensure that it is excluded from any Conditional Access policy requiring Terms of Use policy.-- Azure AD B2B users are not supported.+- The Intune Enrollment app isn't supported. Ensure that it's excluded from any Conditional Access policy requiring Terms of Use policy. +- Azure AD B2B users aren't supported. -If the user's device is not joined, they will receive a message that they need to join their device. Their experience will be dependent on the platform and software. +If the user's device isn't joined, they'll receive a message that they need to join their device. Their experience will be dependent on the platform and software. ### Join a Windows 10 device -If a user is using Windows 10 and Microsoft Edge, they will receive a message similar to the following to [join their device](https://support.microsoft.com/account-billing/join-your-work-device-to-your-work-or-school-network-ef4d6adb-5095-4e51-829e-5457430f3973#to-join-an-already-configured-windows-10-device). +If a user is using Windows 10 and Microsoft Edge, they receive a message similar to the following to [join their device](https://support.microsoft.com/account-billing/join-your-work-device-to-your-work-or-school-network-ef4d6adb-5095-4e51-829e-5457430f3973#to-join-an-already-configured-windows-10-device).  -If they are using Chrome, they will be prompted to install the [Windows 10 Accounts extension](https://chrome.google.com/webstore/detail/windows-10-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji). +If they're using Chrome, they'll be prompted to install the [Windows 10 Accounts extension](https://chrome.google.com/webstore/detail/windows-10-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji). ### Register an iOS device -If a user is using an iOS device, they will be prompted to install the [Microsoft Authenticator app](https://apps.apple.com/us/app/microsoft-authenticator/id983156458). +If a user is using an iOS device, they'll be prompted to install the [Microsoft Authenticator app](https://apps.apple.com/us/app/microsoft-authenticator/id983156458). ### Register an Android device -If a user is using an Android device, they will be prompted to install the [Microsoft Authenticator app](https://play.google.com/store/apps/details?id=com.azure.authenticator). +If a user is using an Android device, they'll be prompted to install the [Microsoft Authenticator app](https://play.google.com/store/apps/details?id=com.azure.authenticator). ### Browsers -If a user is using browser that is not supported, they will be asked to use a different browser. +If a user is using browser that isn't supported, they'll be asked to use a different browser.  You can delete old terms of use policies using the following procedure. User acceptance records are deleted: -- When the admin explicitly deletes the ToU. When this happens all the acceptance records associated with that specific ToU are also deleted.+- When the admin explicitly deletes the ToU. When this change happens, all the acceptance records associated with that specific ToU are also deleted. - When the tenant loses its Azure Active Directory Premium license. - When the tenant is deleted. ## Policy changes -Conditional Access policies take effect immediately. When this happens, the administrator will start to see ΓÇ£sad cloudsΓÇ¥ or "Azure AD token issues". The administrator must sign out and sign in again in order to satisfy the new policy. +Conditional Access policies take effect immediately. When this happens, the administrator will start to see ΓÇ£sad cloudsΓÇ¥ or "Azure AD token issues". The administrator must sign out and sign in to satisfy the new policy. > [!IMPORTANT] > Users in scope will need to sign-out and sign-in in order to satisfy a new policy if: Conditional Access policies take effect immediately. When this happens, the admi Most organizations have a process in place for their employees to consent to their organization's terms of use policy and privacy statements. But how can you enforce the same consents for Azure AD business-to-business (B2B) guests when they're added via SharePoint or Teams? Using Conditional Access and terms of use policies, you can enforce a policy directly towards B2B guest users. During the invitation redemption flow, the user is presented with the terms of use policy. This support is currently in preview. -Terms of use policies will only be displayed when the user has a guest account in Azure AD. SharePoint Online currently has an [ad hoc external sharing recipient experience](/sharepoint/what-s-new-in-sharing-in-targeted-release) to share a document or a folder that does not require the user to have a guest account. In this case, a terms of use policy is not displayed. +Terms of use policies will only be displayed when the user has a guest account in Azure AD. SharePoint Online currently has an [ad hoc external sharing recipient experience](/sharepoint/what-s-new-in-sharing-in-targeted-release) to share a document or a folder that doesn't require the user to have a guest account. In this case, a terms of use policy isn't displayed.  Terms of use policies can be used for different cloud apps, such as Azure Inform ### Azure Information Protection -You can configure a Conditional Access policy for the Azure Information Protection app and require a terms of use policy when a user accesses a protected document. This will trigger a terms of use policy prior to a user accessing a protected document for the first time. +You can configure a Conditional Access policy for the Azure Information Protection app and require a terms of use policy when a user accesses a protected document. This configuration will trigger a terms of use policy before a user accessing a protected document for the first time.  ### Microsoft Intune Enrollment -You can configure a Conditional Access policy for the Microsoft Intune Enrollment app and require a terms of use policy prior to the enrollment of a device in Intune. For more information, see the Read [Choosing the right Terms solution for your organization blog post](https://go.microsoft.com/fwlink/?linkid=2010506&clcid=0x409). +You can configure a Conditional Access policy for the Microsoft Intune Enrollment app and require a terms of use policy before enrollment of a device in Intune. For more information, see the Read [Choosing the right Terms solution for your organization blog post](https://go.microsoft.com/fwlink/?linkid=2010506&clcid=0x409).  A: The user counts in the terms of use report and who accepted/declined are stor A: The terms of use report is stored for the lifetime of that terms of use policy, while the Azure AD audit logs are stored for 30 days. Also, the terms of use report only displays the users current consent state. For example, if a user declines and then accepts, the terms of use report will only show that user's accept. If you need to see the history, you can use the Azure AD audit logs. **Q: If hyperlinks are in the terms of use policy PDF document, will end users be able to click them?**<br />-A: Yes, end users are able to select hyperlinks to additional pages but links to sections within the document are not supported. Also, hyperlinks in terms of use policy PDFs do not work when accessed from the Azure AD MyApps/MyAccount portal. +A: Yes, end users are able to select hyperlinks to other pages but links to sections within the document are not supported. Also, hyperlinks in terms of use policy PDFs do not work when accessed from the Azure AD MyApps/MyAccount portal. **Q: Can a terms of use policy support multiple languages?**<br />-A: Yes. Currently there are 108 different languages an administrator can configure for a single terms of use policy. An administrator can upload multiple PDF documents and tag those documents with a corresponding language (up to 108). When end users sign in, we look at their browser language preference and display the matching document. If there is no match, we will display the default document, which is the first document that is uploaded. +A: Yes. Currently there are 108 different languages an administrator can configure for a single terms of use policy. An administrator can upload multiple PDF documents and tag those documents with a corresponding language (up to 108). When end users sign in, we look at their browser language preference and display the matching document. If there's no match, we display the default document, which is the first document that is uploaded. **Q: When is the terms of use policy triggered?**<br /> A: The terms of use policy is triggered during the sign-in experience. A: You can create a Conditional Access policy on the enterprise applications usi A: Yes, by creating multiple Conditional Access policies targeting those groups or applications. If a user falls in scope of multiple terms of use policies, they accept one terms of use policy at a time. **Q: What happens if a user declines the terms of use policy?**<br />-A: The user is blocked from getting access to the application. The user would have to sign in again and accept the terms in order to get access. +A: The user is blocked from getting access to the application. The user would have to sign in again and accept the terms to get access. **Q: Is it possible to unaccept a terms of use policy that was previously accepted?**<br /> A: You can [review previously accepted terms of use policies](#how-users-can-review-their-terms-of-use), but currently there isn't a way to unaccept. **Q: What happens if I'm also using Intune terms and conditions?**<br />-A: If you have configured both Azure AD terms of use and [Intune terms and conditions](/intune/terms-and-conditions-create), the user will be required to accept both. For more information, see the [Choosing the right Terms solution for your organization blog post](https://go.microsoft.com/fwlink/?linkid=2010506&clcid=0x409). +A: If you've configured both Azure AD terms of use and [Intune terms and conditions](/intune/terms-and-conditions-create), the user will be required to accept both. For more information, see the [Choosing the right Terms solution for your organization blog post](https://go.microsoft.com/fwlink/?linkid=2010506&clcid=0x409). **Q: What endpoints does the terms of use service use for authentication?**<br />-A: Terms of use utilizes the following endpoints for authentication: https://tokenprovider.termsofuse.identitygovernance.azure.com and https://account.activedirectory.windowsazure.com. If your organization has an allowlist of URLs for enrollment, you will need to add these endpoints to your allowlist, along with the Azure AD endpoints for sign-in. +A: Terms of use utilize the following endpoints for authentication: https://tokenprovider.termsofuse.identitygovernance.azure.com and https://account.activedirectory.windowsazure.com. If your organization has an allowlist of URLs for enrollment, you will need to add these endpoints to your allowlist, along with the Azure AD endpoints for sign-in. ## Next steps -- [Quickstart: Require terms of use to be accepted before accessing cloud apps](require-tou.md)+- [Quickstart: Require terms of use to be accepted before accessing cloud apps](require-tou.md) |
| active-directory | Msal Error Handling Dotnet | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/develop/msal-error-handling-dotnet.md | +### Exception types +[MsalClientException](/dotnet/api/microsoft.identity.client.msalexception) is thrown when the library itself detects an error state, such as a bad configuration. ++[MsalServiceException](/dotnet/api/microsoft.identity.client.msalserviceexception) is thrown when the Identity Provider (AAD) returns an error. It is a translation of the server error. ++[MsalUIRequiredException](/dotnet/api/microsoft.identity.client.msaluirequiredexception) is type of [MsalServiceException](/dotnet/api/microsoft.identity.client.msalserviceexception) and indicates that user interaction is required, for example because MFA is required or because the user has changed their password and a token cannot be acquired silently. +++### Processing exceptions When processing .NET exceptions, you can use the exception type itself and the `ErrorCode` member to distinguish between exceptions. `ErrorCode` values are constants of type [MsalError](/dotnet/api/microsoft.identity.client.msalerror). You can also have a look at the fields of [MsalClientException](/dotnet/api/microsoft.identity.client.msalexception), [MsalServiceException](/dotnet/api/microsoft.identity.client.msalserviceexception), and [MsalUIRequiredException](/dotnet/api/microsoft.identity.client.msaluirequiredexception). If [MsalServiceException](/dotnet/api/microsoft.identity.client.msalserviceexception) is thrown, try [Authentication and authorization error codes](reference-aadsts-error-codes.md) to see if the code is listed there. +If [MsalUIRequiredException](/dotnet/api/microsoft.identity.client.msaluirequiredexception) is thrown, it is an indication that an interactive flow needs to happen for the user to resolve the issue. In public client apps such as desktop and mobile app, this is resolved by calling `AcquireTokenInteractive` which displays a browser. In confidential client apps, web apps should redirect the user to the authorization page, and web APIs should return an HTTP status code and header indicative of the authentication failure (401 Unauthorized and a WWW-Authenticate header). + ### Common .NET exceptions Here are the common exceptions that might be thrown and some possible mitigations: Here are the common exceptions that might be thrown and some possible mitigation | Exception | Error code | Mitigation| | | | | | [MsalUiRequiredException](/dotnet/api/microsoft.identity.client.msaluirequiredexception) | AADSTS65001: The user or administrator has not consented to use the application with ID '{appId}' named '{appName}'. Send an interactive authorization request for this user and resource.| Get user consent first. If you aren't using .NET Core (which doesn't have any Web UI), call (once only) `AcquireTokeninteractive`. If you are using .NET core or don't want to do an `AcquireTokenInteractive`, the user can navigate to a URL to give consent: `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id={clientId}&response_type=code&scope=user.read`. to call `AcquireTokenInteractive`: `app.AcquireTokenInteractive(scopes).WithAccount(account).WithClaims(ex.Claims).ExecuteAsync();`|-| [MsalUiRequiredException](/dotnet/api/microsoft.identity.client.msaluirequiredexception) | AADSTS50079: The user is required to use [multi-factor authentication (MFA)](../authentication/concept-mfa-howitworks.md).| There is no mitigation. If MFA is configured for your tenant and Azure Active Directory (AAD) decides to enforce it, fall back to an interactive flow such as `AcquireTokenInteractive` or `AcquireTokenByDeviceCode`.| +| [MsalUiRequiredException](/dotnet/api/microsoft.identity.client.msaluirequiredexception) | AADSTS50079: The user is required to use [multi-factor authentication (MFA)](../authentication/concept-mfa-howitworks.md).| There is no mitigation. If MFA is configured for your tenant and Azure Active Directory (AAD) decides to enforce it, fall back to an interactive flow such as `AcquireTokenInteractive`.| | [MsalServiceException](/dotnet/api/microsoft.identity.client.msalserviceexception) |AADSTS90010: The grant type isn't supported over the */common* or */consumers* endpoints. Use the */organizations* or tenant-specific endpoint. You used */common*.| As explained in the message from Azure AD, the authority needs to have a tenant or otherwise */organizations*.| | [MsalServiceException](/dotnet/api/microsoft.identity.client.msalserviceexception) | AADSTS70002: The request body must contain the following parameter: `client_secret or client_assertion`.| This exception can be thrown if your application was not registered as a public client application in Azure AD. In the Azure portal, edit the manifest for your application and set `allowPublicClient` to `true`. | | [MsalClientException](/dotnet/api/microsoft.identity.client.msalclientexception)| `unknown_user Message`: Could not identify logged in user| The library was unable to query the current Windows logged-in user or this user isn't AD or Azure AD joined (work-place joined users aren't supported). Mitigation 1: on UWP, check that the application has the following capabilities: Enterprise Authentication, Private Networks (Client and Server), User Account Information. Mitigation 2: Implement your own logic to fetch the username (for example, john@contoso.com) and use the `AcquireTokenByIntegratedWindowsAuth` form that takes in the username.| |
| active-directory | Scenario Protected Web Api Verification Scope App Roles | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles.md | public class TodoListController : ApiController } ``` -Instead, you can use the [Authorize("role")] attributes on the controller or an action (or a razor page). +Instead, you can use the [Authorize(Roles = "role")] attributes on the controller or an action (or a razor page). ```CSharp-[Authorize("role")] +[Authorize(Roles = "role")] MyController : ApiController { // ... |
| active-directory | Howto Device Identity Virtual Desktop Infrastructure | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/devices/howto-device-identity-virtual-desktop-infrastructure.md | There are two primary types of virtual desktops: Persistent versions use a unique desktop image for each user or a pool of users. These unique desktops can be customized and saved for future use. -Non-persistent versions use a collection of desktops that users can access on an as needed basis. These non-persistent desktops are reverted to their original state, in case of Windows current<sup>1</sup> this happens when a virtual machine goes through a shutdown/restart/OS reset process and in case of Windows down-level<sup>2</sup> this happens when a user signs out. +Non-persistent versions use a collection of desktops that users can access on an as needed basis. These non-persistent desktops are reverted to their original state, in Windows current<sup>1</sup> this change happens when a virtual machine goes through a shutdown/restart/OS reset process and in Windows down-level<sup>2</sup> this change happens when a user signs out. -There has been a rise in non-persistent VDI deployments as remote work continues to be the new norm. As customers deploy non-persistent VDI, it is important to ensure that you manage stale devices that are created as a result of frequent device registration without having a proper strategy for device lifecycle management. +It's important to ensure organizations manage stale devices that are created because frequent device registration without having a proper strategy for device lifecycle management. > [!IMPORTANT] > Failure to manage stale devices can lead to pressure increase on your tenant quota usage consumption and potential risk of service interruption, if you run out of tenant quota. You should follow the guidance documented below when deploying non persistent VDI environments to avoid this situation. Before configuring device identities in Azure AD for your VDI environment, famil <sup>4</sup> A **Managed** identity infrastructure environment represents an environment with Azure AD as the identity provider deployed with either [password hash sync (PHS)](../hybrid/whatis-phs.md) or [pass-through authentication (PTA)](../hybrid/how-to-connect-pta.md) with [seamless single sign-on](../hybrid/how-to-connect-sso.md). -<sup>5</sup> **Non-Persistence support for Windows current** requires additional consideration as documented below in guidance section. This scenario requires Windows 10 1803, Windows Server 2019 or Windows Server (Semi-annual channel) starting version 1803 +<sup>5</sup> **Non-Persistence support for Windows current** requires other consideration as documented below in guidance section. This scenario requires Windows 10 1803, Windows Server 2019, or Windows Server (Semi-annual channel) starting version 1803 -<sup>6</sup> **Non-Persistence support for Windows down-level** requires additional consideration as documented below in guidance section. +<sup>6</sup> **Non-Persistence support for Windows down-level** requires other consideration as documented below in guidance section. <sup>7</sup> **Azure AD join support** is only available with Azure Virtual Desktop and Windows 365 Administrators should reference the following articles, based on their identity ### Non-persistent VDI -When deploying non-persistent VDI, Microsoft recommends that IT administrators implement the guidance below. Failure to do so will result in your directory having lots of stale Hybrid Azure AD joined devices that were registered from your non-persistent VDI platform resulting in increased pressure on your tenant quota and risk of service interruption due to running out of tenant quota. +When deploying non-persistent VDI, Microsoft recommends organizations implement the guidance below. Failure to do so will result in your directory having lots of stale Hybrid Azure AD joined devices that were registered from your non-persistent VDI platform resulting in increased pressure on your tenant quota and risk of service interruption because of running out of tenant quota. -- If you are relying on the System Preparation Tool (sysprep.exe) and if you are using a pre-Windows 10 1809 image for installation, make sure that image is not from a device that is already registered with Azure AD as hybrid Azure AD joined.-- If you are relying on a Virtual Machine (VM) snapshot to create additional VMs, make sure that snapshot is not from a VM that is already registered with Azure AD as Hybrid Azure AD join.-- Create and use a prefix for the display name (e.g. NPVDI-) of the computer that indicates the desktop as non-persistent VDI-based.+- If you're relying on the System Preparation Tool (sysprep.exe) and if you're using a pre-Windows 10 1809 image for installation, make sure that image isn't from a device that is already registered with Azure AD as hybrid Azure AD joined. +- If you're relying on a Virtual Machine (VM) snapshot to create more VMs, make sure that snapshot isn't from a VM that is already registered with Azure AD as Hybrid Azure AD join. +- Active Directory Federation Services (AD FS) supports instant join for non-persistent VDI and Hybrid Azure AD Join. +- Create and use a prefix for the display name (for example, NPVDI-) of the computer that indicates the desktop as non-persistent VDI-based. - For Windows down-level:- - Implement **autoworkplacejoin /leave** command as part of logoff script. This command should be triggered in the context of the user and should be execute before the user has logged off completely and while there is still network connectivity. -- For Windows current in a Federated environment (e.g. AD FS):+ - Implement **autoworkplacejoin /leave** command as part of logoff script. This command should be triggered in the context of the user, and should be executed before the user has logged off completely and network connectivity exists. +- For Windows current in a Federated environment (for example, AD FS): - Implement **dsregcmd /join** as part of VM boot sequence/order and before user signs in. - **DO NOT** execute dsregcmd /leave as part of VM shutdown/restart process. - Define and implement process for [managing stale devices](manage-stale-devices.md).- - Once you have a strategy to identify your non-persistent Hybrid Azure AD joined devices (such as using computer display name prefix), you should be more aggressive on the cleanup of these devices to ensure your directory does not get consumed with lots of stale devices. + - Once you have a strategy to identify your non-persistent Hybrid Azure AD joined devices (such as using computer display name prefix), you should be more aggressive on the cleanup of these devices to ensure your directory doesn't get consumed with lots of stale devices. - For non-persistent VDI deployments on Windows current and down-level, you should delete devices that have **ApproximateLastLogonTimestamp** of older than 15 days. > [!NOTE] > When using non-persistent VDI, if you want to prevent adding a work or school account ensure the following registry key is set: > `HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin: "BlockAADWorkplaceJoin"=dword:00000001` >-> Ensure you are running Windows 10, version 1803 or higher. +> Ensure you're running Windows 10, version 1803 or higher. > > Roaming any data under the path `%localappdata%` is not supported. If you choose to move content under `%localappdata%`, make sure that the content of the following folders and registry keys **never** leaves the device under any condition. For example: Profile migration tools must skip the following folders and keys: > When deploying non-persistent VDI, Microsoft recommends that IT administrators i When deploying persistent VDI, Microsoft recommends that IT administrators implement the guidance below. Failure to do so will result in deployment and authentication issues. -- If you are relying on the System Preparation Tool (sysprep.exe) and if you are using a pre-Windows 10 1809 image for installation, make sure that image is not from a device that is already registered with Azure AD as hybrid Azure AD joined.-- If you are relying on a Virtual Machine (VM) snapshot to create additional VMs, make sure that snapshot is not from a VM that is already registered with Azure AD as Hybrid Azure AD join.+- If you're relying on the System Preparation Tool (sysprep.exe) and if you're using a pre-Windows 10 1809 image for installation, make sure that image isn't from a device that is already registered with Azure AD as hybrid Azure AD joined. +- If you're relying on a Virtual Machine (VM) snapshot to create more VMs, make sure that snapshot isn't from a VM that is already registered with Azure AD as Hybrid Azure AD join. -In addition, we recommend you to implement process for [managing stale devices](manage-stale-devices.md). This will ensure your directory does not get consumed with lots of stale devices if you periodically reset your VMs. +We recommend you to implement process for [managing stale devices](manage-stale-devices.md). This process will ensure your directory doesn't get consumed with lots of stale devices if you periodically reset your VMs. ## Next steps |
| active-directory | Active Directory Data Storage Australia Newzealand | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/fundamentals/active-directory-data-storage-australia-newzealand.md | -For information about where Azure AD and other Microsoft services' data is located, see the [Where is your data located?](https://www.microsoft.com/trustcenter/privacy/where-your-data-is-located) section of the Microsoft Trust Center. +For information about where Azure AD and other Microsoft services' data is located, see the [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) section of the Microsoft Trust Center. From February 26, 2020, Microsoft began storing Azure ADΓÇÖs Customer Data for new tenants with an Australian or New Zealand billing address within the Australian datacenters. Additionally, certain Azure AD features do not yet support storage of Customer Data in Australia. Please go to the [Azure AD data map](https://msit.powerbi.com/view?r=eyJrIjoiYzEyZTc5OTgtNTdlZS00ZTVkLWExN2ItOTM0OWU4NjljOGVjIiwidCI6IjcyZjk4OGJmLTg2ZjEtNDFhZi05MWFiLTJkN2NkMDExZGI0NyIsImMiOjV9), for specific feature information. For example, Microsoft Azure AD Multi-Factor Authentication stores Customer Data in the US and processes it globally. See [Data residency and customer data for Azure AD Multi-Factor Authentication](../authentication/concept-mfa-data-residency.md). > [!NOTE]-> Microsoft products, services, and third-party applications that integrate with Azure AD have access to Customer Data. Evaluate each product, service, and application you use to determine how Customer Data is processed by that specific product, service, and application, and whether they meet your company's data storage requirements. For more information about Microsoft services' data residency, see the [Where is your data located?](https://www.microsoft.com/trustcenter/privacy/where-your-data-is-located) section of the Microsoft Trust Center. +> Microsoft products, services, and third-party applications that integrate with Azure AD have access to Customer Data. Evaluate each product, service, and application you use to determine how Customer Data is processed by that specific product, service, and application, and whether they meet your company's data storage requirements. For more information about Microsoft services' data residency, see the [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) section of the Microsoft Trust Center. ++## Azure role-based access control (Azure RBAC) ++Role definitions, role assignments, and deny assignments are stored globally to ensure that you have access to your resources regardless of the region you created the resource. For more information, see [What is Azure role-based access control (Azure RBAC)?](../../role-based-access-control/overview.md#where-is-azure-rbac-data-stored). |
| active-directory | Active Directory Data Storage Eu | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/fundamentals/active-directory-data-storage-eu.md | -Identity data is stored by Azure AD in a geographical location based on the address provided by your organization when it subscribed for a Microsoft Online service such as Microsoft 365 and Azure. For information on where your identity data is stored, you can use the [Where is your data located?](https://www.microsoft.com/trustcenter/privacy/where-your-data-is-located) section of the Microsoft Trust Center. +Identity data is stored by Azure AD in a geographical location based on the address provided by your organization when it subscribed for a Microsoft Online service such as Microsoft 365 and Azure. For information on where your identity data is stored, you can use the [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) section of the Microsoft Trust Center. For customers who provided an address in Europe, Azure AD keeps most of the identity data within European datacenters. This document provides information on any data that is stored outside of Europe by Azure AD services. Azure AD B2B stores invitations with redeem link and redirect URL information in Azure AD DS stores user data in the same location as the customer-selected Azure Virtual Network. So, if the network is outside Europe, the data is replicated and stored outside Europe. +## Azure role-based access control (Azure RBAC) ++Role definitions, role assignments, and deny assignments are stored globally to ensure that you have access to your resources regardless of the region you created the resource. For more information, see [What is Azure role-based access control (Azure RBAC)?](../../role-based-access-control/overview.md#where-is-azure-rbac-data-stored). + ## Federation in Microsoft Exchange Server 2013 - Application identifier (AppID) - A unique number generated by the Azure Active Directory authentication system to identify Exchange organizations. For more info about federation in Microsoft Exchange server, see the [Federation Services and applications that integrate with Azure AD have access to identity data. Evaluate each service and application you use to determine how identity data is processed by that specific service and application, and whether they meet your company's data storage requirements. -For more information about Microsoft services' data residency, see the [Where is your data located?](https://www.microsoft.com/trustcenter/privacy/where-your-data-is-located) section of the Microsoft Trust Center. +For more information about Microsoft services' data residency, see the [Where your data is located](https://www.microsoft.com/trust-center/privacy/data-location) section of the Microsoft Trust Center. ## Next steps For more information about any of the features and functionality described above, see these articles: |
| active-directory | Concept Identity Protection Risks | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/identity-protection/concept-identity-protection-risks.md | These risks can be calculated in real-time or calculated offline using Microsoft | | | | | Anonymous IP address | Real-time | This risk detection type indicates sign-ins from an anonymous IP address (for example, Tor browser or anonymous VPN). These IP addresses are typically used by actors who want to hide their login telemetry (IP address, location, device, and so on) for potentially malicious intent. | | Atypical travel | Offline | This risk detection type identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. Among several other factors, this machine learning algorithm takes into account the time between the two sign-ins and the time it would have taken for the user to travel from the first location to the second, indicating that a different user is using the same credentials. <br><br> The algorithm ignores obvious "false positives" contributing to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior. |-| Anomalous Token | Offline | This detection indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. This detection covers Session Tokens and Refresh Tokens. | +| Anomalous Token | Offline | This detection indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. This detection covers Session Tokens and Refresh Tokens. ***NOTE:** Anomalous token is tuned to incur more noise than other detections at the same risk level. This tradeoff is chosen to increase the likelihood of detecting replayed tokens that may otherwise go unnoticed. Because this is a high noise detection, there is a higher than normal chance that some of the sessions flagged by this detection are false positives. We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. If the location, application, IP address, User Agent, or other characteristics are unexpected for the user, the tenant admin should consider this as an indicator of potential token replay*. | | Token Issuer Anomaly | Offline |This risk detection indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns. | | Malware linked IP address | Offline | This risk detection type indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server. This detection is determined by correlating IP addresses of the user's device against IP addresses that were in contact with a bot server while the bot server was active. <br><br> **[This detection has been deprecated](../fundamentals/whats-new.md#planned-deprecationmalware-linked-ip-address-detection-in-identity-protection)**. Identity Protection will no longer generate new "Malware linked IP address" detections. Customers who currently have "Malware linked IP address" detections in their tenant will still be able to view, remediate, or dismiss them until the 90-day detection retention time is reached.| | Suspicious browser | Offline | Suspicious browser detection indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. | |
| active-directory | Application Sign In Problem Application Error | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/application-sign-in-problem-application-error.md | Title: Error message appears on app page after you sign in description: How to resolve issues with Azure AD sign in when the app returns an error message. -+ Last updated 07/11/2017--++ |
| active-directory | Assign User Or Group Access Portal | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/assign-user-or-group-access-portal.md | Title: Assign users and groups description: Learn how to assign and unassign users, and groups, for an app using Azure Active Directory for identity management. -+ Last updated 10/23/2021--++ #customer intent: As an admin, I want to manage user assignment for an app in Azure Active Directory using Powershell |
| active-directory | Configure Admin Consent Workflow | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/configure-admin-consent-workflow.md | |
| active-directory | Disable User Sign In Portal | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/disable-user-sign-in-portal.md | Title: Disable how a how a user signs in description: How to disable an enterprise application so that no users may sign in to it in Azure Active Directory -+ Last updated 09/23/2021--++ #customer intent: As an admin, I want to disable the way a user signs in for an application so that no user can sign in to it in Azure Active Directory. |
| active-directory | Grant Admin Consent | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/grant-admin-consent.md | Title: Grant tenant-wide admin consent to an application description: Learn how to grant tenant-wide consent to an application so that end-users are not prompted for consent when signing in to an application. -+ Last updated 10/23/2021--++ |
| active-directory | Plan An Application Integration | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/plan-an-application-integration.md | Title: Get started integrating Azure Active Directory with apps description: This article is a getting started guide for integrating Azure Active Directory (AD) with on-premises applications, and cloud applications. -+ Last updated 04/05/2021--++ # Integrating Azure Active Directory with applications getting started guide |
| active-directory | Ways Users Get Assigned To Applications | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/ways-users-get-assigned-to-applications.md | Title: Understand how users are assigned to apps description: Understand how users get assigned to an app that is using Azure Active Directory for identity management. -+ Last updated 01/07/2021--++ # Understand how users are assigned to apps For a user to access an application, they must first be assigned to it in some w * [Quickstart Series on Application Management](view-applications-portal.md) * [What is application management?](what-is-application-management.md)-* [What is single sign-on?](what-is-single-sign-on.md) +* [What is single sign-on?](what-is-single-sign-on.md) |
| active-directory | What Is Access Management | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/manage-apps/what-is-access-management.md | Title: Manage access to apps description: Describes how Azure Active Directory enables organizations to specify the apps to which each user has access. -+ Last updated 09/23/2021--++ # Manage access to an application |
| active-directory | How Manage User Assigned Managed Identities | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md | |
| active-directory | How Managed Identities Work Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-managed-identities-work-vm.md | Title: How managed identities for Azure resources work with with Azure virtual machines + Title: How managed identities for Azure resources work with Azure virtual machines description: Description of managed identities for Azure resources work with Azure virtual machines. documentationcenter: |
| active-directory | How To Assign App Role Managed Identity Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-assign-app-role-managed-identity-cli.md | +> [!NOTE] +> The tokens which your application receives are cached by the underlying infrastructure, which means that any changes to the managed identity's roles can take significant time to take effect. For more information, see [Limitation of using managed identities for authorization](managed-identity-best-practice-recommendations.md#limitation-of-using-managed-identities-for-authorization). + In this article, you learn how to assign a managed identity to an application role exposed by another application using Azure CLI. ## Prerequisites |
| active-directory | How To Assign App Role Managed Identity Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-assign-app-role-managed-identity-powershell.md | +> [!NOTE] +> The tokens which your application receives are cached by the underlying infrastructure, which means that any changes to the managed identity's roles can take significant time to take effect. For more information, see [Limitation of using managed identities for authorization](managed-identity-best-practice-recommendations.md#limitation-of-using-managed-identities-for-authorization). + In this article, you learn how to assign a managed identity to an application role exposed by another application using Azure AD PowerShell. [!INCLUDE [az-powershell-update](../../../includes/updated-for-az.md)] |
| active-directory | How To Use Vm Sdk | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-use-vm-sdk.md | |
| active-directory | How To Use Vm Sign In | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-use-vm-sign-in.md | |
| active-directory | How To Use Vm Token | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-use-vm-token.md | Title: Use managed identities on a virtual machine to acquire access token - Azure AD -description: Step by step instructions and examples for using managed identities for Azure resources on a virtual machines to acquire an OAuth access token. +description: Step-by-step instructions and examples for using managed identities for Azure resources on virtual machines to acquire an OAuth access token. documentationcenter: -Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. +Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. This article provides various code and script examples for token acquisition, as well as guidance on important topics such as handling token expiration and HTTP errors. GET 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-0 | - | -- | | `GET` | The HTTP verb, indicating you want to retrieve data from the endpoint. In this case, an OAuth access token. | | `http://169.254.169.254/metadata/identity/oauth2/token` | The managed identities for Azure resources endpoint for the Instance Metadata Service. |-| `api-version` | A query string parameter, indicating the API version for the IMDS endpoint. Please use API version `2018-02-01` or greater. | +| `api-version` | A query string parameter, indicating the API version for the IMDS endpoint. Use API version `2018-02-01` or greater. | | `resource` | A query string parameter, indicating the App ID URI of the target resource. It also appears in the `aud` (audience) claim of the issued token. This example requests a token to access Azure Resource Manager, which has an App ID URI of `https://management.azure.com/`. | | `Metadata` | An HTTP request header field, required by managed identities for Azure resources as a mitigation against Server Side Request Forgery (SSRF) attack. This value must be set to "true", in all lower case. | | `object_id` | (Optional) A query string parameter, indicating the object_id of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.| The managed identities for Azure resources endpoint signals errors via the statu | 404 Not found. | IMDS endpoint is updating. | Retry with Exponential Backoff. See guidance below. | | 429 Too many requests. | IMDS Throttle limit reached. | Retry with Exponential Backoff. See guidance below. | | 4xx Error in request. | One or more of the request parameters was incorrect. | Do not retry. Examine the error details for more information. 4xx errors are design-time errors.|-| 5xx Transient error from service. | The managed identities for Azure resources sub-system or Azure Active Directory returned a transient error. | It is safe to retry after waiting for at least 1 second. If you retry too quickly or too often, IMDS and/or Azure AD may return a rate limit error (429).| +| 5xx Transient error from service. | The managed identities for Azure resources subsystem or Azure Active Directory returned a transient error. | It is safe to retry after waiting for at least 1 second. If you retry too quickly or too often, IMDS and/or Azure AD may return a rate limit error (429).| | timeout | IMDS endpoint is updating. | Retry with Exponential Backoff. See guidance below. | If an error occurs, the corresponding HTTP response body contains JSON with the error details: This section documents the possible error responses. A "200 OK" status is a succ | | access_denied | The resource owner or authorization server denied the request. | | | | unsupported_response_type | The authorization server does not support obtaining an access token using this method. | | | | invalid_scope | The requested scope is invalid, unknown, or malformed. | |-| 500 Internal server error | unknown | Failed to retrieve token from the Active directory. For details see logs in *\<file path\>* | Verify that managed identities for Azure resources has been enabled on the VM. See [Configure managed identities for Azure resources on a VM using the Azure portal](qs-configure-portal-windows-vm.md) if you need assistance with VM configuration.<br><br>Also verify that your HTTP GET request URI is formatted correctly, particularly the resource URI specified in the query string. See the "Sample request" in the preceding REST section for an example, or [Azure services that support Azure AD authentication](./services-support-managed-identities.md) for a list of services and their respective resource IDs. +| 500 Internal server error | unknown | Failed to retrieve token from the Active directory. For details see logs in *\<file path\>* | Verify that managed identities for Azure resources is enabled on the VM. See [Configure managed identities for Azure resources on a VM using the Azure portal](qs-configure-portal-windows-vm.md) if you need assistance with VM configuration.<br><br>Also verify that your HTTP GET request URI is formatted correctly, particularly the resource URI specified in the query string. See the "Sample request" in the preceding REST section for an example, or [Azure services that support Azure AD authentication](./services-support-managed-identities.md) for a list of services and their respective resource IDs. > [!IMPORTANT] > - IMDS is not intended to be used behind a proxy and doing so is unsupported. For examples of how to bypass proxies, refer to the [Azure Instance Metadata Samples](https://github.com/microsoft/azureimds). |
| active-directory | How To View Managed Identity Activity | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-view-managed-identity-activity.md | |
| active-directory | How To View Managed Identity Service Principal Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-view-managed-identity-service-principal-cli.md | -Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication without having credentials in your code. +Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication without having credentials in your code. In this article, you learn how to view the service principal of a managed identity using Azure CLI. |
| active-directory | How To View Managed Identity Service Principal Portal | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-view-managed-identity-service-principal-portal.md | -Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. +Managed identities provide Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. In this article, you learn how to view the service principal of a managed identity using the Azure portal. |
| active-directory | How To View Managed Identity Service Principal Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/how-to-view-managed-identity-service-principal-powershell.md | |
| active-directory | Howto Assign Access Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/howto-assign-access-cli.md | |
| active-directory | Howto Assign Access Portal | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/howto-assign-access-portal.md | |
| active-directory | Howto Assign Access Powershell | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/howto-assign-access-powershell.md | Once you've configured an Azure resource with a managed identity, you can give t - If you're unfamiliar with managed identities for Azure resources, check out the [overview section](overview.md). **Be sure to review the [difference between a system-assigned and user-assigned managed identity](overview.md#managed-identity-types)**. - If you don't already have an Azure account, [sign up for a free account](https://azure.microsoft.com/free/) before continuing. - To run the example scripts, you have two options:- - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top right corner of code blocks. + - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top-right corner of code blocks. - Run scripts locally by installing the latest version of [Azure PowerShell](/powershell/azure/install-az-ps), then sign in to Azure using `Connect-AzAccount`. ## Use Azure RBAC to assign a managed identity access to another resource |
| active-directory | Known Issues | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/known-issues.md | ms.devlang: Previously updated : 04/08/2021 Last updated : 01/11/2022 az vm update -n <VM Name> -g <Resource Group> --set tags.fixVM=1 This command sets a new tag "fixVM" with a value of 1 on the VM. -By setting this property, the VM updates with the correct managed identities for Azure resources resource URI, and then you should be able to start the VM. +By setting this property, the VM updates with the correct managed identities for Azure resources URI, and then you should be able to start the VM. Once the VM is started, the tag can be removed by using following command: |
| active-directory | Managed Identities Faq | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/managed-identities-faq.md | ms.devlang: Previously updated : 10/20/2021 Last updated : 01/11/2022 az resource list --query "[?identity.type=='SystemAssigned'].{Name:name, princi ### Which Azure RBAC permissions are required to use a managed identity on a resource? - System-assigned managed identity: You need write permissions over the resource. For example, for virtual machines you need `Microsoft.Compute/virtualMachines/write`. This action is included in resource specific built-in roles like [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor).-- Assigning user-assigned managed identities to resources: You need write permissions over the resource. For example, for virtual machines you need `Microsoft.Compute/virtualMachines/write`. You will also need the `Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action` action over the user-assigned identity. This action is included in the [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) built-in role.+- Assigning user-assigned managed identities to resources: You need write permissions over the resource. For example, for virtual machines you need `Microsoft.Compute/virtualMachines/write`. You will also need `Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action` action over the user-assigned identity. This action is included in the [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) built-in role. - Managing user-assigned identities: To create or delete user-assigned managed identities, you need the [Managed Identity Contributor](../../role-based-access-control/built-in-roles.md#managed-identity-contributor) role assignment. - Managing role assignments for managed identities: You need the [Owner](../../role-based-access-control/built-in-roles.md#all) or [User Access Administrator](../../role-based-access-control/built-in-roles.md#all) role assignment over the resource to which you're granting access. You will need the [Reader](../../role-based-access-control/built-in-roles.md#all) role assignment to the resource with a system-assigned identity, or to the user-assigned identity that is being given the role assignment. If you do not have read access, you can search by "User, group, or service principal" to find the identity's backing service principal, instead of searching by managed identity while adding the role assignment. [Read more about assigning Azure roles](../../role-based-access-control/role-assignments-portal.md). You can keep your users from creating user-assigned managed identities using [Az 1. Navigate to the [Azure portal](https://portal.azure.com) and go to **Policy**. 2. Choose **Definitions** 3. Select **+ Policy definition** and enter the necessary information.-4. In the policy rule section paste +4. In the policy rule section, paste: ```json { Managed identities use certificate-based authentication. Each managed identity ### What identity will IMDS default to if don't specify the identity in the request? -- If system assigned managed identity is enabled and no identity is specified in the request, IMDS defaults to the system assigned managed identity.+- If system assigned managed identity is enabled and no identity is specified in the request, Azure Instance Metadata Service (IMDS) defaults to the system assigned managed identity. - If system assigned managed identity is not enabled, and only one user assigned managed identity exists, IMDS defaults to that single user assigned managed identity. - If system assigned managed identity is not enabled, and multiple user assigned managed identities exist, then you are required to specify a managed identity in the request. The security boundary of the identity is the resource to which it is attached to ### Will managed identities be recreated automatically if I move a subscription to another directory? -No. If you move a subscription to another directory, you will have to manually re-create them and grant Azure role assignments again. +No. If you move a subscription to another directory, you have to manually re-create them and grant Azure role assignments again. - For system assigned managed identities: disable and re-enable. - For user assigned managed identities: delete, re-create, and attach them again to the necessary resources (for example, virtual machines) Managed identities limits have dependencies on Azure service limits, Azure Insta Moving a user-assigned managed identity to a different resource group is not supported. +### Are tokens cached after they are issued for a managed identity? ++Managed identity tokens are cached by the underlying Azure infrastructure for performance and resiliency purposes: the back-end services for managed identities maintain a cache per resource URI for around 24 hours. This means that it can take several hours for changes to a managed identity's permissions to take effect, for example. Today, it is not possible to force a managed identity's token to be refreshed before its expiry. For more information, see [Limitation of using managed identities for authorization](managed-identity-best-practice-recommendations.md#limitation-of-using-managed-identities-for-authorization). + ## Next steps - Learn [how managed identities work with virtual machines](how-managed-identities-work-vm.md) |
| active-directory | Managed Identities Status | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/managed-identities-status.md | description: List of services supporting managed identities Previously updated : 12/08/2021 Last updated : 01/10/2022 |
| active-directory | Managed Identity Best Practice Recommendations | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/managed-identity-best-practice-recommendations.md | will be displayed with ΓÇ£Identity not foundΓÇ¥ when viewed in the portal. [Read :::image type="content" source="media/managed-identity-best-practice-recommendations/identity-not-found.png" alt-text="Identity not found for role assignment."::: -## Limitation of using Azure AD Groups with managed identities for authorization +## Limitation of using managed identities for authorization -Using Azure AD Groups for granting access to services is a great way to simplify the authorization process. The idea is simple ΓÇô grant permissions to a group and add identities to the group so that they inherit the same permissions. This is a well-established pattern from various on-premises systems and works well when the identities represent users. However, for non-human identities, such as Azure AD Applications and Managed identities, the exact mechanism is not well suited today. TodayΓÇÖs implementation with Azure AD and Azure Role Based Access Control (Azure RBAC), uses access tokens issued by Azure AD for authentication of each identity. However, if the identity is added to a group, its group membership is expressed as a claim in the access token issued by Azure AD. Azure RBAC uses this claim to further evaluate the authorization rules for allowing or denying access. +Using Azure AD **groups** for granting access to services is a great way to simplify the authorization process. The idea is simple ΓÇô grant permissions to a group and add identities to the group so that they inherit the same permissions. This is a well-established pattern from various on-premises systems and works well when the identities represent users. Another option to control authorization in Azure AD is by using [App Roles](../develop/howto-add-app-roles-in-azure-ad-apps.md), which allows you to declare **roles** that are specific to an app (rather than groups, which are a global concept in the directory). You can then [assign app roles to managed identities](how-to-assign-app-role-managed-identity-powershell.md) (as well as users or groups). -As the group membership is a claim in the access token, group membership changes do not take effect until the token is refreshed. A human user can acquire a new access token by logging out and in again. Managed identity tokens are cached by the underlying Azure infrastructure for performance and resiliency purposes. This means that it can take several hours for changes to a managed identityΓÇÖs group membership to take effect. Today, it is not possible to force a managed identityΓÇÖs token to be refreshed before its expiry. If you change a managed identityΓÇÖs group membership to add or remove permissions, you may therefore need to wait several hours for the Azure resource using the identity to have the correct access, compared to just a few minutes if you were to add or remove permissions directly on the identity. +In both cases, for non-human identities such as Azure AD Applications and Managed identities, the exact mechanism of how this authorization information is presented to the application is not ideally suited today. Today's implementation with Azure AD and Azure Role Based Access Control (Azure RBAC) uses access tokens issued by Azure AD for authentication of each identity. If the identity is added to a group or role, this is expressed as claims in the access token issued by Azure AD. Azure RBAC uses these claims to further evaluate the authorization rules for allowing or denying access. -To ensure that changes to permissions for managed identities take effect quickly, we recommend that you group Azure resources using a [user-assigned managed identity](how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-azcli) with permissions applied directly to the identity, instead of adding to or removing managed identities from an Azure AD group that has permissions. A user-assigned managed identity can be used like a group because it can be assigned to one or more Azure resources to use it. The assignment operation can be controlled using the [Managed identity contributor](../../role-based-access-control/built-in-roles.md#managed-identity-contributor) and [Managed identity operator role](../../role-based-access-control/built-in-roles.md#managed-identity-operator). +Given that the identity's groups and roles are claims in the access token, any authorization changes do not take effect until the token is refreshed. For a human user that's typically not a problem, because a user can acquire a new access token by logging out and in again (or waiting for the token lifetime to expire, which is 1 hour by default). Managed identity tokens on the other hand are cached by the underlying Azure infrastructure for performance and resiliency purposes: the back-end services for managed identities maintain a cache per resource URI for around 24 hours. This means that it can take several hours for changes to a managed identity's group or role membership to take effect. Today, it is not possible to force a managed identity's token to be refreshed before its expiry. If you change a managed identityΓÇÖs group or role membership to add or remove permissions, you may therefore need to wait several hours for the Azure resource using the identity to have the correct access. ++If this delay is not acceptable for your requirements, consider alternatives to using groups or roles in the token. To ensure that changes to permissions for managed identities take effect quickly, we recommend that you group Azure resources using a [user-assigned managed identity](how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-azcli) with permissions applied directly to the identity, instead of adding to or removing managed identities from an Azure AD group that has permissions. A user-assigned managed identity can be used like a group because it can be assigned to one or more Azure resources to use it. The assignment operation can be controlled using the [Managed identity contributor](../../role-based-access-control/built-in-roles.md#managed-identity-contributor) and [Managed identity operator role](../../role-based-access-control/built-in-roles.md#managed-identity-operator). |
| active-directory | Msi Tutorial Linux Vm Access Arm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/msi-tutorial-linux-vm-access-arm.md | In this tutorial, you learn how to: - An Azure account, [sign up for a free account](https://azure.microsoft.com/free/). - You also need a Linux Virtual machine. If you need to create a virtual machine for this tutorial, you can follow the article titled [Create a Linux virtual machine with the Azure portal](../../virtual-machines/linux/quick-create-portal.md#create-virtual-machine) - To run the example scripts, you have two options:- - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top right corner of code blocks. + - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top-right corner of code blocks. - Run scripts locally by installing the latest version of the [Azure CLI](/cli/azure/install-azure-cli), then sign in to Azure using [az login](/cli/azure/reference-index#az_login). ## Create a user-assigned managed identity az vm identity assign -g <RESOURCE GROUP> -n <VM NAME> --identities "/subscripti ## Grant access to a Resource Group in Azure Resource Manager -Managed identities for Azure resources provides identities that your code can use to request access tokens to authenticate to resource APIs that support Azure AD authentication. In this tutorial, your code will access the Azure Resource Manager API. +Managed identities are identities that your code can use to request access tokens to authenticate to resource APIs that support Azure AD authentication. In this tutorial, your code will access the Azure Resource Manager API. Before your code can access the API, you need to grant the identity access to a resource in Azure Resource Manager. In this case, the Resource Group in which the VM is contained. Update the value for `<SUBSCRIPTION ID>` and `<RESOURCE GROUP>` as appropriate for your environment. Additionally, replace `<UAMI PRINCIPALID>` with the `principalId` property returned by the `az identity create` command in [Create a user-assigned managed identity](#create-a-user-assigned-managed-identity): To complete these steps, you need an SSH client. If you are using Windows, you c 1. Sign in to the Azure [portal](https://portal.azure.com). 2. In the portal, navigate to **Virtual Machines** and go to the Linux virtual machine and in the **Overview**, click **Connect**. Copy the string to connect to your VM. 3. Connect to the VM with the SSH client of your choice. If you are using Windows, you can use the SSH client in the [Windows Subsystem for Linux](/windows/wsl/about). If you need assistance configuring your SSH client's keys, see [How to Use SSH keys with Windows on Azure](~/articles/virtual-machines/linux/ssh-from-windows.md), or [How to create and use an SSH public and private key pair for Linux VMs in Azure](~/articles/virtual-machines/linux/mac-create-ssh-keys.md).-4. In the terminal window, using CURL, make a request to the Azure Instance Metadata Service (IMDS) identity endpoint to get an access token for Azure Resource Manager.   +4. In the terminal window, use CURL to make a request to the Azure Instance Metadata Service (IMDS) identity endpoint to get an access token for Azure Resource Manager.   The CURL request to acquire an access token is shown in the following example. Be sure to replace `<CLIENT ID>` with the `clientId` property returned by the `az identity create` command in [Create a user-assigned managed identity](#create-a-user-assigned-managed-identity):  |
| active-directory | Qs Configure Cli Windows Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-cli-windows-vm.md | In this section, you learn how to enable and disable the system-assigned managed ### Enable system-assigned managed identity during creation of an Azure VM -To create an Azure VM with the system-assigned managed identity enabled, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To create an Azure VM with the system-assigned managed identity enabled, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Create a [resource group](../../azure-resource-manager/management/overview.md#terminology) for containment and deployment of your VM and its related resources, using [az group create](/cli/azure/group/#az_group_create). You can skip this step if you already have resource group you would like to use instead: To create an Azure VM with the system-assigned managed identity enabled, your ac ### Enable system-assigned managed identity on an existing Azure VM -To enable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To enable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. If you're using the Azure CLI in a local console, first sign in to Azure using [az login](/cli/azure/reference-index#az_login). Use an account that is associated with the Azure subscription that contains the VM. To enable system-assigned managed identity on a VM, your account needs the [Virt ### Disable system-assigned identity from an Azure VM -To disable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To disable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. If you have a Virtual Machine that no longer needs the system-assigned identity, but still needs user-assigned identities, use the following command: In this section, you will learn how to add and remove a user-assigned managed id ### Assign a user-assigned managed identity during the creation of an Azure VM -To assign a user-assigned identity to a VM during its creation, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM during its creation, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. You can skip this step if you already have a resource group you would like to use. Create a [resource group](~/articles/azure-resource-manager/management/overview.md#terminology) for containment and deployment of your user-assigned managed identity, using [az group create](/cli/azure/group/#az_group_create). Be sure to replace the `<RESOURCE GROUP>` and `<LOCATION>` parameter values with your own values. : To assign a user-assigned identity to a VM during its creation, your account nee ### Assign a user-assigned managed identity to an existing Azure VM -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. Create a user-assigned identity using [az identity create](/cli/azure/identity#az_identity_create). The `-g` parameter specifies the resource group where the user-assigned identity is created, and the `-n` parameter specifies its name. Be sure to replace the `<RESOURCE GROUP>` and `<USER ASSIGNED IDENTITY NAME>` parameter values with your own values: |
| active-directory | Qs Configure Cli Windows Vmss | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-cli-windows-vmss.md | |
| active-directory | Qs Configure Portal Windows Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm.md | Title: Configure managed identities using the Azure portal - Azure AD -description: Step by step instructions for configuring managed identities for Azure resources on an Azure VM using the Azure portal. +description: Step-by-step instructions for configuring managed identities for Azure resources on an Azure VM using the Azure portal. documentationcenter: '' In this section, you learn how to enable and disable the system-assigned managed ### Enable system-assigned managed identity during creation of a VM -To enable system-assigned managed identity on a VM during its creation, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To enable system-assigned managed identity on a VM during its creation, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. - Under the **Management** tab in the **Identity** section, switch **Managed service identity** to **On**. Refer to the following Quickstarts to create a VM: ### Enable system-assigned managed identity on an existing VM -To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Sign in to the [Azure portal](https://portal.azure.com) using an account associated with the Azure subscription that contains the VM. To enable system-assigned managed identity on a VM that was originally provision ### Remove system-assigned managed identity from a VM -To remove system-assigned managed identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To remove system-assigned managed identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. If you have a Virtual Machine that no longer needs system-assigned managed identity: If you have a Virtual Machine that no longer needs system-assigned managed ident ### Assign a user-assigned identity during the creation of a VM -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. Currently, the Azure portal does not support assigning a user-assigned managed identity during the creation of a VM. Instead, refer to one of the following VM creation Quickstart articles to first create a VM, and then proceed to the next section for details on assigning a user-assigned managed identity to the VM: Currently, the Azure portal does not support assigning a user-assigned managed i ### Assign a user-assigned managed identity to an existing VM -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. Sign in to the [Azure portal](https://portal.azure.com) using an account associated with the Azure subscription that contains the VM. 2. Navigate to the desired VM and click **Identity**, **User assigned** and then **\+Add**. To assign a user-assigned identity to a VM, your account needs the [Virtual Mach ### Remove a user-assigned managed identity from a VM -To remove a user-assigned identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To remove a user-assigned identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Sign in to the [Azure portal](https://portal.azure.com) using an account associated with the Azure subscription that contains the VM. 2. Navigate to the desired VM and click **Identity**, **User assigned**, the name of the user-assigned managed identity you want to delete and then click **Remove** (click **Yes** in the confirmation pane). |
| active-directory | Qs Configure Portal Windows Vmss | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vmss.md | -# Configure managed identities for Azure resources on a virtual machine scale set (VMSS) using the Azure portal +# Configure managed identities for Azure resources on a virtual machine scale set (virtual machine scale set) using the Azure portal [!INCLUDE [preview-notice](../../../includes/active-directory-msi-preview-notice.md)] -Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. +Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. In this article, using PowerShell, you learn how to perform the following managed identities for Azure resources operations on a virtual machine scale set: |
| active-directory | Qs Configure Powershell Windows Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-powershell-windows-vm.md | In this article, using PowerShell, you learn how to perform the following manage - If you're unfamiliar with managed identities for Azure resources, check out the [overview section](overview.md). **Be sure to review the [difference between a system-assigned and user-assigned managed identity](overview.md#managed-identity-types)**. - If you don't already have an Azure account, [sign up for a free account](https://azure.microsoft.com/free/) before continuing. - To run the example scripts, you have two options:- - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top right corner of code blocks. + - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top-right corner of code blocks. - Run scripts locally by installing the latest version of [Azure PowerShell](/powershell/azure/install-az-ps), then sign in to Azure using `Connect-AzAccount`. ## System-assigned managed identity In this section, you will learn how to enable and disable the system-assigned ma ### Enable system-assigned managed identity during creation of an Azure VM -To create an Azure VM with the system-assigned managed identity enabled, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To create an Azure VM with the system-assigned managed identity enabled, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Refer to one of the following Azure VM Quickstarts, completing only the necessary sections ("Sign in to Azure", "Create resource group", "Create networking group", "Create the VM"). To create an Azure VM with the system-assigned managed identity enabled, your ac ### Enable system-assigned managed identity on an existing Azure VM -To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Retrieve the VM properties using the `Get-AzVM` cmdlet. Then to enable a system-assigned managed identity, use the `-IdentityType` switch on the [Update-AzVM](/powershell/module/az.compute/update-azvm) cmdlet: After you have enabled system assigned identity on a VM, you can add it to a gro ## Disable system-assigned managed identity from an Azure VM -To disable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To disable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. If you have a Virtual Machine that no longer needs the system-assigned managed identity but still needs user-assigned managed identities, use the following cmdlet: In this section, you learn how to add and remove a user-assigned managed identit ### Assign a user-assigned managed identity to a VM during creation -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. Refer to one of the following Azure VM Quickstarts, completing only the necessary sections ("Sign in to Azure", "Create resource group", "Create networking group", "Create the VM"). To assign a user-assigned identity to a VM, your account needs the [Virtual Mach ### Assign a user-assigned managed identity to an existing Azure VM -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. Create a user-assigned managed identity using the [New-AzUserAssignedIdentity](/powershell/module/az.managedserviceidentity/new-azuserassignedidentity) cmdlet. Note the `Id` in the output because you will need this in the next step. > [!IMPORTANT]- > Creating user-assigned managed identities only supports alphanumeric, underscore and hyphen (0-9 or a-z or A-Z, \_ or -) characters. Additionally, name should be limited from 3 to 128 character length for the assignment to VM/VMSS to work properly. For more information see [FAQs and known issues](known-issues.md) + > Creating user-assigned managed identities only supports alphanumeric, underscore and hyphen (0-9 or a-z or A-Z, \_ or -) characters. Additionally, name should be limited from 3 to 128 character length for the assignment to VM/VMSS to work properly. For more information, see [FAQs and known issues](known-issues.md) ```azurepowershell-interactive New-AzUserAssignedIdentity -ResourceGroupName <RESOURCEGROUP> -Name <USER ASSIGNED IDENTITY NAME> |
| active-directory | Qs Configure Powershell Windows Vmss | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-powershell-windows-vmss.md | In this article, using PowerShell, you learn how to perform the managed identiti - [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role to assign and remove a user-assigned managed identity from and to a virtual machine scale set. - To run the example scripts, you have two options:- - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top right corner of code blocks. + - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top-right corner of code blocks. - Run scripts locally by installing the latest version of [Azure PowerShell](/powershell/azure/install-az-ps), then sign in to Azure using `Connect-AzAccount`. ## System-assigned managed identity |
| active-directory | Qs Configure Rest Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-rest-vm.md | In this section, you learn how to enable and disable system-assigned managed ide ### Enable system-assigned managed identity during creation of an Azure VM -To create an Azure VM with the system-assigned managed identity enabled, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To create an Azure VM with the system-assigned managed identity enabled, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Create a [resource group](../../azure-resource-manager/management/overview.md#terminology) for containment and deployment of your VM and its related resources, using [az group create](/cli/azure/group/#az_group_create). You can skip this step if you already have resource group you would like to use instead: To create an Azure VM with the system-assigned managed identity enabled, your ac ### Enable system-assigned identity on an existing Azure VM -To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To enable system-assigned managed identity on a VM that was originally provisioned without it, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity. To enable system-assigned managed identity on a VM that was originally provision ### Disable system-assigned managed identity from an Azure VM -To disable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To disable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity. In this section, you learn how to add and remove user-assigned managed identity ### Assign a user-assigned managed identity during the creation of an Azure VM -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity. To assign a user-assigned identity to a VM, your account needs the [Virtual Mach ### Assign a user-assigned managed identity to an existing Azure VM -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. Retrieve a Bearer access token, which you will use in the next step in the Authorization header to create your VM with a system-assigned managed identity. PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroup For information on how to create, list, or delete user-assigned managed identities using REST see: -- [Create, list or delete a user-assigned managed identities using REST API calls](how-to-manage-ua-identity-rest.md)+- [Create, list, or delete a user-assigned managed identities using REST API calls](how-to-manage-ua-identity-rest.md) |
| active-directory | Qs Configure Rest Vmss | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-rest-vmss.md | Title: Configure managed identities on Azure virtual machine scale set using REST - Azure AD -description: Step by step instructions for configuring a system and user-assigned managed identities on an Azure virtual machine scale set using CURL to make REST API calls. +description: Step-by-step instructions for configuring a system and user-assigned managed identities on an Azure virtual machine scale set using CURL to make REST API calls. documentationcenter: -Managed identities for Azure resources provides Azure services with an automatically managed system identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. +Managed identities for Azure resources provide Azure services with an automatically managed system identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. In this article, using CURL to make calls to the Azure Resource Manager REST endpoint, you learn how to perform the following managed identities for Azure resources operations on a virtual machine scale set: PATCH https://management.azure.com/subscriptions/<SUBSCRIPTION ID>/resourceGroup For information on how to create, list, or delete user-assigned managed identities using REST see: -- [Create, list or delete a user-assigned managed identity using REST API calls](how-to-manage-ua-identity-rest.md)+- [Create, list, or delete a user-assigned managed identity using REST API calls](how-to-manage-ua-identity-rest.md) |
| active-directory | Qs Configure Sdk Windows Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-sdk-windows-vm.md | Title: Use a SDK to configure managed identities on a VM - Azure AD -description: Step by step instructions for configuring and using managed identities for Azure resources on an Azure VM, using an Azure SDK. +description: Step-by-step instructions for configuring and using managed identities for Azure resources on an Azure VM, using an Azure SDK. documentationcenter: '' -Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory (AD). You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. +Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory (AD). You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. In this article, you learn how to enable and remove managed identities for Azure resources for an Azure VM, using an Azure SDK. In this article, you learn how to enable and remove managed identities for Azure ## Azure SDKs with managed identities for Azure resources support -Azure supports multiple programming platforms through a series of [Azure SDKs](https://azure.microsoft.com/downloads). Several of them have been updated to support managed identities for Azure resources, and provide corresponding samples to demonstrate usage. This list is updated as additional support is added: +Azure supports multiple programming platforms through a series of [Azure SDKs](https://azure.microsoft.com/downloads). Several of them have been updated to support managed identities for Azure resources, and provide corresponding samples to demonstrate usage. This list is updated as other support is added: | SDK | Sample | | | | |
| active-directory | Qs Configure Template Windows Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-template-windows-vm.md | In this article, using the Azure Resource Manager deployment template, you learn ## Azure Resource Manager templates -As with the Azure portal and scripting, [Azure Resource Manager](../../azure-resource-manager/management/overview.md) templates provide the ability to deploy new or modified resources defined by an Azure resource group. Several options are available for template editing and deployment, both local and portal-based, including: +As with the Azure portal and scripting, [Azure Resource Manager](../../azure-resource-manager/management/overview.md) templates allow you to deploy new or modified resources defined by an Azure resource group. Several options are available for template editing and deployment, both local and portal-based, including: - Using a [custom template from the Azure Marketplace](../../azure-resource-manager/templates/deploy-portal.md#deploy-resources-from-custom-template), which allows you to create a template from scratch, or base it on an existing common or [quickstart template](https://azure.microsoft.com/resources/templates/). - Deriving from an existing resource group, by exporting a template from either [the original deployment](../../azure-resource-manager/templates/export-template-portal.md), or from the [current state of the deployment](../../azure-resource-manager/templates/export-template-portal.md). In this section, you will enable and disable a system-assigned managed identity ### Enable system-assigned managed identity during creation of an Azure VM or on an existing VM -To enable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To enable system-assigned managed identity on a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Whether you sign in to Azure locally or via the Azure portal, use an account that is associated with the Azure subscription that contains the VM. After you enable a system-assigned managed identity on your VM, you may want to ### Disable a system-assigned managed identity from an Azure VM -To remove system-assigned managed identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To remove system-assigned managed identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Whether you sign in to Azure locally or via the Azure portal, use an account that is associated with the Azure subscription that contains the VM. In this section, you assign a user-assigned managed identity to an Azure VM usin ### Assign a user-assigned managed identity to an Azure VM -To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No additional Azure AD directory role assignments are required. +To assign a user-assigned identity to a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) and [Managed Identity Operator](../../role-based-access-control/built-in-roles.md#managed-identity-operator) role assignments. No other Azure AD directory role assignments are required. 1. Under the `resources` element, add the following entry to assign a user-assigned managed identity to your VM. Be sure to replace `<USERASSIGNEDIDENTITY>` with the name of the user-assigned managed identity you created. To assign a user-assigned identity to a VM, your account needs the [Virtual Mach ### Remove a user-assigned managed identity from an Azure VM -To remove a user-assigned identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No additional Azure AD directory role assignments are required. +To remove a user-assigned identity from a VM, your account needs the [Virtual Machine Contributor](../../role-based-access-control/built-in-roles.md#virtual-machine-contributor) role assignment. No other Azure AD directory role assignments are required. 1. Whether you sign in to Azure locally or via the Azure portal, use an account that is associated with the Azure subscription that contains the VM. 2. Load the template into an [editor](#azure-resource-manager-templates) and locate the `Microsoft.Compute/virtualMachines` resource of interest within the `resources` section. If you have a VM that only has user-assigned managed identity, you can disable it by changing the identity type to `None`. - The following example shows you how remove all user-assigned managed identities from a VM with no system-assigned managed identities: + The following example shows you how to remove all user-assigned managed identities from a VM with no system-assigned managed identities: ```json { |
| active-directory | Qs Configure Template Windows Vmss | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/qs-configure-template-windows-vmss.md | In this section, you will enable and disable the system-assigned managed identit } ``` -4. When you're done, the following sections should added to the resource section of your template and should resemble the following: +4. When you're done, the following sections should added to the resource section of your template and should resemble the example shown below: ```json "resources": [ |
| active-directory | Services Azure Active Directory Support | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/services-azure-active-directory-support.md | description: List of services that support Azure AD authentication Previously updated : 12/08/2021 Last updated : 01/10/2022 |
| active-directory | Services Support Managed Identities | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/services-support-managed-identities.md | +> [!IMPORTANT] +> In the interest of ensuring new features are documented no later than their release, this page may include documentation for features that may not yet be publicly available. + > [!NOTE] > Managed identities for Azure resources is the new name for the service formerly known as Managed Service Identity (MSI). + ## Azure services that support managed identities for Azure resources The following Azure services support managed identities for Azure resources: |
| active-directory | Tutorial Linux Vm Access Arm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-arm.md | |
| active-directory | Tutorial Linux Vm Access Datalake | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-datalake.md | |
| active-directory | Tutorial Linux Vm Access Nonaad | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-nonaad.md | First, we need to create a Key Vault and grant our VM's system-assigned managed ### Create a secret -Next, add a secret to the Key Vault, so you can retrieve it later using code running in your VM. For the purpose of this tutorial, we are using PowerShell but the same concepts apply to any code executing in this virtual machine. +Next, add a secret to the Key Vault, so you can retrieve it later using code running in your VM. In this tutorial, we are using PowerShell but the same concepts apply to any code executing in this virtual machine. 1. Navigate to your newly created Key Vault. 1. Select **Secrets**, and click **Add**. To complete these steps, you need an SSH client.  If you are using Windows, you 1. In the portal, navigate to your Linux VM and in the **Overview**, click **Connect**.  2. **Connect** to the VM with the SSH client of your choice. -3. In the terminal window, using CURL, make a request to the local managed identities for Azure resources endpoint to get an access token for Azure Key Vault.   +3. In the terminal window, use CURL to make a request to the local managed identities for Azure resources endpoint to get an access token for Azure Key Vault.     The CURL request for the access token is below.   |
| active-directory | Tutorial Linux Vm Access Storage Access Key | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-storage-access-key.md | If you don't already have one, you will now create a storage account. You can a 1. Click the **+/Create new service** button found on the upper left-hand corner of the Azure portal. 2. Click **Storage**, then **Storage Account**, and a new "Create storage account" panel will display. 3. Enter a **Name** for the storage account, which you will use later. -4. **Deployment model** and **Account kind** should be set to "Resource manager" and "General purpose", respectively. +4. **Deployment model** and **Account kind** should be set to "Resource Manager" and "General purpose", respectively. 5. Ensure the **Subscription** and **Resource Group** match the ones you specified when you created your VM in the previous step. 6. Click **Create**. The CURL response gives you the list of Keys: ```bash {"keys":[{"keyName":"key1","permissions":"Full","value":"iqDPNt..."},{"keyName":"key2","permissions":"Full","value":"U+uI0B..."}]} ```-Create a sample blob file to upload to your blob storage container. On a Linux VM you can do this with the following command. +Create a sample blob file to upload to your blob storage container. On a Linux VM, you can do this with the following command. ```bash echo "This is a test file." > test.txt |
| active-directory | Tutorial Linux Vm Access Storage Sas | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-storage-sas.md | If you don't already have one, you will now create a storage account. You can a 1. Click the **+/Create new service** button found on the upper left-hand corner of the Azure portal. 2. Click **Storage**, then **Storage Account**, and a new "Create storage account" panel will display. 3. Enter a **Name** for the storage account, which you will use later. -4. **Deployment model** and **Account kind** should be set to "Resource manager" and "General purpose", respectively. +4. **Deployment model** and **Account kind** should be set to "Resource Manager" and "General purpose", respectively. 5. Ensure the **Subscription** and **Resource Group** match the ones you specified when you created your VM in the previous step. 6. Click **Create**. The CURL response returns the SAS credential: {"serviceSasToken":"sv=2015-04-05&sr=c&spr=https&st=2017-09-22T00%3A10%3A00Z&se=2017-09-22T02%3A00%3A00Z&sp=rcw&sig=QcVwljccgWcNMbe9roAJbD8J5oEkYoq%2F0cUPlgriBn0%3D"} ``` -Create a sample blob file to upload to your blob storage container. On a Linux VM you can do this with the following command. +Create a sample blob file to upload to your blob storage container. On a Linux VM, you can do this with the following command. ```bash echo "This is a test file." > test.txt |
| active-directory | Tutorial Linux Vm Access Storage | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-linux-vm-access-storage.md | This tutorial shows you how to use a system-assigned managed identity for a Linu To run the CLI script examples in this tutorial, you have two options: -- Use [Azure Cloud Shell](~/articles/cloud-shell/overview.md) either from the Azure portal, or via the **Try It** button, located in the top right corner of each code block.+- Use [Azure Cloud Shell](~/articles/cloud-shell/overview.md) either from the Azure portal, or via the **Try It** button, located in the top-right corner of each code block. - [Install the latest version of CLI 2.0](/cli/azure/install-azure-cli) (2.0.23 or later) if you prefer to use a local CLI console. ## Create a storage account Files require blob storage so you need to create a blob container in which to st 1. Navigate back to your newly created storage account. 2. Under **Blob Service**, click **Containers**. 3. Click **+ Container** on the top of the page.-4. Under **New container**, enter a name for the container and under **Public access level** keep the default value . +4. Under **New container**, enter a name for the container and under **Public access level** keep the default value.  To complete the following steps, you need to work from the VM created earlier an 1. In the Azure portal, navigate to **Virtual Machines**, go to your Linux virtual machine, then from the **Overview** page click **Connect**. Copy the string to connect to your VM. 2. **Connect** to the VM with the SSH client of your choice. -3. In the terminal window, using CURL, make a request to the local Managed Identity endpoint to get an access token for Azure Storage. +3. In the terminal window, use CURL to make a request to the local Managed Identity endpoint to get an access token for Azure Storage. ```bash curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fstorage.azure.com%2F' -H Metadata:true |
| active-directory | Tutorial Vm Managed Identities Cosmos | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-vm-managed-identities-cosmos.md | To use the sample below, you need to have the following NuGet packages: - Microsoft.Azure.Cosmos - Microsoft.Azure.Management.CosmosDB -In addition to the NuGet packages above you also need to enable **Include prerelease** and then add **Azure.ResourceManager.CosmosDB**. +In addition to the NuGet packages above, you also need to enable **Include prerelease** and then add **Azure.ResourceManager.CosmosDB**. ```csharp using Azure.Identity; |
| active-directory | Tutorial Vm Windows Access Storage | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-vm-windows-access-storage.md | |
| active-directory | Tutorial Windows Vm Access Arm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm.md | |
| active-directory | Tutorial Windows Vm Access Cosmos Db | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-cosmos-db.md | |
| active-directory | Tutorial Windows Vm Access Datalake | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-datalake.md | |
| active-directory | Tutorial Windows Vm Access Nonaad | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad.md | First, we need to create a Key Vault and grant our VMΓÇÖs system-assigned manage ### Create a secret -Next, add a secret to the Key Vault, so you can retrieve it later using code running in your VM. For the purpose of this tutorial, we are using PowerShell but the same concepts apply to any code executing in this virtual machine. +Next, add a secret to the Key Vault, so you can retrieve it later using code running in your VM. In this tutorial, we are using PowerShell but the same concepts apply to any code executing in this virtual machine. 1. Navigate to your newly created Key Vault. 1. Select **Secrets**, and click **Add**. |
| active-directory | Tutorial Windows Vm Access Sql | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql.md | This section shows how to create a contained user in the database that represent - [Universal Authentication with SQL Database and Azure Synapse Analytics (SSMS support for MFA)](../../azure-sql/database/authentication-mfa-ssms-overview.md) - [Configure and manage Azure Active Directory authentication with SQL Database or Azure Synapse Analytics](../../azure-sql/database/authentication-aad-configure.md) -SQL DB requires unique AAD display names. With this, the AAD accounts such as users, groups and Service Principals (applications), and VM names enabled for managed identity must be uniquely defined in AAD regarding their display names. SQL DB checks the AAD display name during T-SQL creation of such users and if it is not unique, the command fails requesting to provide a unique AAD display name for a given account. +SQL DB requires unique Azure AD display names. With this, the Azure AD accounts such as users, groups and Service Principals (applications), and VM names enabled for managed identity must be uniquely defined in AAD regarding their display names. SQL DB checks the Azure AD display name during T-SQL creation of such users and if it is not unique, the command fails requesting to provide a unique Azure AD display name for a given account. **To create a contained user:** if (accessToken != null) { >[!NOTE] >You can use managed identities while working with other programming options using our [SDKs](qs-configure-sdk-windows-vm.md). -Alternatively, a quick way to test the end to end setup without having to write and deploy an app on the VM is using PowerShell. +Alternatively, a quick way to test the end-to-end setup without having to write and deploy an app on the VM is using PowerShell. 1. In the portal, navigate to **Virtual Machines** and go to your Windows virtual machine and in the **Overview**, click **Connect**. 2. Enter in your **Username** and **Password** for which you added when you created the Windows VM. Alternatively, a quick way to test the end to end setup without having to write $SqlConnection.Open() ``` - Next, create and send a query to the server. Remember to replace the value for TABLE. + Next, create, and send a query to the server. Remember to replace the value for TABLE. ```powershell $SqlCmd = New-Object System.Data.SqlClient.SqlCommand |
| active-directory | Tutorial Windows Vm Access Storage Sas | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-storage-sas.md | Context : Microsoft.WindowsAzure.Commands.Storage.AzureStorageContext Name : testblob ``` -You can also download the blob you just uploaded, using the `Get-AzStorageBlobContent` PowerShell cmdlet: +You can also download the blob you uploaded, using the `Get-AzStorageBlobContent` PowerShell cmdlet: ```powershell Get-AzStorageBlobContent -Blob testblob -Container <CONTAINER-NAME> -Destination test2.txt -Context $ctx |
| active-directory | Tutorial Windows Vm Ua Arm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/managed-identities-azure-resources/tutorial-windows-vm-ua-arm.md | You learn how to: - To perform the required resource creation and role management steps in this tutorial, your account needs "Owner" permissions at the appropriate scope (your subscription or resource group). If you need assistance with role assignment, see [Assign Azure roles to manage access to your Azure subscription resources](../../role-based-access-control/role-assignments-portal.md). - To run the example scripts, you have two options:- - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top right corner of code blocks. + - Use the [Azure Cloud Shell](../../cloud-shell/overview.md), which you can open using the **Try It** button on the top-right corner of code blocks. - Run scripts locally with Azure PowerShell, as described in the next section. ### Configure Azure PowerShell locally Update-AzVM -ResourceGroupName TestRG -VM $vm -IdentityType "UserAssigned" -Iden ## Grant access -This section shows how to grant your user-assigned identity access to a Resource Group in Azure Resource Manager. Managed identities for Azure resources provides identities that your code can use to request access tokens to authenticate to resource APIs that support Azure AD authentication. In this tutorial, your code will access the Azure Resource Manager API. +This section shows how to grant your user-assigned identity access to a Resource Group in Azure Resource Manager. Managed identities for Azure resources provide identities that your code can use to request access tokens to authenticate to resource APIs that support Azure AD authentication. In this tutorial, your code will access the Azure Resource Manager API. Before your code can access the API, you need to grant the identity access to a resource in Azure Resource Manager. In this case, the Resource Group in which the VM is contained. Update the value for `<SUBSCRIPTION ID>` as appropriate for your environment. For the remainder of the tutorial, you will work from the VM we created earlier. ### Read properties -Use the access token retrieved in the previous step to access Azure Resource Manager, and read the properties of the Resource Group you granted your user-assigned identity access. Replace `<SUBSCRIPTION ID>` with the subscription id of your environment. +Use the access token retrieved in the previous step to access Azure Resource Manager, and read the properties of the Resource Group you granted your user-assigned identity access. Replace `<SUBSCRIPTION ID>` with the subscription ID of your environment. ```azurepowershell (Invoke-WebRequest -Uri https://management.azure.com/subscriptions/80c696ff-5efa-4909-a64d-f1b616f423ca/resourceGroups/myResourceGroupVM?api-version=2016-06-01 -Method GET -ContentType "application/json" -Headers @{Authorization ="Bearer $ArmToken"}).content |
| active-directory | Admin Units Members List | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/roles/admin-units-members-list.md | Use the [Get-AzureADMSAdministrativeUnit](/powershell/module/azuread/get-azuread ```powershell $userObj = Get-AzureADUser -Filter "UserPrincipalName eq 'bill@example.com'"-Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.ObjectId | where {$_.RefObjectId -eq $userObj.ObjectId} } +Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where {$_.Id -eq $userObj.ObjectId} } ``` ### List the administrative units for a group ```powershell $groupObj = Get-AzureADGroup -Filter "displayname eq 'TestGroup'"-Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -ObjectId $_.ObjectId | where {$_.ObjectId -eq $groupObj.ObjectId} } +Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where {$_.Id -eq $groupObj.ObjectId} } ``` ### List the users and groups for an administrative unit Get-AzureADMSAdministrativeUnitMember -Id $adminUnitObj.Id $adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'" foreach ($member in (Get-AzureADMSAdministrativeUnitMember -Id $adminUnitObj.Id)) {- if($member.ObjectType -eq "Group") + if($member.OdataType -eq "#microsoft.graph.group") {- Get-AzureADGroup -ObjectId $member.ObjectId + Get-AzureADGroup -ObjectId $member.Id } } ``` |
| active-directory | Confluencemicrosoft Tutorial | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/saas-apps/confluencemicrosoft-tutorial.md | As of now, following versions of Confluence are supported: - Confluence: 5.0 to 5.10 - Confluence: 6.0.1 to 6.15.9-- Confluence: 7.0.1 to 7.10.0+- Confluence: 7.0.1 to 7.15.0 > [!NOTE] > Please note that our Confluence Plugin also works on Ubuntu Version 16.04 |
| active-directory | Jiramicrosoft Tutorial | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/active-directory/saas-apps/jiramicrosoft-tutorial.md | Use your Microsoft Azure Active Directory account with Atlassian JIRA server to To configure Azure AD integration with JIRA SAML SSO by Microsoft, you need the following items: - An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).-- JIRA Core and Software 6.4 to 8.17.1 or JIRA Service Desk 3.0 to 4.16.1 should installed and configured on Windows 64-bit version+- JIRA Core and Software 6.4 to 8.21 or JIRA Service Desk 3.0 to 4.21.0 should installed and configured on Windows 64-bit version - JIRA server is HTTPS enabled - Note the supported versions for JIRA Plugin are mentioned in below section. - JIRA server is reachable on the Internet particularly to the Azure AD login page for authentication and should able to receive the token from Azure AD To get started, you need the following items: ## Supported versions of JIRA -* JIRA Core and Software: 6.4 to 8.17.1 -* JIRA Service Desk 3.0 to 4.16.1 +* JIRA Core and Software: 6.4 to 8.21 +* JIRA Service Desk 3.0 to 4.21.0 * JIRA also supports 5.2. For more details, click [Microsoft Azure Active Directory single sign-on for JIRA 5.2](jira52microsoft-tutorial.md) > [!NOTE] |
| aks | Concepts Identity | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/aks/concepts-identity.md | The following permissions are used by the AKS cluster identity, which is created > | `Microsoft.Compute/virtualMachineScaleSets/read` <br/> `Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read` <br/> `Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read` | Required to find information for virtual machines in a virtual machine scale set, such as zones, fault domain, size, and data disks. | > | `Microsoft.Network/networkInterfaces/write` | Required to add a virtual machine in a VMAS to a load balancer backend address pool. | > | `Microsoft.Compute/virtualMachineScaleSets/write` | Required to add a virtual machine scale set to a load balancer backend address pools and scale out nodes in a virtual machine scale set. |+> | `Microsoft.Compute/virtualMachineScaleSets/delete` | Required to delete a virtual machine scale set to a load balancer backend address pools and scale down nodes in a virtual machine scale set. | > | `Microsoft.Compute/virtualMachineScaleSets/virtualmachines/write` | Required to attach AzureDisks and add a virtual machine from a virtual machine scale set to the load balancer. | > | `Microsoft.Network/networkInterfaces/read` | Required to search internal IPs and load balancer backend address pools for virtual machines in a VMAS. | > | `Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read` | Required to search internal IPs and load balancer backend address pools for a virtual machine in a virtual machine scale set. | |
| api-management | Api Management Howto Add Products | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/api-management/api-management-howto-add-products.md | description: In this tutorial, you create and publish a product in Azure API Man Previously updated : 02/09/2021 Last updated : 12/15/2021 + -# Tutorial: Create and publish a product +# Tutorial: Create and publish a product -In Azure API Management, a [*product*](api-management-terminology.md#term-definitions) contains one or more APIs as well as a usage quota and the terms of use. Once a product is published, developers can subscribe to the product and begin to use the product's APIs. +In Azure API Management, a [*product*](api-management-terminology.md#term-definitions) contains one or more APIs, a usage quota, and the terms of use. After a product is published, developers can subscribe to the product and begin to use the product's APIs. In this tutorial, you learn how to: In this tutorial, you learn how to: > * Create and publish a product > * Add an API to the product ## Prerequisites In this tutorial, you learn how to: ### [Portal](#tab/azure-portal) 1. Sign in to the Azure portal, and navigate to your API Management instance.-1. In the left navigation, select **Products** > **+ Add**. -1. In the **Add product** window, enter values described in the following table to create your product. +1. In the left navigation pane, select **Products** > **+ Add**. - :::image type="content" source="media/api-management-howto-add-products/02-create-publish-product-01.png" alt-text="Add product in portal"::: + :::image type="content" source="media/api-management-howto-add-products/add-product-portal.png" alt-text="Add product in Azure portal"::: ++1. In the **Add product** window, enter values described in the following table to create your product. ++ :::image type="content" source="media/api-management-howto-add-products/add-product.png" alt-text="Add product window"::: | Name | Description | |--|-| | Display name | The name as you want it to be shown in the [developer portal](api-management-howto-developer-portal.md). | | Description | Provide information about the product such as its purpose, the APIs it provides access to, and other details. |- | State | Select **Published** if you want to publish the product. Before the APIs in a product can be called, the product must be published. By default, new products are unpublished, and are visible only to the **Administrators** group. | + | Published | Select **Published** if you want to publish the product. Before the APIs in a product can be called, the product must be published. By default, new products are unpublished, and are visible only to the **Administrators** group. | | Requires subscription | Select if a user is required to subscribe to use the product. | | Requires approval | Select if you want an administrator to review and accept or reject subscription attempts to this product. If not selected, subscription attempts are auto-approved. |- | Subscription count limit | Optionally limit the count of multiple simultaneous subscriptions. | - | Legal terms | You can include the terms of use for the product which subscribers must accept in order to use the product. | + | Subscription count limit | Optionally, limit the count of multiple simultaneous subscriptions. | + | Legal terms | You can include the terms of use for the product, which subscribers must accept to use the product. | | APIs | Select one or more APIs. You can also add APIs after creating the product. For more information, see [Add APIs to a product](#add-apis-to-a-product) later in this article. | -3. Select **Create** to create the new product. +1. Select **Create** to create your new product. ### [Azure CLI](#tab/azure-cli) You can specify various values for your product: | `--state` | Select **published** if you want to publish the product. Before the APIs in a product can be called, the product must be published. By default, new products are unpublished, and are visible only to the **Administrators** group. | | `--subscription-required` | Select if a user is required to subscribe to use the product. | | `--approval-required` | Select if you want an administrator to review and accept or reject subscription attempts to this product. If not selected, subscription attempts are auto-approved. |- | `--subscriptions-limit` | Optionally limit the count of multiple simultaneous subscriptions.| - | `--legal-terms` | You can include the terms of use for the product which subscribers must accept in order to use the product. | + | `--subscriptions-limit` | Optionally, limit the count of multiple simultaneous subscriptions.| + | `--legal-terms` | You can include the terms of use for the product, which subscribers must accept to use the product. | To see your current products, use the [az apim product list](/cli/azure/apim/product#az_apim_product_list) command: Continue configuring the product after saving it. In your API Management instanc ## Add APIs to a product -Products are associations of one or more APIs. You can include a number of APIs and offer them to developers through the developer portal. During the product creation, you can add one or more existing APIs. You can also add APIs to the product later, either from the Products **Settings** page or while creating an API. +Products are associations of one or more APIs. You can include many APIs and offer them to developers through the developer portal. During the product creation, you can add one or more existing APIs. You can also add APIs to the product later, either from the Products **Settings** page or while creating an API. -Developers must first subscribe to a product to get access to the API. When they subscribe, they get a subscription key that is good for any API in that product. If you created the APIM instance, you are an administrator already, so you are subscribed to every product by default. +Developers must first subscribe to a product to get access to the API. When they subscribe, they get a subscription key that is good for any API in that product. If you created the API Management instance, you're an administrator already, so you're subscribed to every product by default. ### Add an API to an existing product ### [Portal](#tab/azure-portal) 1. In the left navigation of your API Management instance, select **Products**.-1. Select a product, then select **APIs**. -1. Select **+ Add**. -1. Select one or more APIs and then **Select**. +1. Select a product, and then select **APIs**. +1. Select **+ Add API**. +1. Select one or more APIs, and then **Select**. ### [Azure CLI](#tab/azure-cli) |
| api-management | Get Started Create Service Instance | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/api-management/get-started-create-service-instance.md | description: Create a new Azure API Management service instance by using the Azu - Previously updated : 09/08/2020+ Last updated : 12/10/2021 This quickstart describes the steps for creating a new API Management instance u [!INCLUDE [quickstarts-free-trial-note](../../includes/quickstarts-free-trial-note.md)] ## Sign in to Azure Sign in to the [Azure portal](https://portal.azure.com). ## Create a new service -1. From the Azure portal menu, select **Create a resource**. You can also select **Create a resource** on the Azure **Home** page. +1. From the Azure portal menu, select **Create a resource**. You can also select **Create a resource** on the Azure **Home** page. - :::image type="content" source="media/get-started-create-service-instance/00-CreateResource-01.png" alt-text="Select Create a resource"::: + :::image type="content" source="media/get-started-create-service-instance/create-resource.png" alt-text="Select Create a resource."::: -1. On the **New** page, select **Integration** > **API Management**. +1. On the **Create a resource** page, select **Integration** > **API Management**. - :::image type="content" source="media/get-started-create-service-instance/00-CreateResource-02.png" alt-text="New Azure API Management instance"::: + :::image type="content" source="media/get-started-create-service-instance/create-resource-page.png" alt-text="Screenshot of New Azure API Management instance."::: -1. In the **API Management service** page, enter settings. +1. In the **Create API Management** page, enter settings. - :::image type="content" source="media/get-started-create-service-instance/get-started-create-service-instance-create-new.png" alt-text="New instance"::: + :::image type="content" source="media/get-started-create-service-instance/create-api-management-instance-1.png" alt-text="Create API Management instance."::: | Setting | Description | |-|--|- | **Name** | A unique name for your API Management service. The name can't be changed later. The service name refers to both the service and the corresponding Azure resource. <br/> The service name is used to generate a default domain name: *\<name\>.azure-api.net.* If you would like to use a custom domain name, see [Configure a custom domain](configure-custom-domain.md). | | **Subscription** | The subscription under which this new service instance will be created. | | **Resource group** | Select a new or existing resource group. A resource group is a logical container into which Azure resources are deployed and managed. |- | **Location** | Select a geographic region near you from the available API Management service locations. | - | **Organization name** | The name of your organization. This name is used in a number of places, including the title of the developer portal and sender of notification emails. | + | **Region** | Select a geographic region near you from the available API Management service locations. | + | **Resource name** | A unique name for your API Management service. The name can't be changed later. The service name refers to both the service and the corresponding Azure resource. <br/> The service name is used to generate a default domain name: *\<name\>.azure-api.net.* If you would like to configure a custom domain name later, see [Configure a custom domain](configure-custom-domain.md). | + | **Organization name** | The name of your organization. This name is used in many places, including the title of the developer portal and sender of notification emails. | | **Administrator email** | The email address to which all the notifications from **API Management** will be sent. | | **Pricing tier** | Select **Developer** tier to evaluate the service. This tier isn't for production use. For more information about scaling the API Management tiers, see [upgrade and scale](upgrade-and-scale.md). | -3. Select **Create**. +1. Select **Review + create**. > [!TIP]- > It can take between 30 and 40 minutes to create and activate an API Management service in this tier. Selecting **Pin to dashboard** makes finding a newly created service easier. + > It can take 30 to 40 minutes to create and activate an API Management service in this tier. To quickly find a newly created service, select **Pin to dashboard**. [!INCLUDE [api-management-navigate-to-instance](../../includes/api-management-navigate-to-instance.md)] Review the properties of your service on the **Overview** page. - :::image type="content" source="media/get-started-create-service-instance/get-started-create-service-instance-created.png" alt-text="API Management instance"::: + :::image type="content" source="media/get-started-create-service-instance/get-started-create-service-instance-created-1.png" alt-text="API Management instance."::: When your API Management service instance is online, you're ready to use it. Start with the tutorial to [import and publish your first API](import-and-publish.md). ## Clean up resources -When no longer needed, you can remove the resource group and all related resources by following these steps: +When no longer needed, you can remove the resource group and all the related resources by following these steps: 1. In the Azure portal, search for and select **Resource groups**. You can also select **Resource groups** on the **Home** page. - :::image type="content" source="media/get-started-create-service-instance/00-DeleteResource-01.png" alt-text="Resource group navigation"::: + :::image type="content" source="media/get-started-create-service-instance/resource-groups.png" alt-text="Resource group navigation."::: 1. On the **Resource groups** page, select your resource group. - :::image type="content" source="media/get-started-create-service-instance/00-DeleteResource-02.png" alt-text="Select resource group"::: + :::image type="content" source="media/get-started-create-service-instance/resource-group-page.png" alt-text="Select your resource group."::: -1. On the resource group page, select **Delete resource group**. +1. On the resource group page, select **Delete resource group**. 1. Type the name of your resource group, and then select **Delete**. - :::image type="content" source="media/get-started-create-service-instance/00-DeleteResource-03.png" alt-text="Delete resource group"::: + :::image type="content" source="media/get-started-create-service-instance/delete-resource-group.png" alt-text="Delete resource group."::: ## Next steps |
| api-management | Mock Api Responses | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/api-management/mock-api-responses.md | Title: Tutorial - Mock API responses in API Management - Azure portal | Microsoft Docs -description: In this tutorial, you use API Management to set a policy on an API so it returns a mocked response if the backend is not available to send real responses. +description: In this tutorial, you use API Management to set a policy on an API. The policy returns a mocked response even if the backend isn't available to send real responses. -+ Previously updated : 02/09/2021 Last updated : 12/17/2021 # Tutorial: Mock API responses -Backend APIs can be imported into an API Management (APIM) API or created and managed manually. The steps in this tutorial show you how to use APIM to create a blank API and manage it manually, then set a policy on an API so it returns a mocked response. This method enables developers to proceed with implementation and testing of the APIM instance even if the backend is not available to send real responses. +Backend APIs are imported into an API Management (APIM) API or created and managed manually. The steps in this tutorial, show you how to: -The ability to mock up responses can be useful in a number of scenarios: ++ Use API Management to create a blank HTTP API++ Manage an HTTP API manually++ Set a policy on an API so it returns a mocked response++This method lets developers continue with the implementation and testing of the API Management instance even if the backend isn't available to send real responses. ++The ability to mock up responses is useful in many scenarios: + When the API façade is designed first and the backend implementation comes later. Or, the backend is being developed in parallel. + When the backend is temporarily not operational or not able to scale. The ability to mock up responses can be useful in a number of scenarios: In this tutorial, you learn how to: > [!div class="checklist"]-> * Create a test API +> * Create a test API > * Add an operation to the test API > * Enable response mocking > * Test the mocked API - ## Prerequisites In this tutorial, you learn how to: + Understand the [concept of policies in Azure API Management](api-management-howto-policies.md). + Complete the following quickstart: [Create an Azure API Management instance](get-started-create-service-instance.md). -## Create a test API +## Create a test API ++The steps in this section show how to create an HTTP API with no backend. -The steps in this section show how to create a blank API with no backend. +1. Sign in to the Azure portal, and then navigate to your API Management instance. +1. Select **APIs** > **+ Add API** > **HTTP** tile. + :::image type="content" source="media/mock-api-responses/http-api.png" alt-text="Define a HTTP API"::: -1. Sign in to the Azure portal, and navigate to your API Management instance. -1. Select **APIs** > **+ Add API** > **Blank API**. -1. In the **Create a Blank API** window, select **Full**. +1. In the **Create an HTTP API** window, select **Full**. 1. Enter *Test API* for **Display name**. 1. Select **Unlimited** for **Products**.-1. Ensure **Managed** is selected in **Gateways**. +1. Ensure that **Managed** is selected for **Gateways**. 1. Select **Create**. - :::image type="content" source="media/mock-api-responses/03-mock-api-responses-01-create-test-api.png" alt-text="Create blank API"::: + :::image type="content" source="media/mock-api-responses/create-http-api.png" alt-text="Create an HTTP API"::: ## Add an operation to the test API -An API exposes one or more operations. In this section, add an operation to the blank API you created. Calling the operation after completing steps in this section produces an error. You will get no errors after you complete steps later in the [Enable response mocking](#enable-response-mocking) section. +An API exposes one or more operations. In this section, you'll add an operation to the HTTP API you created. Calling the operation after completing the steps in this section triggers an error. After you complete the steps in the [Enable response mocking](#enable-response-mocking) section, you'll get no errors. ### [Portal](#tab/azure-portal) An API exposes one or more operations. In this section, add an operation to the 1. Select **+ Add Operation**. 1. In the **Frontend** window, enter the following values. + :::image type="content" source="media/mock-api-responses/frontend-window.png" alt-text="Frontend window"::: + | Setting | Value | Description | ||--|--| | **Display name** | *Test call* | The name that is displayed in the [developer portal](api-management-howto-developer-portal.md). | | **URL** (HTTP verb) | GET | Select one of the predefined HTTP verbs. | | **URL** | */test* | A URL path for the API. | | **Description** | | Optional description of the operation, used to provide documentation in the developer portal to the developers using this API. |- + 1. Select the **Responses** tab, located under the URL, Display name, and Description fields. Enter settings on this tab to define response status codes, content types, examples, and schemas. 1. Select **+ Add response**, and select **200 OK** from the list.++ :::image type="content" source="media/mock-api-responses/add-response.png" alt-text="Add response to the API operation"::: + 1. Under the **Representations** heading on the right, select **+ Add representation**. 1. Enter *application/json* into the search box and select the **application/json** content type. 1. In the **Sample** text box, enter `{ "sampleField" : "test" }`. 1. Select **Save**. --Although not required for this example, additional settings for an API operation can be configured on other tabs, including: + :::image type="content" source="media/mock-api-responses/add-representation.png" alt-text="Add representation to the API operation"::: +Although not required for this example, you can configure more settings for an API operation on other tabs, including: |Tab |Description | |||-|**Query** | Add query parameters. Besides providing a name and description, you can provide values that are assigned to a query parameter. One of the values can be marked as default (optional). | +|**Query** | Add query parameters. Besides providing a name and description, you can also provide values that are assigned to a query parameter. You can mark one of the values as default (optional). | |**Request** | Define request content types, examples, and schemas. | ### [Azure CLI](#tab/azure-cli) Keep this operation for use in the rest of this article. ## Enable response mocking 1. Select the API you created in [Create a test API](#create-a-test-api).-1. Select the test operation that you added. 1. In the window on the right, ensure that the **Design** tab is selected.+1. Select the test operation that you added. 1. In the **Inbound processing** window, select **+ Add policy**. - :::image type="content" source="media/mock-api-responses/03-mock-api-responses-03-enable-mocking.png" alt-text="Add processing policy" border="false"::: + :::image type="content" source="media/mock-api-responses/add-policy.png" alt-text="Add processing policy" border="false"::: 1. Select **Mock responses** from the gallery. Keep this operation for use in the rest of this article. 1. In the **API Management response** textbox, type **200 OK, application/json**. This selection indicates that your API should return the response sample you defined in the previous section. - :::image type="content" source="media/mock-api-responses/mock-api-responses-set-mocking.png" alt-text="Set mocking response"::: + :::image type="content" source="media/mock-api-responses/set-mocking-response.png" alt-text="Set mocking response"::: 1. Select **Save**. > [!TIP]- > A yellow bar with the text **Mocking is enabled** for your API indicates that responses returned from API Management are mocked by the [mocking policy](api-management-advanced-policies.md#mock-response) and are not produced by the backend. + > A yellow bar with the text **Mocking is enabled** displays. This indicates that the responses returned from API Management are mocked by the [mocking policy](api-management-advanced-policies.md#mock-response) and aren't produced by the backend. ## Test the mocked API 1. Select the API you created in [Create a test API](#create-a-test-api). 1. Select the **Test** tab.-1. Ensure the **Test call** API is selected. Select **Send** to make a test call. +1. Ensure that the **Test call** API is selected, and then select **Send** to make a test call. - :::image type="content" source="media/mock-api-responses/03-mock-api-responses-04-test-mocking.png" alt-text="Test the mocked API"::: + :::image type="content" source="media/mock-api-responses/test-mock-api.png" alt-text="Test the mocked API"::: 1. The **HTTP response** displays the JSON provided as a sample in the first section of the tutorial. - :::image type="content" source="media/mock-api-responses/mock-api-responses-test-response.png" alt-text="Mock HTTP response"::: + :::image type="content" source="media/mock-api-responses/http-response.png" alt-text="Mock HTTP response"::: ## Next steps |
| app-service | Configure Language Java | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/app-service/configure-language-java.md | JBoss EAP is only available on the Premium v3 and Isolated v2 App Service Plan t ### JDK versions and maintenance -Azure's supported Java Development Kit (JDK) is [Zulu](https://www.azul.com/downloads/azure-only/zulu/) provided through [Azul Systems](https://www.azul.com/). Azul Zulu Enterprise builds of OpenJDK are a no-cost, multi-platform, production-ready distribution of the OpenJDK for Azure and Azure Stack backed by Microsoft and Azul Systems. They contain all the components for building and running Java SE applications. You can install the JDK from [Java JDK Installation](/azure/developer/java/fundamentals/java-support-on-azure). +Microsoft and Adoptium builds of OpenJDK are provided and supported on App Service for Java 8, 11, and 17. These binaries are provided as a no-cost, multi-platform, production-ready distribution of the OpenJDK for Azure. They contain all the components for building and runnning Java SE applications. For local development or testing, you can install the Microsoft build of OpenJDK from the [downloads page](https://docs.microsoft.com/java/openjdk/download). The table below describes the new Java versions included in the January 2022 App Service platform release: ++| Java Version | Linux | Windows | +|--||-| +| Java 8 | 1.8.0_312 (Zulu) * | 1.8.0_312 (Adoptium) | +| Java 11 | 11.0.13 (MSFT) | 11.0.13 (MSFT) | +| Java 17 | 17.0.1 (MSFT) | 17.0.1 (MSFT) | ++\* In following releases, Java 8 on Linux will be distributed from Adoptium builds of the OpenJDK. ++If you are [pinned](#choosing-a-java-runtime-version) to an older minor version of Java your site may be using the [Zulu for Azure](https://www.azul.com/downloads/azure-only/zulu/) binaries provided through [Azul Systems](https://www.azul.com/). You can continue to use these binaries for your site, but any security patches or improvements will only be available in new versions of the OpenJDK, so we recommend that you periodically update your Web Apps to a later version of Java. Major version updates will be provided through new runtime options in Azure App Service. Customers update to these newer versions of Java by configuring their App Service deployment and are responsible for testing and ensuring the major update meets their needs. Supported JDKs are automatically patched on a quarterly basis in January, April, ### Security updates -Patches and fixes for major security vulnerabilities will be released as soon as they become available from Azul Systems. A "major" vulnerability is defined by a base score of 9.0 or higher on the [NIST Common Vulnerability Scoring System, version 2](https://nvd.nist.gov/vuln-metrics/cvss). +Patches and fixes for major security vulnerabilities will be released as soon as they become available in Microsoft builds of the OpenJDK. A "major" vulnerability is defined by a base score of 9.0 or higher on the [NIST Common Vulnerability Scoring System, version 2](https://nvd.nist.gov/vuln-metrics/cvss). Tomcat 8.0 has reached [End of Life (EOL) as of September 30, 2018](https://tomcat.apache.org/tomcat-80-eol.html). While the runtime is still available on Azure App Service, Azure will not apply security updates to Tomcat 8.0. If possible, migrate your applications to Tomcat 8.5 or 9.0. Both Tomcat 8.5 and 9.0 are available on Azure App Service. See the [official Tomcat site](https://tomcat.apache.org/whichversion.html) for more information. +Community support for Java 7 will terminate on July 29th, 2022 and [Java 7 will be retired from App Service](https://azure.microsoft.com/updates/transition-to-java-11-or-8-by-29-july-2022/) at that time. If you have a web app runnning on Java 7, please upgrade to Java 8 or 11 before July 29th. + ### Deprecation and retirement If a supported Java runtime will be retired, Azure developers using the affected runtime will be given a deprecation notice at least six months before the runtime is retired. +- [Reasons to move to Java 11](https://docs.microsoft.com/java/openjdk/reasons-to-move-to-java-11?toc=/azure/developer/java/fundamentals/toc.json&bc=/azure/developer/breadcrumb/toc.json) +- [Java 7 migration guide](https://docs.microsoft.com/java/openjdk/transition-from-java-7-to-java-8?toc=/azure/developer/java/fundamentals/toc.json&bc=/azure/developer/breadcrumb/toc.json) + ### Local development Developers can download the Production Edition of Azul Zulu Enterprise JDK for local development from [Azul's download site](https://www.azul.com/downloads/azure-only/zulu/). ### Development support -Product support for the [Azure-supported Azul Zulu JDK](https://www.azul.com/downloads/azure-only/zulu/) is available through Microsoft when developing for Azure or [Azure Stack](https://azure.microsoft.com/overview/azure-stack/) with a [qualified Azure support plan](https://azure.microsoft.com/support/plans/). +Product support for the [Microsoft Build of OpenJDK](https://docs.microsoft.com/java/openjdk/download) is available through Microsoft when developing for Azure or [Azure Stack](https://azure.microsoft.com/overview/azure-stack/) with a [qualified Azure support plan](https://azure.microsoft.com/support/plans/). ## Next steps |
| app-service | Scenario Secure App Access Microsoft Graph As App | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/app-service/scenario-secure-app-access-microsoft-graph-as-app.md | public async Task OnGetAsync() return Task.CompletedTask; })); + // MSGraphUser is a DTO class being used to hold User information from the graph service client call List<MSGraphUser> msGraphUsers = new List<MSGraphUser>(); try { |
| application-gateway | Url Route Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/application-gateway/url-route-overview.md | description: This article provides an overview of the Azure Application Gateway Previously updated : 11/18/2021 Last updated : 01/12/2022 The urlPathMap element is used to specify Path patterns to back-end server pool PathPattern is a list of path patterns to match. Each path must start with / and may use \* as a wildcard character. The string fed to the path matcher does not include any text after the first ? or #, and those chars are not allowed here. Otherwise, any characters allowed in a URL are allowed in PathPattern. -The supported patterns depend on whether you deploy Application Gateway v1 or v2: --#### v1 - Path rules are case insensitive. -|v1 path pattern |Is supported? | +|Path pattern |Is supported? | ||| |`/images/*` |yes| |`/images*` |yes| Path rules are case insensitive. |`/Repos/*/Comments/*` |no| |`/CurrentUser/Comments/*` |yes| -#### v2 --Path rules are case insensitive. -|v2 path pattern |Is supported? | -||| -|`/images/*` |yes| -|`/images*` |yes| -|`/images/*.jpg` |no| -|`/*.jpg` |no| -|`/Repos/*/Comments/*` |no| -|`/CurrentUser/Comments/*` |yes| You can check out a [Resource Manager template using URL-based routing](https://azure.microsoft.com/resources/templates/application-gateway-url-path-based-routing) for more information. |
| applied-ai-services | Security How To Update Role Assignment | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/applied-ai-services/immersive-reader/security-how-to-update-role-assignment.md | Any new Immersive Reader resources you create with our script at [How to: Create If you created and configured an Immersive Reader resource using the instructions at [How to: Create an Immersive Reader resource](./how-to-create-immersive-reader.md) prior to February 2022, it is advised that you perform the operation below to update the role assignment permissions on ALL of your Immersive Reader resources. The operation involves running a script to update the role assignment on a single resource. If you have multiple resources, run this script multiple times, once for each resource. -### Set up PowerShell environment +After you have updated the role using the script below, it is also advised that you rotate the subscription keys on your resource. This is in case your keys have been compromised by the exploit above, and somebody is actually using your resource with subscription key authentication without your consent. Rotating the keys will render the previous keys invalid and deny any further access. For customers using Azure AD authentication, which should be everyone per current Immersive Reader SDK implementation, rotating the keys will have no impact on the Immersive Reader service, since Azure AD access tokens are used for authentication, not the subscription key. Rotating the subscription keys is just another precaution. ++You can rotate the subscription keys on the [Azure portal](https://portal.azure.com). Navigate to your resource and then to the `Keys and Endpoint` blade. At the top, there are buttons to `Regenerate Key1` and `Regenerate Key2`. ++++++### Use Azure PowerShell environment to update your Immersive Reader resource Role assignment 1. Start by opening the [Azure Cloud Shell](../../cloud-shell/overview.md). Ensure that Cloud Shell is set to PowerShell in the upper-left hand dropdown or by typing `pwsh`. If you created and configured an Immersive Reader resource using the instruction The full command will look something like the following. Here we have put each parameter on its own line for clarity, so you can see the whole command. Do not copy or use this command as-is. Copy and use the command above with your own values. This example has dummy values for the '<PARAMETER_VALUES>' above. Yours will be different, as you will come up with your own names for these values. - ``` - Update-ImmersiveReaderRoleAssignment - -SubscriptionName 'MyOrganizationSubscriptionName' - -ResourceGroupName 'MyResourceGroupName' - -ResourceName 'MyOrganizationImmersiveReader' - -AADAppIdentifierUri 'https://MyOrganizationImmersiveReaderAADApp' - ``` + ```Update-ImmersiveReaderRoleAssignment```<br> + ``` -SubscriptionName 'MyOrganizationSubscriptionName'```<br> + ``` -ResourceGroupName 'MyResourceGroupName'```<br> + ``` -ResourceName 'MyOrganizationImmersiveReader'```<br> + ``` -AADAppIdentifierUri 'https://MyOrganizationImmersiveReaderAADApp'```<br> | Parameter | Comments | | | | If you created and configured an Immersive Reader resource using the instruction | ResourceName |The name of your Immersive Reader resource. | | AADAppIdentifierUri |The URI for your Azure AD app. | - ``` ## Next steps If you created and configured an Immersive Reader resource using the instruction * View the [Android tutorial](./how-to-launch-immersive-reader.md) to see what else you can do with the Immersive Reader SDK using Java or Kotlin for Android * View the [iOS tutorial](./how-to-launch-immersive-reader.md) to see what else you can do with the Immersive Reader SDK using Swift for iOS * View the [Python tutorial](./how-to-launch-immersive-reader.md) to see what else you can do with the Immersive Reader SDK using Python-* Explore the [Immersive Reader SDK](https://github.com/microsoft/immersive-reader-sdk) and the [Immersive Reader SDK Reference](./reference.md) +* Explore the [Immersive Reader SDK](https://github.com/microsoft/immersive-reader-sdk) and the [Immersive Reader SDK Reference](./reference.md) |
| azure-arc | Agent Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-arc/servers/agent-overview.md | Metadata information about the connected machine is collected after the Connecte * Computer manufacturer and model * Computer fully qualified domain name (FQDN) * Domain name (if joined to an Active Directory domain)-* Connected Machine agent version * Active Directory and DNS fully qualified domain name (FQDN) * UUID (BIOS ID) * Connected Machine agent heartbeat |
| azure-functions | Durable Functions Task Hubs | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-functions/durable/durable-functions-task-hubs.md | A *task hub* in [Durable Functions](durable-functions-overview.md) is a logical If multiple function apps share a storage account, each function app *must* be configured with a separate task hub name. A storage account can contain multiple task hubs. This restriction generally applies to other storage providers as well. +> [!NOTE] +> The exception to the task hub sharing rule is if you are configuring your app for regional disaster recovery. See the [disaster recovery and geo-distribution](durable-functions-disaster-recovery-geo-distribution.md) article for more information. + The following diagram illustrates one task hub per function app in shared and dedicated Azure Storage accounts.  |
| azure-functions | Functions Infrastructure As Code | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-functions/functions-infrastructure-as-code.md | A function app must include these application settings: | AzureWebJobsStorage | A connection string to a storage account that the Functions runtime uses for internal queueing | See [Storage account](#storage) | | FUNCTIONS_EXTENSION_VERSION | The version of the Azure Functions runtime | `~3` | | FUNCTIONS_WORKER_RUNTIME | The language stack to be used for functions in this app | `dotnet`, `node`, `java`, `python`, or `powershell` |-| WEBSITE_NODE_DEFAULT_VERSION | Only needed if using the `node` language stack, specifies the version to use | `10.14.1` | +| WEBSITE_NODE_DEFAULT_VERSION | Only needed if using the `node` language stack, specifies the [version](/azure/azure-functions/functions-reference-node#node-version) to use | `~14` | These properties are specified in the `appSettings` collection in the `siteConfig` property: These properties are specified in the `appSettings` collection in the `siteConfi }, { "name": "WEBSITE_NODE_DEFAULT_VERSION",- "value": "10.14.1" + "value": "~14" }, { "name": "FUNCTIONS_EXTENSION_VERSION", On Windows, a Consumption plan requires an another setting in the site configura }, { "name": "WEBSITE_NODE_DEFAULT_VERSION",- "value": "10.14.1" + "value": "~14" }, { "name": "FUNCTIONS_EXTENSION_VERSION", On Linux, the function app must have its `kind` set to `functionapp,linux`, and }, { "name": "WEBSITE_NODE_DEFAULT_VERSION",- "value": "10.14.1" + "value": "~14" }, { "name": "FUNCTIONS_EXTENSION_VERSION", A function app on a Premium plan must have the `serverFarmId` property set to th }, { "name": "WEBSITE_NODE_DEFAULT_VERSION",- "value": "10.14.1" + "value": "~14" }, { "name": "FUNCTIONS_EXTENSION_VERSION", A function app on an App Service plan must have the `serverFarmId` property set }, { "name": "WEBSITE_NODE_DEFAULT_VERSION",- "value": "10.14.1" + "value": "~14" }, { "name": "FUNCTIONS_EXTENSION_VERSION", Linux apps should also include a `linuxFxVersion` property under `siteConfig`. I | Stack | Example value | ||-|-| Python | `python|3.7` | -| JavaScript | `node|12` | -| .NET | `dotnet|3.1` | +| Python | `python\|3.7` | +| JavaScript | `node\|14` | +| .NET | `dotnet\|3.1` | ```json { Linux apps should also include a `linuxFxVersion` property under `siteConfig`. I }, { "name": "WEBSITE_NODE_DEFAULT_VERSION",- "value": "10.14.1" + "value": "~14" }, { "name": "FUNCTIONS_EXTENSION_VERSION", "value": "~3" } ],- "linuxFxVersion": "node|12" + "linuxFxVersion": "node|14" } } } If you are [deploying a custom container image](./functions-create-function-linu }, { "name": "WEBSITE_NODE_DEFAULT_VERSION",- "value": "10.14.1" + "value": "~14" }, { "name": "FUNCTIONS_EXTENSION_VERSION", |
| azure-functions | Functions Reference Java | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-functions/functions-reference-java.md | The following example shows the operating system setting in the `runtime` sectio ## JDK runtime availability and support -For local development of Java function apps, download and use the appropriate Azul Zulu Enterprise for Azure Java JDKs from [Azul Systems](https://www.azul.com/downloads/azure-only/zulu/). Azure Functions uses an Azul Java JDK runtime when you deploy your function app to the cloud. +Microsoft and [Adoptium](https://adoptium.net/) builds of OpenJDK are provided and supported on Functions for Java 8 and 11. These binaries are provided as a no-cost, multi-platform, production-ready distribution of the OpenJDK for Azure. They contain all the components for building and runnning Java SE applications. The table below describes the new Java versions that Function apps will begin using with the January 2022 Functions platform release: -[Azure support](https://azure.microsoft.com/support/) for issues with the JDKs and function apps is available with a [qualified support plan](https://azure.microsoft.com/support/plans/). +| Java Version | Linux | Windows | +|--||-| +| Java 8 | 1.8.0_302 (Adoptium) | 1.8.0_302 (Adoptium) | +| Java 11 | 11.0.12 (MSFT) | 11.0.12 (MSFT) | ++For local development or testing, you can download the [Microsoft build of OpenJDK](https://docs.microsoft.com/java/openjdk/download) or [Adoptium Temurin](https://adoptium.net/?variant=openjdk8&jvmVariant=hotspot) binaries for free. [Azure support](https://azure.microsoft.com/support/) for issues with the JDKs and function apps is available with a [qualified support plan](https://azure.microsoft.com/support/plans/). ++If you would like to continue using the Zulu for Azure binaries on your Function app, please [configure your app accordingly](https://github.com/Azure/azure-functions-java-worker/wiki/Customize-JVM-to-use-Zulu). You can continue to use the Azul binaries for your site, but any security patches or improvements will only be available in new versions of the OpenJDK, so we recommend that you eventually remove this configuration so that your Function apps use the latest available version of Java. ## Customize JVM |
| azure-monitor | Availability Azure Functions | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-monitor/app/availability-azure-functions.md | This article will cover how to create an Azure Function with TrackAvailability() - If you do not have an Application Insights Resource created yet for your timer triggered function: - By default when you are creating your Azure Functions application it will create an Application Insights resource for you. Follow the instructions on how to [create an Azure Functions resource](../../azure-functions/functions-create-scheduled-function.md#create-a-function-app). > [!NOTE]- > You can host your functions on a Consumption, Premium, or App Service plan. If you are testing behind a V-Net or testing non public endpoints then you will need to use the premium plan in place of the consumption. Select your plan on the **Hosting** tab. + > You can host your functions on a Consumption, Premium, or App Service plan. If you are testing behind a V-Net or testing non public endpoints then you will need to use the premium plan in place of the consumption. Select your plan on the **Hosting** tab. Please ensure the latest .NET version is selected when creating the Function App. 2. Create a timer trigger function. 1. In your function app, select the **Functions** tab. 1. Select **Add** and in the Add function tab select the follow configurations: |
| azure-monitor | Azure Vm Vmss Apps | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-monitor/app/azure-vm-vmss-apps.md | Extension execution output is logged to files found in the following directories C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Diagnostics.ApplicationMonitoringWindows\<version>\ ``` +## Release notes ++### 2.8.42 ++- Updated ApplicationInsights .NET/.NET Core SDK to 2.18.1-redfield. ++### 2.8.41 ++- Added ASP.NET Core Auto-Instrumentation feature. + ## Next steps * Learn how to [deploy an application to an Azure virtual machine scale set](../../virtual-machine-scale-sets/virtual-machine-scale-sets-deploy-app.md). * [Set up Availability web tests](monitor-web-app-availability.md) to be alerted if your endpoint is down. |
| azure-monitor | Java Jmx Metrics Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-monitor/app/java-jmx-metrics-configuration.md | Application Insights Java 3.x collects some of the JMX metrics by default, but i ## How do I collect additional JMX metrics? -JMX metrics collection can be configured by adding a ```"jmxMetrics"``` section to the applicationinsights.json file. You can specify the name of the metric the way you want it to appear in Azure portal in application insights resource. You have to define the object name and attribute for each of the metrics you want collected. +JMX metrics collection can be configured by adding a ```"jmxMetrics"``` section to the applicationinsights.json file. You can specify the name of the metric the way you want it to appear in Azure portal in application insights resource. Object name and attribute are required for each of the metrics you want collected. ## How do I know what metrics are available to configure? -You nailed it - you must know the object names and the attributes, those properties are different for various libraries, frameworks, and application servers, and are often not well documented. To get the object names and attributes, you need to view the MBean tree. An MBean is a managed Java object, that can represent a device, an application, or a resource, and has a set of attributes. +You nailed it - you must know the object names and the attributes, those properties are different for various libraries, frameworks, and application servers, and are often not well documented. Luckily, it's easy to find exactly what JMX metrics are supported for your particular environment. -To view the available metrics and browse through the available metrics, we recommend using [Java Mission Control](https://www.oracle.com/java/technologies/jdk-mission-control.html). +To view the available metrics, set the self-diagnostics level to `DEBUG` in your `applicationinsights.json` configuration file, for example: -### How to navigate the Java Mission Control to get to the right metrics? --When you run the Java Mission Control tool, you'll have a selection of JVMs available on the left side, click on the relevant process under the 'JVM Browser' tab. Wait until JMC loads the dashboard for the process, select 'MBean Browser' tab on the bottom (see below). The JMC must be located in the same folder as the JVM and your process/app must be up and running. -- +```json +{ + "selfDiagnostics": { + "level": "DEBUG" + } +} +``` -### How to get to the metrics I want, and the necessary attributes? +The available JMX metrics, with the object names and attribute names will appear in the application insights log file. -The MBean browser opens the MBean tree with the list of categories that can be expanded. Selecting a category on the left opens the list of attributes on the right. Below is an example of a metric, its object name, and the attributes. The attributes may be nested, as in the example below. +The output in the log file will look similar to the example below. In some cases the list can be quite extensive. +> [!div class="mx-imgBorder"] +>  - -### Configuration example +## Configuration example -From the selection as shown in the image above, lets configure a few metrics. The first one is an example of a nested metric - `LastGcInfo` that has several properties, and we want to capture the `GcThreadCount`. +Knowing what metrics are available, you can configure the agent to collect those. The first one is an example of a nested metric - `LastGcInfo` that has several properties, and we want to capture the `GcThreadCount`. ```json "jmxMetrics": [ From the selection as shown in the image above, lets configure a few metrics. Th ], ``` -### Types of collected metrics and available configuration options? +## Types of collected metrics and available configuration options? We support numeric and boolean JMX metrics, while other types aren't supported and will be ignored. Currently, the wildcards and aggregated attributes aren't supported, that's why As your application is running and the JMX metrics are collected, you can view them by going to Azure portal and navigate to your application insights resource. Under Metrics tab, select the dropdown as shown below to view the metrics. - +> [!div class="mx-imgBorder"] +>  |
| azure-monitor | Diagnostic Settings | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-monitor/essentials/diagnostic-settings.md | When you create the assignment by using the Azure portal, you have the option of ### Metric category is not supported -When deploying a diagnostic setting, you receive an error message, similar to *Metric category 'xxxx' is not supported*. You may receive this error even though a previous your deployment succeeded. +When deploying a diagnostic setting, you receive an error message, similar to *Metric category 'xxxx' is not supported*. You may receive this error even though your previous deployment succeeded. -The problem occurs when using a Resource Manager template, the diagnostic settings REST API, Azure CLI, or Azure PowerShell. Diagnostic settings created via the Azure portal are not affected as only the supported category names are presented. +The problem occurs when using a Resource Manager template, REST API, Azure CLI, or Azure PowerShell. Diagnostic settings created via the Azure portal are not affected as only the supported category names are presented. The problem is caused by a recent change in the underlying API. Metric categories other than 'AllMetrics' are not supported and never were except for a few specific Azure services. In the past, other category names were ignored when deploying a diagnostic setting. The Azure Monitor backend redirected these categories to 'AllMetrics'. As of February 2021, the backend was updated to specifically confirm the metric category provided is accurate. This change has caused some deployments to fail. |
| azure-resource-manager | Template Specs | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-resource-manager/bicep/template-specs.md | + + Title: Create & deploy template specs in Bicep +description: Describes how to create template specs in Bicep and share them with other users in your organization. + Last updated : 01/07/2022+++# Azure Resource Manager template specs in Bicep ++A template spec is a resource type for storing an Azure Resource Manager template (ARM template) or a Bicep file in Azure for later deployment. Bicep files are transpiled into ARM JSON templates before they are stored. This resource type enables you to share ARM templates with other users in your organization. Just like any other Azure resource, you can use Azure role-based access control (Azure RBAC) to share the template spec. ++[**Microsoft.Resources/templateSpecs**](/azure/templates/microsoft.resources/templatespecs) is the resource type for template specs. It consists of a main template and any number of linked templates. Azure securely stores template specs in resource groups. Both the main template and the linked templates must be in JSON. Template Specs support [versioning](#versioning). ++To deploy the template spec, you use standard Azure tools like PowerShell, Azure CLI, Azure portal, REST, and other supported SDKs and clients. You use the same commands as you would for the template or the Bicep file. ++> [!NOTE] +> To use template specs in Bicep with Azure PowerShell, you must install [version 6.3.0 or later](/powershell/azure/install-az-ps). To use it with Azure CLI, use [version 2.27.0 or later](/cli/azure/install-azure-cli). ++When designing your deployment, always consider the lifecycle of the resources and group the resources that share similar lifecycle into a single template spec. For instance, your deployments include multiple instances of Cosmos DB with each instance containing its own databases and containers. Given the databases and the containers donΓÇÖt change much, you want to create one template spec to include a Cosmo DB instance and its underlying databases and containers. You can then use conditional statements in your Bicep along with copy loops to create multiple instances of these resources. ++The choice between template specs and [private module registries](./private-module-registry.md) is mostly a matter of preference. If you're deploying templates or Bicep files without other project artifacts, template specs are an easier option. If you're deploying project artifacts with the templates or Bicep files, you can integrate the private registry with your development work and then more easily deploy all of it from the registry. ++### Microsoft Learn ++To learn more about template specs, and for hands-on guidance, see [Publish libraries of reusable infrastructure code by using template specs](/learn/modules/arm-template-specs) on **Microsoft Learn**. ++## Why use template specs? ++Template specs provide the following benefits: ++* You use standard ARM templates or Bicep files for your template spec. +* You manage access through Azure RBAC, rather than SAS tokens. +* Users can deploy the template spec without having write access to the Bicep file. +* You can integrate the template spec into existing deployment process, such as PowerShell script or DevOps pipeline. ++Template specs enable you to create canonical templates and share them with teams in your organization. The template specs are secure because they're available to Azure Resource Manager for deployment, but not accessible to users without the correct permission. Users only need read access to the template spec to deploy its template, so you can share the template without allowing others to modify it. ++If you currently have your templates in a GitHub repo or storage account, you run into several challenges when trying to share and use the templates. To deploy the template, you need to either make the template publicly accessible or manage access with SAS tokens. To get around this limitation, users might create local copies, which eventually diverge from your original template. Template specs simplify sharing templates. ++The templates you include in a template spec should be verified by administrators in your organization to follow the organization's requirements and guidance. ++## Create template spec ++The following example shows a simple Bicep file for creating a storage account in Azure. ++```bicep +@allowed([ + 'Standard_LRS' + 'Standard_GRS' + 'Standard_ZRS' + 'Premium_LRS' +]) +param storageAccountType string = 'Standard_LRS' ++resource stg 'Microsoft.Storage/storageAccounts@2021-04-01' = { + name: 'store${uniqueString(resourceGroup().id)}' + location: resourceGroup().location + sku: { + name: storageAccountType + } + kind:'StorageV2' +} +``` ++Create a template spec by using: ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +New-AzTemplateSpec -Name storageSpec -Version 1.0a -ResourceGroupName templateSpecsRg -Location westus2 -TemplateFile ./mainTemplate.bicep +``` ++# [CLI](#tab/azure-cli) ++```azurecli +az ts create \ + --name storageSpec \ + --version "1.0a" \ + --resource-group templateSpecRG \ + --location "westus2" \ + --template-file "./mainTemplate.bicep" +``` ++++You can also create template specs by using Bicep files. However the content of `mainTemplate` must be in JSON. The following template creates a template spec to deploy a storage account: ++```bicep +param templateSpecName string = 'CreateStorageAccount' +param templateSpecVersionName string = '0.1' +param location string = resourceGroup().location ++resource createTemplateSpec 'Microsoft.Resources/templateSpecs@2021-05-01' = { + name: templateSpecName + location: location + properties: { + description: 'A basic templateSpec - creates a storage account.' + displayName: 'Storage account (Standard_LRS)' + } +} ++resource createTemplateSpecVersion 'Microsoft.Resources/templateSpecs/versions@2021-05-01' = { + parent: createTemplateSpec + name: templateSpecVersionName + location: location + properties: { + mainTemplate: { + '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#' + 'contentVersion': '1.0.0.0' + 'parameters': { + 'storageAccountType': { + 'type': 'string' + 'defaultValue': 'Standard_LRS' + 'allowedValues': [ + 'Standard_LRS' + 'Standard_GRS' + 'Standard_ZRS' + 'Premium_LRS' + ] + } + } + 'resources': [ + { + 'type': 'Microsoft.Storage/storageAccounts' + 'apiVersion': '2019-06-01' + 'name': 'store$uniquestring(resourceGroup().id)' + 'location': resourceGroup().location + 'kind': 'StorageV2' + 'sku': { + 'name': '[parameters(\'storageAccountType\')]' + } + } + ] + } + } +} ++``` ++The JSON template embedded in the Bicep file needs to make these changes: ++* Remove the commas at the end of the lines. +* Replace double quotes to single quotes. +* Escape the single quotes within the expressions. For example, **'name': '[parameters(\'storageAccountType\')]'**. +* To access the parameters and variables defined in the Bicep file, you can directly use the parameter names and the variable names. To access the parameters and variables defined in `mainTemplate`, you still need to use the ARM JSON template syntax. For example, **'name': '[parameters(\'storageAccountType\')]'**. +* Use the Bicep syntax to call Bicep functions. For example, **'location': resourceGroup().location**. ++You can view all template specs in your subscription by using: ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +Get-AzTemplateSpec +``` ++# [CLI](#tab/azure-cli) ++```azurecli +az ts list +``` ++++You can view details of a template spec, including its versions with: ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +Get-AzTemplateSpec -ResourceGroupName templateSpecsRG -Name storageSpec +``` ++# [CLI](#tab/azure-cli) ++```azurecli +az ts show \ + --name storageSpec \ + --resource-group templateSpecRG \ + --version "1.0a" +``` ++++## Deploy template spec ++After you've created the template spec, users with **read** access to the template spec can deploy it. For information about granting access, see [Tutorial: Grant a group access to Azure resources using Azure PowerShell](../../role-based-access-control/tutorial-role-assignments-group-powershell.md). ++Template specs can be deployed through the portal, PowerShell, Azure CLI, or as a Bicep module in a larger template deployment. Users in an organization can deploy a template spec to any scope in Azure (resource group, subscription, management group, or tenant). ++Instead of passing in a path or URI for a Bicep file, you deploy a template spec by providing its resource ID. The resource ID has the following format: ++**/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Resources/templateSpecs/{template-spec-name}/versions/{template-spec-version}** ++Notice that the resource ID includes a version name for the template spec. ++For example, you deploy a template spec with the following command. ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +$id = "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/templateSpecsRG/providers/Microsoft.Resources/templateSpecs/storageSpec/versions/1.0a" ++New-AzResourceGroupDeployment ` + -TemplateSpecId $id ` + -ResourceGroupName demoRG +``` ++# [CLI](#tab/azure-cli) ++```azurecli +id = "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/templateSpecsRG/providers/Microsoft.Resources/templateSpecs/storageSpec/versions/1.0a" ++az deployment group create \ + --resource-group demoRG \ + --template-spec $id +``` ++++In practice, you'll typically run `Get-AzTemplateSpec` or `az ts show` to get the ID of the template spec you want to deploy. ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +$id = (Get-AzTemplateSpec -Name storageSpec -ResourceGroupName templateSpecsRg -Version 1.0a).Versions.Id ++New-AzResourceGroupDeployment ` + -ResourceGroupName demoRG ` + -TemplateSpecId $id +``` ++# [CLI](#tab/azure-cli) ++```azurecli +id = $(az ts show --name storageSpec --resource-group templateSpecRG --version "1.0a" --query "id") ++az deployment group create \ + --resource-group demoRG \ + --template-spec $id +``` ++++You can also open a URL in the following format to deploy a template spec: ++```url +https://portal.azure.com/#create/Microsoft.Template/templateSpecVersionId/%2fsubscriptions%2f{subscription-id}%2fresourceGroups%2f{resource-group-name}%2fproviders%2fMicrosoft.Resources%2ftemplateSpecs%2f{template-spec-name}%2fversions%2f{template-spec-version} +``` ++## Parameters ++Passing in parameters to template spec is exactly like passing parameters to a Bicep file. Add the parameter values either inline or in a parameter file. ++To pass a parameter inline, use: ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +New-AzResourceGroupDeployment ` + -TemplateSpecId $id ` + -ResourceGroupName demoRG ` + -StorageAccountType Standard_GRS +``` ++# [CLI](#tab/azure-cli) ++```azurecli +az deployment group create \ + --resource-group demoRG \ + --template-spec $id \ + --parameters storageAccountType='Standard_GRS' +``` ++++To create a local parameter file, use: ++```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "StorageAccountType": { + "value": "Standard_GRS" + } + } +} +``` ++And, pass that parameter file with: ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +New-AzResourceGroupDeployment ` + -TemplateSpecId $id ` + -ResourceGroupName demoRG ` + -TemplateParameterFile ./mainTemplate.parameters.json +``` ++# [CLI](#tab/azure-cli) ++```azurecli +az deployment group create \ + --resource-group demoRG \ + --template-spec $id \ + --parameters "./mainTemplate.parameters.json" +``` ++++## Versioning ++When you create a template spec, you provide a version name for it. As you iterate on the template code, you can either update an existing version (for hotfixes) or publish a new version. The version is a text string. You can choose to follow any versioning system, including semantic versioning. Users of the template spec can provide the version name they want to use when deploying it. ++## Use tags ++[Tags](../management/tag-resources.md) help you logically organize your resources. You can add tags to template specs by using Azure PowerShell and Azure CLI: ++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +New-AzTemplateSpec ` + -Name storageSpec ` + -Version 1.0a ` + -ResourceGroupName templateSpecsRg ` + -Location westus2 ` + -TemplateFile ./mainTemplate.bicep ` + -Tag @{Dept="Finance";Environment="Production"} +``` ++# [CLI](#tab/azure-cli) ++```azurecli +az ts create \ + --name storageSpec \ + --version "1.0a" \ + --resource-group templateSpecRG \ + --location "westus2" \ + --template-file "./mainTemplate.bicep" \ + --tags Dept=Finance Environment=Production +``` ++++# [PowerShell](#tab/azure-powershell) ++```azurepowershell +Set-AzTemplateSpec ` + -Name storageSpec ` + -Version 1.0a ` + -ResourceGroupName templateSpecsRg ` + -Location westus2 ` + -TemplateFile ./mainTemplate.bicep ` + -Tag @{Dept="Finance";Environment="Production"} +``` ++# [CLI](#tab/azure-cli) ++```azurecli +az ts update \ + --name storageSpec \ + --version "1.0a" \ + --resource-group templateSpecRG \ + --location "westus2" \ + --template-file "./mainTemplate.bicep" \ + --tags Dept=Finance Environment=Production +``` ++++When creating or modifying a template spec with the version parameter specified, but without the tag/tags parameter: ++* If the template spec exists and has tags, but the version doesn't exist, the new version inherits the same tags as the existing template spec. ++When creating or modifying a template spec with both the tag/tags parameter and the version parameter specified: ++* If both the template spec and the version don't exist, the tags are added to both the new template spec and the new version. +* If the template spec exists, but the version doesn't exist, the tags are only added to the new version. +* If both the template spec and the version exist, the tags only apply to the version. ++When modifying a template with the tag/tags parameter specified but without the version parameter specified, the tags is only added to the template spec. ++## Link to template specs ++After creating a template spec, you can link to that template spec in a Bicep module. For more information, see [File in template spec](./modules.md#path-to-module). ++## Next steps ++To learn more about template specs, and for hands-on guidance, see [Publish libraries of reusable infrastructure code by using template specs](/learn/modules/arm-template-specs) on **Microsoft Learn**. |
| azure-sql | Add Database To Failover Group Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/add-database-to-failover-group-cli.md | Last updated 01/05/2022 This Azure CLI script example creates a database in Azure SQL Database, creates a failover group, adds the database to it, and tests failover. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Add Elastic Pool To Failover Group Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/add-elastic-pool-to-failover-group-cli.md | Last updated 01/05/2022 This Azure CLI script example creates a single database, adds it to an elastic pool, creates a failover group, and tests failover. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Auditing Threat Detection Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/auditing-threat-detection-cli.md | Last updated 01/05/2022 This Azure CLI script example configures SQL Database auditing and Advanced Threat Protection. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Backup Database Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/backup-database-cli.md | Last updated 01/05/2022 This Azure CLI example backs up a database in SQL Database to an Azure storage container. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Copy Database To New Server Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/copy-database-to-new-server-cli.md | Last updated 01/05/2022 This Azure CLI script example creates a copy of an existing database in a new server. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Create And Configure Database Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/create-and-configure-database-cli.md | Last updated 01/05/2022 This Azure CLI script example creates a single database in Azure SQL Database and configures a server-level firewall rule. After the script has been successfully run, the database can be accessed from all Azure services and the allowed IP address range. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Import From Bacpac Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/import-from-bacpac-cli.md | Last updated 01/05/2022 This Azure CLI script example imports a database from a *.bacpac* file into a database in SQL Database. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Monitor And Scale Database Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/monitor-and-scale-database-cli.md | Last updated 01/05/2022 This Azure CLI script example scales a single database in Azure SQL Database to a different compute size after querying the size information of the database. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Move Database Between Elastic Pools Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/move-database-between-elastic-pools-cli.md | Last updated 01/05/2022 This Azure CLI script example creates two elastic pools, moves a pooled database in SQL Database from one SQL elastic pool into another SQL elastic pool, and then moves the pooled database out of the SQL elastic pool to be a single database in SQL Database. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Restore Database Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/restore-database-cli.md | Last updated 01/05/2022 This Azure CLI example restores a single database in Azure SQL Database to a specific point in time. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Scale Pool Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/scale-pool-cli.md | Last updated 01/05/2022 This Azure CLI script example creates elastic pools in Azure SQL Database, moves pooled databases, and changes elastic pool compute sizes. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Setup Geodr Failover Database Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/setup-geodr-failover-database-cli.md | Last updated 01/05/2022 This Azure CLI script example configures active geo-replication for a single database and fails it over to a secondary replica of the database. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Setup Geodr Failover Group Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/setup-geodr-failover-group-cli.md | Last updated 01/05/2022 [!INCLUDE[appliesto-sqldb](../../includes/appliesto-sqldb.md)] + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Setup Geodr Failover Pool Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/database/scripts/setup-geodr-failover-pool-cli.md | Last updated 01/05/2022 This Azure CLI script example configures active geo-replication for a pooled database in Azure SQL Database and fails it over to the secondary replica of the database. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Resource Limits | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/managed-instance/resource-limits.md | Support for the premium-series hardware generations (public preview) is currentl | Region | **Premium-series** | **Memory optimized premium-series** | |: |: |: |+| Australia Central | Yes | | +| Australia East | Yes | Yes | | Canada Central | Yes | | | Canada East | Yes | | -| Central US | Yes | Yes | +| Central US | Yes | | | East US | Yes | Yes | | East US 2 | Yes | Yes | | France Central | | Yes | +| Germany West Central | | Yes | +| Japan East | Yes | | +| Korea Central | Yes | | | North Central US | Yes | Yes | -| North Europe | Yes | Yes | +| North Europe | Yes | | | South Central US | Yes | Yes | | Southeast Asia | Yes | | -| UK South | | Yes | +| UK South | Yes | | | West Europe | Yes | Yes | | West US | Yes | Yes | | West US 2 | Yes | Yes | |
| azure-sql | Create Configure Managed Instance Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/managed-instance/scripts/create-configure-managed-instance-cli.md | This Azure CLI script example creates an Azure SQL Managed Instance in a dedicat > [!IMPORTANT] > For limitations, see [supported regions](../../../azure-sql/managed-instance/resource-limits.md#supported-regions) and [supported subscription types](../../../azure-sql/managed-instance/resource-limits.md#supported-subscription-types). + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Restore Geo Backup Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/managed-instance/scripts/restore-geo-backup-cli.md | This Azure CLI script example restores an Azure SQL Managed Instance database fr This sample requires an existing pair of managed instances, see [Use Azure CLI to create an Azure SQL Managed Instance](create-configure-managed-instance-cli.md) to create a pair of managed instances in different regions. + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Transparent Data Encryption Byok Sql Managed Instance Cli | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/managed-instance/scripts/transparent-data-encryption-byok-sql-managed-instance-cli.md | This Azure CLI script example configures Transparent Data Encryption (TDE) with This sample requires an existing Managed Instance, see [Use Azure CLI to create an Azure SQL Managed Instance](create-configure-managed-instance-cli.md). + [!INCLUDE [azure-cli-prepare-your-environment.md](../../../../includes/azure-cli-prepare-your-environment.md)] ## Sample script |
| azure-sql | Db2 To Sql On Azure Vm Guide | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/db2-to-sql-on-azure-vm-guide.md | Title: "Db2 to SQL Server on Azure VM: Migration guide"+ description: This guide teaches you to migrate your IBM Db2 databases to SQL Server on Azure VM, by using SQL Server Migration Assistant for Db2. |
| azure-sql | Oracle To Sql On Azure Vm Guide | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/oracle-to-sql-on-azure-vm-guide.md | Title: "Oracle to SQL Server on Azure Virtual Machines: Migration guide"+ description: This guide teaches you to migrate your Oracle schemas to SQL Server on Azure Virtual Machines by using SQL Server Migration Assistant for Oracle. |
| azure-sql | Sql Server Availability Group To Sql On Azure Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-availability-group-to-sql-on-azure-vm.md | Title: Migrate availability group+ description: Learn how to lift and shift your Always On availability group high availability solution to SQL Server on Azure VMs using Azure Migrate. Prepare Azure for migration with the [Server Migration tool](../../../migrate/mi |**Task** | **Details**| | | |**Create an Azure Migrate project** | Your Azure account needs Contributor or Owner permissions to [create a new project](../../../migrate/create-manage-projects.md).|-|**Verify permissions for your Azure account** | Your Azure account needs Contributor or Owner permissions on the Azure subscription, permissions to register Azure Active Directory (AAD) apps, and User Access Administrator permissions on the Azure subscription to create a Key Vault, to create a VM, and to write to an Azure managed disk. | +|**Verify permissions for your Azure account** | Your Azure account needs Contributor or Owner permissions on the Azure subscription, permissions to register Azure Active Directory (Azure AD) apps, and User Access Administrator permissions on the Azure subscription to create a Key Vault, to create a VM, and to write to an Azure managed disk. | |**Set up an Azure virtual network** | [Setup](../../../virtual-network/virtual-networks-overview.md) an Azure virtual network (VNet). When you replicate to Azure, Azure VMs are created and joined to the Azure VNet that you specify when you set up migration.| |
| azure-sql | Sql Server Distributed Availability Group Complete Migration | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-distributed-availability-group-complete-migration.md | + + Title: Complete migration using a distributed availability group ++description: Use a distributed availability group to complete the migration of your SQL Server databases to SQL Server on Azure VMs. ++++ Last updated : 12/15/2021+++# Complete migration using a distributed AG ++Use a [distributed availability group (AG)](/sql/database-engine/availability-groups/windows/distributed-availability-groups) to migrate your databases from SQL Server to SQL Server on Azure Virtual Machines (VMs). ++This article assumes you've already configured your distributed ag for either your [standalone databases](sql-server-distributed-availability-group-migrate-standalone-instance.md) or your [availability group databases](sql-server-distributed-availability-group-migrate-ag.md) and now you're ready to finalize the migration to SQL Server on Azure VMs. ++## Monitor migration ++Use Transact-SQL (T-SQL) to monitor the progress of your migration. ++Run the following script on the global primary and the forwarder and validate that the state for `synchronization_state_desc` for the primary availability group (**OnPremAG**) and the secondary availability group (**AzureAG**) is `SYNCHRONIZED`. Confirm that the the `synchronization_state_desc` for the distributed AG (**DAG**) is synchronizing and the `last_hardened_lsn` is the same per database on both the global primary and the forwarder. ++If not, rerun the query on both sides every 5 seconds or so until it is the case. ++Use the following script to monitor the migration: ++```sql +SELECT ag.name + , drs.database_id + , db_name(drs.database_id) as database_name + , drs.group_id + , drs.replica_id + , drs.synchronization_state_desc + , drs.last_hardened_lsn +FROM sys.dm_hadr_database_replica_states drs +INNER JOIN sys.availability_groups ag on drs.group_id = ag.group_id; +``` ++## Complete migration ++Once you've validated the states of the availability group and the distributed ag, you're ready to complete the migration. This consists of failing over the distributed ag to the forwarder (the target SQL Server in Azure), and then cutting over the application to the new primary on the Azure side. ++To failover your distributed availability group, review [failover to secondary availability group](/sql/database-engine/availability-groups/windows/configure-distributed-availability-groups#failover). ++After the failover, update the connection string of your application to connect to the new primary replica in Azure. At this point, you can choose to maintain the distributed availability group, or use `DROP AVAILABILITY GROUP [DAG]` on the both the source and target SQL Server instances to drop it. ++If your domain controller is on the source side, validate that your target SQL Server VMs in Azure have joined the domain before abandoning the source SQL Server instances. Do not delete the domain controller on the source side until you [create a domain](../../virtual-machines/windows/availability-group-manually-configure-prerequisites-tutorial-multi-subnet.md#create-domain-controllers) on the source side in Azure and add your SQL Server VMs to this new domain. +++## Next steps ++For a tutorial showing you how to migrate a database to SQL Server on Azure Virtual Machines using the T-SQL RESTORE command, see [Migrate a SQL Server database to SQL Server on a virtual machine](../../virtual-machines/windows/migrate-to-vm-from-sql-server.md). ++For information about SQL Server on Azure Virtual Machines, see the [Overview](../../virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview.md). ++For information about connecting apps to SQL Server on Azure Virtual Machines, see [Connect applications](../../virtual-machines/windows/ways-to-connect-to-sql.md). +++ |
| azure-sql | Sql Server Distributed Availability Group Migrate Ag | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-distributed-availability-group-migrate-ag.md | + + Title: Use distributed AG to migrate availability group ++description: Learn to use a distributed availability group (AG) to migrate a database (or multiple databases) from a source SQL Server Always On availability group to a target SQL Server on Azure VM. ++++ Last updated : 12/15/2021+++# Use distributed AG to migrate availability group ++Use a [distributed availability group (AG)](/sql/database-engine/availability-groups/windows/distributed-availability-groups) to migrate databases in an Always On availability group while maintaining high availability and disaster recovery (HADR) support post migration on your SQL Server on Azure Virtual Machines (VMs). ++Once you've validated your source SQL Server instances meet the [prerequisites](sql-server-distributed-availability-group-migrate-prerequisites.md), follow the steps in this article to create a distributed availability between your existing availability group, and your target availability group on your SQL Server on Azure VMs. ++This article is intended for databases participating in an availability group, and requires a Windows Server Failover Cluster (WSFC) and an availability group listener. It's also possible to [migrate databases from a standalone SQL Server instance](sql-server-distributed-availability-group-migrate-standalone-instance.md). +++## Initial setup ++The first step is to create your SQL Server VMs in Azure. You can do so by using the [Azure portal](../../virtual-machines/windows/sql-vm-create-portal-quickstart.md), [Azure PowerShell](../../virtual-machines/windows/sql-vm-create-powershell-quickstart.md), or an [ARM template](../../virtual-machines/windows/create-sql-vm-resource-manager-template.md). ++Be sure to configure your SQL Server VMs according to the [prerequisites](sql-server-distributed-availability-group-migrate-prerequisites.md). Choose between a single subnet deployment, which relies on an Azure Load Balancer or distributed network name to route traffic to your availability group listener, or a multi-subnet deployment which does not have such a requirement. The multi-subnet deployment is recommended. To learn more, see [connectivity](../../virtual-machines/windows/availability-group-overview.md#connectivity). ++For simplicity, join your target SQL Server VMs to the same domain as your source SQL Server instances. Otherwise, join your target SQL Server VM to a domain that's federated with the domain of your source SQL Server instances. ++To use automatic seeding to create your distributed availability group (DAG), the instance name for the global primary (source) of the DAG must match the instance name of the forwarder (target) of the DAG. If there is an instance name mismatch between the global primary and forwarder, then you must use manual seeding to create the DAG, and manually add any additional database files in the future. ++This article uses the following example parameters: ++- Database name: **Adventureworks** +- Source machine names : **OnPremNode1** (global primary in DAG), **OnPremNode2** +- Source SQL Server instance names: **MSSQLSERVER**, **MSSQLSERVER** +- Source availability group name : **OnPremAg** +- Source availability group listener name: **OnPremAG_LST** +- Target SQL Server VM names: **SQLVM1** (forwarder in DAG), **SQLVM2** +- Target SQL Server on Azure VM instance names: **MSSQLSERVER**, **MSSQLSERVER** +- Target availability group name: **AzureAG** +- Source availability group listener name: **AzureAG_LST** +- Endpoint name: **Hadr_endpoint** +- Distributed availability group name: **DAG** +- Domain name: **Contoso** ++## Create endpoints ++Use Transact-SQL (T-SQL) to create endpoints on both your two source instances (**OnPremNode1**, **OnPremNode2**) and target SQL Server instances (**SQLVM1**, **SQLVM2**). ++If you already have an availability group configured on the source instances, only run this script on the two target instances. ++To create your endpoints, run this T-SQL script on both source and target servers: ++```sql +CREATE ENDPOINT [Hadr_endpoint] + STATE=STARTED + AS TCP (LISTENER_PORT = 5022, LISTENER_IP = ALL) +FOR DATA_MIRRORING ( + ROLE = ALL, + AUTHENTICATION = WINDOWS NEGOTIATE, + ENCRYPTION = REQUIRED ALGORITHM AES +) +GO +``` ++Domain accounts automatically have access to endpoints, but service accounts may not automatically be part of the sysadmin group and may not have connect permission. To manually grant the SQL Server service account connect permission to the endpoint, run the following T-SQL script on both servers: ++```sql +GRANT CONNECT ON ENDPOINT::[Hadr_endpoint] TO [<your account>] +``` ++## Create source AG ++Since a distributed availability group is a special availability group that spans across two individual availability groups, you first need to create an availability group on the two source SQL Server instances. ++If you already have an availability group on your source instances, skip this section. ++Use Transact-SQL (T-SQL) to create an availability group (**OnPremAG**) between your two source instances (**OnPremNode1**, **OnPremNode2**) for the example **Adventureworks** database. ++To create the availability group on the source instances, run this script on the source primary replica (**OnPremNode1**): ++```sql +CREATE AVAILABILITY GROUP [OnPremAG] +WITH ( AUTOMATED_BACKUP_PREFERENCE = PRIMARY, + DB_FAILOVER = OFF, + DTC_SUPPORT = NONE, +FOR DATABASE [Adventureworks] +REPLICA ON + N'OnPremNode1' WITH (ENDPOINT_URL = N'TCP://OnPremNode1.contoso.com:5022', + FAILOVER_MODE = AUTOMATIC, + AVAILABILITY_MODE = SYNCHRONOUS_COMMIT, + SEEDING_MODE = AUTOMATIC, + SECONDARY_ROLE(ALLOW_CONNECTIONS = NO)), + N'OnPremNode2' WITH (ENDPOINT_URL = N'TCP://OnPremNode2.contoso.com:5022', + FAILOVER_MODE = AUTOMATIC, + AVAILABILITY_MODE = SYNCHRONOUS_COMMIT, + SEEDING_MODE = AUTOMATIC, + SECONDARY_ROLE(ALLOW_CONNECTIONS = NO)); +``` ++Next, to join the secondary replica (**OnPremNode2**) to the availability group (**OnPremAg**). ++To join the availability group, run this script on the source secondary replica: ++```sql +ALTER AVAILABILITY GROUP [OnPremAG] JOIN; +GO +ALTER AVAILABILITY GROUP [OnPremAG] GRANT CREATE ANY DATABASE; +GO +``` ++Finally, create the listener for your global forwarder availability group (**OnPremAG**). ++To create the listener, run this script on the source primary replica: ++```sql +USE [master] +GO +ALTER AVAILABILITY GROUP [OnPremAG] +ADD LISTENER N'OnPremAG_LST' ( +WITH IP ((<available static ip>, <mask>) +, PORT=60173); +GO ++``` +++## Create target AG ++You also need to create an availability group on the target SQL Server VMs as well. ++If you already have an availability group configured between your SQL Server instances in Azure, skip this section. ++Use Transact-SQL (T-SQL) to create an availability group (**AzureAG**) on the target SQL Server instances (**SQLVM1** and **SQLVM2**). ++To create the availability group on the target, run this script on the target primary replica: ++```sql +CREATE AVAILABILITY GROUP [AzureAG] +FOR + REPLICA ON N'SQLVM1' WITH (ENDPOINT_URL = N'TCP://SQLVM1.contoso.com:5022', + FAILOVER_MODE = MANUAL, + AVAILABILITY_MODE = SYNCHRONOUS_COMMIT, + BACKUP_PRIORITY = 50, + SECONDARY_ROLE(ALLOW_CONNECTIONS = NO), + SEEDING_MODE = AUTOMATIC), +N'SQLVM2' WITH (ENDPOINT_URL = N'TCP://SQLVM2.contoso.com:5022', + FAILOVER_MODE = MANUAL, + AVAILABILITY_MODE = SYNCHRONOUS_COMMIT, + BACKUP_PRIORITY = 50, + SECONDARY_ROLE(ALLOW_CONNECTIONS = NO), + SEEDING_MODE = AUTOMATIC); +GO +``` ++Next, join the target secondary replica (**SQLVM2**) to the availability group (**AzureAG**). ++Run this script on the target secondary replica: ++```sql +ALTER AVAILABILITY GROUP [AzureAG] JOIN; +GO +ALTER AVAILABILITY GROUP [AzureAG] GRANT CREATE ANY DATABASE; +GO +``` ++Finally, create a listener (**AzureAG_LST**) for your target availability group (**AzureAG**). If you deployed your SQL Server VMs to multiple subnets, create your listener using Transact-SQL. If you deployed your SQL Server VMs to a single subnet, configure either an [Azure Load Balancer](../../virtual-machines/windows/availability-group-vnn-azure-load-balancer-configure.md), or a [distributed network name](../../virtual-machines/windows/availability-group-distributed-network-name-dnn-listener-configure.md) for your listener. ++To create your listener, run this script on the primary replica of the availability group in Azure. ++```sql +ALTER AVAILABILITY GROUP [AzureAG] +ADD LISTENER N'AzureAG_LST' ( +WITH IP +( (N'<primary replica's secondary ip >', N'<primary mask>'), (N'<secondary replica's secondary ip>', N'<secondary mask>') ) +, PORT=<port number you set>); +GO +``` ++++## Create distributed AG ++After you have your source (**OnPremAG**) and target (**AzureAG**) availability groups configured, create your distributed availability group to span both individual availability groups. ++Use Transact-SQL on the source SQL Server global primary (**OnPremNode1**) and AG (**OnPremAG**) to create the distributed availability group (**DAG**). ++To create the distributed AG on the source, run this script on the source global primary: ++```sql +CREATE AVAILABILITY GROUP [DAG] + WITH (DISTRIBUTED) + AVAILABILITY GROUP ON + 'OnPremAG' WITH + ( + LISTENER_URL = 'tcp://OnPremAG_LST.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ), + 'AzureAG' WITH + ( + LISTENER_URL = 'tcp://AzureAG_LST.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ); +GO ++``` ++>[!NOTE] +> The seeding mode is set to `AUTOMATIC` as the version of SQL Server on the target and source is the same. If your SQL Server target is a higher version, or if your global primary and forwarder have different instance names, then create the distributed ag, and join the secondary AG to the distributed ag with **SEEDING_MODE** set to `MANUAL`. Then manually restore your databases from the source to the target SQL Server instance. Review [upgrading versions during migration](/sql/database-engine/availability-groups/windows/distributed-availability-groups#cautions-when-using-distributed-availability-groups-to-migrate-to-higher-sql-server-versions) to learn more. ++After your distributed AG is created, join the target AG (**AzureAG**) on the target forwarder instance (**SQLVM1**) to the distributed AG (**DAG**). ++To join the target AG to the distributed AG, run this script on the target forwarder: ++```sql +ALTER AVAILABILITY GROUP [DAG] + JOIN + AVAILABILITY GROUP ON + 'OnPremAG' WITH + ( + LISTENER_URL = 'tcp://OnPremAG_LST.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ), + 'AzureAG' WITH + ( + LISTENER_URL = 'tcp://AzureAG_LST.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ); +GO +``` ++If you need to cancel, pause, or delay synchronization between the source and target availability groups (such as, for example, performance issues), run this script on the source global primary instance (**OnPremNode1**): ++```sql +ALTER AVAILABILITY GROUP [DAG] + MODIFY + AVAILABILITY GROUP ON + 'AzureAG' WITH + ( SEEDING_MODE = MANUAL ); +``` ++To learn more, review [cancel automatic seeding to forwarder](/sql/database-engine/availability-groups/windows/configure-distributed-availability-groups#cancel-automatic-seeding-to-forwarder). ++## Next steps ++After your distributed availability group is created, you are ready to [complete the migration](sql-server-distributed-availability-group-complete-migration.md). |
| azure-sql | Sql Server Distributed Availability Group Migrate Prerequisites | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-distributed-availability-group-migrate-prerequisites.md | + + Title: "Prerequisites: Migrate to SQL Server VM using distributed AG" ++description: Review the prerequisites to migrate your SQL Server to SQL Server on Azure VMs using a distributed availability group. ++++ Last updated : 12/15/2021+++# Prerequisites: Migrate to SQL Server VM using distributed AG ++Use a [distributed availability group (AG)](/sql/database-engine/availability-groups/windows/distributed-availability-groups) to migrate either a [standalone instance](sql-server-distributed-availability-group-migrate-standalone-instance.md) of SQL Server or an [Always On availability group](sql-server-distributed-availability-group-migrate-ag.md) to SQL Server on Azure Virtual Machines (VMs). ++This article describes the prerequisites to prepare your source and target environments to migrate your SQL Server instance or availability group to SQL Server VMs using a distributed ag. ++Migrating a database (or multiple databases) from a standalone instance using a distributed availability group is a simple solution that does not require a Windows Server Failover Cluster, or an availability group listener on either the source or the target. Migrating an availability group requires a cluster, and a listener on both source and target. ++## Source SQL Server ++To migrate your instance or availability group, your source SQL Server should meet the following prerequisites: ++- For a standalone instance migration, the minimum supported version is SQL Server 2017. For an availability group migration, SQL Server 2016 or later is supported. +- Your SQL Server edition should be enterprise. +- You must enable the [Always On feature](/sql/database-engine/availability-groups/windows/enable-and-disable-always-on-availability-groups-sql-server). +- The databases you intend to migrate have been backed up in full mode. +- If you already have an availability group, it must be in a healthy state. If you create an availability group as part of this process, it must be in a healthy state before you start the migration. +- Ports used by the SQL Server instance (1433 by default) and the database mirroring endpoint (5022 by default) must be open in the firewall. To migrate databases in an availability group, make sure the port used by the listener is also open in the firewall. ++## Target SQL Server VM ++Before your target SQL Server VMs are ready for migration, make sure they meet the following prerequisites: ++- The Azure account performing the migration is assigned as the owner or contributor to the resource group that contains target the SQL Server VMs. +- To use automatic seeding to create your distributed availability group (DAG), the instance name for the global primary (source) of the DAG must match the instance name of the forwarder (target) of the DAG. If there is an instance name mismatch between the global primary and forwarder, then you must use manual seeding to create the DAG, and manually add any additional database files in the future. +- For simplicity, the target SQL Server instance should match the version of the source SQL Server instance. If you choose to upgrade during the migration process by using a higher version of SQL Server on the target, then you will need to manually seed your database rather than relying on autoseeding as is provided in this series of articles. Review [Migrate to higher SQL Server versions](/sql/database-engine/availability-groups/windows/distributed-availability-groups#cautions-when-using-distributed-availability-groups-to-migrate-to-higher-sql-server-versions) for more details. +- The SQL Server edition should be enterprise. +- You must enable the [Always On feature](/sql/database-engine/availability-groups/windows/enable-and-disable-always-on-availability-groups-sql-server). +- Ports used by the SQL Server instance (1433 by default) and the database mirroring endpoint (5022 by default) must be open in the firewall. To migrate databases in an availability group, make sure the port used by the listener is also open in the firewall. ++## Connectivity ++The source and target SQL Server instance must have an established network connection. ++If the source SQL Server instance is located on an on-premises network, configure a [Site-to-site VPN connection](/microsoft-365/enterprise/connect-an-on-premises-network-to-a-microsoft-azure-virtual-network) or an [Azure ExpressRoute connection](../../../expressroute/expressroute-introduction.md) between the on-premises network and the virtual network where your target SQL Server VM resides. ++If your source SQL Server instance is located on an Azure virtual network that is different than the target SQL Server VM, then configure [virtual network peering](../../../virtual-network/virtual-network-peering-overview.md). ++## Authentication ++To simplify authentication between your source and target SQL Server instance, join both servers to the same domain, preferably with the domain being on the source side and apply domain-based authentication. Since this is the recommended approach, the steps in this tutorial series assume both source and target SQL Server instance are part of the same domain. ++If the source and target servers are part of different domains, configure [federation](../../../active-directory/hybrid/whatis-fed.md) between the two domains, or configure a [domain-independent availability group](../../virtual-machines/windows/availability-group-clusterless-workgroup-configure.md). +++## Next steps ++Once you have configured both source and target environment to meet the prerequisites, you're ready to migrate either your [standalone instance](sql-server-distributed-availability-group-migrate-standalone-instance.md) of SQL Server or an [Always On availability group](sql-server-distributed-availability-group-migrate-ag.md) to your target SQL Server VM(s). +++ |
| azure-sql | Sql Server Distributed Availability Group Migrate Standalone Instance | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-distributed-availability-group-migrate-standalone-instance.md | + + Title: Use distributed AG to migrate databases from a standalone instance ++description: Learn to use a distributed availability group (AG) to migrate a database (or multiple databases) from a standalone instance of SQL Server to a target SQL Server on Azure VM. ++++ Last updated : 12/15/2021+++# Use distributed AG to migrate databases from a standalone instance ++Use a [distributed availability group (AG)](/sql/database-engine/availability-groups/windows/distributed-availability-groups) to migrate a database (or multiple databases) from a standalone instance of SQL Server to SQL Server on Azure Virtual Machines (VMs). ++Once you've validated your source SQL Server instance meets the [prerequisites](sql-server-distributed-availability-group-migrate-prerequisites.md), follow the steps in this article to create an availability group on your standalone SQL Server instance and migrate your database (or group of databases) to your SQL Server VM in Azure. ++This article is intended for databases on a standalone instance of SQL Server. This solution does not require a Windows Server Failover Cluster (WSFC) or an availability group listener. It's also possible to [migrate databases in an availability group](sql-server-distributed-availability-group-migrate-ag.md). +++## Initial setup ++The first step is to create your SQL Server VM in Azure. You can do so by using the [Azure portal](../../virtual-machines/windows/sql-vm-create-portal-quickstart.md), [Azure PowerShell](../../virtual-machines/windows/sql-vm-create-powershell-quickstart.md), or an [ARM template](../../virtual-machines/windows/create-sql-vm-resource-manager-template.md). ++Be sure to configure your SQL Server VM according to the [prerequisites](sql-server-distributed-availability-group-migrate-prerequisites.md). ++For simplicity, join your target SQL Server VM to the same domain as your source SQL Server. Otherwise, join your target SQL Server VM to a domain that's federated with the domain of your source SQL Server. ++To use automatic seeding to create your distributed availability group (DAG), the instance name for the global primary (source) of the DAG must match the instance name of the forwarder (target) of the DAG. If there is an instance name mismatch between the global primary and forwarder, then you must use manual seeding to create the DAG, and manually add any additional database files in the future. ++This article uses the following example parameters: ++- Database name: **Adventureworks** +- Source machine name (global primary in DAG): **OnPremNode** +- Source SQL Server instance name: **MSSQLSERVER** +- Source availability group name: **OnPremAg** +- Target SQL Server VM name (forwarder in DAG): **SQLVM** +- Target SQL Server on Azure VM instance name: **MSSQLSERVER** +- Target availability group name: **AzureAG** +- Endpoint name: **Hadr_endpoint** +- Distributed availability group name: **DAG** +- Domain name: **Contoso** ++## Create endpoints ++Use Transact-SQL (T-SQL) to create endpoints on both your source (**OnPremNode**) and target (**SQLVM**) SQL Server instances. ++To create your endpoints, run this T-SQL script on both source and target servers: ++```sql +CREATE ENDPOINT [Hadr_endpoint] + STATE=STARTED + AS TCP (LISTENER_PORT = 5022, LISTENER_IP = ALL) +FOR DATA_MIRRORING ( + ROLE = ALL, + AUTHENTICATION = WINDOWS NEGOTIATE, + ENCRYPTION = REQUIRED ALGORITHM AES +) +GO +``` ++Domain accounts automatically have access to endpoints, but service accounts may not automatically be part of the sysadmin group and may not have connect permission. To manually grant the SQL Server service account connect permission to the endpoint, run the following T-SQL script on both servers: ++```sql +GRANT CONNECT ON ENDPOINT::[Hadr_endpoint] TO [<your account>] +``` ++## Create source AG ++Since a distributed availability group is a special availability group that spans across two individual availability groups, you first need to create an availability group on the source SQL Server instance. If you already have an availability group that you would like to maintain in Azure, then [migrate your availability group](sql-server-distributed-availability-group-migrate-ag.md) instead. ++Use Transact-SQL (T-SQL) to create an availability group (**OnPremAg**) on the source (**OnPremNode**) instance for the example **Adventureworks** database. ++To create the availability group, run this script on the source: ++```sql +CREATE AVAILABILITY GROUP [OnPremAG] + WITH (AUTOMATED_BACKUP_PREFERENCE = PRIMARY, + DB_FAILOVER = OFF, + DTC_SUPPORT = NONE, + CLUSTER_TYPE=NONE, + FOR DATABASE [Adventureworks] ++REPLICA ON N'OnPremNode' +WITH (ENDPOINT_URL = N'TCP://OnPremNode.contoso.com:5022', FAILOVER_MODE = MANUAL, +AVAILABILITY_MODE = SYNCHRONOUS_COMMIT, +SEEDING_MODE = AUTOMATIC, SECONDARY_ROLE(ALLOW_CONNECTIONS = NO)); ++GO +``` ++## Create target AG ++You also need to create an availability group on the target SQL Server VM as well. ++Use Transact-SQL (T-SQL) to create an availability group (**AzureAG**) on the target (**SQLVM**) instance. ++To create the availability group, run this script on the target: ++```sql +CREATE AVAILABILITY GROUP [AzureAG] + WITH (AUTOMATED_BACKUP_PREFERENCE = PRIMARY, + DB_FAILOVER = OFF, + DTC_SUPPORT = NONE, + CLUSTER_TYPE=NONE, + REQUIRED_SYNCHRONIZED_SECONDARIES_TO_COMMIT = 0) +FOR REPLICA ON N'SQLVM' +WITH (ENDPOINT_URL = N'TCP://SQLVM.contoso.com:5022', FAILOVER_MODE = MANUAL, +AVAILABILITY_MODE = SYNCHRONOUS_COMMIT, +SEEDING_MODE = AUTOMATIC,SECONDARY_ROLE(ALLOW_CONNECTIONS = NO)); +GO ++``` ++## Create distributed AG ++After you have your source (**OnPremAG**) and target (**AzureAG**) availability groups configured, create your distributed availability group to span both individual availability groups. ++Use Transact-SQL on the source SQL Server instance (**OnPremNode**) and AG (**OnPremAG**) to create the distributed availability group (**DAG**). ++To create the distributed AG, run this script on the source: ++```sql +CREATE AVAILABILITY GROUP [DAG] + WITH (DISTRIBUTED) + AVAILABILITY GROUP ON + 'OnPremAG' WITH + ( + LISTENER_URL = 'tcp://OnPremNode.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ), + 'AzureAG' WITH + ( + LISTENER_URL = 'tcp://SQLVM.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ); +GO ++``` ++>[!NOTE] +> The seeding mode is set to `AUTOMATIC` as the version of SQL Server on the target and source is the same. If your SQL Server target is a higher version, or if your global primary and forwarder have different instance names, then create the distributed ag, and join the secondary AG to the distributed ag with **SEEDING_MODE** set to `MANUAL`. Then manually restore your databases from the source to the target SQL Server instance. Review [upgrading versions during migration](/sql/database-engine/availability-groups/windows/distributed-availability-groups#cautions-when-using-distributed-availability-groups-to-migrate-to-higher-sql-server-versions) to learn more. ++After your distributed AG is created, join the target AG (**AzureAG**) on the target instance (**SQLVM**) to the distributed AG (**DAG**). ++To join the target AG to the distributed AG, run this script on the target: ++```sql +ALTER AVAILABILITY GROUP [DAG] +JOIN +AVAILABILITY GROUP ON + 'OnPremAG' WITH + (LISTENER_URL = 'tcp://OnPremNode.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ), + 'AzureAG' WITH + (LISTENER_URL = 'tcp://SQLVM.contoso.com:5022', + AVAILABILITY_MODE = ASYNCHRONOUS_COMMIT, + FAILOVER_MODE = MANUAL, + SEEDING_MODE = AUTOMATIC + ); +GO +``` ++If you need to cancel, pause, or delay synchronization between the source and target availability groups (such as, for example, performance issues), run this script on the source global primary instance (**OnPremNode**): ++```sql +ALTER AVAILABILITY GROUP [DAG] + MODIFY + AVAILABILITY GROUP ON + 'AzureAG' WITH + ( SEEDING_MODE = MANUAL ); +``` ++To learn more, review [cancel automatic seeding to forwarder](/sql/database-engine/availability-groups/windows/configure-distributed-availability-groups#cancel-automatic-seeding-to-forwarder). ++## Next steps ++After your distributed availability group is created, you are ready to [complete the migration](sql-server-distributed-availability-group-complete-migration.md). |
| azure-sql | Sql Server Failover Cluster Instance To Sql On Azure Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-failover-cluster-instance-to-sql-on-azure-vm.md | Title: Migrate failover cluster instance+ description: Learn how to lift and shift your Always On failover cluster instance high availability solution to SQL Server on Azure VMs using Azure Migrate. Prepare Azure for migration with Server Migration. **Task** | **Details** | **Create an Azure Migrate project** | Your Azure account needs Contributor or Owner permissions to [create a new project](../../../migrate/create-manage-projects.md).-**Verify permissions for your Azure account** | Your Azure account needs Contributor or Owner permissions on the Azure subscription, permissions to register Azure Active Directory (AAD) apps, and User Access Administrator permissions on the Azure subscription to create a Key Vault, to create a VM, and to write to an Azure managed disk. +**Verify permissions for your Azure account** | Your Azure account needs Contributor or Owner permissions on the Azure subscription, permissions to register Azure Active Directory (Azure AD) apps, and User Access Administrator permissions on the Azure subscription to create a Key Vault, to create a VM, and to write to an Azure managed disk. **Set up an Azure virtual network** | [Setup](../../../virtual-network/manage-virtual-network.md#create-a-virtual-network) an Azure virtual network (VNet). When you replicate to Azure, Azure VMs are created and joined to the Azure VNet that you specify when you set up migration. |
| azure-sql | Sql Server To Sql On Azure Vm Individual Databases Guide | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-to-sql-on-azure-vm-individual-databases-guide.md | Title: "SQL Server to SQL Server on Azure Virtual Machines: Migration guide"+ description: In this guide, you learn how to migrate your individual SQL Server databases to SQL Server on Azure Virtual Machines. |
| azure-sql | Sql Server To Sql On Azure Vm Migration Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/migration-guides/virtual-machines/sql-server-to-sql-on-azure-vm-migration-overview.md | Title: SQL Server to SQL Server on Azure VM (Migration overview)+ description: Learn about the different migration strategies when you want to migrate your SQL Server to SQL Server on Azure VMs. The following table details all available methods to migrate your SQL Server dat |**Method** | **Minimum source version** | **Minimum target version** | **Source backup size constraint** | **Notes** | | | | | | | | **[Azure SQL Migration extension for Azure Data Studio](../../../dms/migration-using-azure-data-studio.md)** | SQL Server 2005 | SQL Server 2008 | [Azure VM storage limit](../../../index.yml) | This is an easy to use wizard based extension in Azure Data Studio for migrating SQL Server database(s) to SQL Server on Azure virtual machines. Use compression to minimize backup size for transfer. <br /><br /> The Azure SQL Migration extension for Azure Data Studio provides both assessment and migration capabilities in a simple user interface. |+| **[Distributed availability group](sql-server-distributed-availability-group-migrate-prerequisites.md)** | SQL Server 2016| SQL Server 2016 | [Azure VM storage limit](../../../index.yml) | A [distributed availability group](/sql/database-engine/availability-groups/windows/distributed-availability-groups) is a special type of availability group that spans two separate availability groups. The availability groups that participate in a distributed availability group do not need to be in the same location and include cross-domain support. <br /><br /> This method minimizes downtime, use when you have an availability group configured on-premises. <br /><br /> **Automation & scripting**: [T-SQL](/sql/t-sql/statements/alter-availability-group-transact-sql) | | **[Backup to a file](sql-server-to-sql-on-azure-vm-individual-databases-guide.md#migrate)** | SQL Server 2008 SP4 | SQL Server 2008 SP4| [Azure VM storage limit](../../../index.yml) | This is a simple and well-tested technique for moving databases across machines. Use compression to minimize backup size for transfer. <br /><br /> **Automation & scripting**: [Transact-SQL (T-SQL)](/sql/t-sql/statements/backup-transact-sql) and [AzCopy to Blob storage](../../../storage/common/storage-use-azcopy-v10.md) | | **[Backup to URL](/sql/relational-databases/backup-restore/sql-server-backup-to-url)** | SQL Server 2012 SP1 CU2 | SQL Server 2012 SP1 CU2| 12.8 TB for SQL Server 2016, otherwise 1 TB | An alternative way to move the backup file to the VM using Azure storage. Use compression to minimize backup size for transfer. <br /><br /> **Automation & scripting**: [T-SQL or maintenance plan](/sql/relational-databases/backup-restore/sql-server-backup-to-url) | | **[Database Migration Assistant (DMA)](/sql/dma/dma-overview)** | SQL Server 2005| SQL Server 2008 SP4| [Azure VM storage limit](../../../index.yml) | The [DMA](/sql/dma/dma-overview) assesses SQL Server on-premises and then seamlessly upgrades to later versions of SQL Server or migrates to SQL Server on Azure VMs, Azure SQL Database or Azure SQL Managed Instance. <br /><br /> Should not be used on Filestream-enabled user databases.<br /><br /> DMA also includes capability to migrate [SQL and Windows logins](/sql/dma/dma-migrateserverlogins) and assess [SSIS Packages](/sql/dma/dma-assess-ssis). <br /><br /> **Automation & scripting**: [Command line interface](/sql/dma/dma-commandline) | | **[Detach and attach](../../virtual-machines/windows/migrate-to-vm-from-sql-server.md#detach-and-attach-from-a-url)** | SQL Server 2008 SP4 | SQL Server 2014 | [Azure VM storage limit](../../../index.yml) | Use this method when you plan to [store these files using the Azure Blob storage service](/sql/relational-databases/databases/sql-server-data-files-in-microsoft-azure) and attach them to an instance of SQL Server on an Azure VM, particularly useful with very large databases or when the time to backup and restore is too long. <br /><br /> **Automation & scripting**: [T-SQL](/sql/relational-databases/databases/detach-a-database#TsqlProcedure) and [AzCopy to Blob storage](../../../storage/common/storage-use-azcopy-v10.md)| |**[Log shipping](sql-server-to-sql-on-azure-vm-individual-databases-guide.md#migrate)** | SQL Server 2008 SP4 (Windows Only) | SQL Server 2008 SP4 (Windows Only) | [Azure VM storage limit](../../../index.yml) | Log shipping replicates transactional log files from on-premises on to an instance of SQL Server on an Azure VM. <br /><br /> This provides minimal downtime during failover and has less configuration overhead than setting up an Always On availability group. <br /><br /> **Automation & scripting**: [T-SQL](/sql/database-engine/log-shipping/log-shipping-tables-and-stored-procedures) |-| **[Distributed availability group](../../virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview.md#hybrid-it-disaster-recovery-solutions)** | SQL Server 2016| SQL Server 2016 | [Azure VM storage limit](../../../index.yml) | A [distributed availability group](/sql/database-engine/availability-groups/windows/distributed-availability-groups) is a special type of availability group that spans two separate availability groups. The availability groups that participate in a distributed availability group do not need to be in the same location and include cross-domain support. <br /><br /> This method minimizes downtime, use when you have an availability group configured on-premises. <br /><br /> **Automation & scripting**: [T-SQL](/sql/t-sql/statements/alter-availability-group-transact-sql) | | | | | | | |
| azure-sql | Doc Changes Updates Release Notes Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/virtual-machines/windows/doc-changes-updates-release-notes-whats-new.md | -## December 2021 -+## January 2022 | Changes | Details | | | |-| **Deployment configuration improvements** | It's now possible to configure the following options when deploying your SQL Server VM from an Azure marketplace image: System database location, number of tempdb data files, collation, max degree of parallelism, min and max server memory settings, and optimize for ad hoc workloads. Review [Deploy SQL Server VM](create-sql-vm-portal.md) to learn more. | -| **Automated backup improvements** | The possible maximum automated backup retention period has changed from 30 days to 90, and you're now able to choose a specific container within the storage account. Review [automated backup](automated-backup.md) to learn more. | -| **Tempdb configuration** | You can now modify tempdb settings directly from the [SQL virtual machines](manage-sql-vm-portal.md) blade in the Azure portal, such as increasing the size, and adding data files. | +| **Migrate with distributed AG** | It's now possible to migrate your database(s) from a [standalone instance](../../migration-guides/virtual-machines/sql-server-distributed-availability-group-migrate-standalone-instance.md) of SQL Server or an [entire availability group](../../migration-guides/virtual-machines/sql-server-distributed-availability-group-migrate-ag.md) over to SQL Server on Azure VMs using a distributed availability group! See the [prerequisites](../../migration-guides/virtual-machines/sql-server-distributed-availability-group-migrate-prerequisites.md) to get started. | | | | -## November 2021 --| Changes | Details | -| | | -| **Eliminate need for HADR Azure Load Balancer or DNN** | Deploy your SQL Server VMs to multiple subnets to eliminate the dependency on the Azure Load Balancer or distributed network name (DNN) to route traffic to your high availability / disaster recovery (HADR) solution! See the [multi-subnet availability group](availability-group-manually-configure-prerequisites-tutorial-multi-subnet.md) tutorial, or [prepare SQL Server VM for FCI](failover-cluster-instance-prepare-vm.md#subnets) article to learn more. | -| **SQL Assessment** | It's now possible to assess the health of your SQL Server VM in the Azure portal using [SQL Assessment](sql-assessment-for-sql-vm.md) to surface recommendations that improve performance, and identify missing best practices configurations. This feature is currently in preview. | -| | | -## October 2021 +## 2021 | Changes | Details | | | |+| **Deployment configuration improvements** | It's now possible to configure the following options when deploying your SQL Server VM from an Azure Marketplace image: System database location, number of tempdb data files, collation, max degree of parallelism, min and max server memory settings, and optimize for ad hoc workloads. Review [Deploy SQL Server VM](create-sql-vm-portal.md) to learn more. | +| **Automated backup improvements** | The possible maximum automated backup retention period has changed from 30 days to 90, and you're now able to choose a specific container within the storage account. Review [automated backup](automated-backup.md) to learn more. | +| **Tempdb configuration** | You can now modify tempdb settings directly from the [SQL virtual machines](manage-sql-vm-portal.md) blade in the Azure portal, such as increasing the size, and adding data files. | +| **Eliminate need for HADR Azure Load Balancer or DNN** | Deploy your SQL Server VMs to multiple subnets to eliminate the dependency on the Azure Load Balancer or distributed network name (DNN) to route traffic to your high availability / disaster recovery (HADR) solution! See the [multi-subnet availability group](availability-group-manually-configure-prerequisites-tutorial-multi-subnet.md) tutorial, or [prepare SQL Server VM for FCI](failover-cluster-instance-prepare-vm.md#subnets) article to learn more. | +| **SQL Assessment** | It's now possible to assess the health of your SQL Server VM in the Azure portal using [SQL Assessment](sql-assessment-for-sql-vm.md) to surface recommendations that improve performance, and identify missing best practices configurations. This feature is currently in preview. | | **SQL IaaS extension now supports Ubuntu** | Support has been added to [register](../linux/sql-iaas-agent-extension-register-vm-linux.md) your SQL Server VM running on Ubuntu Linux with the [SQL Server IaaS Extension](../linux/sql-server-iaas-agent-extension-linux.md) for limited functionality. | -| | | ---## September 2021 --| Changes | Details | -| | | | **SQL IaaS extension full mode no longer requires restart** | Restarting the SQL Server service is no longer necessary when registering your SQL Server VM with the [SQL IaaS Agent extension](sql-server-iaas-agent-extension-automate-management.md) in [full mode](sql-agent-extension-manually-register-single-vm.md#full-mode)! | -| | | ---## July 2021 --| Changes | Details | -| | | | **Repair SQL Server IaaS extension in portal** | It's now possible to verify the status of your SQL Server IaaS Agent extension directly from the Azure portal, and [repair](sql-agent-extension-manually-register-single-vm.md#repair-extension) it, if necessary. | -| | | ---## June 2021 --| Changes | Details | -| | | | **Security enhancements in the Azure portal** | Once you've enabled [Azure Defender for SQL](../../../security-center/defender-for-sql-usage.md), you can view Security Center recommendations in the [SQL virtual machines resource in the Azure portal](manage-sql-vm-portal.md#security-center). | -| | | ---## May 2021 --| Changes | Details | -| | | | **HADR content refresh** | We've refreshed and enhanced our high availability and disaster recovery (HADR) content! There's now an [Overview of the Windows Server Failover Cluster](hadr-windows-server-failover-cluster-overview.md), as well as a consolidated [how-to configure quorum](hadr-cluster-quorum-configure-how-to.md) for SQL Server VMs. Additionally, we've enhanced the [cluster best practices](hadr-cluster-best-practices.md) with more comprehensive setting recommendations adopted to the cloud.| -| | | ---## April 2021 --| Changes | Details | -| | | -| **Migrate high availability to VM** | Azure Migrate brings support to lift and shift your entire high availability solution to SQL Server on Azure VMs! Bring your [availability group](../../migration-guides/virtual-machines/sql-server-availability-group-to-sql-on-azure-vm.md) or your [failover cluster instance](../../migration-guides/virtual-machines/sql-server-failover-cluster-instance-to-sql-on-azure-vm.md) to SQL Server VMs using Azure Migrate today! | -| | | --## March 2021 --| Changes | Details | -| | | +| **Migrate high availability to VM** | Azure Migrate brings support to lift and shift your entire high availability solution to SQL Server on Azure VMs! Bring your [availability group](../../migration-guides/virtual-machines/sql-server-availability-group-to-sql-on-azure-vm.md) or your [failover cluster instance](../../migration-guides/virtual-machines/sql-server-failover-cluster-instance-to-sql-on-azure-vm.md) to SQL Server VMs using Azure Migrate today! | **Performance best practices refresh** | We've rewritten, refreshed, and updated the performance best practices documentation, splitting one article into a series that contain: [a checklist](performance-guidelines-best-practices-checklist.md), [VM size guidance](performance-guidelines-best-practices-vm-size.md), [Storage guidance](performance-guidelines-best-practices-storage.md), and [collecting baseline instructions](performance-guidelines-best-practices-collect-baseline.md). | | | | + ## 2020 | Changes | Details | |
| azure-sql | Sql Agent Extension Manually Register Single Vm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-sql/virtual-machines/windows/sql-agent-extension-manually-register-single-vm.md | Upgrade the extension to full mode with Azure PowerShell: # Get the existing Compute VM $vm = Get-AzVM -Name <vm_name> -ResourceGroupName <resource_group_name> # Register with SQL IaaS Agent extension in full mode-Update-AzSqlVM -Name $vm.Name -ResourceGroupName $vm.ResourceGroupName -SqlManagementType Full -Location $vm.Location +Update-AzSqlVM -Name $vm.Name -ResourceGroupName $vm.ResourceGroupName -SqlManagementType Full ``` |
| azure-video-analyzer | Production Readiness | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-video-analyzer/video-analyzer-docs/edge/production-readiness.md | This article provides guidance on how to configure and deploy the Azure Video An You should consult your organization's IT department on aspects related to security. -## Creating the Video Analyzer account +## Create the Video Analyzer account When you [create](../create-video-analyzer-account.md) a Video Analyzer account, the following is recommended: When you [create](../create-video-analyzer-account.md) a Video Analyzer account, 1. Then, the owner should grant you [Contributor](../../../role-based-access-control/built-in-roles.md#contributor) and [User Access Administrator](../../../role-based-access-control/built-in-roles.md#user-access-administrator) roles to that resource group. 1. You can then create the relevant resources: Storage account, IoT Hub, user-assigned managed identity, and Video Analyzer account under that resource group. -## Running the module as a local user +## Run the module as a local user When you deploy the Video Analyzer edge module to an IoT Edge device, by default it runs with elevated privileges. You can check this using the logs from the module (`sudo iotedge logs {name-of-module}`) which would show: When you deploy the Video Analyzer edge module to an IoT Edge device, by default The sections below discuss how you can address the above warning. -### Creating and using a local user account +### Create and use a local user account You can and should run the Video Analyzer edge module in production using an account with as few privileges as possible. The following commands, for example, show how you can create a local user account on a Linux VM: Next, in the deployment manifest, you can set the LOCAL_USER_ID and LOCAL_GROUP_ … ``` -### Granting permissions to device storage +### Grant permissions to device storage The Video Analyzer edge module requires the ability to write files to the local file system when: |
| backup | Backup Rbac Rs Vault | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/backup/backup-rbac-rs-vault.md | Title: Manage Backups with Azure role-based access control description: Use Azure role-based access control to manage access to backup management operations in Recovery Services vault. Previously updated : 03/09/2021 Last updated : 01/12/2022 # Use Azure role-based access control to manage Azure Backup recovery points The following table captures the Backup management actions and corresponding min | | Virtual Machine Contributor | VM resource | Alternatively, instead of a built-in-role, you can consider a custom role which has the following permissions: Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/read Microsoft.Compute/virtualMachines/instanceView/read | | On-demand backup of VM | Backup Operator | Recovery Services vault | | | Restore VM | Backup Operator | Recovery Services vault | |-| | Contributor | Resource group in which VM will be deployed | Alternatively, instead of a built-in-role, you can consider a custom role which has the following permissions: Microsoft.Resources/subscriptions/resourceGroups/write Microsoft.DomainRegistration/domains/write, Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/read Microsoft.Network/virtualNetworks/read Microsoft.Network/virtualNetworks/subnets/join/action | +| | Contributor | Resource group in which VM will be deployed | Alternatively, instead of a built-in-role, you can consider a custom role which has the following permissions: Microsoft.Resources/subscriptions/resourceGroups/write Microsoft.DomainRegistration/domains/write, Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/read Microsoft.Network/virtualNetworks/read Microsoft.Network/virtualNetworks/subnets/read Microsoft.Network/virtualNetworks/subnets/join/action | | | Virtual Machine Contributor | Source VM that got backed up | Alternatively, instead of a built-in-role, you can consider a custom role which has the following permissions: Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/read| | Restore unmanaged disks VM backup | Backup Operator | Recovery Services vault | | | Virtual Machine Contributor | Source VM that got backed up | Alternatively, instead of a built-in-role, you can consider a custom role which has the following permissions: Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/read | |
| batch | Automatic Certificate Rotation | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/batch/automatic-certificate-rotation.md | Request Body "authenticationSettings": { "msiEndpoint": "http://169.254.169.254/metadata/identity", "msiClientId": "b9f6dd56-d2d6-4967-99d7-8062d56fd84c"- } }, "protectedSettings":{} - } ] } + } + }, + } + ] + } }, "scaleSettings": { "fixedScale": { |
| batch | Batch Job Prep Release | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/batch/batch-job-prep-release.md | Title: Create tasks to prepare and complete jobs on compute nodes description: Make job-level preparation tasks to minimize data transfer to Azure Batch compute nodes, and release tasks for node cleanup at job completion. Previously updated : 12/20/2021 Last updated : 01/12/2021 ms.devlang: csharp -# reate tasks to prepare and complete jobs on Batch compute nodes +# Create tasks to prepare and complete jobs on Batch compute nodes - An Azure Batch job often requires some form of setup before its tasks are executed. It also may require post-job maintenance when its tasks are completed. For example, you might need to download common task input data to your compute nodes, or upload task output data to Azure Storage after the job completes. You can use **job preparation** and **job release** tasks to perform these operations. +An Azure Batch job often requires some form of setup before its tasks are executed. It also may require post-job maintenance when its tasks are completed. For example, you might need to download common task input data to your compute nodes, or upload task output data to Azure Storage after the job completes. You can use **job preparation** and **job release** tasks to perform these operations. ## What are job preparation and release tasks? |
| batch | Batch Pool No Public Ip Address | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/batch/batch-pool-no-public-ip-address.md | Title: Create an Azure Batch pool without public IP addresses -description: Learn how to create a pool without public IP addresses + Title: Create an Azure Batch pool without public IP addresses (preview) +description: Learn how to create an Azure Batch pool without public IP addresses. Previously updated : 12/13/2021 Last updated : 01/11/2022 -# Create an Azure Batch pool without public IP addresses +# Create an Azure Batch pool without public IP addresses (preview) ++> [!IMPORTANT] +> Support for pools without public IP addresses in Azure Batch is currently in public preview for the following regions: France Central, East Asia, West Central US, South Central US, West US 2, East US, North Europe, East US 2, Central US, West Europe, North Central US, West US, Australia East, Japan East, Japan West. +> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. +> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). When you create an Azure Batch pool, you can provision the virtual machine configuration pool without a public IP address. This article explains how to set up a Batch pool without public IP addresses. By default, all the compute nodes in an Azure Batch virtual machine configuratio To restrict access to these nodes and reduce the discoverability of these nodes from the internet, you can provision the pool without public IP addresses. -> [!IMPORTANT] -> Support for pools without public IP addresses in Azure Batch is currently in public preview for the following regions: France Central, East Asia, West Central US, South Central US, West US 2, East US, North Europe, East US 2, Central US, West Europe, North Central US, West US, Australia East, Japan East, Japan West. -> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. -> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). - ## Prerequisites - **Authentication**. To use a pool without public IP addresses inside a [virtual network](./batch-virtual-network.md), the Batch client API must use Azure Active Directory (AD) authentication. Azure Batch support for Azure AD is documented in [Authenticate Batch service solutions with Active Directory](batch-aad-auth.md). If you aren't creating your pool within a virtual network, either Azure AD authentication or key-based authentication can be used. |
| cognitive-services | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/cognitive-services/Face/Overview.md | keywords: facial recognition, facial recognition software, facial analysis, face # What is the Azure Face service? > [!WARNING]-> On June 11, 2020, Microsoft announced that it will not sell facial recognition technology to police departments in the United States until strong regulation, grounded in human rights, has been enacted. As such, customers may not use facial recognition features or functionality included in Azure Services, such as Face or Video Indexer, if a customer is, or is allowing use of such services by or for, a police department in the United States. When you create a new Face resource, you must acknowledge and agree in Azure Portal that you will not use the service by or for a police department in the United States and that you have reviewed the [Responsible AI (RAI) documentation](../cognitive-services-apis-create-account-cli.md#prerequisites) and will use this service in accordance with it. +> On June 11, 2020, Microsoft announced that it will not sell facial recognition technology to police departments in the United States until strong regulation, grounded in human rights, has been enacted. As such, customers may not use facial recognition features or functionality included in Azure Services, such as Face or Video Indexer, if a customer is, or is allowing use of such services by or for, a police department in the United States. When you create a new Face resource, you must acknowledge and agree in the Azure Portal that you will not use the service by or for a police department in the United States and that you have reviewed the Responsible AI documentation and will use this service in accordance with it. The Azure Face service provides AI algorithms that detect, recognize, and analyze human faces in images. Facial recognition software is important in many different scenarios, such as identity verification, touchless access control, and face blurring for privacy. |
| cognitive-services | Export Knowledge Base | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/cognitive-services/QnAMaker/Tutorials/export-knowledge-base.md | + + Title: Export knowledge bases - QnA Maker +description: Exporting a knowledge base requires exporting from one knowledge base, then importing into another. +++ Last updated : 11/09/2020+++# Move a knowledge base using export-import ++You may want to create a copy of your knowledge base for several reasons: ++* Copy a knowledge base from QnA Maker GA to Custom question answering +* To implement a backup and restore process +* Integrate with your CI/CD pipeline +* When you wish to move your data to different regions ++## Prerequisites ++> * If you don't have an Azure subscription, [create a free account](https://azure.microsoft.com/free/cognitive-services/) before you begin. +> * A [QnA Maker resource](https://ms.portal.azure.com/#create/Microsoft.CognitiveServicesQnAMaker) created in the Azure portal. Remember your Azure Active Directory ID, Subscription, QnA resource name you selected when you created the resource. +> * Set up a new [QnA Maker service](../How-To/set-up-qnamaker-service-azure.md) ++## Export a knowledge base +1. Sign in to [QnA Maker portal](https://qnamaker.ai). +1. Select the knowledge base you want to move. ++1. On the **Settings** page, you have the options to export **QnAs**, **Synonyms**, or **Knowledge Base Replica**. You can choose to download the data in .tsv/.xlsx. ++ 1. **QnAs**: When exporting QnAs, all QnA pairs (with questions, answers, metadata, follow-up prompts, and the data source names) are downloaded. The QnA IDs that are exported with the questions and answers may be used to update a specific QnA pair using the [update API](/rest/api/cognitiveservices/qnamaker/knowledgebase/update). The QnA ID for a specific QnA pair remains unchanged across multiple export operations. + 2. **Synonyms**: You can export Synonyms that have been added to the knowledge base. + 4. **Knowledge Base Replica**: If you want to download the entire knowledge base with synonyms and other settings, you can choose this option. ++## Import a knowledge base +1. Click **Create a knowledge base** from the top menu of the qnamaker.ai portal and then create an _empty_ knowledge base by not adding any URLs or files. Set the name of your choice for the new knowledge base and then ClickΓÇ»**Create your KB**. ++1. In this new knowledge base, open the **Settings** tab and and under _Import knowledge base_ select one of the following options: **QnAs**, **Synonyms**, or **Knowledge Base Replica**. ++ 1. **QnAs**: This option imports all QnA pairs. **The QnA pairs created in the new knowledge base shall have the same QnA ID as present in the exported file**. You can refer [SampleQnAs.xlsx](https://aka.ms/qnamaker-sampleqnas), [SampleQnAs.tsv](https://aka.ms/qnamaker-sampleqnastsv) to import QnAs. + 2. **Synonyms**: This option can be used to import synonyms to the knowledge base. You can refer [SampleSynonyms.xlsx](https://aka.ms/qnamaker-samplesynonyms), [SampleSynonyms.tsv](https://aka.ms/qnamaker-samplesynonymstsv) to import synonyms. + 3. **Knowledge Base Replica**: This option can be used to import KB replica with QnAs, Synonyms and Settings. You can refer [KBReplicaSampleExcel](https://aka.ms/qnamaker-samplereplica), [KBReplicaSampleTSV](https://aka.ms/qnamaker-samplereplicatsv) for more details. If you also want to add unstructured content to the replica, refer [CustomQnAKBReplicaSample](https://aka.ms/qnamaker-samplev2replica). ++ Either QnAs or Unstructured content is required when importing replica. Unstructured documents are only valid for Custom question answering. + Synonyms file is not mandatory when importing replica. + Settings file is mandatory when importing replica. ++ |Settings|Update permitted when importing to QnA Maker KB?|Update permitted when importing to Custom question answering KB?| + |:--|--|--| + |DefaultAnswerForKB|No|Yes| + |EnableActiveLearning (True/False)|Yes|No| + |EnableMultiTurnExtraction (True/False)|Yes|Yes| + |DefaultAnswerforMultiturn|Yes|Yes| + |Language|No|No| ++1. **Test** the new knowledge base using the Test panel. Learn how to [test your knowledge base](../How-To/test-knowledge-base.md). ++1. **Publish** the knowledge base and create a chat bot. Learn how to [publish your knowledge base](../Quickstarts/create-publish-knowledge-base.md#publish-the-knowledge-base). ++ > [!div class="mx-imgBorder"] + >  ++## Programmatically export a knowledge base from QnA Maker ++The export/import process is programmatically available using the following REST APIs: ++**Export** ++* [Download knowledge base API](/rest/api/cognitiveservices/qnamaker4.0/knowledgebase/download) ++**Import** ++* [Replace API (reload with same knowledge base ID)](/rest/api/cognitiveservices/qnamaker4.0/knowledgebase/replace) +* [Create API (load with new knowledge base ID)](/rest/api/cognitiveservices/qnamaker4.0/knowledgebase/create) ++## Chat logs ++There is no way to export chat logs, since the new knowledge base uses Application Insights for storing chat logs. ++## Next steps ++> [!div class="nextstepaction"] +> [Edit a knowledge base](../How-To/edit-knowledge-base.md) |
| cognitive-services | Quickstart Translator | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/cognitive-services/Translator/quickstart-translator.md | In this quickstart, you learn to use the Translator service via REST. You start * [Add Newtonsoft.Json using .NET CLI](https://www.nuget.org/packages/Newtonsoft.Json/). * Run the program from the project directory: ``dotnet run`` -> [!div class="nextstepaction"] -> [I created a project](#headers) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=platform-setup) # [Go](#tab/go) In this quickstart, you learn to use the Translator service via REST. You start * Build the file, for example: 'go build example-code.go'. * Run the file, for example: 'example-code'. -> [!div class="nextstepaction"] -> [I created a project](#headers) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=platform-setup) - # [Java](#tab/java) * Create a working directory for your project. For example: `mkdir sample-project`. In this quickstart, you learn to use the Translator service via REST. You start * Create a Java file and copy in the code from the provided sample. Don't forget to add your subscription key. * Run the sample: `gradle run`. -> [!div class="nextstepaction"] -> [I created a project](#headers) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=platform-setup) + # [Node.js](#tab/nodejs) In this quickstart, you learn to use the Translator service via REST. You start * Set your subscription key. * Run the program. For example: `node Translate.js`. -> [!div class="nextstepaction"] -> [I created a project](#headers) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=platform-setup) + # [Python](#tab/python) In this quickstart, you learn to use the Translator service via REST. You start * Set your subscription key. * Run the program. For example: `python translate.py`. -> [!div class="nextstepaction"] -> [I created a project](#headers) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=platform-setup) + class Program } ``` -> [!div class="nextstepaction"] -> [I translated text](#detect-language) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=translate-text) # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I translated text](#detect-language) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=translate-text) # [Java](#tab/java) public class Translate { } ``` -> [!div class="nextstepaction"] -> [I translated text](#detect-language) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=translate-text) # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I translated text](#detect-language) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=translate-text) + # [Python](#tab/python) response = request.json() print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I translated text](#detect-language) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=translate-text) class Program } ``` -> [!div class="nextstepaction"] -> [I detected source language during translation](#detect-source-language-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=detect-source-language-during-translation) - # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I detected source language during translation](#detect-source-language-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=detect-source-language-during-translation) + # [Java](#tab/java) public class Translate { } ``` -> [!div class="nextstepaction"] -> [I detected source language during translation](#detect-source-language-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=detect-source-language-during-translation) # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I detected source language during translation](#detect-source-language-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=detect-source-language-during-translation) # [Python](#tab/python) response = request.json() print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I detected source language during translation](#detect-source-language-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=detect-source-language-during-translation) class Program } ``` -> [!div class="nextstepaction"] -> [I detected source languages without translation](#transliterate-text) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=detect-source-language-without-translation) # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I detected source languages without translation](#transliterate-text) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=detect-source-language-without-translation) # [Java](#tab/java) public class Detect { } ``` -> [!div class="nextstepaction"] -> [I detected source languages without translation](#transliterate-text) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=detect-source-language-without-translation) # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I detected source languages without translation](#transliterate-text) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=detect-source-language-without-translation) # [Python](#tab/python) ```python response = request.json() print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I detected source languages without translation](#transliterate-text) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=detect-source-language-without-translation) class Program } ``` -> [!div class="nextstepaction"] -> [I transliterated text during translation](#transliterate-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=transliterate-during-translation) # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I transliterated text during translation](#transliterate-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=transliterate-during-translation) # [Java](#tab/java) public class Translate { } ``` -> [!div class="nextstepaction"] -> [I transliterated text during translation](#transliterate-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=transliterate-during-translation) # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I transliterated text during translation](#transliterate-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=transliterate-during-translation) # [Python](#tab/python) ```Python response = request.json() print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I transliterated text during translation](#transliterate-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=transliterate-during-translation) class Program } ``` -> [!div class="nextstepaction"] -> [I transliterated text without translation](#get-sentence-length) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=transliterate-without-translation) # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I transliterated text without translation](#get-sentence-length) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=transliterate-without-translation) + # [Java](#tab/java) public class Transliterate { } ``` -> [!div class="nextstepaction"] -> [I transliterated text without translation](#get-sentence-length) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=transliterate-without-translation) # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I transliterated text without translation](#get-sentence-length) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=transliterate-without-translation) # [Python](#tab/python) ```python response = request.json() print(json.dumps(response, sort_keys=True, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I transliterated text without translation](#get-sentence-length) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=transliterate-without-translation) class Program } ``` -> [!div class="nextstepaction"] -> [I got sentence length during translation](#get-sentence-length-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-during-translation) # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I got sentence length during translation](#get-sentence-length-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-during-translation) + # [Java](#tab/java) public class Translate { } ``` -> [!div class="nextstepaction"] -> [I got sentence length during translation](#get-sentence-length-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-during-translation) - # [Node.js](#tab/nodejs) ```javascript axios({ }) ``` -> [!div class="nextstepaction"] -> [I got sentence length during translation](#get-sentence-length-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-during-translation) # [Python](#tab/python) ```python response = request.json() print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I got sentence length during translation](#get-sentence-length-without-translation) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-during-translation) + class Program } ``` -> [!div class="nextstepaction"] -> [I got sentence length without translation](#dictionary-lookup-alternate-translations) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-without-translation) + # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I got sentence length without translation](#dictionary-lookup-alternate-translations) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-without-translation) - # [Java](#tab/java) ```java public class BreakSentence { } ``` -> [!div class="nextstepaction"] -> [I got sentence length without translation](#dictionary-lookup-alternate-translations) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-without-translation) + # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I got sentence length without translation](#dictionary-lookup-alternate-translations) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-without-translation) + # [Python](#tab/python) ```python response = request.json() print(json.dumps(response, sort_keys=True, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I got sentence length without translation](#dictionary-lookup-alternate-translations) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=get-sentence-length-without-translation) class Program } ``` -> [!div class="nextstepaction"] -> [I got alternate translations](#dictionary-examples-translations-in-context) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=dictionary-lookup-alternate-translations) # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I got alternate translations](#dictionary-examples-translations-in-context) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=dictionary-lookup-alternate-translations) # [Java](#tab/java) public class DictionaryLookup { } ``` -> [!div class="nextstepaction"] -> [I got alternate translations](#dictionary-examples-translations-in-context) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=dictionary-lookup-alternate-translations) + # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I got alternate translations](#dictionary-examples-translations-in-context) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=dictionary-lookup-alternate-translations) # [Python](#tab/python) ```python response = request.json() print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I got alternate translations](#dictionary-examples-translations-in-context) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=dictionary-lookup-alternate-translations) class Program } ``` -> [!div class="nextstepaction"] -> [I got translations in context](#next-steps) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Csharp&Product=Translator&Page=quickstart-translator&Section=dictionary-examples-translations-in-context) + # [Go](#tab/go) func main() { } ``` -> [!div class="nextstepaction"] -> [I got translations in context](#next-steps) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Go&Product=Translator&Page=quickstart-translator&Section=dictionary-examples-translations-in-context) # [Java](#tab/java) public class DictionaryExamples { } ``` -> [!div class="nextstepaction"] -> [I got translations in context](#troubleshooting) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Java&Product=Translator&Page=quickstart-translator&Section=dictionary-examples-translations-in-context) # [Node.js](#tab/nodejs) axios({ }) ``` -> [!div class="nextstepaction"] -> [I got translations in context](#next-steps) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Nodejs&Product=Translator&Page=quickstart-translator&Section=dictionary-examples-translations-in-context) # [Python](#tab/python) ```python response = request.json() print(json.dumps(response, sort_keys=True, ensure_ascii=False, indent=4, separators=(',', ': '))) ``` -> [!div class="nextstepaction"] -> [I got translations in context](#next-steps) [I ran into an issue](https://microsoft.qualtrics.com/jfe/form/SV_0Cl5zkG3CnDjq6O?PLanguage=Python&Product=Translator&Page=quickstart-translator&Section=dictionary-examples-translations-in-context) + |
| cognitive-services | Cognitive Services Container Support | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/cognitive-services/cognitive-services-container-support.md | Azure Cognitive Services containers provide the following set of Docker containe | Service | Container | Description | Availability | |--|--|--|--|-| [Computer Vision][cv-containers] | **Read OCR** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-vision-read)) | The Read OCR container allows you to extract printed and handwritten text from images and documents with support for JPEG, PNG, BMP, PDF, and TIFF file formats. For more information, see the [Read API documentation](./computer-vision/overview-ocr.md). | Gated preview. [Request access][request-access]. | +| [Computer Vision][cv-containers] | **Read OCR** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-vision-read)) | The Read OCR container allows you to extract printed and handwritten text from images and documents with support for JPEG, PNG, BMP, PDF, and TIFF file formats. For more information, see the [Read API documentation](./computer-vision/overview-ocr.md). | Generally Available. | | [Spatial Analysis][spa-containers] | **Spatial analysis** ([image](https://hub.docker.com/_/microsoft-azure-cognitive-services-vision-spatial-analysis)) | Analyzes real-time streaming video to understand spatial relationships between people, their movement, and interactions with objects in physical environments. | Preview | <!-- |
| cognitive-services | Cognitive Search | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/cognitive-services/language-service/custom-named-entity-recognition/tutorials/cognitive-search.md | In this tutorial, you learn how to: Next you will need to prepare your secrets for your Azure function. Your project secrets are your: * Endpoint * Resource key-* Model ID +* Deployment name ### Get your custom NER project secrets * You will need your **Project name**, Project names are case sensitive. -* You will also need the deployment slot. +* You will also need the deployment name. * If you have deployed your model via Language Studio, your deployment slot will be `prod` by default. * If you have deployed your model programmatically, using the API, this is the deployment name you assigned in your request. Replace `name-your-index-here` with the index name that appears in your Cognitiv ## Next steps -* [Search your app with with the Cognitive Search SDK](../../../../search/search-howto-dotnet-sdk.md#run-queries) +* [Search your app with with the Cognitive Search SDK](../../../../search/search-howto-dotnet-sdk.md#run-queries) |
| communication-services | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/communication-services/samples/overview.md | Azure Communication Services has many samples available, which you can use to te | [Contoso Medical App](https://github.com/Azure-Samples/communication-services-contoso-med-app) | Sample app demonstrating a patient-doctor flow. | Web & Node.js | | [Contoso Retail App](https://github.com/Azure-Samples/communication-services-contoso-retail-app) | Sample app demonstrating a retail support flow. | ASP.NET, .NET Core, JavaScript/Web | | [WPF Calling Sample](https://github.com/Azure-Samples/communication-services-web-calling-wpf-sample) | Sample app for Windows demonstrating calling functionality | WPF / Node.js |-| [WPF Network Traversal Sample]( https://github.com/Azure/azure-sdk-for-js/tree/master/sdk/communication/communication-network-traversal) | Sample app demonstrating network traversal functionality | WPF / Node.js +| [Network Traversal Sample]( https://github.com/Azure-Samples/communication-services-network-traversal-hero) | Sample app demonstrating network traversal functionality | Node.js ## Quickstart samples Access code samples for quickstarts found on our documentation. |
| data-factory | Data Flow Expression Functions | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/data-factory/data-flow-expression-functions.md | The following functions are only available in aggregate, pivot, unpivot, and win | [avgIf](data-flow-expression-functions.md#avgIf) | Based on a criteria gets the average of values of a column. | | [collect](data-flow-expression-functions.md#collect) | Collects all values of the expression in the aggregated group into an array. Structures can be collected and transformed to alternate structures during this process. The number of items will be equal to the number of rows in that group and can contain null values. The number of collected items should be small. | | [count](data-flow-expression-functions.md#count) | Gets the aggregate count of values. If the optional column(s) is specified, it ignores NULL values in the count. |+| [countAll](data-flow-expression-functions.md#countAll) | Gets the aggregate count of values including NULLs. | | [countDistinct](data-flow-expression-functions.md#countDistinct) | Gets the aggregate count of distinct values of a set of columns. |+| [countAllDistinct](data-flow-expression-functions.md#countAllDistinct) | Gets the aggregate count of distinct values of a set of columns including NULLs. | | [countIf](data-flow-expression-functions.md#countIf) | Based on a criteria gets the aggregate count of values. If the optional column is specified, it ignores NULL values in the count. | | [covariancePopulation](data-flow-expression-functions.md#covariancePopulation) | Gets the population covariance between two columns. | | [covariancePopulationIf](data-flow-expression-functions.md#covariancePopulationIf) | Based on a criteria, gets the population covariance of two columns. | Gets the aggregate count of values. If the optional column(s) is specified, it i * ``count(iif(isNull(custId), 1, NULL))`` ___ +<a name="countAll" ></a> ++### <code>countAll</code> +<code><b>countAll([<i><value1></i> : any]) => long</b></code><br/><br/> +Gets the aggregate count of values including nulls. +* ``countAll(custId)`` +* ``countAll()`` ++___ + <a name="countDistinct" ></a> Gets the aggregate count of distinct values of a set of columns. ___ +<a name="countAllDistinct" ></a> ++### <code>countAllDistinct</code> +<code><b>countAllDistinct(<i><value1></i> : any, [<i><value2></i> : any], ...) => long</b></code><br/><br/> +Gets the aggregate count of distinct values of a set of columns including nulls. +* ``countAllDistinct(custId, custName)`` +___ ++ <a name="countIf" ></a> ### <code>countIf</code> Gets the year value of a date. ## Next steps -[Learn how to use Expression Builder](concepts-data-flow-expression-builder.md). +[Learn how to use Expression Builder](concepts-data-flow-expression-builder.md). |
| data-factory | Quickstart Create Data Factory Copy Data Tool | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/data-factory/quickstart-create-data-factory-copy-data-tool.md | Last updated 07/05/2021 -# Quickstart: Use the Copy Data tool to copy data +# Quickstart: Use the Copy Data tool in the Azure Data Factory Studio to copy data > [!div class="op_single_selector" title1="Select the version of Data Factory service that you are using:"] > * [Version 1](v1/data-factory-copy-data-from-azure-blob-storage-to-sql-database.md) |
| data-factory | Quickstart Create Data Factory Portal | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/data-factory/quickstart-create-data-factory-portal.md | -# Quickstart: Create a data factory by using the Azure Data Factory UI +# Quickstart: Create a data factory by using the Azure portal and Azure Data Factory Studio > [!div class="op_single_selector" title1="Select the version of Data Factory service that you are using:"] > * [Version 1](v1/data-factory-copy-data-from-azure-blob-storage-to-sql-database.md) |
| databox | Data Box Limits | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/databox/data-box-limits.md | |
| defender-for-cloud | Alerts Reference | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/defender-for-cloud/alerts-reference.md | At the bottom of this page, there's a table describing the Microsoft Defender fo | **Antimalware scans blocked for files potentially related to malware campaigns on your virtual machine (Preview)**<br>(VM_AmMalwareCampaignRelatedExclusion) | An exclusion rule was detected in your virtual machine to prevent your antimalware extension scanning certain files that are suspected of being related to a malware campaign. The rule was detected by analyzing the Azure Resource Manager operations in your subscription. Attackers might exclude files from antimalware scans to prevent detection while running arbitrary code or infecting the machine with malware. | Defense Evasion | Medium | | **Antimalware temporarily disabled in your virtual machine**<br>(VM_AmTemporarilyDisablement) | Antimalware temporarily disabled in your virtual machine. This was detected by analyzing Azure Resource Manager operations in your subscription.<br>Attackers might disable the antimalware on your virtual machine to prevent detection. | - | Medium | | **Antimalware unusual file exclusion in your virtual machine**<br>(VM_UnusualAmFileExclusion) | Unusual file exclusion from antimalware extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.<br>Attackers might exclude files from the antimalware scan on your virtual machine to prevent detection while running arbitrary code or infecting the machine with malware. | Defense Evasion | Medium |+| **Communication with suspicious domain identified by threat intelligence**<br>(AzureDNS_ThreatIntelSuspectDomain) | Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised. | Initial Access, Persistence, Execution, Command And Control, Exploitation | Medium | | **Custom script extension with suspicious command in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousCmd) | Custom script extension with suspicious command was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.<br>Attackers may use custom script extension to execute a malicious code on your virtual machine via the Azure Resource Manager. | Execution | Medium | | **Custom script extension with suspicious entry-point in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousEntryPoint) | Custom script extension with a suspicious entry-point was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. The entry-point refers to a suspicious GitHub repository.<br>Attackers may use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager. | Execution | Medium | | **Custom script extension with suspicious payload in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousPayload) | Custom script extension with a payload from a suspicious GitHub repository was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.<br>Attackers may use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager. | Execution | Medium | At the bottom of this page, there's a table describing the Microsoft Defender fo |**Behavior similar to Fairware ransomware detected [seen multiple times]**|Analysis of host data on %{Compromised Host} detected the execution of rm -rf commands applied to suspicious locations. As rm -rf will recursively delete files, it is normally used on discrete folders. In this case, it is being used in a location that could remove a lot of data. Fairware ransomware is known to execute rm -rf commands in this folder. This behavior was seen [x] times today on the following machines: [Machine names]|-|Medium| |**Behavior similar to Fairware ransomware detected**<br>(VM_FairwareMalware)|Analysis of host data on %{Compromised Host} detected the execution of rm -rf commands applied to suspicious locations. As rm -rf will recursively delete files, it is normally used on discrete folders. In this case, it is being used in a location that could remove a lot of data. Fairware ransomware is known to execute rm -rf commands in this folder.|Execution|Medium| |**Behavior similar to ransomware detected [seen multiple times]**|Analysis of host data on %{Compromised Host} detected the execution of files that have resemblance of known ransomware that can prevent users from accessing their system or personal files, and demands ransom payment in order to regain access. This behavior was seen [x] times today on the following machines: [Machine names]|-|High|+|**Communication with suspicious domain identified by threat intelligence**<br>(AzureDNS_ThreatIntelSuspectDomain) | Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised. | Initial Access, Persistence, Execution, Command And Control, Exploitation | Medium | |**Container with a miner image detected**<br>(VM_MinerInContainerImage) | Machine logs indicate execution of a Docker container that run an image associated with a digital currency mining. | Execution | High | |**Custom script extension with suspicious command in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousCmd) | Custom script extension with suspicious command was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.<br>Attackers may use custom script extension to execute a malicious code on your virtual machine via the Azure Resource Manager. | Execution | Medium | |**Custom script extension with suspicious entry-point in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousEntryPoint) | Custom script extension with a suspicious entry-point was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. The entry-point refers to a suspicious GitHub repository.<br>Attackers may use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager. | Execution | Medium | At the bottom of this page, there's a table describing the Microsoft Defender fo | **An attempt to run Linux commands on a Windows App Service**<br>(AppServices_LinuxCommandOnWindows) | Analysis of App Service processes detected an attempt to run a Linux command on a Windows App Service. This action was running by the web application. This behavior is often seen during campaigns that exploit a vulnerability in a common web application.<br>(Applies to: App Service on Windows) | - | Medium | | **An IP that connected to your Azure App Service FTP Interface was found in Threat Intelligence**<br>(AppServices_IncomingTiClientIpFtp) | Azure App Service FTP log indicates a connection from a source address that was found in the threat intelligence feed. During this connection, a user accessed the pages listed.<br>(Applies to: App Service on Windows and App Service on Linux) | Initial Access | Medium | | **Attempt to run high privilege command detected**<br>(AppServices_HighPrivilegeCommand) | Analysis of App Service processes detected an attempt to run a command that requires high privileges.<br>The command ran in the web application context. While this behavior can be legitimate, in web applications this behavior is also observed in malicious activities.<br>(Applies to: App Service on Windows) | - | Medium |+| **Communication with suspicious domain identified by threat intelligence**<br>(AzureDNS_ThreatIntelSuspectDomain) | Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised. | Initial Access, Persistence, Execution, Command And Control, Exploitation | Medium | | **Connection to web page from anomalous IP address detected**<br>(AppServices_AnomalousPageAccess) | Azure App Service activity log indicates an anomalous connection to a sensitive web page from the listed source IP address. This might indicate that someone is attempting a brute force attack into your web app administration pages. It might also be the result of a new IP address being used by a legitimate user. If the source IP address is trusted, you can safely suppress this alert for this resource. To learn how to suppress security alerts, see [Suppress alerts from Microsoft Defender for Cloud](alerts-suppression-rules.md). <br>(Applies to: App Service on Windows and App Service on Linux) | Initial Access | Medium | | **Dangling DNS record for an App Service resource detected**<br>(AppServices_DanglingDomain) | A DNS record that points to a recently deleted App Service resource (also known as "dangling DNS" entry) has been detected. This leaves you susceptible to a subdomain takeover. Subdomain takeovers enable malicious actors to redirect traffic intended for an organization’s domain to a site performing malicious activity.<br>(Applies to: App Service on Windows and App Service on Linux) | - | High | | **Detected encoded executable in command line data**<br>(AppServices_Base64EncodedExecutableInCommandLineParams) | Analysis of host data on {Compromised host} detected a base-64 encoded executable. This has previously been associated with attackers attempting to construct executables on-the-fly through a sequence of commands, and attempting to evade intrusion detection systems by ensuring that no individual command would trigger an alert. This could be legitimate activity, or an indication of a compromised host.<br>(Applies to: App Service on Windows) | Defense Evasion, Execution | High | Microsoft Defender for Containers provides security alerts on the cluster level | **Attempted communication with suspicious sinkholed domain**<br>(AzureDNS_SinkholedDomain) | Analysis of DNS transactions from %{CompromisedEntity} detected request for sinkholed domain. Such activity, while possibly legitimate user behavior, is frequently an indication of the download or execution of malicious software. Typical related attacker activity is likely to include the download and execution of further malicious software or remote administration tools. | Exfiltration | - | | **Communication with possible phishing domain**<br>(AzureDNS_PhishingDomain) | Analysis of DNS transactions from %{CompromisedEntity} detected a request for a possible phishing domain. Such activity, while possibly benign, is frequently performed by attackers to harvest credentials to remote services. Typical related attacker activity is likely to include the exploitation of any credentials on the legitimate service. | Exfiltration | - | | **Communication with suspicious algorithmically generated domain**<br>(AzureDNS_DomainGenerationAlgorithm) | Analysis of DNS transactions from %{CompromisedEntity} detected possible usage of a domain generation algorithm. Such activity, while possibly benign, is frequently performed by attackers to evade network monitoring and filtering. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools. | Exfiltration | - |-| **Communication with suspicious domain identified by threat intelligence**<br>(AzureDNS_ThreatIntelSuspectDomain) | Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised." | Initial Access | Medium | +| **Communication with suspicious domain identified by threat intelligence**<br>(AzureDNS_ThreatIntelSuspectDomain) | Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised. | Initial Access | Medium | | **Communication with suspicious random domain name**<br>(AzureDNS_RandomizedDomain) | Analysis of DNS transactions from %{CompromisedEntity} detected usage of a suspicious randomly generated domain name. Such activity, while possibly benign, is frequently performed by attackers to evade network monitoring and filtering. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools. | Exfiltration | - | | **Digital currency mining activity**<br>(AzureDNS_CurrencyMining) | Analysis of DNS transactions from %{CompromisedEntity} detected digital currency mining activity. Such activity, while possibly legitimate user behavior, is frequently performed by attackers following compromise of resources. Typical related attacker activity is likely to include the download and execution of common mining tools. | Exfiltration | - | | **Network intrusion detection signature activation**<br>(AzureDNS_SuspiciousDomain) | Analysis of DNS transactions from %{CompromisedEntity} detected a known malicious network signature. Such activity, while possibly legitimate user behavior, is frequently an indication of the download or execution of malicious software. Typical related attacker activity is likely to include the download and execution of further malicious software or remote administration tools. | Exfiltration | - | |
| defender-for-cloud | Permissions | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/defender-for-cloud/permissions.md | Title: Permissions in Microsoft Defender for Cloud | Microsoft Docs description: This article explains how Microsoft Defender for Cloud uses role-based access control to assign permissions to users and identify the permitted actions for each role. Previously updated : 11/09/2021 Last updated : 01/12/2022 # Permissions in Microsoft Defender for Cloud The following table displays roles and allowed actions in Defender for Cloud. | Add/assign initiatives (including) regulatory compliance standards) | - | - | - | - | Γ£ö | | Edit security policy | - | Γ£ö | - | - | Γ£ö | | Enable / disable Microsoft Defender plans | - | Γ£ö | - | - | Γ£ö |-| Enable / disable auto provisioning | - | Γ£ö | - | Γ£ö | Γ£ö | | Dismiss alerts | - | Γ£ö | - | Γ£ö | Γ£ö | | Apply security recommendations for a resource</br> (and use [Fix](implement-security-recommendations.md#fix-button)) | - | - | Γ£ö | Γ£ö | Γ£ö | | View alerts and recommendations | Γ£ö | Γ£ö | Γ£ö | Γ£ö | Γ£ö | |||||| +For **auto provisioning**, the specific role required depends on the extension you're deploying. For full details, check the tab for the specific extension in the [availability table on the auto provisioning quick start page](enable-data-collection.md#availability). + > [!NOTE] > We recommend that you assign the least permissive role needed for users to complete their tasks. For example, assign the Reader role to users who only need to view information about the security health of a resource but not take action, such as applying recommendations or editing policies. |
| defender-for-cloud | Recommendations Reference Aws | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/defender-for-cloud/recommendations-reference-aws.md | Title: Reference table for all Microsoft Defender for Cloud recommendations for AWS resources description: This article lists Microsoft Defender for Cloud's security recommendations that help you harden and protect your AWS resources. Previously updated : 01/08/2022 Last updated : 01/12/2022 # Security recommendations for AWS resources - a reference guide |
| defender-for-cloud | Recommendations Reference | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/defender-for-cloud/recommendations-reference.md | description: This article lists Microsoft Defender for Cloud's security recommen Previously updated : 01/08/2022 Last updated : 01/12/2022 |
| defender-for-cloud | Release Notes | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/defender-for-cloud/release-notes.md | Title: Release notes for Microsoft Defender for Cloud description: A description of what's new and changed in Microsoft Defender for Cloud Previously updated : 01/06/2022 Last updated : 01/12/2022 # What's new in Microsoft Defender for Cloud? Updates in January include: - [Recommendations to enable Microsoft Defender plans on workspaces (in preview)](#recommendations-to-enable-microsoft-defender-plans-on-workspaces-in-preview) - [Auto provision Log Analytics agent to Azure Arc-enabled machines (preview)](#auto-provision-log-analytics-agent-to-azure-arc-enabled-machines-preview) - [Deprecated the recommendation to classify sensitive data in SQL databases](#deprecated-the-recommendation-to-classify-sensitive-data-in-sql-databases)+- [Communication with suspicious domain alert expanded to included known Log4Shell-related domains](#communication-with-suspicious-domain-alert-expanded-to-included-known-log4shell-related-domains) +- ['Copy alert JSON' button added to security alert details pane](#copy-alert-json-button-added-to-security-alert-details-pane) +- [Renamed two recommendations](#renamed-two-recommendations) ### Recommendations to enable Microsoft Defender plans on workspaces (in preview) We've removed the recommendation **Sensitive data in your SQL databases should b Advance notice of this change appeared for the last six months in the [Important upcoming changes to Microsoft Defender for Cloud](upcoming-changes.md) page. +### Communication with suspicious domain alert expanded to included known Log4Shell-related domains ++The following alert was previously only available to organizations who'd enabled the [Microsoft Defender for DNS](defender-for-dns-introduction.md) plan. ++With this update, the alert will also show for subscriptions with the [Microsoft Defender for servers](defender-for-servers-introduction.md) or [Defender for App Service](defender-for-app-service-introduction.md) plan enabled. ++In addition, [Microsoft Threat Intelligence](https://go.microsoft.com/fwlink/?linkid=2128684) has expanded the list of known malicious domains to include domains associated with exploiting the widely publicised vulnerabilities associated with Log4j. ++| Alert (alert type) | Description | MITRE tactics | Severity | +|-|-|:--:|-| +| **Communication with suspicious domain identified by threat intelligence**<br>(AzureDNS_ThreatIntelSuspectDomain) | Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised. | Initial Access / Persistence / Execution / Command And Control / Exploitation | Medium | ++### 'Copy alert JSON' button added to security alert details pane ++To help our users quickly share an alert's details with others (for example, SOC analysts, resource owners, and developers) we've added the capability to easily extract all the details of a specific alert with one button from the security alert's details pane. ++The new **Copy alert JSON** button puts the alertΓÇÖs details, in JSON format, into the user's clipboard. +++### Renamed two recommendations ++For consistency with other recommendation names, we've renamed the following two recommendations: ++- Recommendation to resolve vulnerabilities discovered in running container images + - Previous name: Vulnerabilities in running container images should be remediated (powered by Qualys) + - New name: Running container images should have vulnerability findings resolved ++- Recommendation to enable diagnostic logs for Azure App Service + - Previous name: Diagnostic logs should be enabled in App Service + - New name: Diagnostic logs in App Service should be enabled + ## December 2021 |
| devtest-labs | Create Application Centric Environment | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/devtest-labs/create-application-centric-environment.md | - Title: Create an application-centric environment with Colony -description: This article demonstrates how to create an application-centric environment with Colony and Azure. - Previously updated : 11/09/2021---# Create an application-centric environment with Colony --[Quali CloudShell Colony](https://azuremarketplace.microsoft.com/marketplace/apps/quali_systems.cloudshell_colony?tab=Overview) is a software-as-a-service (SaaS) platform for delivering infrastructure automation at scale. Colony works to help developers deploy applications in complex cloud environments like Azure and Kubernetes. Colony complements Azure DevTest Labs throughout the application deployment process, all the way to production. This article demonstrates how to create an application-centric environment with Colony and Azure. --## Set up the environment with Colony and Microsoft Azure --1. Sign up for your free trial of [Colony](https://azuremarketplace.microsoft.com/marketplace/apps/quali_systems.cloudshell_colony?tab=Overview). -- :::image type="content" source="./media/create-application-centric-environment/free-trial.png" alt-text="Screenshot that shows the signup for a free Colony trial."::: -1. [Link your Azure account](https://colonysupport.quali.com/hc/articles/360008222234). -- :::image type="content" source="./media/create-application-centric-environment/welcome.png" alt-text="Screenshot of the Welcome to Colony screen."::: -1. Invite users into your space. -1. [Create your first blueprint by using a YAML file](https://colonysupport.quali.com/hc/articles/360001680807-Steps-to-Developing-a-Blueprint). - 1. Link your GitHub or BitBucket blueprint repo to Colony. - 1. Use a Colony sample blueprint as the foundation, and modify as appropriate. -- :::image type="content" source="./media/create-application-centric-environment/performance-stress-tests.png" alt-text="Screenshot that shows stress tests."::: - 1. Publish your blueprint for others to use. -1. Launch your application environment into a sandbox by using Colony. -- :::image type="content" source="./media/create-application-centric-environment/blueprints.png" alt-text="Screenshot of launching your application environment into a sandbox by using Colony."::: --You can also integrate your blueprint as part of a continuous integration and continuous delivery (CI/CD) workflow in Azure Pipelines. For steps, see [Launching a Sandbox from Azure DevOps (VSTS)](https://colonysupport.quali.com/hc/articles/360008464234). ---## Next steps --[Request a demo of Colony](https://info.quali.com/cloudshell-colony-demo-request) |
| devtest-labs | Devtest Lab Configure Use Public Environments | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/devtest-labs/devtest-lab-configure-use-public-environments.md | - Title: Configure and use public environments -description: This article describes how to configure and use public environments (Azure Resource Manager templates in a Git repo) in Azure DevTest Labs. - Previously updated : 06/26/2020---# Configure and use public environments in Azure DevTest Labs -Azure DevTest Labs has a [public repository of Azure Resource Manager templates](https://github.com/Azure/azure-devtestlab/tree/master/Environments) you can use to create environments. You don't have to connect to an external GitHub source by yourself. This repository includes frequently used templates such as Azure Web Apps, Service Fabric cluster, and a development SharePoint farm. This feature is similar to the public repository of artifacts that is included for every lab that you create. The environment repository provides pre-authored environment templates with minimum input parameters. The templates give you a smooth getting started experience for platform-as-a-service (PaaS) resources within labs. - -## Configuring public environments -As a lab owner, you can enable the public environment repository for your lab during the lab creation. To enable public environments for your lab, select **On** for the **Public environments** field while creating a lab. -- --For existing labs, the public environment repository isn't enabled. Manually enable the repository to use the templates. For labs created using Resource Manager templates, the repository is also disabled by default. --You can enable or disable public environments for your lab, and also make only specific environments available to lab users by using the following steps: --1. Select **Configuration and policies** for your lab. -2. In the **Virtual machine bases** section, select **Public environments**. -3. To enable public environments for the lab, select **Yes**. Otherwise, select **No**. -4. If you enabled public environments, all the environments in the repository are enabled by default. You can deselect an environment to make it unavailable to your lab users. -- --## Use environment templates as a lab user -As a lab user, you can create a new environment from the enabled list of environment templates by selecting **Add** from the tool bar in the lab page. The list of bases includes the public environments templates enabled by your lab admin at the top of the list. -- --## Next steps -This repository is an open-source repository that you can contribute to. To add your own frequently used and helpful Resource Manager templates, submit a pull request against the repository. |
| devtest-labs | Devtest Lab Create Environment From Arm | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/devtest-labs/devtest-lab-create-environment-from-arm.md | Title: Create multi-VM environments and PaaS resources with templates -description: Learn how to create multi-VM environments and PaaS resources in Azure DevTest Labs from an Azure Resource Manager template + Title: Use ARM templates to create multi-VM environments and PaaS resources +description: Learn how to use Azure Resource Manager (ARM) templates to create multi-VM, platform-as-a-service (PaaS) environments and resources in Azure DevTest Labs. Previously updated : 08/12/2020 Last updated : 01/03/2021 -# Create multi-VM environments and PaaS resources with Azure Resource Manager templates +# Use ARM templates to create DevTest Labs environments -Azure DevTest Labs environments allow users to readily deploy complex infrastructures in a consistent way within the confines of the lab. You can use [Azure Resource Manager templates](../azure-resource-manager/templates/syntax.md) to create environments with sets of resources in DevTest Labs. These environments can contain any Azure resources that Resource Manager templates can create. +Azure multi-tier web apps or SharePoint farms use multiple virtual machines (VMs) with platform-as-a-service (PaaS) resources installed. You can provision these PaaS resources and infrastructure-as-a-service (IaaS) VMs in Azure DevTest Labs by using [Azure Resource Manager (ARM)](../azure-resource-manager/templates/syntax.md) environment templates. -You can easily [add one virtual machine (VM) at a time](devtest-lab-add-vm.md) to a lab by using the [Azure portal](https://portal.azure.com). However, scenarios like multi-tier web apps or a SharePoint farm need a mechanism to create multiple VMs in a single step. By using Azure Resource Manager templates, you can define the infrastructure and configuration of your Azure solution, and repeatedly deploy multiple VMs in a consistent state. -Azure Resource Manager templates also provide the following benefits: +Multi-VM ARM environment templates use the [Microsoft.Compute/virtualmachines](/azure/templates/microsoft.compute/virtualmachines) resource type. Lab users can use the templates to easily and consistently deploy multiple VMs with preinstalled resources as a single environment. The VMs created with this resource type appear under their environments in the lab's **My environments** list. -- Azure Resource Manager templates are loaded directly from your GitHub or Azure Repos source control repository.-- Your users can create an environment by picking a configured Azure Resource Manager template from the Azure portal, just as they do with other types of [VM bases](devtest-lab-comparing-vm-base-image-types.md).-- You can provision Azure PaaS resources as well as IaaS VMs in an environment from an Azure Resource Manager template.-- You can track the cost of environments in the lab, in addition to individual VMs created by other types of bases. PaaS resources are created and will appear in cost tracking. However, VM auto shutdown does not apply to PaaS resources.+ -To learn more about the benefits of using Resource Manager templates to deploy, update, or delete many lab resources in a single operation, see [Benefits of using Resource Manager templates](../azure-resource-manager/management/overview.md#the-benefits-of-using-resource-manager). +You can configure DevTest Labs to load ARM environment templates directly from public or private Git source control repositories. Lab users can then create environments by selecting the templates in the Azure portal, just as they select individual [VM base images](devtest-lab-comparing-vm-base-image-types.md) to create VMs. -> [!NOTE] -> When you use a Resource Manager template as a base to create lab VMs, there are some differences between creating multiple VMs or a single VM. For more information, see [Use a virtual machine's Azure Resource Manager template](devtest-lab-use-resource-manager-template.md). -> +VMs in the same environment share the same lifecycle, and lab users can manage the VMs together. You can track the cost of lab environments and PaaS resources, just as you track costs for individual lab VMs. -## Use DevTest Labs public environments -Azure DevTest Labs has a [public repository of Azure Resource Manager templates](https://github.com/Azure/azure-devtestlab/tree/master/Environments) that you can use to create environments without having to connect to an external GitHub source yourself. This public repository is similar to the public repository of artifacts that's available in the Azure portal for every lab that you create. The environment repository lets you quickly get started with pre-authored environment templates that have few input parameters. These templates provide you with a smooth getting started experience for PaaS resources within labs. +To learn more about the benefits of using ARM templates to deploy, update, or delete multiple lab resources and VMs as a single environment, see [Benefits of using Resource Manager templates](../azure-resource-manager/management/overview.md#the-benefits-of-using-resource-manager). -In the public repository, the DevTest Labs team and others have created and shared frequently-used templates like Azure Web Apps, Service Fabric Cluster, and a development SharePoint Farm environment. You can use these templates directly, or customize them to suit your needs. For more information, see [Configure and use public environments in DevTest Labs](devtest-lab-configure-use-public-environments.md). After you create your own templates, you can store them in this repository to share them with others, or set up your own Git repository. +Consider these limitations when using ARM environment templates in DevTest Labs: -<a name="configure-your-own-template-repositories"></a> -## Create your own template repositories --As one of the best practices with infrastructure-as-code and configuration-as-code, you should manage environment templates in source control. Azure DevTest Labs follows this practice, and loads all Azure Resource Manager templates directly from your GitHub or Azure Repos repositories. As a result, you can use Resource Manager templates across the entire release cycle, from the test environment to the production environment. --There are several rules to follow to organize your Azure Resource Manager templates in a repository: --- You must name the master template file *azuredeploy.json*.--- If you want to use parameter values defined in a parameter file, the parameter file must be named *azuredeploy.parameters.json*.-- You can use the parameters `_artifactsLocation` and `_artifactsLocationSasToken` to construct the parametersLink URI value, allowing DevTest Labs to automatically manage nested templates. For more information, see [Deploy nested Azure Resource Manager templates for testing environments](deploy-nested-template-environments.md). --- You can define metadata to specify the template display name and description in a file named *metadata.json*, as follows:+- VM auto-shutdown doesn't apply to PaaS resources. - ```json - { - "itemDisplayName": "<your template name>", - "description": "<description of the template>" - } - ``` +- Not all lab policies are evaluated when deploying ARM templates. Policies that aren't evaluated include number of VMs per lab user, number of premium VMs per user, and number of premium desks per user. For example, your lab policy might limit users to only five VMs apiece. However, a user can deploy an ARM environment template that creates dozens of VMs. - --## Add template repositories to the lab +<a name="create-your-own-template-repositories"></a> +<a name="configure-your-own-template-repositories"></a> +## Use public and private template repositories -After you create and configure your repository, you can add it to your lab by using the Azure portal: +Azure DevTest Labs has a [public ARM template repository](https://github.com/Azure/azure-devtestlab/tree/master/Environments) that includes pre-authored environment templates for Azure Web Apps, an Azure Service Fabric cluster, and development SharePoint farms. The templates have minimal input parameters, for a smooth getting started experience with PaaS resources. -1. Sign in to the [Azure portal](https://portal.azure.com). -1. Select **All Services**, and then select **DevTest Labs** from the list. -1. From the list of labs, select the lab you want. -1. On the lab's **Overview** pane, select **Configuration and policies**. +You can use the public environment templates as-is, or customize them to suit your needs. To suggest revisions or additions to the public templates, submit pull requests against the open-source [GitHub public template repository](https://github.com/Azure/azure-devtestlab/tree/master/Environments) -  +You can also [store environment templates in your own Git repositories](devtest-lab-use-resource-manager-template.md#store-arm-templates-in-git-repositories), and [connect those repositories to your lab](devtest-lab-use-resource-manager-template.md#add-template-repositories-to-labs) to make your templates available to all lab users. -1. From the **Configuration and policies** settings list, select **Repositories**. The **Public Artifact Repo** repository is automatically generated for all labs, and connects to the [DevTest Labs public GitHub repository](https://github.com/Azure/azure-devtestlab). +## Enable and configure public environments -1. To add your Azure Resource Manager template repository, select **Add**. +DevTest Labs users don't have to connect to the public template repository externally to use the environment templates. You can enable and configure lab access to the public repository so lab users can access the templates directly from the Azure portal. -  +### Enable public environments when you create a lab -1. In the **Repositories** pane, enter the following information: +To enable public environment repository access for a lab, make sure **On** is selected in the **Public environments** field when you create the lab. The setting is **On** by default. - - **Name**: Enter a repository name to use in the lab. - - **Git clone URL**: Enter the Git HTTPS clone URL from GitHub or Azure Repos. - - **Branch** (optional): Enter the branch name to access your Azure Resource Manager template definitions. - - **Personal access token**: Enter the personal access token that is used to securely access your repository. - - To get your token from Azure Repos, under your profile, select **User settings** > **Security** > **Personal access tokens**. - - To get your token from GitHub, under your profile, select **Settings** > **Developer Settings** > **Personal access tokens**. - - **Folder paths**: Enter the folder path that is relative to your Git clone URI for either your artifact definitions or your Azure Resource Manager template definitions. + -1. Select **Save**. +### Enable or disable public environments for existing labs -  +Existing labs, and labs you create with some ARM templates, might not have public environments enabled. To enable or disable the public environment repository for existing labs: -Once you add an Azure Resource Manager template to the lab, your lab users can create environments by using the template. +1. From the lab's **Overview** page in the Azure portal, select **Configuration and policies** in the left navigation. +1. On the **Configuration and policies** page, select **Public environments** under **Virtual machine bases** in the left navigation. +1. Under **Enable Public Environments for this lab**, select **Yes** to enable or **No** to disable public environments. -## Configure access rights for lab users +### Select available public environment templates -Lab users have **Reader** role by default, so they can't change the resources in an environment resource group. For example, they can't stop or start their resources. +If you enable public environments, all the environment templates in the repository are available by default. Deselect specific environments to make them unavailable to lab users. -To give your lab users **Contributor** role so they can edit the resources in their environments, follow these steps: + -1. In the [Azure portal](https://portal.azure.com), on your lab's **Overview** pane, select **Configuration and policies**, and then select **Lab settings**. +<a name="create-environments-from-templates-in-the-azure-portal"></a> +## Create environments from templates -1. In the **Lab settings** pane, select **Contributor**, and then select **Save** to grant write permissions to lab users. +Once you enable the public environment repository or [add a private template repository](devtest-lab-use-resource-manager-template.md#add-template-repositories-to-labs) to your lab, lab users can use the repository templates to create environments. -  +To create an environment from a template: -The next section walks through creating environments from an Azure Resource Manager template. +1. On the lab's **Overview** page, select **Add** from the top toolbar. -## Create environments from templates in the Azure portal +1. On the **Choose a base** page, select the ARM environment template to use. The available environment templates appear first in the list of bases. -Once you add an Azure Resource Manager template to the lab, your lab users can create environments in the Azure portal by following these steps: +  -1. Sign in to the [Azure portal](https://portal.azure.com). +1. On the **Add** screen, enter an **Environment name**. The ARM template defines the rest of the input fields. As necessary, enter values for input fields that the template *azuredeploy.parameters.json* file defines as blank or default. -1. Select **All Services**, and then select **DevTest Labs** from the list. + - For `secure string` parameters, you can use secrets from Azure Key Vault. To learn how to store secrets in a key vault and use them when creating lab resources, see [Store secrets in Azure Key Vault](devtest-lab-store-secrets-in-key-vault.md). -1. From the list of labs, select the lab you want. + - In ARM template files, the `GEN-UNIQUE`, `GEN-UNIQUE-[N]`, `GEN-SSH-PUB-KEY`, and `GEN-PASSWORD` parameter values generate blank input fields for users to input values. -1. On the lab's page, select **Add**. +  -1. The **Choose a base** pane displays the base images you can use, with the Azure Resource Manager templates listed first. Select the Azure Resource Manager template you want. +1. Select **Add** to create the environment. -  + The environment starts provisioning immediately. You can see the provisioning status under **My environments** on the lab **Overview** page. Provisioning an environment can take a long time. -1. On the **Add** pane, enter an **Environment name** value to display to environment users. +1. Once the environment is created, expand the environment under **My environments** to see the list of VMs that the template provisioned. - The Azure Resource Manager template defines the rest of the input fields. If the template *azuredeploy.parameter.json* file defines default values, the input fields show those values. +  - For parameters of type *secure string*, you can use secrets from your Azure Key Vault. To learn about storing secrets in a key vault and using them when creating lab resources, see [Store secrets in Azure Key Vault](devtest-lab-store-secrets-in-key-vault.md). + The deployment creates a new resource group to provision all the environment resources that the ARM template defined. Select the environment name under **My environments** to view the resource group and all the resources the template created. -  +  - > [!NOTE] - > The following parameter values don't appear in the input fields, even if the template specifies them. Instead, the form shows blank input fields where lab users must enter values when creating the environment. - > - > - GEN-UNIQUE - > - GEN-UNIQUE-[N] - > - GEN-SSH-PUB-KEY - > - GEN-PASSWORD +1. Select an environment VM to see available actions for the VM, such as managing configuration, schedules, and policies. -1. Select **Add** to create the environment. +  - The environment starts provisioning immediately, with the status displaying in the **My virtual machines** list. The lab automatically creates a new resource group to provision all the resources defined in the Azure Resource Manager template. +## Configure environment user rights -1. Once the environment is created, select the environment in the **My virtual machines** list to open the resource group pane and browse all of the resources the environment provisioned. +By default, lab users have **Reader** role in environments, so they can't change environment resources. For example, users can't stop or start resources. To give lab users **Contributor** role so they can edit environment resources: -  +1. On the lab's **Overview** page, select **Configuration and policies** from the left navigation. +1. On the **Configuration and policies** page, select **Lab settings** in the left navigation. +1. In the **Lab settings** pane, under **Environment access** > **Resource group user rights**, select **Contributor**, and then select **Save**. - You can also expand the environment to view just the list of VMs the environment provisioned. +  -  +<a name="automate-deployment-of-environments"></a> +## Automate environment creation -1. Select any of the environments to view the available actions, such as applying artifacts, attaching data disks, changing auto-shutdown time, and more. +If you need to create multiple environments for development or testing scenarios, you can automate environment deployment with Azure PowerShell or Azure CLI. -  +You can use the Azure CLI command [az deployment group create](/cli/azure/deployment/group#az_deployment_group_create) to create environments. For more information, see [Deploy resources with Resource Manager templates and Azure CLI](../azure-resource-manager/templates/deploy-cli.md). -<a name="automate-deployment-of-environments"></a> -## Automate environment creation with PowerShell +Lab owners and administrators can use Azure PowerShell to create VMs and environments from ARM templates. -It's feasible to use the Azure portal to add a single environment to a lab, but when a development or testing scenario must create multiple environments, automated deployment is a better experience. -Before you proceed, make sure you have an Azure Resource Manager template that defines the resources to create. [Add and configure the template in a Git repository](#configure-your-own-template-repositories), and [add the repository to the lab](#add-template-repositories-to-the-lab). +To automate ARM environment template deployment with Azure PowerShell: -The following sample script creates an environment in your lab. The comments help you understand the script better. +1. Have an ARM environment template [checked in to a Git repository](devtest-lab-use-resource-manager-template.md#configure-your-own-template-repositories), and the repository [added to the lab](devtest-lab-use-resource-manager-template.md#add-template-repositories-to-labs). -1. Save the following sample PowerShell script to your hard drive as *deployenv.ps1*. -- [!INCLUDE [updated-for-az](../../includes/updated-for-az.md)] +1. Save the following PowerShell script to your computer as *deployenv.ps1*. This script calls the ARM template to create the environment in the lab. ```powershell #Requires -Module Az.Resources The following sample script creates an environment in your lab. The comments hel [CmdletBinding()] param (- # ID of the Azure Subscription for the lab + # ID of the Azure subscription for the lab [string] [Parameter(Mandatory=$true)] $SubscriptionId, - # Name of the existing lab in which to create the environment + # Name of the lab in which to create the environment [string] [Parameter(Mandatory=$true)] $LabName, - # Name of the connected repository in the lab + # Name of the template repository connected to the lab [string] [Parameter(Mandatory=$true)] $RepositoryName, # Name of the template (folder name in the Git repository) [string] [Parameter(Mandatory=$true)] $TemplateName, - # Name of the environment to be created in the lab + # Name of the environment to create in the lab [string] [Parameter(Mandatory=$true)] $EnvironmentName, # The parameters to be passed to the template. Each parameter is prefixed with "-param_". # For example, if the template has a parameter named "TestVMName" with a value of "MyVMName",- # the string in $Params will have the form: -param_TestVMName MyVMName. + # the string in $Params will be "-param_TestVMName MyVMName". # This convention allows the script to dynamically handle different templates. [Parameter(ValueFromRemainingArguments=$true)] $Params ) - # Sign in to Azure. - # Comment out the following statement to completely automate the environment creation. + # Sign in to Azure, or comment out this statement to completely automate environment creation. Connect-AzAccount # Select the subscription that has the lab. Set-AzContext -SubscriptionId $SubscriptionId | Out-Null - # Get information about the user, specifically the user ID, which is used later in the script. + # Get the user ID to use later in the script. $UserId = $((Get-AzADUser -UserPrincipalName ((Get-AzContext).Account).Id).Id) - # Get information about the lab, such as lab location. + # Get the lab location. $lab = Get-AzResource -ResourceType "Microsoft.DevTestLab/labs" -Name $LabName if ($lab -eq $null) { throw "Unable to find lab $LabName in subscription $SubscriptionId." } - # Get information about the repository in the lab. + # Get information about the repository connected to the lab. $repository = Get-AzResource -ResourceGroupName $lab.ResourceGroupName ` -ResourceType 'Microsoft.DevTestLab/labs/artifactsources' ` -ResourceName $LabName ` The following sample script creates an environment in your lab. The comments hel | Select-Object -First 1 if ($repository -eq $null) { throw "Unable to find repository $RepositoryName in lab $LabName." } - # Get information about the Resource Manager template base for the environment. + # Get information about the ARM template base for the environment. $template = Get-AzResource -ResourceGroupName $lab.ResourceGroupName ` -ResourceType "Microsoft.DevTestLab/labs/artifactSources/armTemplates" ` -ResourceName "$LabName/$($repository.Name)" ` The following sample script creates an environment in your lab. The comments hel | Select-Object -First 1 if ($template -eq $null) { throw "Unable to find template $TemplateName in lab $LabName." } - # Build the template parameters with parameter name and values. + # Build the template parameters by using parameter names and values. $parameters = Get-Member -InputObject $template.Properties.contents.parameters -MemberType NoteProperty | Select-Object -ExpandProperty Name $templateParameters = @() - # Extract the custom parameters from $Params and format as name/value pairs. + # Extract the custom parameters from $Params and format them as name/value pairs. $Params | ForEach-Object { if ($_ -match '^-param_(.*)' -and $Matches[1] -in $parameters) { $name = $Matches[1] The following sample script creates an environment in your lab. The comments hel } } - # Once name/value pairs are isolated, create an object to hold the necessary template properties. + # Create an object to hold the necessary template properties. $templateProperties = @{ "deploymentProperties" = @{ "armTemplateId" = "$($template.ResourceId)"; "parameters" = $templateParameters }; } - # Now, create or deploy the environment in the lab by using the New-AzResource command. + # Deploy the environment in the lab by using the New-AzResource command. New-AzResource -Location $Lab.Location ` -ResourceGroupName $lab.ResourceGroupName ` -Properties $templateProperties ` The following sample script creates an environment in your lab. The comments hel Write-Output "Environment $EnvironmentName completed." ``` -1. Run the script as follows, using your specific values for SubscriptionId, LabName, ResourceGroupName, RepositoryName, TemplateName (folder in the Git repo), and EnvironmentName. +1. Run the script, using your own values to replace the example values for: + - `SubscriptionId` + - `LabName` + - `ResourceGroupName` + - `RepositoryName` + - `TemplateName` (template folder in the Git repository) + - `EnvironmentName` ```powershell- ./deployenv.ps1 -SubscriptionId "000000000-0000-0000-0000-0000000000000" -LabName "mydevtestlab" -ResourceGroupName "mydevtestlabRG000000" -RepositoryName "myRepository" -TemplateName "My Environment template name" -EnvironmentName "myGroupEnv" + ./deployenv.ps1 -SubscriptionId "000000000-0000-0000-0000-0000000000000" -LabName "mydevtestlab" -ResourceGroupName "mydevtestlabRG000000" -RepositoryName "myRepository" -TemplateName "ARM template folder name" -EnvironmentName "myNewEnvironment" ``` -You can also use Azure CLI to deploy resources with Resource Manager templates. For more information, see [Deploy resources with Resource Manager templates and Azure CLI](../azure-resource-manager/templates/deploy-cli.md). --> [!NOTE] -> Only a user with lab owner permissions can create VMs from a Resource Manager template by using Azure PowerShell. If you want to automate VM creation using a Resource Manager template and you only have user permissions, you can use the CLI command [az lab vm create](/cli/azure/lab/vm#az_lab_vm_create). --## Resource Manager template limitations in DevTest Labs --Consider these limitations when using Resource Manager templates in DevTest Labs: --- You can't create formulas or custom images from lab VMs that were created from a Resource Manager template.--- Most policies aren't evaluated when you deploy Resource Manager templates.--For example, you might have a lab policy that a user can create only five VMs. However, a user can deploy a Resource Manager template that creates dozens of VMs. Policies that aren't evaluated include: -- - Number of VMs per user -- - Number of premium VMs per lab user -- - Number of premium disks per lab user - ## Next steps-- Once you create a VM, you can connect to the VM by selecting **Connect** on the VM's management pane.-- View and manage resources in an environment by selecting the environment in the **My virtual machines** list in your lab.-- Explore the [Azure Resource Manager templates from the Azure Quickstart template gallery](https://github.com/Azure/azure-quickstart-templates).++- [Public ARM environment template repository](https://github.com/Azure/azure-devtestlab/tree/master/Environments) +- [Azure quickstart template gallery](https://github.com/Azure/azure-quickstart-templates) |
| devtest-labs | Devtest Lab Use Arm And Powershell For Lab Resources | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/devtest-labs/devtest-lab-use-arm-and-powershell-for-lab-resources.md | Title: Create or modify labs using Azure Resource Manager templates -description: Learn how to use Azure Resource Manager templates with PowerShell to create or modify labs automatically. + Title: Create and deploy labs with Azure Resource Manager (ARM) templates +description: Learn how Azure DevTest Labs uses Azure Resource Manager (ARM) templates to create and configure lab virtual machines (VMs) and environments. Previously updated : 06/26/2020 Last updated : 01/11/2022 -# Create or modify labs automatically using Azure Resource Manager templates and PowerShell +# Azure Resource Manager (ARM) templates in Azure DevTest Labs -Azure DevTest Labs provides many Azure Resource Manager templates and PowerShell scripts. These templates and scripts can help you quickly and automatically create, modify, and deploy labs and lab resources. +Azure DevTest Labs can use Azure Resource Manager (ARM) templates for many tasks, from creating and provisioning labs and virtual machines (VMs) to adding users. -This article helps guide you through the process of using these templates and scripts to automate the creation, modification, and deployment of your labs. This article also shows you where you can find more information about how to use PowerShell to perform some common tasks in DevTest Labs. -## Step 1: Gather your templates and scripts -You can find pre-made [Azure Resource Manager templates](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/QuickStartTemplates) and [PowerShell scripts](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/Scripts) at our public [GitHub repository](https://github.com/Azure/azure-devtestlab). Use them as-is, or customize them for your needs and store them in your own [private Git repo](devtest-lab-add-artifact-repo.md). +In DevTest Labs, you can: -## Step 2: Modify your Azure Resource Manager template -You can follow the steps at [Create your first Azure Resource Manager template](../azure-resource-manager/templates/quickstart-create-templates-use-the-portal.md) if you've never created a template before. +- [Use an ARM quickstart template](#arm-quickstart-templates) to deploy a lab with a virtual machine (VM). -[Best practices for creating Azure Resource Manager templates](../azure-resource-manager/templates/best-practices.md) offers many guidelines and suggestions to help you create Azure Resource Manager templates that are reliable and easy to use. You can use a variation of one of the approaches or examples provided, and modify your template for your needs. +- Create your own ARM templates to use for various tasks. Follow the steps at [Create and deploy ARM templates](../azure-resource-manager/templates/quickstart-create-templates-use-the-portal.md), and modify the example templates for your needs. -## Step 3: Deploy resources with PowerShell -After you customize your templates and scripts, follow the steps necessary to [deploy resources with Resource Manager templates and Azure PowerShell](../azure-resource-manager/templates/deploy-powershell.md). The article provides general information about using Azure PowerShell with Azure Resource Manager templates to deploy your resources to Azure. +- Access the public [DevTest Labs GitHub repository](https://github.com/Azure/azure-devtestlab) for preconfigured [ARM templates](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/QuickStartTemplates) and [scripts](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/Scripts) that you can use as-is or customize. +- [Connect public and private template repositories to DevTest Labs](devtest-lab-use-resource-manager-template.md#add-template-repositories-to-labs), so lab users can use the templates to create and manage their own resources and environments. -## Common tasks you can perform in DevTest Labs using PowerShell -There are many other common tasks that you can automate by using PowerShell. The following sections of the documentation outline the steps required to perform these tasks. +- [Use an ARM template from any available Azure VM base image](devtest-lab-use-resource-manager-template.md) to create more VMs or custom images. -* [Create a custom image from a VHD file using PowerShell](devtest-lab-create-custom-image-from-vhd-using-powershell.md) -* [Upload VHD file to lab's storage account using PowerShell](devtest-lab-upload-vhd-using-powershell.md) -* [Add an external user to a lab using PowerShell](devtest-lab-add-devtest-user.md#add-an-external-user-to-a-lab-using-powershell) -* [Create a lab custom role using PowerShell](devtest-lab-grant-user-permissions-to-specific-lab-policies.md#creating-a-lab-custom-role-using-powershell) +- [Use ARM environment templates](devtest-lab-create-environment-from-arm.md) to create multi-VM infrastructure-as-a-service (IaaS) or platform-as-a-service (PaaS) DevTest Labs environments. -### Next steps -* Learn how to create a [private Git repository](devtest-lab-add-artifact-repo.md) where you will store your customized templates or scripts. -* Explore the [Azure Resource Manager templates from Azure Quickstart template gallery](https://github.com/Azure/azure-quickstart-templates). +- [Use ARM templates with Azure PowerShell or Azure CLI automation](#arm-template-automation) to create, deploy, and manage labs, environments, and VMs. ++## Single-VM and environment templates ++DevTest Labs often uses ARM templates to create VMs. There are two methods for creating VMs in DevTest Labs. Each method is used for different scenarios and requires different permissions. The ARM template's `resource` property declares the method to use. ++### Microsoft.Compute/virtualmachines environment templates ++ARM templates that use the [Microsoft.Compute/virtualmachines](/azure/templates/microsoft.compute/virtualmachines) resource type provision multiple lab VMs and PaaS resources in a single environment, such as a SharePoint farm. Lab users can use these templates to create multiple-VM environments. VMs created with this resource type appear under the environments in the lab's **My environments** list. +++For more information and instructions for configuring and using environment templates, see [Use ARM templates to create DevTest Labs environments](devtest-lab-create-environment-from-arm.md). ++### Microsoft.DevTestLab/labs/virtualmachines single-VM templates ++ARM templates that use the [Microsoft.DevTestLab/labs/virtualmachines](/azure/templates/microsoft.devtestlab/2018-09-15/labs/virtualmachines) resource type provision individual VM configurations. Each VM created with this resource type appears as a separate item in the lab's **My virtual machines** list. To create and deploy VMs with these templates, you can [use a quickstart template](#arm-quickstart-templates) from the Azure portal. You can also [automate VM deployment](#arm-template-automation) with Azure PowerShell or Azure CLI. +++## ARM quickstart templates ++To use an ARM template to quickly create a DevTest Labs lab with a Windows Server VM, follow the instructions at [Quickstart: Use an ARM template to create a lab in DevTest Labs](create-lab-windows-vm-template.md). ++Or to access DevTest Labs quickstart template from the Azure portal: ++1. In the Azure portal, search for and select **Deploy a custom template**. +1. On the **Custom deployment** screen, make sure **Quickstart template** is selected, and select the dropdown arrow next to **Quickstart template (disclaimer)**. +1. Type *devtest* in the filter box, and then select the **dtl-create-lab-windows-vm-claimed** template or other quickstart template from the popup list. +1. Select **Select template**. You can also select **Edit template** to modify the template. +++## ARM template automation ++Lab administrators can deploy ARM templates with Azure CLI or Azure PowerShell to automate VM creation and management. ++In Azure CLI, use the commands [az lab vm create](/cli/azure/lab/vm#az_lab_vm_create) and [az deployment group create](/cli/azure/deployment/group#az_deployment_group_create) to automate VM creation with ARM templates. For more information and instructions, see [Deploy resources with Resource Manager templates and Azure CLI](../azure-resource-manager/templates/deploy-cli.md). ++In Azure PowerShell, use [New-AzResource](/powershell/module/az.resources/new-azresource) and [New-AzResourceGroupDeployment](/powershell/module/az.resources/new-azresourcegroupdeployment) to provision VMs with ARM templates. +++Lab administrators can deploy ARM templates to create claimable lab VMs or image factory golden images. Provisioning VMs with PowerShell requires administrator permissions. Lab users can then use the custom images to create VM instances. For more information and instructions, see [Create a DevTest Labs VM with Azure PowerShell](devtest-lab-vm-powershell.md). ++You can automate several other common DevTest Labs tasks by using ARM templates with PowerShell: ++- [Create a custom image from a VHD file using PowerShell](devtest-lab-create-custom-image-from-vhd-using-powershell.md) +- [Upload a VHD file to a lab's storage account using PowerShell](devtest-lab-upload-vhd-using-powershell.md) +- [Add an external user to a lab using PowerShell](devtest-lab-add-devtest-user.md#add-an-external-user-to-a-lab-using-powershell) +- [Create a lab custom role using PowerShell](devtest-lab-grant-user-permissions-to-specific-lab-policies.md#creating-a-lab-custom-role-using-powershell) ++Lab administrators can also automate ARM environment template deployment, to fully manage development and test environments. For information and instructions, see [Automate environment creation](devtest-lab-create-environment-from-arm.md#automate-environment-creation). ++## Next steps ++- [Best practices for creating Azure Resource Manager templates](../azure-resource-manager/templates/best-practices.md) has guidelines and suggestions for creating reliable, easy-to-use ARM templates. +- [Deploy resources with Resource Manager templates and Azure PowerShell](../azure-resource-manager/templates/deploy-powershell.md) has general information about using Azure PowerShell with ARM templates. +- The public [DevTest Labs GitHub repository](https://github.com/Azure/azure-devtestlab) has preconfigured [quickstart ARM templates](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/QuickStartTemplates), [PowerShell scripts](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/Scripts), [artifacts](https://github.com/Azure/azure-devtestlab/tree/master/Artifacts), and [environments](https://github.com/Azure/azure-devtestlab/tree/master/Environments) that you can use as-is or customize for your needs. +- You can explore more ARM templates in the [Azure Quickstart template gallery](https://github.com/Azure/azure-quickstart-templates). |
| devtest-labs | Devtest Lab Use Resource Manager Template | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/devtest-labs/devtest-lab-use-resource-manager-template.md | Title: View and use a virtual machine's Azure Resource Manager template -description: Learn how to use the Azure Resource Manager template from a virtual machine to create other VMs + Title: Create VMs by using ARM templates +description: Learn how to view, edit, save, and store ARM virtual machine (VM) templates, and connect template repositories to Azure DevTest Labs. Previously updated : 06/26/2020 Last updated : 01/11/2022 -# Create virtual machines using an Azure Resource Manager template +# Use ARM templates to create DevTest Labs virtual machines -When you are creating a virtual machine (VM) in DevTest Labs through the [Azure portal](https://go.microsoft.com/fwlink/p/?LinkID=525040), you can view the Azure Resource Manager template before you save the VM. The template can then be used as a basis to create more lab VMs with the same settings. +You can use Azure Resource Manager (ARM) templates to create preconfigured Azure virtual machines (VMs) in Azure DevTest Labs. -This article describes Multi-VM vs. single-VM Resource Manager templates and shows you how to view and save a template when creating a VM. +Single-VM ARM templates use the [Microsoft.DevTestLab/labs/virtualmachines](/azure/templates/microsoft.devtestlab/2018-09-15/labs/virtualmachines) resource type. Each VM created with this resource type appears as a separate item in the lab's **My virtual machines** list. -## Multi-VM vs. single-VM Resource Manager templates -There are two ways to create VMs in DevTest Labs using a Resource Manager template: provision the Microsoft.DevTestLab/labs/virtualmachines resource or provision the Microsoft.Compute/virtualmachines resource. Each is used in different scenarios and requires different permissions. +You can create your own single-VM ARM templates, access the public [DevTest Labs GitHub repository](https://github.com/Azure/azure-devtestlab) for preconfigured templates, or modify existing ARM templates to meet your needs. Lab users can use your ARM templates to create and deploy Azure VMs. -- Resource Manager templates that use a Microsoft.DevTestLab/labs/virtualmachines resource type (as declared in the “resource” property in the template) can provision individual lab VMs. Each VM then shows up as a single item in the DevTest Labs virtual machines list:+This article describes how to: -  +- View, edit, and save ARM templates for Azure VMs. +- Store ARM templates in source control repositories. +- Connect ARM template repositories to Azure DevTest Labs so lab users can access the templates. - This type of Resource Manager template can be provisioned through the Azure PowerShell command **New-AzResourceGroupDeployment** or through the Azure CLI command **az deployment group create**. It requires administrator permissions, so users who are assigned with a DevTest Labs user role can’t perform the deployment. +## View, edit, and save ARM templates for VMs -- Resource Manager templates that use a Microsoft.Compute/virtualmachines resource type can provision multiple VMs as a single environment in the DevTest Labs virtual machines list:+You can customize and use an ARM template from any Azure VM base to deploy more of the same VM type in DevTest Labs. -  +1. On your lab's **Overview** page, select **Add** on the top toolbar. +1. On the **Choose a base** page, select the type of VM you want. +1. On the **Create lab resource** page, configure settings and add desired artifacts to your template VM. +1. On the **Advanced Settings** tab, select **View ARM template**. +1. Copy and [save the ARM template](#store-arm-templates-in-git-repositories) to use for creating more VMs. - VMs in the same environment can be managed together and share the same lifecycle. Users who are assigned with a DevTest Labs user role can create environments using those templates as long as the administrator has configured the lab that way. +  -The remainder of this article discusses Resource Manager templates that use Microsoft.DevTestLab/labs/virtualmachines. These are used by lab admins to automate lab VM creation (for example, claimable VMs) or golden image generation (for example, image factory). +1. If you want to create an instance of the VM now, on the **Basic Settings** tab, select **Create**. -[Best practices for creating Azure Resource Manager templates](../azure-resource-manager/templates/best-practices.md) offers many guidelines and suggestions to help you create Azure Resource Manager templates that are reliable and easy to use. +### Set VM expiration date -## View and save a virtual machine's Resource Manager template -1. Follow the steps at [Create your first VM in a lab](tutorial-create-custom-lab.md#add-a-vm-to-the-lab) to begin creating a virtual machine. -1. Enter the required information for your virtual machine and add any artifacts you want for this VM. -1. Switch to the **Advanced Settings** tab. -1. At the bottom of the Configure settings window, choose **View ARM template**. -1. Copy and save the Resource Manager template to use later to create another virtual machine. +For scenarios such as training, demos, and trials, you might want to delete VMs automatically after a certain date so they don't keep incurring costs. When you create a lab VM from the Azure portal, you can set an expiration date by specifying the **Expiration date** property on the **Advanced settings** tab. For an ARM template that defines the `expirationDate` property, see [Creates a new virtual machine in a Lab with a specified expiration date](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/QuickStartTemplates/101-dtl-create-vm-username-pwd-customimage-with-expiration). -  +<a name="configure-your-own-template-repositories"></a> +<a name="create-your-own-template-repositories"></a> +## Store ARM templates in Git repositories -After you have saved the Resource Manager template, you must update the parameters section of the template before you can use it. You can create a parameter.json that customizes just the parameters, outside of the actual Resource Manager template. +As a best practice for infrastructure as code and configuration as code, store your ARM templates in source control. DevTest Labs can load your ARM templates directly from your GitHub or Azure Repos source control repository. You can then use the templates throughout your release cycle, from development through test to production environments. - +Use the following file structure to store an ARM template in a source control repository: -The Resource Manager template is now ready to use to [create a VM](devtest-lab-create-environment-from-arm.md). +- Name the main template file *azuredeploy.json*. -## Set expiration date -In scenarios such as training, demos and trials, you may want to create virtual machines and delete them automatically after a fixed duration so that you don’t incur unnecessary costs. You can create a lab VM with an expiration date by specifying the **expirationDate** property for the VM. Check out the same Resource Manager template in [our GitHub repository](https://github.com/Azure/azure-devtestlab/tree/master/samples/DevTestLabs/QuickStartTemplates/101-dtl-create-vm-username-pwd-customimage-with-expiration). +- To reuse the ARM template, you need to update the `parameters` section of *azuredeploy.json*. You can create a *parameter.json* file that customizes just the parameters, without having to edit the main template file. Name this parameter file *azuredeploy.parameters.json*. +  + In the parameters file, you can use the parameters `_artifactsLocation` and `_artifactsLocationSasToken` to construct a `parametersLink` URI value for automatically managing nested templates. For more information about nested templates, see [Deploy nested Azure Resource Manager templates for testing environments](deploy-nested-template-environments.md). ++- You can define metadata that specifies the template display name and description in a file named *metadata.json*. ++ ```json + { + "itemDisplayName": "<template name>", + "description": "<template description>" + } + ``` ++The following screenshot shows a typical ARM template folder structure in a repository. ++ ++## Add template repositories to labs ++Add your template repositories to your lab so all lab users can access the templates. ++1. On the lab's **Overview** page, select **Configuration and policies** from the left navigation. ++1. On the **Configuration and policies** page, select **Repositories** under **External resources** in the left navigation. ++ On the **Repositories** screen, the **Public Artifact Repo** and **Public Environment Repo** are automatically present for all labs, and connect to the [DevTest Labs public GitHub repository](https://github.com/Azure/azure-devtestlab). If these repos aren't enabled for your lab, you can enable them by selecting the checkboxes next to **Public Artifact Repo** and **Public Environment Repo**, and then selecting **Enable** on the top menu bar. For more information, see [Enable and configure public environments](devtest-lab-create-environment-from-arm.md#enable-and-configure-public-environments). ++1. To add your private ARM template repository to the lab, select **Add** in the top menu bar. ++  ++1. In the **Repositories** pane, enter the following information: ++ - **Name**: Enter a repository name to use in the lab. + - **Git clone URL**: Enter the Git HTTPS clone URL from GitHub or Azure Repos. + - **Branch** (optional): Enter the branch that has your ARM template definitions. + - **Personal access token**: Enter the personal access token to securely access your repository. + - To get a token from Azure Repos, select **User settings** > **Personal access tokens**. + - To get your token from GitHub, under your profile, select **Settings** > **Developer settings** > **Personal access tokens**. + - **Folder paths**: Enter the folder for your ARM template definitions, relative to the Git clone URI. ++1. Select **Save**. ++  ++The repository now appears in the **Repositories** list for the lab. Users can now use the repository templates to [create multi-VM DevTest Labs environments](devtest-lab-create-environment-from-arm.md). Lab administrators can use the templates to [automate lab deployment and management tasks](devtest-lab-use-arm-and-powershell-for-lab-resources.md#arm-template-automation). ### Next steps-* Learn how to [Create multi-VM environments with Resource Manager templates](devtest-lab-create-environment-from-arm.md). -* [Deploy a Resource Manager template to create a VM](devtest-lab-create-environment-from-arm.md#automate-deployment-of-environments) -* Explore more quickstart Resource Manager templates for DevTest Labs automation from the [public DevTest Labs GitHub repo](https://github.com/Azure/azure-quickstart-templates). ++- [Best practices for creating Azure Resource Manager templates](../azure-resource-manager/templates/best-practices.md) +- [Add a Git repository to store custom artifacts and Resource Manager templates](devtest-lab-add-artifact-repo.md) +- [Use ARM templates to create DevTest Labs environments](devtest-lab-create-environment-from-arm.md) +- [ARM quickstart templates for DevTest Labs automation](https://github.com/Azure/azure-quickstart-templates) |
| frontdoor | How To Add Custom Domain | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/frontdoor/standard-premium/how-to-add-custom-domain.md | Then lastly, validate that your application content is getting served using a br To learn how to enable HTTPS for your custom domain, continue to the next tutorial. > [!div class="nextstepaction"]-> [Enable HTTPS for a custom domain]() +> [Enable HTTPS for a custom domain](how-to-configure-https-custom-domain.md) |
| iot-dps | Concepts Service | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/concepts-service.md | There are two types of enrollments supported by Device Provisioning Service: ### Enrollment group -An enrollment group is a group of devices that share a specific attestation mechanism. Enrollment groups support both X.509 as well as symmetric. All devices in the X.509 enrollment group present X.509 certificates that have been signed by the same root or intermediate Certificate Authority (CA). Each device in the symmetric key enrollment group present SAS tokens derived from the group symmetric key. The enrollment group name and certificate name must be alphanumeric, lowercase, and may contain hyphens. +An enrollment group is a group of devices that share a specific attestation mechanism. Enrollment groups support X.509 certificate or symmetric key attestation. Devices in an X.509 enrollment group present X.509 certificates that have been signed by the same root or intermediate Certificate Authority (CA). The common name (CN) of each device's end-entity (leaf) certificate becomes the registration ID for that device. Devices in a symmetric key enrollment group present SAS tokens derived from the group symmetric key. The name of the enrollment group as well as the registration IDs presented by devices must be case-insensitive strings (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). For devices in an enrollment group, the registration ID is also used as the device ID that is registered to IoT Hub. > [!TIP] > We recommend using an enrollment group for a large number of devices that share a desired initial configuration, or for devices all going to the same tenant. ### Individual enrollment -An individual enrollment is an entry for a single device that may register. Individual enrollments may use either X.509 leaf certificates or SAS tokens (from a physical or virtual TPM) as attestation mechanisms. The registration ID in an individual enrollment is alphanumeric, lowercase, and may contain hyphens. Individual enrollments may have the desired IoT hub device ID specified. +An individual enrollment is an entry for a single device that may register. Individual enrollments may use either X.509 leaf certificates or SAS tokens (from a physical or virtual TPM) as the attestation mechanisms. The registration ID in an individual enrollment is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). For X.509 individual enrollments, the certificate common name (CN) becomes the registration ID, so the common name must adhere to the registration ID string format. Individual enrollments may have the desired IoT hub device ID specified in the enrollment entry. If it's not specified, the registration ID becomes the device ID that's registered to IoT Hub. > [!TIP] > We recommend using individual enrollments for devices that require unique initial configurations, or for devices that can only authenticate using SAS tokens via TPM attestation. A registration is the record of a device successfully registering/provisioning t ## Registration ID -The registration ID is used to uniquely identify a device registration with the Device Provisioning Service. The device ID must be unique in the provisioning service [ID scope](#id-scope). Each device must have a registration ID. The registration ID is alphanumeric, case insensitive, and may contain special characters including colon, period, underscore and hyphen. +The registration ID is used to uniquely identify a device registration with the Device Provisioning Service. The registration ID must be unique in the provisioning service [ID scope](#id-scope). Each device must have a registration ID. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). * In the case of TPM, the registration ID is provided by the TPM itself.-* In the case of X.509-based attestation, the registration ID is provided as the subject name of the certificate. +* In the case of X.509-based attestation, the registration ID is set to the common name (CN) of the device certificate. For this reason, the common name must adhere to the registration ID string format. ## Device ID |
| iot-dps | Concepts Symmetric Key Attestation | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/concepts-symmetric-key-attestation.md | Creating security tokens for symmetric key attestation is supported by the Azure The symmetric keys for group enrollments are not used directly by devices when provisioning. Instead devices that belong to an enrollment group provision using a derived device key. -First, a unique registration ID is defined for each device attesting with an enrollment group. Valid characters for the registration ID are lowercase alphanumeric and dash ('-'). This registration ID should be something unique that identifies the device. For example, a legacy device may not support many security features. The legacy device may only have a MAC address or serial number available to uniquely identify that device. In that case, a registration ID can be composed of the MAC address and serial number similar to the following: +First, a unique registration ID is defined for each device authenticating through an enrollment group. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). The registration ID should be something unique that identifies the device. For example, a legacy device may not support many security features. The legacy device may only have a MAC address or serial number available to uniquely identify that device. In that case, a registration ID can be composed of the MAC address and serial number similar to the following: ``` sn-007-888-abc-mac-a1-b2-c3-d4-e5-f6 String deviceKey = Utils.ComputeDerivedSymmetricKey(Convert.FromBase64String(mas The resulting device key is then used to generate a SAS token to be used for attestation. Each device in an enrollment group is required to attest using a security token generated from a unique derived key. The enrollment group symmetric key cannot be used directly for attestation. -#### Installation of the derived device key +### Installation of the derived device key Ideally the device keys are derived and installed in the factory. This method guarantees the group key is never included in any software deployed to the device. When the device is assigned a MAC address or serial number, the key can be derived and injected into the device however the manufacturer chooses to store it. |
| iot-dps | Concepts X509 Attestation | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/concepts-x509-attestation.md | Imagine that Contoso is a large corporation with its own Public Key Infrastructu The leaf certificate, or end-entity certificate, identifies the certificate holder. It has the root certificate in its certificate chain as well as zero or more intermediate certificates. The leaf certificate is not used to sign any other certificates. It uniquely identifies the device to the provisioning service and is sometimes referred to as the device certificate. During authentication, the device uses the private key associated with this certificate to respond to a proof of possession challenge from the service. -Leaf certificates used with an [Individual enrollment](./concepts-service.md#individual-enrollment) entry have a requirement that the **Subject Name** must be set to the registration ID of the Individual Enrollment entry. Leaf certificates used with an [Enrollment group](./concepts-service.md#enrollment-group) entry should have the **Subject Name** set to the desired device ID that will be shown in the **Registration Records** for the authenticated device in the enrollment group. +Leaf certificates used with [Individual enrollment](./concepts-service.md#individual-enrollment) or [Enrollment group](./concepts-service.md#enrollment-group) entries must have the certificate common name (CN) set to the registration ID. The registration ID identifies the device registration with DPS and must be unique to the DPS instance (ID scope) where the device registers. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). ++For enrollment groups, the certificate common name (CN) also sets the device ID that is registered with IoT Hub. The device ID will be shown in the **Registration Records** for the authenticated device in the enrollment group. For individual enrollments, the device ID can be set in the enrollment entry. If it's not set in the enrollment entry, then the certificate common name (CN) is used. To learn more, see [Authenticating devices signed with X.509 CA certificates](../iot-hub/iot-hub-x509ca-overview.md#authenticating-devices-signed-with-x509-ca-certificates). |
| iot-dps | How To Legacy Device Symm Key | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/how-to-legacy-device-symm-key.md | The SDK includes the sample code for the simulated device. This simulated device 3. On **Add Enrollment Group**, enter the following information, and click the **Save** button. - - **Group name**: Enter **mylegacydevices**. + - **Group name**: Enter **mylegacydevices**. The enrollment group name is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). - **Attestation Type**: Select **Symmetric Key**. In this example, we use a combination of a MAC address and serial number forming sn-007-888-abc-mac-a1-b2-c3-d4-e5-f6 ``` -Create unique registration IDs for each device. Valid characters are lowercase alphanumeric and dash ('-'). +Create unique registration IDs for each device. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). ## Derive a device key |
| iot-dps | How To Manage Enrollments | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/how-to-manage-enrollments.md | To create a symmetric key enrollment group: | Field | Description | | : | : |- | **Group name** | The name of the group of devices.| + | **Group name** | The name of the group of devices. The enrollment group name is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`).| | **Attestation Type** |Select **Symmetric Key**.| | **Auto Generate Keys** |Check this box.| | **Select how you want to assign devices to hubs** |Select *Static configuration* so that you can assign to a specific hub| |
| iot-dps | How To Provision Multitenant | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/how-to-provision-multitenant.md | For simplicity, this article uses [Symmetric key attestation](concepts-symmetric 4. On the **Add Enrollment Group** page, enter the following information: - **Group name**: Enter *contoso-us-devices*. + **Group name**: Enter *contoso-us-devices*. The enrollment group name is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). **Attestation Type**: Select *Symmetric Key*. In this part of the tutorial, you'll generate a device key from the you group ma For **both** *eastus* and *westus 2* devices: -1. Generate your unique key using **openssl**. You'll use the following Bash shell script (replace `{primary-key}` with the enrollment group's **Primary Key** that you copied earlier and replace `{contoso-simdevice-east}`with your own unique registration ID for each device. Use lowercase alphanumeric and dash ('-') characters to define both IDs): +1. Generate your unique key using **openssl**. You'll use the following Bash shell script (replace `{primary-key}` with the enrollment group's **Primary Key** that you copied earlier and replace `{contoso-simdevice}`with your own unique registration ID for each device. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). ```bash KEY={primary-key} |
| iot-dps | Quick Create Simulated Device Symm Key | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/quick-create-simulated-device-symm-key.md | This article demonstrates an individual enrollment for a single device to be pro * **Auto-generate keys**: Check this box. - * **Registration ID**: Enter a registration ID to identify the enrollment. Use only lowercase alphanumeric and dash ('-') characters. For example, *symm-key-device-007*. + * **Registration ID**: Enter a registration ID to identify the enrollment. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). For example, *symm-key-device-007*. - * **IoT Hub Device ID:** Enter a device identifier. + * **IoT Hub Device ID:** Enter a device identifier. The device ID must comply with the [Device ID string requirements](../iot-hub/iot-hub-devguide-identity-registry.md#device-identity-properties). :::zone pivot="programming-language-ansi-c" To update and run the provisioning sample with your device information: | Parameter | Required | Description | | :-- | :- | :-- | | `--s` or `--IdScope` | True | The ID Scope of the DPS instance |- | `--i` or `--Id` | True | The registration ID when using individual enrollment, or the desired device ID when using group enrollment. | + | `--i` or `--Id` | True | The registration ID when using individual enrollment, or the desired device ID when using group enrollment. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). The device ID must comply with the [Device ID string requirements](../iot-hub/iot-hub-devguide-identity-registry.md#device-identity-properties). | | `--p` or `--PrimaryKey` | True | The primary key of the individual or group enrollment. | | `--e` or `--EnrollmentType` | False | The type of enrollment: `Individual` or `Group`. Defaults to `Individual` | | `--g` or `--GlobalDeviceEndpoint` | False | The global endpoint for devices to connect to. Defaults to `global.azure-devices-provisioning.net` | |
| iot-dps | Quick Create Simulated Device X509 | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/quick-create-simulated-device-x509.md | In this section, you'll use sample code from the Azure IoT SDK to create a self- > To learn about obtaining certificates suitable for production use, see [How to get an X.509 CA certificate](../iot-hub/iot-hub-x509ca-overview.md#how-to-get-an-x509-ca-certificate) in the Azure IoT Hub documentation. > --The device ID of the IoT device will be the subject common name on the certificate. Make sure to use a subject name that complies with the [Device ID string requirements](../iot-hub/iot-hub-devguide-identity-registry.md#device-identity-properties). -- To create the X.509 certificate: ::: zone pivot="programming-language-ansi-c" In addition to the tooling in the C SDK, the [Group certificate verification sam PS D:\azure-iot-samples-csharp\provisioning\Samples\device\X509Sample> .\GenerateTestCertificate.ps1 iothubx509device1 ``` + The certificate generated by this command has a subject common name (CN) of _iothubx509device1_. For X.509-based enrollments, the [Registration ID](./concepts-service.md#registration-id) is set to the common name. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). The common name must adhere to this format. + 3. The script prompts you for a PFX password. Remember this password, as you will use it later when you run the sample. Optionally, you can run `certutil` to dump the certificate and verify the subject name. ```powershell In addition to the tooling in the C SDK, the [Group certificate verification sam npm install ``` -2. Create a _leaf_ X.509 certificate by running the script using your own _certificate-name_. The leaf certificate's common name becomes the [Registration ID](./concepts-service.md#registration-id) so be sure to only use lower-case alphanumerics and hyphens. +2. Create a _leaf_ X.509 certificate by running the script using your own _certificate-name_. For X.509-based enrollments, the leaf certificate's common name becomes the [Registration ID](./concepts-service.md#registration-id). The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). The _certificate-name_ parameter must adhere to this format. ```cmd/sh node create_test_cert.js device {certificate-name} In addition to the tooling in the C SDK, the [Group certificate verification sam A test certificate file (*python-device.pem*) and private key file (*python-device.key.pem*) should now be generated in the directory where you ran the `openssl` command. +The certificate file has its subject common name (CN) set to `Python-device-01`. For an X.509-based enrollments, the [Registration ID](./concepts-service.md#registration-id) is set to the common name. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). The common name must adhere to this format. + ::: zone-end ::: zone pivot="programming-language-java" A test certificate file (*python-device.pem*) and private key file (*python-devi java -jar ./provisioning-x509-cert-generator-{version}-with-deps.jar ``` -3. Enter **N** for _Do you want to input common name_. +3. Enter **N** for _Do you want to input common name_. This creates a certificate with a subject common name (CN) of _microsoftriotcore_. ++ For an X.509-based enrollments, the [Registration ID](./concepts-service.md#registration-id) is set to the common name. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). The common name must adhere to this format. 4. Copy the output of `Client Cert` to the clipboard, starting from *--BEGIN CERTIFICATE--* through *--END CERTIFICATE--*. |
| iot-dps | Tutorial Custom Allocation Policies | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/tutorial-custom-allocation-policies.md | In this section, you'll create a new enrollment group that uses the custom alloc | Field | Description and/or suggested value | | :- | :-- |- | **Group name** | Enter **contoso-custom-allocated-devices** | + | **Group name** | Enter **contoso-custom-allocated-devices**. The enrollment group name is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). | | **Attestation Type** | Select **Symmetric Key** | | **Auto Generate Keys** | This checkbox should already be checked. | | **Select how you want to assign devices to hubs** | Select **Custom (Use Azure Function)** | |
| iot-dps | Tutorial Custom Hsm Enrollment Group X509 | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/tutorial-custom-hsm-enrollment-group-x509.md | Your signing certificates are now trusted on the Windows-based device and the fu | Field | Value | | :-- | :-- |- | **Group name** | For this tutorial, enter **custom-hsm-x509-devices** | + | **Group name** | For this tutorial, enter **custom-hsm-x509-devices**. The enrollment group name is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). | | **Attestation Type** | Select **Certificate** | | **IoT Edge device** | Select **False** | | **Certificate Type** | Select **Intermediate Certificate** | |
| iot-dps | Tutorial Net Provision Device To Hub | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-dps/tutorial-net-provision-device-to-hub.md | This step involves adding the device's unique security artifacts to the Device P - For TPM-based devices: - The *Endorsement Key* that is unique to each TPM chip or simulation. Read the [Understand TPM Endorsement Key](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770443(v=ws.11)) for more information.- - The *Registration ID* that is used to uniquely identify a device in the namespace/scope. This may or may not be the same as the device ID. The ID is mandatory for every device. For TPM-based devices, the registration ID may be derived from the TPM itself, for example, an SHA-256 hash of the TPM Endorsement Key. + - The *Registration ID* that is used to uniquely identify a device in the namespace/scope. This may or may not be the same as the device ID. The registration ID is mandatory for every device. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). For TPM-based devices, the registration ID may be derived from the TPM itself, for example, an SHA-256 hash of the TPM Endorsement Key. - For X.509 based devices: - The [X.509 certificate issued to the device](/windows/win32/seccertenroll/about-x-509-public-key-certificates), in the form of either a *.pem* or a *.cer* file. For individual enrollment, you need to use the *leaf certificate* for your X.509 system, while for enrollment groups, you need to use the *root certificate* or an equivalent *signer certificate*.- - The *Registration ID* that is used to uniquely identify a device in the namespace/scope. This may or may not be the same as the device ID. The ID is mandatory for every device. For X.509 based devices, the registration ID is derived from the certificate's common name (CN). For further information on these requirements see [Device concepts](./concepts-service.md). + - The *Registration ID* that is used to uniquely identify a device in the namespace/scope. This may or may not be the same as the device ID. The registration ID is mandatory for every device. The registration ID is a case-insensitive string (up to 128 characters long) of alphanumeric characters plus the special characters: `'-'`, `'.'`, `'_'`, `':'`. The last character must be alphanumeric or dash (`'-'`). For X.509 based devices, the registration ID is derived from the certificate's common name (CN), so the common name must adhere to the registration ID string format. For further information on these requirements see [DPS terminology](./concepts-service.md). There are two ways to enroll the device to the Device Provisioning Service: |
| iot-hub | Iot Hub Devguide Messages Read Builtin | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/iot-hub/iot-hub-devguide-messages-read-builtin.md | The product integrations you can use with the built-in Event Hub-compatible endp * [Time Series Insights](../time-series-insights/index.yml). See [Add an IoT hub event source to your Time Series Insights environment](../time-series-insights/how-to-ingest-data-iot-hub.md). * [Apache Storm spout](../hdinsight/storm/apache-storm-develop-csharp-event-hub-topology.md). You can view the [spout source](https://github.com/apache/storm/tree/master/external/storm-eventhubs) on GitHub. * [Apache Spark integration](../hdinsight/spark/apache-spark-ipython-notebook-machine-learning.md).+* [Apache Kafka](https://kafka.apache.org/). For more information, see the [Apache Kafka developer guide for Event Hubs](../event-hubs/apache-kafka-developer-guide.md). * [Azure Databricks](/azure/azure-databricks/). ## Use AMQP-WS or a proxy with Event Hubs SDKs |
| key-vault | Azure Policy | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/key-vault/general/azure-policy.md | You manage a key vault used by multiple teams that contains 100 certificates, an  -1. Click on the parameters tab at the top of the screen in order to specify the maximum validity period in months that you want. Select **audit** or **deny** for the effect of the policy following the guidance in the sections above. Then select the review + create button. +1. Click on the parameters tab at the top of the screen in order to specify the maximum validity period in months that you want. If you need to input the parameters, you can uncheck 'Only show parameters that need input or review' option. Select **audit** or **deny** for the effect of the policy following the guidance in the sections above. Then select the review + create button.  |
| key-vault | Third Party Solutions | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/key-vault/managed-hsm/third-party-solutions.md | Several vendors have worked closely with Microsoft to integrate their solutions |[Cloudflare](https://cloudflare.com)|CloudflareΓÇÖs Keyless SSL enables your websites to use CloudflareΓÇÖs SSL service while keeping custody of their private keys in Managed HSM. This service, coupled with Managed HSM helps a high level of protection by safeguarding your private keys, performing signing and encryption operations internally, providing access controls, and storing keys in a tamper-resistant FIPS 140-2 Level 3 HSM. <br>[Documentation](https://developers.cloudflare.com/ssl/keyless-ssl/hardware-security-modules/azure-managed-hsm) |[NewNet Communication Technologies](https://newnet.com/)|NewNetΓÇÖs Secure Transaction Cloud(STC) is an Industry first Cloud based secure payment routing, switching, transport solution augmented with Cloud based virtualized HSM, handling Mobile, Web, In-Store payments. STC enables cloud transformation for payment entities & rapid deployment for green field payment providers.<br/>[Azure Marketplace offering](https://azuremarketplace.microsoft.com/marketplace/apps/newnetcommunicationtechnologies1589991852134.secure_transaction_cloud?tab=overview)<br/>[Documentation](https://newnet.com/business-units/secure-transactions/products/secure-transaction-cloud-stc/)| |[PrimeKey](https://www.primekey.com)|EJBCA Enterprise, world's most used PKI (public key infrastructure), provides the basic security services for trusted identities and secure communication for any use case. A single instance of EJBCA Enterprise supports multiple CAs and levels to enable you to build complete infrastructure(s) for multiple use cases.<br>[Azure Marketplace offering](https://azuremarketplace.microsoft.com/marketplace/apps/primekey.ejbca_enterprise_cloud_2)<br/>[Documentation](https://doc.primekey.com/x/a4z_/)|+|[HashiCorp Vault](https://www.hashicorp.com/products/vault)| HashiCorp Vault is an identity-based security solution that leverages trusted sources of identity to keep secrets and application data secure, including API keys, passwords, or certificates. HashiCorp Vaults must be unsealed with an unsealing key to provide access to data. Hardware-backed keys stored in Managed HSM can be used to automatically unseal a HashiCorp Vault and reduce the operational overhead associated with storing and serving this unsealing key. <br>[Documentation](https://www.vaultproject.io/docs/configuration/seal/azurekeyvault)| |
| lab-services | Tutorial Setup Classroom Lab | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/lab-services/tutorial-setup-classroom-lab.md | When you add users, by default, the **Restrict access** option is turned on and, ### Add users from an Azure AD group -You can sync a lab user list to an existing Azure Active Directory (Azure AD) group so that you do not have to manually add or delete users. +You can sync a lab user list to an existing Azure Active Directory (Azure AD) group so that you don't have to manually add or delete users. An Azure AD group can be created within your organization's Azure Active Directory to manage access to organizational resources and cloud-based apps. To learn more, see [Azure AD groups](../active-directory/fundamentals/active-directory-manage-groups.md). If your organization uses Microsoft Office 365 or Azure services, your organization will already have admins who manage your Azure Active Directory. An Azure AD group can be created within your organization's Azure Active Directo If you don't see an Azure AD group in the list, could be because of the following reasons: - If you are a guest user for an Azure Active Directory (usually if you're outside the organization that owns the Azure AD), and you are not able to to search for groups inside the Azure AD. In this case, you wonΓÇÖt be able to add an Azure AD group to the lab in this case. - - Azure AD groups created through Teams do not show up in this list. You can add the Azure Lab Services app inside Teams to create and manage labs directly from within it. See more information about [managing a labΓÇÖs user list from within Teams](how-to-manage-user-lists-within-teams.md). + - Azure AD groups created through Teams don't show up in this list. You can add the Azure Lab Services app inside Teams to create and manage labs directly from within it. See more information about [managing a labΓÇÖs user list from within Teams](how-to-manage-user-lists-within-teams.md). 1. Once you picked the Azure AD group to sync your lab to, click **Add**. 1. Once a lab is synced, it will pull everyone inside the Azure AD group into the lab as users, and you will see the user list updated. Only the people in this Azure AD group will have access to your lab. The user list will refresh every 24 hours to match the latest membership of the Azure AD group. You can also click on the Sync button in the Users tab to manually sync to the latest changes in the Azure AD group. 1. Invite the users to your lab by clicking on the **Invite All** button, which will send an email to all users with the registration link to the lab. For more information about adding students to a class and managing their usage o In this tutorial, you created a lab for your class in Azure. To learn how a student can access a VM in the lab using the registration link, advance to the next tutorial: > [!div class="nextstepaction"]-> [Connect to a VM in the classroom lab](tutorial-connect-virtual-machine-classroom-lab.md) +> [Connect to a VM in the classroom lab](tutorial-connect-virtual-machine-classroom-lab.md) |
| load-testing | Overview What Is Azure Load Testing | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/load-testing/overview-what-is-azure-load-testing.md | You can create a load test by using existing test scripts based on Apache JMeter Azure Load Testing test engines abstract the required infrastructure for running a high-scale load test. The test engines run the Apache JMeter script to simulate a large number of virtual users simultaneously accessing your application endpoints. To scale out the load test, you can configure the number of test engines. -Azure Load Testing uses Apache JMeter version 5.4.1 for running load tests. +Azure Load Testing uses Apache JMeter version 5.4.1 for running load tests. You can use Apache JMeter plugins that are available on https://jmeter-plugins.org in your test script. The application can be hosted anywhere: in Azure, on-premises, or in other clouds. During the load test, the service collects the following resource metrics and displays them in a dashboard: |
| machine-learning | Concept Azure Machine Learning Architecture | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/concept-azure-machine-learning-architecture.md | You can bring a model that was trained outside of Azure Machine Learning. Or you Azure Machine Learning is framework agnostic. When you create a model, you can use any popular machine learning framework, such as Scikit-learn, XGBoost, PyTorch, TensorFlow, and Chainer. -For an example of training a model using Scikit-learn, see [Tutorial: Train an image classification model with Azure Machine Learning](tutorial-train-models-with-aml.md). +For an example of training a model using Scikit-learn, see [Tutorial: Train an image classification model with Azure Machine Learning](tutorial-train-deploy-notebook.md). ### <a name="register-model"></a> Model registry When you register the model, you can provide additional metadata tags and then u You can't delete a registered model that is being used by an active deployment. -For an example of registering a model, see [Train an image classification model with Azure Machine Learning](tutorial-train-models-with-aml.md). +For an example of registering a model, see [Train an image classification model with Azure Machine Learning](tutorial-train-deploy-notebook.md). ## Deployment Here are the details: [](media/concept-azure-machine-learning-architecture/inferencing.png#lightbox) -For an example of deploying a model as a web service, see [Deploy an image classification model in Azure Container Instances](tutorial-deploy-models-with-aml.md). +For an example of deploying a model as a web service, see [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md). #### Real-time endpoints To get started with Azure Machine Learning, see: * [What is Azure Machine Learning?](overview-what-is-azure-machine-learning.md) * [Create an Azure Machine Learning workspace](how-to-manage-workspace.md)-* [Tutorial (part 1): Train a model](tutorial-train-models-with-aml.md) +* [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md) |
| machine-learning | Concept Compute Instance | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/concept-compute-instance.md | You can also **[use a setup script (preview)](how-to-create-manage-compute-insta To create a compute instance for yourself, use your workspace in Azure Machine Learning studio, [create a new compute instance](how-to-create-manage-compute-instance.md?tabs=azure-studio#create) from either the **Compute** section or in the **Notebooks** section when you are ready to run one of your notebooks. You can also create an instance-* Directly from the [integrated notebooks experience](tutorial-train-models-with-aml.md#azure) +* Directly from the [integrated notebooks experience](tutorial-train-deploy-notebook.md#azure) * In Azure portal * From Azure Resource Manager template. For an example template, see the [create an Azure Machine Learning compute instance template](https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.machinelearningservices/machine-learning-compute-create-computeinstance). * With [Azure Machine Learning SDK](https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/machine-learning/concept-compute-instance.md) |
| machine-learning | Concept Model Management And Deployment | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/concept-model-management-and-deployment.md | Learn more by reading and exploring the following resources: + [How & where to deploy models](how-to-deploy-and-where.md) with Azure Machine Learning -+ [Tutorial: Deploy an image classification model in ACI](tutorial-deploy-models-with-aml.md). ++ [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md). + [End-to-end MLOps examples repo](https://github.com/microsoft/MLOps) |
| machine-learning | How To Assign Roles | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-assign-roles.md | Here are a few things to be aware of while you use Azure role-based access contr - [Enterprise security overview](concept-enterprise-security.md) - [Virtual network isolation and privacy overview](how-to-network-security-overview.md)-- [Tutorial: Train models](tutorial-train-models-with-aml.md)+- [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md) - [Resource provider operations](../role-based-access-control/resource-provider-operations.md#microsoftmachinelearningservices) |
| machine-learning | How To Attach Compute Targets | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-attach-compute-targets.md | See these notebooks for examples of training with various compute targets: ## Next steps * Use the compute resource to [configure and submit a training run](how-to-set-up-training-targets.md).-* [Tutorial: Train a model](tutorial-train-models-with-aml.md) uses a managed compute target to train a model. +* [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md) uses a managed compute target to train a model. * Learn how to [efficiently tune hyperparameters](how-to-tune-hyperparameters.md) to build better models. * Once you have a trained model, learn [how and where to deploy models](how-to-deploy-and-where.md). * [Use Azure Machine Learning with Azure Virtual Networks](./how-to-network-security-overview.md) |
| machine-learning | How To Configure Databricks Automl Environment | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-configure-databricks-automl-environment.md | Try it out: ## Next steps -- [Train a model](tutorial-train-models-with-aml.md) on Azure Machine Learning with the MNIST dataset.+- [Train and deploy a model](tutorial-train-deploy-notebook.md) on Azure Machine Learning with the MNIST dataset. - See the [Azure Machine Learning SDK for Python reference](/python/api/overview/azure/ml/intro). |
| machine-learning | How To Configure Environment | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-configure-environment.md | For more information, see [Data Science Virtual Machines](https://azure.microsof ## Next steps -- [Train a model](tutorial-train-models-with-aml.md) on Azure Machine Learning with the MNIST dataset.+- [Train and deploy a model](tutorial-train-deploy-notebook.md) on Azure Machine Learning with the MNIST dataset. - See the [Azure Machine Learning SDK for Python reference](/python/api/overview/azure/ml/intro). |
| machine-learning | How To Create Attach Compute Studio | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-create-attach-compute-studio.md | myvm = ComputeTarget(workspace=ws, name='my-vm-name') ``` * Use the compute resource to [submit a training run](how-to-set-up-training-targets.md).-* [Tutorial: Train a model](tutorial-train-models-with-aml.md) uses a managed compute target to train a model. * Learn how to [efficiently tune hyperparameters](how-to-tune-hyperparameters.md) to build better models. * Once you have a trained model, learn [how and where to deploy models](how-to-deploy-and-where.md). * [Use Azure Machine Learning with Azure Virtual Networks](./how-to-network-security-overview.md) |
| machine-learning | How To Deploy App Service | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-deploy-app-service.md | For more information on features provided by Azure App Service, see the [App Ser * An Azure Machine Learning workspace. For more information, see the [Create a workspace](how-to-manage-workspace.md) article. * The [Azure CLI](/cli/azure/install-azure-cli).-* A trained machine learning model registered in your workspace. If you do not have a model, use the [Image classification tutorial: train model](tutorial-train-models-with-aml.md) to train and register one. +* A trained machine learning model registered in your workspace. If you do not have a model, use the [Image classification tutorial: train model](tutorial-train-deploy-notebook.md) to train and register one. > [!IMPORTANT] > The code snippets in this article assume that you have set the following variables: |
| machine-learning | How To Deploy Functions | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-deploy-functions.md | With Azure Machine Learning, you can create Docker images from trained machine l * An Azure Machine Learning workspace. For more information, see the [Create a workspace](how-to-manage-workspace.md) article. * The [Azure CLI](/cli/azure/install-azure-cli).-* A trained machine learning model registered in your workspace. If you do not have a model, use the [Image classification tutorial: train model](tutorial-train-models-with-aml.md) to train and register one. +* A trained machine learning model registered in your workspace. If you do not have a model, use the [Image classification tutorial: train model](tutorial-train-deploy-notebook.md) to train and register one. > [!IMPORTANT] > The code snippets in this article assume that you have set the following variables: |
| machine-learning | How To Deploy Local | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-deploy-local.md | Scenarios for local deployment include: ## Prerequisites - An Azure Machine Learning workspace. For more information, see [Create an Azure Machine Learning workspace](how-to-manage-workspace.md).-- A model and an environment. If you don't have a trained model, you can use the model and dependency files provided in [this tutorial](tutorial-train-models-with-aml.md).+- A model and an environment. If you don't have a trained model, you can use the model and dependency files provided in [this tutorial](tutorial-train-deploy-notebook.md). - The [Azure Machine Learning SDK for Python](/python/api/overview/azure/ml/intro). - A conda manager, like Anaconda or Miniconda, if you want to mirror Azure Machine Learning package dependencies. - Docker, if you want to use a containerized version of the Azure Machine Learning environment. The argument to the `run()` method will be in this form: The object you return from the `run()` method must implement `toJSON() -> string`. -The following example demonstrates how to load a registered scikit-learn model and score it by using NumPy data. This example is based on the model and dependencies of [this tutorial](tutorial-train-models-with-aml.md). +The following example demonstrates how to load a registered scikit-learn model and score it by using NumPy data. This example is based on the model and dependencies of [this tutorial](tutorial-train-deploy-notebook.md). ```python import json |
| machine-learning | How To Enable App Insights | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-enable-app-insights.md | The [enable-app-insights-in-production-service.ipynb](https://github.com/Azure/M * An Azure Machine Learning workspace, a local directory that contains your scripts, and the Azure Machine Learning SDK for Python installed. To learn more, see [How to configure a development environment](how-to-configure-environment.md). -* A trained machine learning model. To learn more, see the [Train image classification model](tutorial-train-models-with-aml.md) tutorial. +* A trained machine learning model. To learn more, see the [Train image classification model](tutorial-train-deploy-notebook.md) tutorial. <a name="python"></a> |
| machine-learning | How To Enable Data Collection | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-enable-data-collection.md | The path to the output data in the blob follows this syntax: - An Azure Machine Learning workspace, a local directory containing your scripts, and the Azure Machine Learning SDK for Python must be installed. To learn how to install them, see [How to configure a development environment](how-to-configure-environment.md). -- You need a trained machine-learning model to be deployed to AKS. If you don't have a model, see the [Train image classification model](tutorial-train-models-with-aml.md) tutorial.+- You need a trained machine-learning model to be deployed to AKS. If you don't have a model, see the [Train image classification model](tutorial-train-deploy-notebook.md) tutorial. - You need an AKS cluster. For information on how to create one and deploy to it, see [How to deploy and where](how-to-deploy-and-where.md). |
| machine-learning | How To Homomorphic Encryption Seal | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-homomorphic-encryption-seal.md | The encryption method used in this sample is [homomorphic encryption](https://gi ## Prerequisites -This guide assumes that you have an image classification model registered in Azure Machine Learning. If not, register the model using a [pretrained model](https://github.com/Azure/MachineLearningNotebooks/raw/master/tutorials/image-classification-mnist-dat). +This guide assumes that you have an image classification model registered in Azure Machine Learning. If not, register the model using a [pretrained model](https://github.com/Azure/MachineLearningNotebooks/raw/master/tutorials/image-classification-mnist-dat). ## Configure local environment |
| machine-learning | How To Label Data | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-label-data.md | When you're done labeling, select your name in the upper-right corner of the lab ## Next steps -* Learn to [train image classification models in Azure](./tutorial-train-models-with-aml.md) +* Learn to [train image classification models in Azure](./tutorial-train-deploy-notebook.md) |
| machine-learning | How To Log View Metrics | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-log-view-metrics.md | The following notebooks demonstrate concepts in this article: See these articles to learn more on how to use Azure Machine Learning: -* See an example of how to register the best model and deploy it in the tutorial, [Train an image classification model with Azure Machine Learning](tutorial-train-models-with-aml.md). +* See an example of how to register the best model and deploy it in the tutorial, [Train an image classification model with Azure Machine Learning](tutorial-train-deploy-notebook.md). |
| machine-learning | How To Manage Files | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-manage-files.md | To create a new file in a different folder: Your workspace contains a **Sample notebooks** folder with notebooks designed to help you explore the SDK and serve as examples for your own machine learning projects. Clone these notebooks into your own folder to run and edit them. -For an example, see [Tutorial: Create your first ML experiment](tutorial-train-models-with-aml.md#azure). +For an example, see [Tutorial: Create your first ML experiment](tutorial-train-deploy-notebook.md#azure). ## Share files |
| machine-learning | How To Manage Workspace | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-manage-workspace.md | Examples of creating a workspace: ## Next steps -Once you have a workspace, learn how to [Train and deploy a model](tutorial-train-models-with-aml.md). +Once you have a workspace, learn how to [Train and deploy a model](tutorial-train-deploy-notebook.md). To learn more about planning a workspace for your organization's requirements, see [Organize and set up Azure Machine Learning](/azure/cloud-adoption-framework/ready/azure-best-practices/ai-machine-learning-resource-organization). |
| machine-learning | How To Set Up Training Targets | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-set-up-training-targets.md | method, or from the Experiment tab view in Azure Machine Learning studio client ## Next steps -* [Tutorial: Train a model](tutorial-train-models-with-aml.md) uses a managed compute target to train a model. +* [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md) uses a managed compute target to train a model. * See how to train models with specific ML frameworks, such as [Scikit-learn](how-to-train-scikit-learn.md), [TensorFlow](how-to-train-tensorflow.md), and [PyTorch](how-to-train-pytorch.md). * Learn how to [efficiently tune hyperparameters](how-to-tune-hyperparameters.md) to build better models. * Once you have a trained model, learn [how and where to deploy models](how-to-deploy-and-where.md). |
| machine-learning | How To Troubleshoot Deployment Local | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-troubleshoot-deployment-local.md | Learn more about deployment: * [How to troubleshoot remote deployments](how-to-troubleshoot-deployment.md) * [Azure Machine Learning inference HTTP Server](how-to-inference-server-http.md) * [How to deploy and where](how-to-deploy-and-where.md)-* [Tutorial: Train & deploy models](tutorial-train-models-with-aml.md) +* [Tutorial: Train & deploy models](tutorial-train-deploy-notebook.md) * [How to run and debug experiments locally](./how-to-debug-visual-studio-code.md) |
| machine-learning | How To Troubleshoot Deployment | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-troubleshoot-deployment.md | For more information, visit the [interactive debugging in VS Code guide](how-to- Learn more about deployment: * [How to deploy and where](how-to-deploy-and-where.md)-* [Tutorial: Train & deploy models](tutorial-train-models-with-aml.md) +* [Tutorial: Train & deploy models](tutorial-train-deploy-notebook.md) * [How to run and debug experiments locally](./how-to-debug-visual-studio-code.md) |
| machine-learning | How To Use Environments | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-use-environments.md | Using the Azure Machine Learning extension, you can create and manage environmen ## Next steps -* To use a managed compute target to train a model, see [Tutorial: Train a model](tutorial-train-models-with-aml.md). * After you have a trained model, learn [how and where to deploy models](how-to-deploy-and-where.md). * View the [`Environment` class SDK reference](/python/api/azureml-core/azureml.core.environment%28class%29). |
| machine-learning | How To Use Managed Identities | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-use-managed-identities.md | If you do not bring your own ACR, Azure Machine Learning service will create one az ml workspace show -n <my workspace> -g <my resource group> ``` -1. Perform an action that requires ACR. For example, the [tutorial on training a model](tutorial-train-models-with-aml.md). +1. Perform an action that requires ACR. For example, the [tutorial on training a model](tutorial-train-deploy-notebook.md). 1. Get the ACR name created by the cluster: |
| machine-learning | How To Use Reinforcement Learning | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/how-to-use-reinforcement-learning.md | Run this code in either of these environments. We recommend you try Azure Machin - Azure Machine Learning compute instance - - Learn how to clone sample notebooks in [Tutorial: Setup environment and workspace](tutorial-train-models-with-aml.md). + - Learn how to clone sample notebooks in [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md). - Clone the **how-to-use-azureml** folder instead of **tutorials** - Run the virtual network setup notebook located at `/how-to-use-azureml/reinforcement-learning/setup/devenv_setup.ipynb` to open network ports used for distributed reinforcement learning. - Run the sample notebook `/how-to-use-azureml/reinforcement-learning/atari-on-distributed-compute/pong_rllib.ipynb` |
| machine-learning | Overview What Happened To Workbench | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/overview-what-happened-to-workbench.md | The portal's workspace dashboard is supported on Microsoft Edge, Chrome, and Fir [](./media/overview-what-happened-to-workbench/image001.png#lightbox) -Start training your models and tracking the run histories using the new CLI and SDK. You can learn how with the [Tutorial: train models with Azure Machine Learning](tutorial-train-models-with-aml.md). +Start training your models and tracking the run histories using the new CLI and SDK. You can learn how with the [Tutorial: train models with Azure Machine Learning](tutorial-train-deploy-notebook.md). ## Will projects persist? In the latest version, models are deployed as web services to Azure Container In Learn more in these articles: + [Where and how to deploy models](how-to-deploy-and-where.md)-+ [Tutorial: Deploy models with Azure Machine Learning](tutorial-deploy-models-with-aml.md) ++ [Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md) ## Next steps For an overview of the service, read [What is Azure Machine Learning?](overview- Start with [Quickstart: Get started with Azure Machine Learning](quickstart-create-resources.md). Then use these resources to create your first experiment with your preferred method: + [Run a "Hello world!" Python script (part 1 of 3)](tutorial-1st-experiment-hello-world.md)- + [Use a Jupyter notebook to train image classification models](tutorial-train-models-with-aml.md) + + [Use a Jupyter notebook to train image classification models](tutorial-train-deploy-notebook.md) + [Use automated machine learning](tutorial-designer-automobile-price-train-score.md) + [Use the designer's drag & drop capabilities](tutorial-first-experiment-automated-ml.md) + [Use the ML extension to the CLI](how-to-train-cli.md) |
| machine-learning | Overview What Is Machine Learning Studio | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/overview-what-is-machine-learning-studio.md | Visit the [studio](https://ml.azure.com), or explore the different authoring opt Start with [Quickstart: Get started with Azure Machine Learning](quickstart-create-resources.md). Then use these resources to create your first experiment with your preferred method: + [Run a "Hello world!" Python script (part 1 of 3)](tutorial-1st-experiment-hello-world.md)- + [Use a Jupyter notebook to train image classification models](tutorial-train-models-with-aml.md) + + [Use a Jupyter notebook to train image classification models](tutorial-train-deploy-notebook.md) + [Use automated machine learning to train & deploy models](tutorial-first-experiment-automated-ml.md) + [Use the designer to train & deploy models](tutorial-designer-automobile-price-train-score.md) + [Use studio in a secured virtual network](how-to-enable-studio-virtual-network.md) |
| machine-learning | Samples Notebooks | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/samples-notebooks.md | For more GitHub sample projects and examples, see these repos: Try these tutorials: -- [Train and deploy an image classification model with MNIST](tutorial-train-models-with-aml.md)+- [Train and deploy an image classification model with MNIST](tutorial-train-deploy-notebook.md) - [Prepare data and use automated machine learning to train a regression model with the NYC taxi data set](tutorial-auto-train-models.md) |
| machine-learning | Tutorial Auto Train Models | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/tutorial-auto-train-models.md | In this automated machine learning tutorial, you did the following tasks: > * Trained by using an automated regression model locally with custom parameters. > * Explored and reviewed training results. -[Deploy your model](tutorial-deploy-models-with-aml.md) with Azure Machine Learning. +[Tutorial: Train and deploy a model](tutorial-train-deploy-notebook.md) with Azure Machine Learning. |
| machine-learning | Tutorial Train Deploy Image Classification Model Vscode | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/machine-learning/tutorial-train-deploy-image-classification-model-vscode.md | For next steps, see: * [Connect Visual Studio Code to a compute instance](how-to-set-up-vs-code-remote.md) for a full development experience. * For a walkthrough of how to edit, run, and debug code locally, see the [Python hello-world tutorial](https://code.visualstudio.com/docs/Python/Python-tutorial). * [Run Jupyter Notebooks in Visual Studio Code](how-to-manage-resources-vscode.md) using a remote Jupyter server.-* For a walkthrough of how to train with Azure Machine Learning outside of Visual Studio Code, see [Tutorial: Train models with Azure Machine Learning](tutorial-train-models-with-aml.md). +* For a walkthrough of how to train with Azure Machine Learning outside of Visual Studio Code, see [Tutorial: Train and deploy a model with Azure Machine Learning](tutorial-train-deploy-notebook.md). |
| mariadb | Sample Change Server Configuration | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/mariadb/scripts/sample-change-server-configuration.md | This sample CLI script lists all available configuration parameters as well as t In this sample script, edit the highlighted lines to update the admin username and password to your own. [!code-azurecli-interactive[main](../../../cli_scripts/mariadb/change-server-configurations/change-server-configurations.sh?highlight=15-16 "List and update configurations of Azure Database for MariaDB.")] -## Clean up deployment -Use the following command to remove the resource group and all resources associated with it after the script has been run. -[!code-azurecli-interactive[main](../../../cli_scripts/mariadb/change-server-configurations/delete-mariadb.sh "Delete the resource group.")] - ## Script explanation This script uses the commands outlined in the following table: |
| mariadb | Sample Create Server And Firewall Rule | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/mariadb/scripts/sample-create-server-and-firewall-rule.md | This sample CLI script creates an Azure Database for MariaDB server and configur In this sample script, edit the highlighted lines to update the admin username and password to your own. [!code-azurecli-interactive[main](../../../cli_scripts/mariadb/create-mariadb-server-and-firewall-rule/create-mariadb-server-and-firewall-rule.sh?highlight=15-16 "Create an Azure Database for mariadb, and server-level firewall rule.")] -## Clean up deployment -Use the following command to remove the resource group and all resources associated with it after the script has been run. -[!code-azurecli-interactive[main](../../../cli_scripts/mariadb/create-mariadb-server-and-firewall-rule/delete-mariadb.sh "Delete the resource group.")] - ## Script explanation This script uses the commands outlined in the following table: |
| mariadb | Sample Point In Time Restore | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/mariadb/scripts/sample-point-in-time-restore.md | This sample CLI script restores a single Azure Database for MariaDB server to a In this sample script, edit the highlighted lines to update the admin username and password to your own. Replace the subscription ID used in the `az monitor` commands with your own subscription ID. [!code-azurecli-interactive[main](../../../cli_scripts/mariadb/backup-restore-pitr/backup-restore.sh?highlight=15-16 "Restore Azure Database for MariaDB.")] -## Clean up deployment -Use the following command to remove the resource group and all resources associated with it after the script has been run. -[!code-azurecli-interactive[main](../../../cli_scripts/mariadb/backup-restore-pitr/delete-mariadb.sh "Delete the resource group.")] - ## Script explanation This script uses the commands outlined in the following table: |
| mariadb | Sample Scale Server | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/mariadb/scripts/sample-scale-server.md | This sample CLI script scales compute and storage for a single Azure Database fo Update the script with your subscription ID. [!code-azurecli-interactive[main](../../../cli_scripts/mariadb/scale-mariadb-server/scale-mariadb-server.sh "Create and scale Azure Database for MariaDB.")] -## Clean up deployment -Use the following command to remove the resource group and all resources associated with it after the script has been run. -[!code-azurecli-interactive[main](../../../cli_scripts/mariadb/scale-mariadb-server/delete-mariadb.sh "Delete the resource group.")] - ## Script explanation This script uses the commands outlined in the following table: |
| mariadb | Sample Server Logs | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/mariadb/scripts/sample-server-logs.md | This sample CLI script enables and downloads the slow query logs of a single Azu In this sample script, edit the highlighted lines to update the admin username and password to your own. Replace the <log_file_name> in the `az monitor` commands with your own server log file name. [!code-azurecli-interactive[main](../../../cli_scripts/mariadb/server-logs/server-logs.sh?highlight=15-16 "Manipulate with server logs.")] -## Clean up deployment -Use the following command to remove the resource group and all resources associated with it after the script has been run. -[!code-azurecli-interactive[main](../../../cli_scripts/mariadb/server-logs/delete-mariadb.sh "Delete the resource group.")] - ## Script explanation This script uses the commands outlined in the following table: |
| marketplace | Azure Private Plan Troubleshooting | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/marketplace/azure-private-plan-troubleshooting.md | Title: Troubleshoot private plans in the commercial marketplace -description: Troubleshoot private plans in commercial marketplace +description: Troubleshoot private plans in the commercial marketplace -# Troubleshooting Private Plans in Commercial Marketplace +# Troubleshooting Private Plans in the commercial marketplace -This topic will discuss various issues and solutions when troubleshooting private plans. +This topic discusses various issues and solutions when troubleshooting private plans. ## Customer Blockers and Common Solutions |
| marketplace | Co Sell Configure | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/marketplace/co-sell-configure.md | The supported file types are .pdf, .ppt, .pptx, .doc, .docx, .xls, .xlsx, .jpg, | **Documents** | **Description** | | :- | :-|-| *Solution/offer one-pager (Required)* | Drive awareness among potential customers with a professionally designed one-pager that showcases the value proposition of your solution.<br><br>You can use one of the relevant templates to provide a customer-ready description of your offering:<br><ul><li> [Microsoft Azure one-pager template](https://go.microsoft.com/fwlink/?linkid=2171711)</li><li>[Microsoft Dynamics 365 one-pager template](https://go.microsoft.com/fwlink/?linkid=2171609)</li> <li>[Microsoft 365 one-pager template](https://go.microsoft.com/fwlink/?linkid=2171408) </li><li>[Windows 10 one-pager template](https://go.microsoft.com/fwlink/?linkid=2171550)</li></ul><br>Microsoft sales teams may share this information with customers to help determine if your offering may be a good fit, and to ensure that it is customer ready. | -| *Solution/offer pitch deck (Required)* | You can use the [Customer presentation template](https://go.microsoft.com/fwlink/?linkid=2171712) to create your pitch deck. This deck should reference the [Reference architecture diagram](reference-architecture-diagram.md). The purpose of this slide deck is to pitch your offer and its value proposition. After ensuring that your offer is customer ready, Microsoft sales teams may share this presentation with customers to articulate the value that your company and Microsoft bring when deploying a joint solution. The presentation should cover what your offer does, how it can help customers, what industries the offer is relevant for, and how it compares with competing solutions. | -| *Customer case study* (Optional)| Use the [Case study template](https://go.microsoft.com/fwlink/?linkid=2171611) to create your customer case study. This information shows a potential customer how you and Microsoft have successfully deployed your offer in prior cases. | +| *Solution/offer one-pager (Required)* | Drive awareness among potential customers with a professionally designed one-pager that showcases the value proposition of your solution.<br><br>You can use one of the relevant templates to provide a customer-ready description of your offering:<br><ul><li> [Microsoft Azure one-pager template](https://aka.ms/Customer-One-Pager_MicrosoftAzure)</li><li>[Microsoft Dynamics 365 one-pager template](https://aka.ms/Customer-One-Pager_MicrosoftDynamics365)</li> <li>[Microsoft 365 one-pager template](https://aka.ms/Customer-One-Pager_MicrosoftOffice365) </li><li>[Windows 10 one-pager template](https://aka.ms/Customer-One-Pager_Windows)</li></ul> <br> Microsoft sales teams may share this information with customers to help determine if your offering may be a good fit, and to ensure that it is customer ready. <br><br>A one-pager <i>should not</i> be longer than 10 pages. | +| *Solution/offer pitch deck (Required)* | You can use the [Customer presentation template](https://aka.ms/GTMServices_CustomerPresentation) to create your pitch deck. This deck should reference the [Reference architecture diagram](reference-architecture-diagram.md). The purpose of this slide deck is to pitch your offer and its value proposition. After ensuring that your offer is customer ready, Microsoft sales teams may share this presentation with customers to articulate the value that your company and Microsoft bring when deploying a joint solution. The presentation should cover what your offer does, how it can help customers, what industries the offer is relevant for, and how it compares with competing solutions. | +| *Customer case study* (Optional)| Use the [Case study template](https://aka.ms/GTM_Case_Study_Template) to create your customer case study. This information shows a potential customer how you and Microsoft have successfully deployed your offer in prior cases. | | *Verifiable customer wins* (Optional) | Provide specific examples of customer successes after your offer has been deployed. | | *Channel pitch deck* (Optional) | A slide deck with information that helps channel resellers learn more about your offer and get their sales teams ready to sell it. This deck typically includes an elevator pitch, information about target customers, questions to ask customers, talking points, and links to videos, documentation, and support information. | | *Reference architecture diagram* (Required for Azure IP co-sell incentive status) | A diagram that represents your offer and its relationship with Microsoft cloud services. It may also demonstrate how your offer meets the technical requirements for Azure IP Co-sell incentive status. [Learn more about the reference architecture diagram.](reference-architecture-diagram.md) | Your contact information lets Microsoft sales teams and channel resellers reques ## Next steps - For details about republishing an offer, see [How to review and publish an offer to the commercial marketplace](review-publish-offer.md).-- For information about commercial marketplace rewards and technical benefits, see [Your commercial marketplace benefits](gtm-your-marketplace-benefits.md).+- For information about commercial marketplace rewards and technical benefits, see [Your commercial marketplace benefits](gtm-your-marketplace-benefits.md). |
| marketplace | Manage Account | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/marketplace/manage-account.md | If you have not already done so, you (or your organization's administrator) shou [  ](./media/manage-accounts/settings-account-workspaces.png#lightbox) -1. Under **Account settings**, select **Legal**, then the **Developer** tab to view details related to your commercial marketplace account. +1. In the left menu, under **Organization profile**, select **Legal**. Then select the **Developer** tab to view details related to your commercial marketplace account. [  ](./media/manage-accounts/developer-tab-workspaces.png#lightbox) By default, Microsoft sends payments on a monthly basis. However, you can option **To place your payments on hold**: -1. Go to **Account settings**. -1. In the left-nav expand **Payout and tax** and select **Payout and tax profiles**. +1. Go to **Account settings**. +1. In the left menu expand **Payout and tax** and select **Payout and tax profiles**. 1. Select the program for which you want to hold payments, and then select the **Hold my Payment** check box. You can change your payout hold status at any time, but be aware that your decision will impact the next monthly payout. For example, if you want to hold April's payout, make sure to set your payout hold status to **On** before the end of March. If you are publishing a [Dynamics 365 apps on Dataverse and Power Apps](./partne The billing address is pre-populated from your legal entity, and you can update this address later. The TAX and VAT ID fields are required for some countries and optional for others. The country/region name and company name cannot be edited. 1. In the top-right, select **Settings** (gear icon), and then select **Account settings**.-1. Then in the left-nav expand **Organization profile** and select **Billing profile**. +1. Then in the left menu expand **Organization profile** and select **Billing profile**. ## Multi-user account management Partner Center uses [Azure Active Directory](../active-directory/fundamentals/ac ## Next steps -- [Add and manage users](add-manage-users.md)+- [Add and manage users](add-manage-users.md) |
| marketplace | Support Azure Marketplace | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/marketplace/support-azure-marketplace.md | - Title: Microsoft commercial marketplace support - Azure Marketplace -description: Support information and links for Azure Marketplace and AppSource in Partner Center ----- Previously updated : 06/14/2021---# Support for the Microsoft commercial marketplace --Do you have questions about getting started as a Microsoft commercial marketplace publisher? Here's a list of support options for the commercial marketplace. In addition to the following resources, you can also get many of your questions answered in the [Marketplace channel of C+AI Community Forum](https://www.microsoftpartnercommunity.com/t5/Marketplace/bd-p/2222). --## Onboarding --Open a ticket with Microsoft [marketplace publisher support](https://go.microsoft.com/fwlink/?linkid=2165533) for issues with onboarding and getting started. --## Partner Center --| Support channel | Description | Availability | -|: |: |: | -| For assistance, visit the Create an incident page located at [Marketplace Support](https://go.microsoft.com/fwlink/?linkid=2165533)</li> </ul> | Support for Partner Center. | Support is provided 24x5. | -| --## Technical --| Support channel | Description | -|: |: | -| MSDN forums: Marketplace located at [Microsoft Q&A question page](/answers/products/azure) | Microsoft Developer Network forum. | -| Stack Overflow: Azure located at [stackoverflow.com/questions/tagged/azure](https://stackoverflow.com/questions/tagged/azure) | Stack Overflow environment to get solutions and ask questions about everything related to Azure Marketplace.<ul> <li>Stack Overflow: Azure Marketplace located at [stackoverflow.com/questions/tagged/azure-marketplace](https://stackoverflow.com/questions/tagged/azure-marketplace)</li> <li>Stack Overflow: Azure Resource Manager located at [stackoverflow.com/questions/tagged/azure-resource-manager](https://stackoverflow.com/questions/tagged/azure-resource-manager)</li> <li>Stack Overflow: Virtual Machines on Azure located at [stackoverflow.com/questions/tagged/azure-virtual-machine](https://stackoverflow.com/questions/tagged/azure-virtual-machine)</li> <li>Stack Overflow: Containers on Azure located at [stackoverflow.com/search?q=azure+container](https://stackoverflow.com/search?q=azure+container)</li> </ul> | --## Marketing resources --| Support channel | Description | Availability | -|: |: |: | -| Email: [cebrand@microsoft.com](mailto:cebrand@microsoft.com) | Answers to questions about usage for Azure logos and branding. | | -| --For questions about Marketplace Rewards, contact [Partner Center support](https://partner.microsoft.com/support/v2/?stage=1). --## Next steps --- Visit the [commercial marketplace publisher guide page](index.yml)-- Learn more about [support for the commercial marketplace program in Partner Center](support.md) |
| marketplace | Support | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/marketplace/support.md | description: Learn about your support options for the commercial marketplace pro -- Previously updated : 09/27/2021++ Last updated : 01/12/2022 # Support for the commercial marketplace program in Partner Center To generate a HAR file using **Safari**:  +## Additional resources ++Do you have questions about getting started as a Microsoft commercial marketplace publisher? Here's a list of support options for the commercial marketplace. In addition to the following resources, you can also get many of your questions answered in the [Marketplace channel of C+AI Community Forum](https://www.microsoftpartnercommunity.com/t5/Marketplace/bd-p/2222). ++### Onboarding ++Open a ticket with Microsoft [marketplace publisher support](https://go.microsoft.com/fwlink/?linkid=2165533) for issues with onboarding and getting started. ++### Partner Center ++| Support channel | Description | Availability | +|: |: |: | +| For assistance, visit the Create an incident page located at [Marketplace Support](https://go.microsoft.com/fwlink/?linkid=2165533)</li> </ul> | Support for Partner Center. | Support is provided 24x5. | +| ++### Technical ++| Support channel | Description | +|: |: | +| MSDN forums: Marketplace located at [Microsoft Q&A question page](/answers/products/azure) | Microsoft Developer Network forum. | +| Stack Overflow: Azure located at [stackoverflow.com/questions/tagged/azure](https://stackoverflow.com/questions/tagged/azure) | Stack Overflow environment to get solutions and ask questions about everything related to Azure Marketplace.<ul> <li>Stack Overflow: Azure Marketplace located at [stackoverflow.com/questions/tagged/azure-marketplace](https://stackoverflow.com/questions/tagged/azure-marketplace)</li> <li>Stack Overflow: Azure Resource Manager located at [stackoverflow.com/questions/tagged/azure-resource-manager](https://stackoverflow.com/questions/tagged/azure-resource-manager)</li> <li>Stack Overflow: Virtual Machines on Azure located at [stackoverflow.com/questions/tagged/azure-virtual-machine](https://stackoverflow.com/questions/tagged/azure-virtual-machine)</li> <li>Stack Overflow: Containers on Azure located at [stackoverflow.com/search?q=azure+container](https://stackoverflow.com/search?q=azure+container)</li> </ul> | ++### Marketing resources ++| Support channel | Description | Availability | +|: |: |: | +| Email: [cebrand@microsoft.com](mailto:cebrand@microsoft.com) | Answers to questions about usage for Azure logos and branding. | | +| ++For questions about Marketplace Rewards, contact [Partner Center support](https://partner.microsoft.com/support/v2/?stage=1). + ## Next steps - [Update an existing offer in the Commercial Marketplace](update-existing-offer.md) |
| marketplace | What Is New | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/marketplace/what-is-new.md | -Learn about important updates in the commercial marketplace program of Partner Center. This page is updated frequently, so be sure to check back often! +Learn about important updates in the commercial marketplace program of Partner Center. This page is updated monthly, so be sure to check back! ## New features | Category | Description | Date | | | | |+| Added a [Revenue Dashboard](revenue-dashboard.md) to Partner Center, including a revenue report, [sample queries](analytics-sample-queries.md#revenue-report-queries), and [FAQs](/analytics-faq#revenue) page. | 2021-12-08 | +| Offers | Container and container apps offers can now use the Microsoft [Standard Contract](standard-contract.md). | 2021-11-02 | +| Offers | Private plans for [SaaS offers](plan-saas-offer.md) are now available on AppSource. | 2021-10-06 | +| Offers | In [Set up an Azure Marketplace subscription for hosted test drives](test-drive-azure-subscription-setup.md), for **Set up for Dynamics 365 apps on Dataverse and Power Apps**, we added a new method to remove users from your Azure tenant. | 2021-10-01 | | Offers | Setup and maintenance of Power BI Visuals is migrating from the Office Store to the commercial marketplace this month. [This FAQ](power-bi-visual-faq.yml) provides a summary of improvements to the offer submission process. To start, see [Plan a Power BI visual offer](marketplace-power-bi-visual.md).| 2021-09-21 | | Offers | While [private plans](private-plans.md) were previously only available on the Azure portal, they are now also available on Microsoft AppSource. | 2021-09-10 | | Analytics | Publishers of Azure application offers can view offer deployment health in the Quality of service (QoS) reports. QoS helps publishers understand the reasons for offer deployment failures and provides actionable insights for their remediation. For details, see [Quality of service (QoS) dashboard](quality-of-service-dashboard.md). | 2021-09-07 |+| Policy | The SaaS customer [refund window](/marketplace/refund-policies) is now [72 hours](/marketplace-faq-publisher-guide) for all offers. | 2021-09-01 | | Offers | Additional properties at the plan level are now available for Azure Virtual Machine offers. See the [virtual machine technical configuration properties](azure-vm-plan-overview.md#properties) article for more information. | 2021-07-26 | | Fees | Microsoft has reduced its standard store service fee to 3%. See [Commercial marketplace transact capabilities](marketplace-commercial-transaction-capabilities-and-considerations.md#examples-of-pricing-and-store-fees) and Common questions about payouts and taxes, "[How do I find the current Store Service Fee and the payout rate?](/partner-center/payout-faq)". | 2021-07-14 |-| Offers | Publishers can publish a virtual machine (VM) that they have built on premises. To learn more, see [Create a virtual machine using your own image](azure-vm-use-own-image.md). | 2021-06-23 | -| Customer engagement | Publishers can now respond to user reviews on Azure Marketplace or AppSource. To learn more, see [Ratings & Reviews analytics dashboard in Partner Center](ratings-reviews.md). | 2021-06-03 | | ## Tax updates | Category | Description | Date | | | | |+| Payouts | We've updated the external tax form page, including instructions on how to reconcile 1099-k forms; see questions about tax forms at [Understand IRS tax forms issued by Microsoft](/partner-center/understand-irs-tax-forms). | 2022-01-06 | | Taxation | Nigeria and Thailand are now [Microsoft-managed countries](/partner-center/tax-details-marketplace) in Azure Marketplace. | 2021-09-13 | | Taxation | End-customer taxation in Australia is managed by Microsoft, except for customer purchases made through an enterprise agreement, which are managed by the publisher. | 2021-07-01 |-| Taxation | Updated [tax details page](/partner-center/tax-details-marketplace) country list to include the following: <ul><li>Argentina</li><li>Bulgaria</li><li>Hong Kong SAR</li><li>Korea (South)</li><li>Pakistan</li><li>Palestinian Authority</li><li>Panama</li><li>Paraguay</li><li>Peru</li><li>Philippines</li><li>Saint Kitts and Nevis</li><li>Senegal</li><li>Sri Lanka</li><li>Tajikistan</li><li>Tanzania</li><li>Thailand</li><li>Trinidad and Tobago</li><li>Tunisia</li><li>Turkmenistan</li><li>Uganda</li><li>Uzbekistan</li><li>Zimbabwe</li></ul> | 2021-07-01 | +| Taxation | Updated [tax details page](/partner-center/tax-details-marketplace) country list to include the following: <br><br> - Argentina <br> - Bulgaria <br> - Hong Kong SAR <br> - Korea (South) <br>- Pakistan <br> - Palestinian Authority <br> - Panama <br> - Paraguay <br> - Peru <br> - Philippines <br> - Saint Kitts and Nevis <br> - Senegal <br> - Sri Lanka <br> - Tajikistan <br> - Tanzania <br> - Thailand <br> - Trinidad and Tobago <br> - Tunisia <br> - Turkmenistan <br> - Uganda <br> - Uzbekistan <br> - Zimbabwe | 2021-07-01 | | Taxation | Nigeria moved from the "shared publisher/developer-managed countries" list to the ΓÇ£end-customer taxation with differences in Marketplaces". | 2021-07-01 | | Learn about important updates in the commercial marketplace program of Partner C | Category | Description | Date | | | - | - |+| Offers | Added a new article, [Troubleshooting Private Plans in the commercial marketplace](azure-private-plan-troubleshooting.md). | 2021-12-13 | +| Offers | We have updated the names of [Dynamics 365](/marketplace-dynamics-365#licensing-options) offer types: <br><br> - Dynamics 365 for Customer Engagement & PowerApps is now **Dynamics 365 apps on Dataverse and Power Apps** <br> - Dynamics 365 for operations is now **Dynamics 365 Operations Apps** <br> - Dynamics 365 business central is now **Dynamics 365 Business Central** | 2021-12-03 | | Policy | WeΓÇÖve created an [FAQ topic](/legal/marketplace/mpa-faq) to answer publisher questions about the Microsoft Publisher Agreement. | 2021-09-27 | | Policy | We've updated the [Microsoft Publisher Agreement](/legal/marketplace/msft-publisher-agreement). For change history, see [Microsoft Publisher Agreement Version 8.0 ΓÇô October 2021 Update](/legal/marketplace/mpa-change-history-oct-2021). | 2021-09-14 | | Policy | Updated [certification](/legal/marketplace/certification-policies) policy for September; see [change history](/legal/marketplace/offer-policies-change-history). | 2021-09-10 | Learn about important updates in the commercial marketplace program of Partner C | Offers | We moved the list of categories and industries from our [Marketing Best Practices](gtm-offer-listing-best-practices.md) topic to their [own page](marketplace-categories-industries.md). | 2021-08-20 | | Offers | The [Commercial marketplace transact capabilities](marketplace-commercial-transaction-capabilities-and-considerations.md) topic now includes a flowchart to help you determine the appropriate transactable offer type and pricing plan to sell your software in the commercial marketplace. | 2021-08-18 | | Policy | Updated [certification](/legal/marketplace/certification-policies?context=/azure/marketplace/context/context) policy; see [change history](/legal/marketplace/offer-policies-change-history). | 2021-08-06 |-| Co-sell | Information added for the MACC program including, requirements, how often we update MACC status, and definitions for Enrolled, and not Enrolled. To learn more, see [Azure Consumption Commitment enrollment](./azure-consumption-commitment-enrollment.md), or [Co-sell with Microsoft sales teams and partners overview](co-sell-overview.md). | 2021-06-03 | | |
| postgresql | Concepts Configuration Options | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/postgresql/hyperscale/concepts-configuration-options.md | Hyperscale (Citus) server groups are available in the following Azure regions: * East US * East US 2 * North Central US+ * West Central US + * West US * West US 2 * Asia Pacific: * Australia East |
| purview | Concept Best Practices Scanning | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/purview/concept-best-practices-scanning.md | To avoid unexpected cost and rework, it is recommended to plan and follow the be - SQL Authentication (for example, for on-prem or Azure SQL sources) - Account key or Basic Authentication (for example, for SAP S/4HANA sources) + For details, see the how-to guide to [manage credentials](./manage-credentials.md). + > [!Note] > If you have firewall enabled for the storage account, you must use Managed Identity authentication method when setting up a scan. > While setting up a new credential, the credential name can only contain _letters, numbers, underscores and hyphens_. - **Integration runtime**- - Refer the [Network architecture best practices](./concept-best-practices-network.md#integration-runtime-options) + - Refer to [Network architecture best practices](./concept-best-practices-network.md#integration-runtime-options). - If SHIR is deleted, any ongoing scans relying on it will fail. - While using SHIR, ensure that the memory is sufficient for the data source being scanned. For example, when using SHIR for scanning SAP source, if you observe "out of memory error": - Ensure the SHIR machine has enough memory (it is recommended to have 128 GB) |
| purview | Concept Best Practices Sensitivity Labels | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/purview/concept-best-practices-sensitivity-labels.md | -Azure Purview supports labeling of both structured and unstructured data stored across various data sources. Labeling of data within Purview allows users to easily find data that matches pre-defined autolabeling rules that have been configured in the Microsoft 365 Security and Compliance Center(SCC). Azure Purview extends the use of Microsoft 365 sensitivity labels to assets stored in infrastructure cloud locations and structured data sources. +Azure Purview supports labeling of both structured and unstructured data stored across various data sources. Labeling of data within Purview allows users to easily find data that matches pre-defined auto-labeling rules that have been configured in the Microsoft 365 Security and Compliance Center (SCC). Azure Purview extends the use of Microsoft 365 sensitivity labels to assets stored in infrastructure cloud locations and structured data sources. +## Protect Personal Identifiable Information(PII) with Custom Sensitivity Label for Azure Purview, using Microsoft Information Protection ++Storing and processing of Personal Identifiable Information is subject to special protection. With referring to Regulations labeling of Personal Identifiable Information data is crucial to identify and label sensitive information. The detection and labeling tasks of Personal Identifiable Information can be used on different stages of your workflows and because Personal Identifiable Information is ubiquitous and fluid in your organization it is important to define identification rules for building policies that suit your individual situation ## Why do you need to use Labeling within Azure Purview? It also abstracts the data itself, so you use labels to track the type of data, ### Label considerations -- If you already have Microsoft 365 sensitivity labels in use in your environment, it is recommended that you continue to use your existing labels rather than making duplicate or more labels for Purview. This allows you to maximize the investment you have already made in the Microsoft 365 compliance space and ensures consistent labeling across your data estate.+- If you already have Microsoft 365 sensitivity labels in use in your environment, it is recommended that you continue to use your existing labels rather than making duplicate or more labels for Purview. This approach allows you to maximize the investment you have already made in the Microsoft 365 compliance space and ensures consistent labeling across your data estate. - If you have not yet created Microsoft 365 sensitivity labels, it is recommended that you review the documentation to [Get started with sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels). Creating a classification schema is a tenant-wide operation and should be discussed thoroughly before enabling it within your organization. ### Label recommendations - When configuring sensitivity labels for Azure Purview, you may define autolabeling rules for files, database columns, or both within the label properties. Azure Purview will label files within the Purview data map when the autolabeling rule is configured to automatically apply the label or recommend that the label is applied. -[!WARNING] If you have not already configured autolabeling for files and emails on your sensitivity labels, keep in mind this can have user impact within your Office and Microsoft 365 environment. You may however test autolabeling on database columns without user impact. +> [!WARNING] +> If you have not already configured autolabeling for files and emails on your sensitivity labels, keep in mind this can have user impact within your Office and Microsoft 365 environment. You may however test autolabeling on database columns without user impact. - If you are defining new autolabeling rules for files when configuring labels for Purview, make sure that you have the condition for applying the label set appropriately. - You can set the detection criteria to **All of these** or **Any of these** in the upper right of the autolabeling for files and emails page of the label properties.-- The default for this is **All of these** which means that the asset must contain all of the specified sensitive info types for the label to be applied. While this may be valid in some instances, many customers prefer to change this to **Any of these** meaning that if at least one of them is found the label is applied.+- The default setting for detection criteria is **All of these** which means that the asset must contain all of the specified sensitive info types for the label to be applied. While the default setting may be valid in some instances, many customers prefer to change the setting to **Any of these** meaning that if at least one of them is found the label is applied. :::image type="content" source="media/concept-best-practices/label-detection-criteria.png" alt-text="Screenshot that shows detection criteria for a label."::: It also abstracts the data itself, so you use labels to track the type of data, - For consistency in labeling across your data estate, if you are using autolabeling rules for files, it is recommended that you use the same sensitive information types for autolabeling database columns. +- [Define your sensitivity labels via Microsoft information Protection is recommended to identify your Personal Identifiable Information at central place](/microsoft-365/compliance/information-protection). +- [Use Policy templates as a starting point to build your rulesets](/microsoft-365/compliance/what-the-dlp-policy-templates-include#general-data-protection-regulation-gdpr). +- [Combine Data Classifications to an individual Ruleset](./supported-classifications.md). +- [Force Labeling by using auto label functionality](./how-to-automatically-label-your-content.md). +- Build groups of Sensitivity Labels and store them as dedicated Sensitivity Label Policy ΓÇô for example store all required Sensitivity Labels for Regulatory Rules by using the same Sensitivity Label Policy to publish. +- Capture all test cases for your labels and test your Label policies with all applications you want to secure. +- Promote Sensitivity Label Policies to Azure Purview. +- Run test scans from Purview on different Data Sources (for Example Hybrid-Cloud, On-Premise) to identify Sensitivity Labels. +- Gather and consider insights (for example by using Purview insights) and use alerting mechanism to mitigate potential breaches of Regulations. ++By using Sensitivity Labels with Azure Purview you are able to extend your Microsoft Information Protection beyond the border of Microsoft Data Estate to your On-prem, Hybrid-Could, Multi-Cloud and SaaS Scenarios. + ## Next steps - [Get started with sensitivity labels](/microsoft-365/compliance/get-started-with-sensitivity-labels). |
| purview | How To Access Policies Storage | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/purview/how-to-access-policies-storage.md | Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) >[!IMPORTANT] > The access policy feature is only available on **new** Azure Purview and Azure Storage accounts. - Create a new or use an existing isolated test subscription. You can [follow this guide to create one](../cost-management-billing/manage/create-subscription.md).-- Create a new Purview account. You can [follow our quick-start guide to create one](create-catalog-portal.md).+- Create a new Azure Purview account. You can [follow our quick-start guide to create one](create-catalog-portal.md). - Create a new Azure Storage account in one of the regions listed below. You can [follow this guide to create one](../storage/common/storage-account-create.md). Only Storage account versions >= 81.x.x support policy enforcement. [!INCLUDE [supported regions](./includes/storage-access-policy-regions.md)] Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) ## Configuration [!INCLUDE [access policy enablement storage](./includes/storage-access-policy-enable.md)] -### Register Purview as a resource provider in other subscriptions -Execute this step only if the Storage and Purview accounts are in different subscriptions. Register Azure Purview as a resource provider in the subscription for the Azure Storage account by following this guide: [Azure resource providers and types](../azure-resource-manager/management/resource-providers-and-types.md) +### Register Azure Purview as a resource provider in other subscriptions +Execute this step only if the Storage and Azure Purview accounts are in different subscriptions. Register Azure Purview as a resource provider in the subscription for the Azure Storage account by following this guide: [Azure resource providers and types](../azure-resource-manager/management/resource-providers-and-types.md) ### Configure permissions for policy management actions #### Storage account permissions User needs to have **either one of these** role combinations in the Azure Storag You can follow this [guide to configure Azure RBAC permissions](../role-based-access-control/check-access.md) -#### Purview account permissions +#### Azure Purview account permissions >[!IMPORTANT] > - Policy operations are only supported at **root collection level** and not child collection level.-- User needs Purview *Data source admins* role at the root collection level to:+- User needs Azure Purview *Data source admins* role at the root collection level to: - Register a source for *Data use governance*. - Publish a policy.-- User needs Purview *Policy authors* role at root collection level to create or edit policies.+- User needs Azure Purview *Policy authors* role at root collection level to create or edit policies. -Check the section on managing Purview role assignments in this [guide](how-to-create-and-manage-collections.md). +Check the section on managing Azure Purview role assignments in this [guide](how-to-create-and-manage-collections.md). >[!WARNING] > **Known issues** related to permissions-> - In addition to Purview *Policy authors* role, user requires *Directory Reader* permission in Azure Active Directory to create data owner policy. Learn more about permissions for [Azure AD Directory Reader](../active-directory/roles/permissions-reference.md#directory-readers) -> - Purview *Policy author* role is not sufficient to create policies. It also requires Purview *Data source admin* role as well. +> - In addition to Azure Purview *Policy authors* role, user requires *Directory Reader* permission in Azure Active Directory to create data owner policy. Learn more about permissions for [Azure AD Directory Reader](../active-directory/roles/permissions-reference.md#directory-readers) +> - Azure Purview *Policy author* role is not sufficient to create policies. It also requires Azure Purview *Data source admin* role as well. -### Register and scan data sources in Purview -Register and scan each data source with Purview to later define access policies. You can follow these guides: +### Register and scan data sources in Azure Purview +Register and scan each data source with Azure Purview to later define access policies. You can follow these guides: - [Register and scan Azure Storage Blob - Azure Purview](register-scan-azure-blob-storage-source.md) - [Register and scan Azure Data Lake Storage (ADLS) Gen2 - Azure Purview](register-scan-adls-gen2.md) >[!Important]-> Make sure you write down the **Name** you use when registering a source in Purview. You will need it when you publish a policy. The recommended practice is to make the registered name exactly the same as the endpoint name (i.e. the Storage account name). +> Make sure you write down the **Name** you use when registering a source in Azure Purview. You will need it when you publish a policy. The recommended practice is to make the registered name exactly the same as the endpoint name (i.e. the Storage account name). -If you would like to use a data source to create access policies in Purview, enable it for access policy through the **Data use governance** toggle, as shown in the picture. +If you would like to use a data source to create access policies in Azure Purview, enable it for access policy through the **Data use governance** toggle, as shown in the picture.  >[!Note] > - To disable a source for *Data use Governance*, remove it first from being bound (i.e. published) in any policy.-> - While user needs to have both Azure Storage *Owner* and Purview *Data source admin* to enable a source for *Data use governance*, any of those roles can independently disable it. +> - While user needs to have both Azure Storage *Owner* and Azure Purview *Data source admin* to enable a source for *Data use governance*, any of those roles can independently disable it. > - Disabling *Data use governance* for a subscription will disable it also for all assets registered in that subscription. > [!WARNING] > **Known issues** related to source registration-> - Moving data sources to a different resource group or subscription is not yet supported. If want to do that, de-register the data source in Purview before moving it and then register it again after that happens. +> - Moving data sources to a different resource group or subscription is not yet supported. If want to do that, de-register the data source in Azure Purview before moving it and then register it again after that happens. ### Data use governance best practices - We highly encourage registering data sources for *Data use governance* and managing all associated access policies in a single Azure Purview account.-- Should you have multiple Purview accounts, be aware that **all** data sources belonging to a subscription must be registered for *Data use governance* in a single Purview account. That Purview account can be in any subscription in the tenant. The *Data use governance* toggle will become greyed out when there are invalid configurations. Some examples of valid and invalid configurations follow in the diagram below:- - **Case 1** shows a valid configuration where a Storage account is registered in a Purview account in the same subscription. - - **Case 2** shows a valid configuration where a Storage account is registered in a Purview account in a different subscription. - - **Case 3** shows an invalid configuration arising because Storage accounts S3SA1 and S3SA2 both belong to Subscription 3, but are registered to different Purview accounts. In that case, the *Data use governance* toggle will only work in the Purview account that wins and registers a data source in that subscription first. The toggle will then be greyed out for the other data source. +- Should you have multiple Azure Purview accounts, be aware that **all** data sources belonging to a subscription must be registered for *Data use governance* in a single Azure Purview account. That Azure Purview account can be in any subscription in the tenant. The *Data use governance* toggle will become greyed out when there are invalid configurations. Some examples of valid and invalid configurations follow in the diagram below: + - **Case 1** shows a valid configuration where a Storage account is registered in an Azure Purview account in the same subscription. + - **Case 2** shows a valid configuration where a Storage account is registered in an Azure Purview account in a different subscription. + - **Case 3** shows an invalid configuration arising because Storage accounts S3SA1 and S3SA2 both belong to Subscription 3, but are registered to different Azure Purview accounts. In that case, the *Data use governance* toggle will only work in the Azure Purview account that wins and registers a data source in that subscription first. The toggle will then be greyed out for the other data source. -" +" ## Policy authoring -This section describes the steps for creating, updating, and publishing Purview access policies. +This section describes the steps for creating, updating, and publishing Azure Purview access policies. ### Create a new policy This section describes the steps to create a new policy in Azure Purview. -1. Log in to Purview portal. +1. Log in to Azure Purview portal. 1. Navigate to **Policy management** app using the left side panel. This section describes the steps to create a new policy in Azure Purview. > [!WARNING] > **Known issues** related to Policy creation-> - Do not create policy statements based on Purview resource sets. Even if displayed in Purview policy authoring UI, they are not yet enforced. Learn more about [resource sets](concept-resource-sets.md). +> - Do not create policy statements based on Azure Purview resource sets. Even if displayed in Azure Purview policy authoring UI, they are not yet enforced. Learn more about [resource sets](concept-resource-sets.md). > - Once subscription gets disabled for *Data use governance* any underlying assets that are enabled for *Data use governance* will be disabled, which is the right behavior. However, policy statements based on those assets will still be allowed after that. ### Update or delete a policy -Steps to create a new policy in Purview are as follows. +Steps to create a new policy in Azure Purview are as follows. -1. Log in to Purview portal. +1. Log in to Azure Purview portal. -1. Navigate to Purview policy app using the left side panel. +1. Navigate to Azure Purview policy app using the left side panel.  -1. The Policy portal will present the list of existing policies in Purview. Select the policy that needs to be updated. +1. The Policy portal will present the list of existing policies in Azure Purview. Select the policy that needs to be updated. 1. The policy details page will appear, including Edit and Delete options. Select the **Edit** button, which brings up the policy statement builder for the statements in this policy. Now, any parts of the statements in this policy can be updated. To delete the policy, use the **Delete** button. A newly created policy is in the draft state. The process of publishing associat The steps to publish a policy are as follows -1. Log in to Purview portal. +1. Log in to Azure Purview portal. -1. Navigate to the Purview Policy app using the left side panel. +1. Navigate to the Azure Purview Policy app using the left side panel.  -1. The Policy portal will present the list of existing policies in Purview. Locate the policy that needs to be published. Select the **Publish** button on the right top corner of the page. +1. The Policy portal will present the list of existing policies in Azure Purview. Locate the policy that needs to be published. Select the **Publish** button on the right top corner of the page.  The steps to publish a policy are as follows ## Additional information ### Limits-The limit for Purview policies that can be enforced by Storage accounts is 100MB per subscription, which roughly equates to 5000 policies. +The limit for Azure Purview policies that can be enforced by Storage accounts is 100MB per subscription, which roughly equates to 5000 policies. ### Policy action mapping This section contains a reference of how actions in Azure Purview data policies map to specific actions in Azure Storage. -| **Purview policy action** | **Data source specific actions** | +| **Azure Purview policy action** | **Data source specific actions** | ||--| ||| | *Read* |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/read | |
| purview | How To Manage Quotas | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/purview/how-to-manage-quotas.md | Azure Purview is a cloud service for use by data users. You use Azure Purview to |vCores available for scanning, per account*|160|160| |Concurrent scans, per account at a given point. The limit is based on the type of data sources scanned*|5 | 10 | |Maximum time that a scan can run for|7 days|7 days|-|[Data Map Capacity unit (CU)](concept-elastic-data-map.md) |1 CU (25 Operations/second throughput and 2 GB metadata storage) | 100 CU (Contact Support for higher CU)| +|[Data Map Capacity unit (CU)](concept-elastic-data-map.md) |1 CU (25 Operations/second throughput and 10 GB metadata storage) | 100 CU (Contact Support for higher CU)| |Data Map Operations throughput |25 Operations/second for each Capacity Unit | 2,500 Operations/Sec for 100 CU (Contact Support for more throughput)| -|Data Map Storage |10 GB for each Capacity Unit | 200 GB for for 100 CU (Contact Support for more storage) | +|Data Map Storage |10 GB for each Capacity Unit | 1000 GB for for 100 CU (Contact Support for more storage) | |Data Map elasticity window | 1 - 8 CU (Data Map can auto scale up/down based on throughput within elasticity window) | Contact support to get higher elasticity window | |Size of assets per account|100M physical assets |Contact Support| |Maximum size of an asset in a catalog|2 MB|2 MB| |
| role-based-access-control | Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/role-based-access-control/overview.md | The following diagram is a summary of the evaluation logic.  +## Where is Azure RBAC data stored? ++Role definitions, role assignments, and deny assignments are stored globally to ensure that you have access to your resources regardless of the region you created the resource. ++When a role assignment or any other Azure RBAC data is deleted, the data is globally deleted. Principals that had access to a resource via Azure RBAC data will lose their access. ++## Why is Azure RBAC data global? ++Azure RBAC data is global to ensure that customers can timely access resources regardless from where they are accessing. Azure RBAC is enforced by Azure Resource Manager, which has a global endpoint and requests are routed to the nearest region for speed and resilience. Therefore, Azure RBAC must be enforced in all regions and the data is replicated to all regions. For more information, see [Resiliency of Azure Resource Manager](../azure-resource-manager/management/overview.md#resiliency-of-azure-resource-manager). ++Consider the following example. Arina creates a virtual machine in East Asia. Bob, who is a member of Arina's team, works in the United States. Bob needs to access the virtual machine that was created in East Asia. To grant Bob timely access to the virtual machine, Azure needs to globally replicate the role assignment that grants Bob access to the virtual machine from anywhere Bob is. ++ + ## License requirements [!INCLUDE [Azure AD free license](../../includes/active-directory-free-license.md)] |
| search | Search Howto Monitor Indexers | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/search/search-howto-monitor-indexers.md | Warnings are common with some types of indexers, and do not always indicate a pr For more information about investigating indexer errors and warnings, see [Indexer troubleshooting guidance](search-indexer-troubleshooting.md). +## Monitor with Azure Monitoring Metrics ++Cognitive Search is a monitored resource in Azure Monitor, which means that you can use [Metrics Explorer](/azure/azure-monitor/essentials/data-platform-metrics#metrics-explorer) to see basic metrics about the number of indexer-processed documents and skill invocations. These metrics can be used to monitor indexer progress and [set up alerts](/azure/azure-monitor/alerts/alerts-metric-overview). ++Metric views can be filtered or split up by a set of predefined dimensions. ++| Metric Name | Description | Dimensions | Sample use cases | +||||| +| Document processed count | Shows the number of indexer processed documents. | Data source name, failed, index name, indexer name, skillset name | <br> - Can be referenced as a rough measure of throughput (number of documents processed by indexer over time) <br> - Set up to alert on failed documents | +| Skill execution invocation count | Shows the number of skill invocations. | Data source name, failed, index name, indexer name, skill name, skill type, skillset name | <br> - Reference to ensure skills are invoked as expected by comparing relative invocation numbers between skills and number of skill invocation to the number of documents. <br> - Set up to alert on failed skill invocations | ++The screenshot below shows the number of documents processed by indexers within a service over an hour, split up by indexer name. ++  ++You can also configure the graph to see the number of skill invocation over the same hour interval. ++  ++ ## Monitor using Get Indexer Status (REST API) You can retrieve the status and execution history of an indexer using the [Get Indexer Status command](/rest/api/searchservice/get-indexer-status): |
| search | Semantic Search Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/search/semantic-search-overview.md | Semantic search is a premium feature. We recommend this article for background, ## What is semantic search? -Semantic search is collection of features that improve the quality of search results. When enabled on your search service, it extends the query execution pipeline in two ways. First, it adds secondary ranking over an initial result set, promoting the most semantically relevant results to the top of the list. Second, it extracts and returns captions and answers in the response, which you can render on a search page to improve the user's search experience. +Semantic search is a collection of features that improve the quality of search results. When enabled on your search service, it extends the query execution pipeline in two ways. First, it adds secondary ranking over an initial result set, promoting the most semantically relevant results to the top of the list. Second, it extracts and returns captions and answers in the response, which you can render on a search page to improve the user's search experience. | Feature | Description | ||-| |
| sentinel | Connect Azure Virtual Desktop | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/connect-azure-virtual-desktop.md | + + Title: Connect Azure Virtual Desktop to Microsoft Sentinel | Microsoft Docs +description: Learn to connect your Azure Virtual Desktop data to Microsoft Sentinel. ++ Last updated : 11/09/2021+++++# Connect Azure Virtual Desktop data to Microsoft Sentinel +++This article describes how you can monitor your Azure Virtual Desktop environments using Microsoft Sentinel. ++For example, monitoring your Azure Virtual Desktop environments can enable you to provide more remote work using virtualized desktops, while maintaining your organization's security posture. ++## Azure Virtual Desktop data in Microsoft Sentinel ++Azure Virtual Desktop data in Microsoft Sentinel includes the following types: ++|Data |Description | +||| +|**Windows event logs** | Windows event logs from the Azure Virtual Desktop environment are streamed into a Microsoft Sentinel-enabled Log Analytics workspace in the same manner as Windows event logs from other Windows machines, outside of the Azure Virtual Desktop environment. <br><br>Install the Log Analytics agent onto your Windows machine and configure the Windows event logs to be sent to the Log Analytics workspace.<br><br>For more information, see:<br>- [Install Log Analytics agent on Windows computers](../azure-monitor/agents/agent-windows.md)<br>- [Collect Windows event log data sources with Log Analytics agent](../azure-monitor/agents/data-sources-windows-events.md)<br>- [Connect Windows security events](connect-windows-security-events.md) | +|**Microsoft Defender for Endpoint alerts** | To configure Defender for Endpoint for Azure Virtual Desktop, use the same procedure as you would for any other Windows endpoint. <br><br>For more information, see: <br>- [Set up Microsoft Defender for Endpoint deployment](/windows/security/threat-protection/microsoft-defender-atp/production-deployment)<br>- [Connect data from Microsoft 365 Defender to Microsoft Sentinel](connect-microsoft-365-defender.md) | +|**Azure Virtual Desktop diagnostics** | Azure Virtual Desktop diagnostics is a feature of the Azure Virtual Desktop PaaS service, which logs information whenever someone assigned Azure Virtual Desktop role uses the service. <br><br>Each log contains information about which Azure Virtual Desktop role was involved in the activity, any error messages that appear during the session, tenant information, and user information. <br><br>The diagnostics feature creates activity logs for both user and administrative actions. <br><br>For more information, see [Use Log Analytics for the diagnostics feature in Azure Virtual Desktop](../virtual-desktop/virtual-desktop-fall-2019/diagnostics-log-analytics-2019.md). | +| | | ++## Connect Azure Virtual Desktop data ++To start ingesting Azure Virtual Desktop data into Microsoft Sentinel, use the instructions from the Azure Virtual Desktop documentation. ++For more information, see [Push Azure Virtual Desktop data to your Log Analytics workspace](../virtual-desktop/diagnostics-log-analytics.md). ++## Find your data ++After a successful connection is established, run queries in Microsoft Sentinel against your Log Analytics data. ++For example, see sample queries from the [Azure Virtual Desktop documentation](../virtual-desktop/diagnostics-log-analytics.md). ++Microsoft Sentinel also provides built-in queries in the **General** > **Logs** > **Azure Virtual Desktop** area: ++[ ](media/connect-windows-virtual-desktop/windows-virtual-desktop-queries.png#lightbox) ++## Next steps ++For more information, see the [Azure Monitor for Azure Virtual Desktop glossary](../virtual-desktop/azure-monitor-glossary.md). |
| sentinel | Connect Windows Virtual Desktop | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/connect-windows-virtual-desktop.md | - Title: Connect Windows Virtual Desktop to Microsoft Sentinel | Microsoft Docs -description: Learn to connect your Windows Virtual Desktop data to Microsoft Sentinel. -- Previously updated : 11/09/2021-----# Connect Windows Virtual Desktop data to Microsoft Sentinel ---This article describes how you can monitor your Windows Virtual Desktop (WVD) environments using Microsoft Sentinel. --For example, monitoring your Windows Virtual Desktop environments can enable you to provide more remote work using virtualized desktops, while maintaining your organization's security posture. --## Windows Virtual Desktop data in Microsoft Sentinel --Windows Virtual Desktop data in Microsoft Sentinel includes the following types: ---|Data |Description | -||| -|**Windows event logs** | Windows event logs from the WVD environment are streamed into a Microsoft Sentinel-enabled Log Analytics workspace in the same manner as Windows event logs from other Windows machines, outside of the WVD environment. <br><br>Install the Log Analytics agent onto your Windows machine and configure the Windows event logs to be sent to the Log Analytics workspace.<br><br>For more information, see:<br>- [Install Log Analytics agent on Windows computers](../azure-monitor/agents/agent-windows.md)<br>- [Collect Windows event log data sources with Log Analytics agent](../azure-monitor/agents/data-sources-windows-events.md)<br>- [Connect Windows security events](connect-windows-security-events.md) | -|**Microsoft Defender for Endpoint alerts** | To configure Defender for Endpoint for Windows Virtual Desktop, use the same procedure as you would for any other Windows endpoint. <br><br>For more information, see: <br>- [Set up Microsoft Defender for Endpoint deployment](/windows/security/threat-protection/microsoft-defender-atp/production-deployment)<br>- [Connect data from Microsoft 365 Defender to Microsoft Sentinel](connect-microsoft-365-defender.md) | -|**Windows Virtual Desktop diagnostics** | Windows Virtual Desktop diagnostics is a feature of the Windows Virtual Desktop PaaS service, which logs information whenever someone assigned Windows Virtual Desktop role uses the service. <br><br>Each log contains information about which Windows Virtual Desktop role was involved in the activity, any error messages that appear during the session, tenant information, and user information. <br><br>The diagnostics feature creates activity logs for both user and administrative actions. <br><br>For more information, see [Use Log Analytics for the diagnostics feature in Windows Virtual Desktop](../virtual-desktop/virtual-desktop-fall-2019/diagnostics-log-analytics-2019.md). | -| | | --## Connect Windows Virtual Desktop data --To start ingesting Windows Virtual Desktop data into Microsoft Sentinel, use the instructions from the Windows Virtual Desktop documentation. --For more information, see [Push Windows Virtual Desktop data to your Log Analytics workspace](../virtual-desktop/diagnostics-log-analytics.md). --## Find your data --After a successful connection is established, run queries in Microsoft Sentinel against your Log Analytics data. --For example, see sample queries from the [Windows Virtual Desktop documentation](../virtual-desktop/diagnostics-log-analytics.md). ---Microsoft Sentinel also provides built-in queries in the **General** > **Logs** > **WINDOWS VIRTUAL DESKTOP** area: --[ ](media/connect-windows-virtual-desktop/windows-virtual-desktop-queries.png#lightbox) --## Next steps ---For more information, see the [Azure Monitor for Windows Virtual Desktop glossary](../virtual-desktop/azure-monitor-glossary.md). |
| sentinel | Create Custom Connector | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/create-custom-connector.md | For examples of this method, see: ## Parse your custom connector data -You can use your custom connector's built-in parsing technique to extract the relevant information and populate the relevant fields in Microsoft Sentinel. --For example: +To take advantage of the data collected with your custom connector, [develop Advanced SIM Information Model (SIEM) parsers](normalization-develop-parsers.md) to work with your connector. Using [ASIM](normalization.md) enables Microsoft Sentinel's built-in content to use your custom data and makes it easier for analysts to query the data. +If your connector method allows for it, you can implement part of the parsing as part of the connector to improve query time parsing performance: - **If you've used Logstash**, use the [Grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) filter plugin to parse your data. - **If you've used an Azure function**, parse your data with code. -Microsoft Sentinel supports parsing at query time. Parsing at query time enables you to push data in at the original format, and then parse on demand, when needed. --Parsing at query time also means you don't need to know your data's exact structure ahead of time, when you create your custom connector, or even the information you'll need to extract. Instead, parse your data at any time, even during an investigation. --For more information on parsing at query time, see [Parsers](normalization-about-parsers.md). --> [!NOTE] -> Updating your parser also applies to data that you've already ingested into Microsoft Sentinel. +You will still need to implement ASIM parsers, but implementing part of the parsing directly with the connector simplifies the parsing and improves performance. ## Next steps |
| sentinel | Customize Entity Activities | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/customize-entity-activities.md | The **Activity wizard - Create new activity** will open, with its fields blank. Here you will write or paste the KQL query that will be used to detect the activity for the chosen entity, and determine how it will be represented in the timeline. +> [!IMPORTANT] +> +> We recommend that your query uses an [Advanced SIEM Information model (ASIM) parser](normalization-about-parsers.md) and not a built-in table. This ensures that the query will support any current or future relevant data source rather than a single data source. +> + In order to correlate events and detect the custom activity, the KQL requires an input of several parameters, depending on the entity type. The parameters are the various identifiers of the entity in question. Selecting a strong identifier is better in order to have one-to-one mapping between the query results and the entity. Selecting a weak identifier may yield inaccurate results. [Learn more about entities and strong vs. weak identifiers](entities.md). |
| sentinel | Detect Threats Custom | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/detect-threats-custom.md | In the **Set rule logic** tab, you can either write a query directly in the **Ru | make-series dcount(ResourceId)  default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller ``` + > [!IMPORTANT] + > + > We recommend that your query uses an [Advanced SIEM Information model (ASIM) parser](normalization-about-parsers.md) and not a native table. This will ensure that the query supports any current or future relevant data source rather than a single data source. + > ++ > [!NOTE] > **Rule query best practices**: > |
| sentinel | Hunting | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/hunting.md | Create or modify a query and save it as your own query or share it with users wh ## Sample query -A typical query starts with a table name followed by a series of operators separated by a pipe character ("\|"). +A typical query starts with a table or parser name followed by a series of operators separated by a pipe character ("\|"). In the example above, start with the table name SecurityEvent and add piped elements as needed. In the example above, start with the table name SecurityEvent and add piped elem 1. Select the green triangle and run the query. You can test the query and run it to look for anomalous behavior. +> [!IMPORTANT] +> +> We recommend that your query uses an [Advanced SIEM Information model (ASIM) parser](normalization-about-parsers.md) and not a built-in table. This ensures that the query will support any current or future relevant data source rather than a single data source. +> + ## Create bookmarks During the hunting and investigation process, you may come across query results that may look unusual or suspicious. Bookmark these items to refer back to them in the future, such as when creating or enriching an incident for investigation. |
| sentinel | Monitor Your Data | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/monitor-your-data.md | You must have at least **Workbook reader** or **Workbook contributor** permissio 1. When building a query, make sure the **Data source** is set to **Logs** and **Resource type** is set to **Log Analytics**, and then choose the relevant workspace(s). + > [!IMPORTANT] + > + > We recommend that your query uses an [Advanced SIEM Information model (ASIM) parser](normalization-about-parsers.md) and not a built-in table. This ensures that the query will support any current or future relevant data source rather than a single data source. + > + 1. After you create your workbook, save the workbook, making sure you save it under the subscription and resource group of your Microsoft Sentinel workspace. 1. If you want to let others in your organization use the workbook, under **Save to** select **Shared reports**. If you want this workbook to be available only to you, select **My reports**. |
| sentinel | Top Workbooks | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/top-workbooks.md | Access workbooks in Microsoft Sentinel under **Threat Management** > **Workbooks |**Azure AD Audit logs** | Uses Azure Active Directory audit logs to provide insights into Azure AD scenarios. <br><br>For more information, see [Quickstart: Get started with Microsoft Sentinel](get-visibility.md). | |**Azure AD Audit, Activity and Sign-in logs** | Provides insights into Azure Active Directory Audit, Activity, and Sign-in data with one workbook. Shows activity such as sign-ins by location, device, failure reason, user action, and more. <br><br> This workbook can be used by both Security and Azure administrators. | |**Azure AD Sign-in logs** | Uses the Azure AD sign-in logs to provide insights into Azure AD scenarios. |-|**Cybersecurity Maturity Model Certification (CMMC)** | Provides a mechanism for viewing log queries aligned to CMMC controls across the Microsoft portfolio, including Microsoft security offerings, Office 365, Teams, Intune, Windows Virtual Desktop, and so on. <br><br>For more information, see [Cybersecurity Maturity Model Certification (CMMC) Workbook in Public Preview](https://techcommunity.microsoft.com/t5/azure-sentinel/what-s-new-cybersecurity-maturity-model-certification-cmmc/ba-p/2111184).| +|**Cybersecurity Maturity Model Certification (CMMC)** | Provides a mechanism for viewing log queries aligned to CMMC controls across the Microsoft portfolio, including Microsoft security offerings, Office 365, Teams, Intune, Azure Virtual Desktop, and so on. <br><br>For more information, see [Cybersecurity Maturity Model Certification (CMMC) Workbook in Public Preview](https://techcommunity.microsoft.com/t5/azure-sentinel/what-s-new-cybersecurity-maturity-model-certification-cmmc/ba-p/2111184).| |**Data collection health monitoring** / **Usage monitoring** | Provides insights into your workspace's data ingestion status, such as ingestion size, latency, and number of logs per source. View monitors and detect anomalies to help you determine your workspaces data collection health. <br><br>For more information, see [Monitor the health of your data connectors with this Microsoft Sentinel workbook](monitor-data-connector-health.md). | |**Event Analyzer** | Enables you to explore, audit, and speed up Windows Event Log analysis, including all event details and attributes, such as security, application, system, setup, directory service, DNS, and so on. | |**Exchange Online** |Provides insights into Microsoft Exchange online by tracing and analyzing all Exchange operations and user activities. | |
| sentinel | Whats New Archive | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/whats-new-archive.md | For more information, see [Collaborate in Microsoft Teams (Public preview)](coll The new, Azure Sentinel Zero Trust (TIC3.0) workbook provides an automated visualization of [Zero Trust](/security/zero-trust/) principles, cross-walked to the [Trusted Internet Connections](https://www.cisa.gov/trusted-internet-connections) (TIC) framework. -We know that compliance isnΓÇÖt just an annual requirement, and organizations must monitor configurations over time like a muscle. Azure Sentinel's Zero Trust workbook uses the full breadth of Microsoft security offerings across Azure, Office 365, Teams, Intune, Windows Virtual Desktop, and many more. +We know that compliance isnΓÇÖt just an annual requirement, and organizations must monitor configurations over time like a muscle. Azure Sentinel's Zero Trust workbook uses the full breadth of Microsoft security offerings across Azure, Office 365, Teams, Intune, Azure Virtual Desktop, and many more. [  ](media/zero-trust-workbook.gif#lightbox) Customers will still be able to send the logs manually for specific instances an ### Cybersecurity Maturity Model Certification (CMMC) workbook -The Azure Sentinel CMMC Workbook provides a mechanism for viewing log queries aligned to CMMC controls across the Microsoft portfolio, including Microsoft security offerings, Office 365, Teams, Intune, Windows Virtual Desktop and many more. +The Azure Sentinel CMMC Workbook provides a mechanism for viewing log queries aligned to CMMC controls across the Microsoft portfolio, including Microsoft security offerings, Office 365, Teams, Intune, Azure Virtual Desktop and many more. The CMMC workbook enables security architects, engineers, security operations analysts, managers, and IT professionals to gain situational awareness visibility for the security posture of cloud workloads. There are also recommendations for selecting, designing, deploying, and configuring Microsoft offerings for alignment with respective CMMC requirements and practices. |
| sentinel | Work With Threat Indicators | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/sentinel/work-with-threat-indicators.md | Tagging threat indicators is an easy way to group them together to make them eas :::image type="content" source="media/work-with-threat-indicators/threat-intel-tagging-indicators.png" alt-text="Apply tags to threat indicators" lightbox="media/work-with-threat-indicators/threat-intel-tagging-indicators.png"::: +Microsoft Sentinel also allows you to edit indicators, whether they've been created directly in Microsoft Sentinel, or come from partner sources, like TIP and TAXII servers. For indicators created in Microsoft Sentinel, all fields are editable. For indicators coming from partner sources, only specific fields are editable, including tags, *Expiration date*, *Confidence*, and *Revoked*. + ## Detect threats with threat indicator-based analytics The most important use case for threat indicators in SIEM solutions like Microsoft Sentinel is to power threat detection analytics rules. These indicator-based rules compare raw events from your data sources against your threat indicators to determine the presence of security threats in your organization. In Microsoft Sentinel **Analytics**, you create analytics rules that run on a scheduled basis and generate security alerts. The rules are driven by queries, along with configurations that determine how often the rule should run, what kind of query results should generate security alerts and incidents, and which automations to trigger in response. |
| static-web-apps | Authentication Custom | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/static-web-apps/authentication-custom.md | If you are using Azure Active Directory, use `aad` as the value for the `<PROVID > [!Note] > These URLs are provided by Azure Static Web Apps to receive the response from the authentication provider, you don't need to create pages at these routes. -## Login, logout, and purging user details +## Login, logout, and user details To use a custom identity provider, use the following URL patterns. To use a custom identity provider, use the following URL patterns. | | - | | Login | `/.auth/login/<PROVIDER_NAME_IN_CONFIG>` | | Logout | `/.auth/logout` |+| User details | `/.auth/me` | | Purge user details | `/.auth/purge/<PROVIDER_NAME_IN_CONFIG>` | If you are using Azure Active Directory, use `aad` as the value for the `<PROVIDER_NAME_IN_CONFIG>` placeholder. If you are using Azure Active Directory, use `aad` as the value for the `<PROVID ## Next steps > [!div class="nextstepaction"]-> [Securing authentication secrets in Azure Key Vault](./key-vault-secrets.md) +> [Set user roles programmatically](./assign-roles-microsoft-graph.md) |
| static-web-apps | Enterprise Edge | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/static-web-apps/enterprise-edge.md | + + Title: Enterprise-grade edge (preview) in Azure Static Web Apps +description: Learn about Azure Static Web Apps enterprise-grade edge (Preview) ++++ Last updated : 01/11/2021++++# Enterprise-grade edge (Preview) ++Use Azure Static Web Apps enterprise-grade edge (Preview) to enable faster page loads, enhance security, and optimize reliability for your global applications. Enterprise edge combines the capabilities of Azure Static Web Apps, Azure Front Door, and Azure Content Delivery Network (CDN) into a single secure cloud CDN platform. ++Key features of Azure Static Web Apps enterprise-grade edge include: ++* Global presence in 118+ [edge locations](/azure/frontdoor/edge-locations-by-region) across 100 metro cities. ++* Caching assets at the [edge](/azure/frontdoor/front-door-caching). ++* Proactive protection against [Distributed Denial of Service (DDoS) attacks](/azure/frontdoor/front-door-ddos). ++* Native support of end-to-end IPv6 connectivity and [HTTP/2 protocol](/azure/frontdoor/front-door-http2.md). ++* Optimized file compression. ++> [!NOTE] +> Static Web Apps enterprise-grade edge is currently in preview. ++## Caching ++When enterprise-grade edge is enabled for your static web app, you benefit from caching at various levels. ++* **CDN**: Caching content on edge locations as physically close to users a possible to reduce latency. ++* **DNS**: Caching DNS records for faster lookups. ++* **Browser**: Files are stored in the browser and returned for identical requests. ++For further control, you can also create [custom cache control headers](configuration.md) for your static web app. ++## Configuration types ++You can enable enterprise-grade edge powered by Azure Front Door via a managed experience through the Azure portal, or you [can set it up manually](front-door-manual.md). ++A managed experience provides: ++* Zero configuration changes +* No downtime +* Automatically managed SSL certifications and custom domains ++A manual setup gives you full control over the CDN configuration including the chance to: ++* Limit traffic origin by origin +* Add a web application firewall +* Use more advanced features of Azure Front Door ++## Enable enterprise-grade edge ++### Prerequisites ++* [Custom domain](./custom-domain.md) configured for your static web app with a time to live (TTL) set to less than 48 hrs. +* An application deployed with [Azure Static Web Apps](./get-started-portal.md) that uses the Standard hosting plan. ++# [Azure portal](#tab/azure-portal) ++1. Navigate to your static web app in the Azure portal. ++1. Select **Enterprise-grade edge** in the left menu. ++1. Check the box labeled **Enable enterprise-grade edge**. ++1. Select **Save**. ++1. Select **OK** to confirm the save. ++ Enabling this feature incurs extra costs. ++# [Azure CLI](#tab/azure-cli) ++```azurecli +az extension add -n enterprise-edge ++az staticwebapp enterprise-edge enable -n my-static-webapp -g my-resource-group +``` ++++## Next steps ++> [!div class="nextstepaction"] +> [Application configuration](configuration.md) |
| static-web-apps | User Information | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/static-web-apps/user-information.md | Client principal data object exposes user-identifiable information to your app. | `userId` | An Azure Static Web Apps-specific unique identifier for the user. <ul><li>The value is unique on a per-app basis. For instance, the same user returns a different `userId` value on a different Static Web Apps resource.<li>The value persists for the lifetime of a user. If you delete and add the same user back to the app, a new `userId` is generated.</ul> | | `userDetails` | Username or email address of the user. Some providers return the [user's email address](authentication-authorization.md), while others send the [user handle](authentication-authorization.md). | | `userRoles` | An array of the [user's assigned roles](authentication-authorization.md). |+| `claims` | An array of claims returned by your [custom authentication provider](authentication-custom.md). | The following example is a sample client principal object: The following example is a sample client principal object: "identityProvider": "github", "userId": "d75b260a64504067bfc5b2905e3b8182", "userDetails": "username",- "userRoles": ["anonymous", "authenticated"] + "userRoles": ["anonymous", "authenticated"], + "claims": [{ + "typ": "name", + "val": "Azure Static Web Apps" + }] } ``` |
| stream-analytics | Stream Analytics Define Outputs | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/stream-analytics/stream-analytics-define-outputs.md | Some outputs types support [partitioning](#partitioning), and [output batch size | Output type | Partitioning | Security | |-|--|-| |[Azure Data Lake Storage Gen 1](azure-data-lake-storage-gen1-output.md)|Yes|Azure Active Directory user </br> , Managed Identity|-|[Azure Database Explorer](azure-database-explorer-output.md)|Yes|Managed Identity| +|[Azure Data Explorer](azure-database-explorer-output.md)|Yes|Managed Identity| |[Azure Database for PostgreSQL](postgresql-database-output.md)|Yes|Username and password auth| |[Azure SQL Database](sql-database-output.md)|Yes, optional.|SQL user auth, </br> Managed Identity| |[Azure Synapse Analytics](azure-synapse-analytics-output.md)|Yes|SQL user auth, </br> Managed Identity (preview)| |
| synapse-analytics | Overview Features | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/synapse-analytics/sql/overview-features.md | Query languages used in Synapse SQL can have different supported features depend | **UPDATE statement** | Yes | No, but data updated using Spark is automatically available in serverless pool. | | **DELETE statement** | Yes | No, but data deleted using Spark is automatically available in serverless pool. | | **MERGE statement** | Yes ([preview](/sql/t-sql/statements/merge-transact-sql?view=azure-sqldw-latest&preserve-view=true)) | No, but data merged using Spark is automatically available in serverless pool. |-| **[Transactions](develop-transactions.md)** | Yes | Yes, applicable on meta-data objects. | +| **[Transactions](develop-transactions.md)** | Yes | Yes, applicable only on the meta-data objects. | | **[Labels](develop-label.md)** | Yes | No | | **Data load** | Yes. Preferred utility is [COPY](/sql/t-sql/statements/copy-into-transact-sql?view=azure-sqldw-latest&preserve-view=true) statement, but the system supports both BULK load (BCP) and [CETAS](/sql/t-sql/statements/create-external-table-as-select-transact-sql?view=azure-sqldw-latest&preserve-view=true) for data loading. | No, you can initially load data into an external table using CETAS statement. | | **Data export** | Yes. Using [CETAS](/sql/t-sql/statements/create-external-table-as-select-transact-sql?view=azure-sqldw-latest&preserve-view=true). | Yes. Using [CETAS](/sql/t-sql/statements/create-external-table-as-select-transact-sql?view=azure-sqldw-latest&preserve-view=true). | | **Types** | Yes, all Transact-SQL types except [cursor](/sql/t-sql/data-types/cursor-transact-sql?view=azure-sqldw-latest&preserve-view=true), [hierarchyid](/sql/t-sql/data-types/hierarchyid-data-type-method-reference?view=azure-sqldw-latest&preserve-view=true), [ntext, text, and image](/sql/t-sql/data-types/ntext-text-and-image-transact-sql?view=azure-sqldw-latest&preserve-view=true), [rowversion](/sql/t-sql/data-types/rowversion-transact-sql?view=azure-sqldw-latest&preserve-view=true), [Spatial Types](/sql/t-sql/spatial-geometry/spatial-types-geometry-transact-sql?view=azure-sqldw-latest&preserve-view=true), [sql\_variant](/sql/t-sql/data-types/sql-variant-transact-sql?view=azure-sqldw-latest&preserve-view=true), and [xml](/sql/t-sql/xml/xml-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes, all Transact-SQL types except [cursor](/sql/t-sql/data-types/cursor-transact-sql?view=azure-sqldw-latest&preserve-view=true), [hierarchyid](/sql/t-sql/data-types/hierarchyid-data-type-method-reference?view=azure-sqldw-latest&preserve-view=true), [ntext, text, and image](/sql/t-sql/data-types/ntext-text-and-image-transact-sql?view=azure-sqldw-latest&preserve-view=true), [rowversion](/sql/t-sql/data-types/rowversion-transact-sql?view=azure-sqldw-latest&preserve-view=true), [Spatial Types](/sql/t-sql/spatial-geometry/spatial-types-geometry-transact-sql?view=azure-sqldw-latest&preserve-view=true), [sql\_variant](/sql/t-sql/data-types/sql-variant-transact-sql?view=azure-sqldw-latest&preserve-view=true), [xml](/sql/t-sql/xml/xml-transact-sql?view=azure-sqldw-latest&preserve-view=true), and Table type |-| **Cross-database queries** | No | Yes, including [USE](/sql/t-sql/language-elements/use-transact-sql?view=azure-sqldw-latest&preserve-view=true) statement. | +| **Cross-database queries** | No | Yes, 3-part-name references are supported including [USE](/sql/t-sql/language-elements/use-transact-sql?view=azure-sqldw-latest&preserve-view=true) statement. | | **Built-in/system functions (analysis)** | Yes, all Transact-SQL [Analytic](/sql/t-sql/functions/analytic-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), Conversion, [Date and Time](/sql/t-sql/functions/date-and-time-data-types-and-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), Logical, [Mathematical](/sql/t-sql/functions/mathematical-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true) functions, except [CHOOSE](/sql/t-sql/functions/logical-functions-choose-transact-sql?view=azure-sqldw-latest&preserve-view=true) and [PARSE](/sql/t-sql/functions/parse-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes, all Transact-SQL [Analytic](/sql/t-sql/functions/analytic-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), Conversion, [Date and Time](/sql/t-sql/functions/date-and-time-data-types-and-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), Logical, [Mathematical](/sql/t-sql/functions/mathematical-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true) functions. | | **Built-in/system functions ([string](/sql/t-sql/functions/string-functions-transact-sql))** | Yes. All Transact-SQL [String](/sql/t-sql/functions/string-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), [JSON](/sql/t-sql/functions/json-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), and Collation functions, except [STRING_ESCAPE](/sql/t-sql/functions/string-escape-transact-sql?view=azure-sqldw-latest&preserve-view=true) and [TRANSLATE](/sql/t-sql/functions/translate-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes. All Transact-SQL [String](/sql/t-sql/functions/string-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), [JSON](/sql/t-sql/functions/json-functions-transact-sql?view=azure-sqldw-latest&preserve-view=true), and Collation functions. | | **Built-in/system functions ([Cryptographic](/sql/t-sql/functions/cryptographic-functions-transact-sql))** | Some | `HASHBYTES` is the only supported cryptographic function in serverless SQL pools. | | **Built-in/system table-value functions** | Yes, [Transact-SQL Rowset functions](/sql/t-sql/functions/functions?view=azure-sqldw-latest&preserve-view=true#rowset-functions), except [OPENXML](/sql/t-sql/functions/openxml-transact-sql?view=azure-sqldw-latest&preserve-view=true), [OPENDATASOURCE](/sql/t-sql/functions/opendatasource-transact-sql?view=azure-sqldw-latest&preserve-view=true), [OPENQUERY](/sql/t-sql/functions/openquery-transact-sql?view=azure-sqldw-latest&preserve-view=true), and [OPENROWSET](/sql/t-sql/functions/openrowset-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes, [Transact-SQL Rowset functions](/sql/t-sql/functions/functions?view=azure-sqldw-latest&preserve-view=true#rowset-functions), except [OPENXML](/sql/t-sql/functions/openxml-transact-sql?view=azure-sqldw-latest&preserve-view=true), [OPENDATASOURCE](/sql/t-sql/functions/opendatasource-transact-sql?view=azure-sqldw-latest&preserve-view=true), and [OPENQUERY](/sql/t-sql/functions/openquery-transact-sql?view=azure-sqldw-latest&preserve-view=true) |-| **Built-in/system aggregates** | Transact-SQL built-in aggregates except, except [CHECKSUM_AGG](/sql/t-sql/functions/checksum-agg-transact-sql?view=azure-sqldw-latest&preserve-view=true) and [GROUPING_ID](/sql/t-sql/functions/grouping-id-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Transact-SQL built-in aggregates. | +| **Built-in/system aggregates** | Transact-SQL built-in aggregates except, except [CHECKSUM_AGG](/sql/t-sql/functions/checksum-agg-transact-sql?view=azure-sqldw-latest&preserve-view=true) and [GROUPING_ID](/sql/t-sql/functions/grouping-id-transact-sql?view=azure-sqldw-latest&preserve-view=true) | All Transact-SQL built-in [aggregates](/sql/t-sql/functions/aggregate-functions-transact-sql?view=sql-server-ver15) are supported. | | **Operators** | Yes, all [Transact-SQL operators](/sql/t-sql/language-elements/operators-transact-sql?view=azure-sqldw-latest&preserve-view=true) except [!>](/sql/t-sql/language-elements/not-greater-than-transact-sql?view=azure-sqldw-latest&preserve-view=true) and [!<](/sql/t-sql/language-elements/not-less-than-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes, all [Transact-SQL operators](/sql/t-sql/language-elements/operators-transact-sql?view=azure-sqldw-latest&preserve-view=true) | | **Control of flow** | Yes. All [Transact-SQL Control-of-flow statement](/sql/t-sql/language-elements/control-of-flow?view=azure-sqldw-latest&preserve-view=true) except [CONTINUE](/sql/t-sql/language-elements/continue-transact-sql?view=azure-sqldw-latest&preserve-view=true), [GOTO](/sql/t-sql/language-elements/goto-transact-sql?view=azure-sqldw-latest&preserve-view=true), [RETURN](/sql/t-sql/language-elements/return-transact-sql?view=azure-sqldw-latest&preserve-view=true), [USE](/sql/t-sql/language-elements/use-transact-sql?view=azure-sqldw-latest&preserve-view=true), and [WAITFOR](/sql/t-sql/language-elements/waitfor-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes. All [Transact-SQL Control-of-flow statement](/sql/t-sql/language-elements/control-of-flow?view=azure-sqldw-latest&preserve-view=true) SELECT query in `WHILE (...)` condition | | **DDL statements (CREATE, ALTER, DROP)** | Yes. All Transact-SQL DDL statement applicable to the supported object types | Yes. All Transact-SQL DDL statement applicable to the supported object types | Synapse SQL pools enable you to use built-in security features to secure your da | **Logins** | N/A (only contained users are supported in databases) | Yes server-level Azure AD and SQL logins are supported. | | **Users** | N/A (only contained users are supported in databases) | Yes | | **[Contained users](/sql/relational-databases/security/contained-database-users-making-your-database-portable?view=azure-sqldw-latest&preserve-view=true)** | Yes. **Note:** only one Azure AD user can be unrestricted admin | No |-| **SQL username/password authentication**| Yes | Yes | +| **SQL username/password authentication**| Yes | Yes, users can access serverless SQL pool using their usernames and passwords. | | **Azure Active Directory (Azure AD) authentication**| Yes, Azure AD users | Yes, Azure AD logins and users can access serverless SQL pools using their Azure AD identities. |-| **Storage Azure Active Directory (Azure AD) passthrough authentication** | Yes | Yes | +| **Storage Azure Active Directory (Azure AD) passthrough authentication** | Yes | [Yes](develop-storage-files-storage-access-control.md?tabs=user-identity#supported-storage-authorization-types), applicable to Azure AD logins. The identity of the Azure AD user is passed to the storage if a credential is not specified. Azure AD passthrough authentication is not available for the SQL users. | | **Storage SAS token authentication** | No | Yes, using [DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?view=azure-sqldw-latest&preserve-view=true) in [EXTERNAL DATA SOURCE](/sql/t-sql/statements/create-external-data-source-transact-sql?view=azure-sqldw-latest&preserve-view=true) or instance-level [CREDENTIAL](/sql/t-sql/statements/create-credential-transact-sql?view=azure-sqldw-latest&preserve-view=true). | | **Storage Access Key authentication** | Yes, using [DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?view=azure-sqldw-latest&preserve-view=true) in [EXTERNAL DATA SOURCE](/sql/t-sql/statements/create-external-data-source-transact-sql?view=azure-sqldw-latest&preserve-view=true) | No |-| **Storage [Managed Identity](../../data-factory/data-factory-service-identity.md?context=/azure/synapse-analytics/context/context&tabs=synapse-analytics) authentication** | Yes, using [Managed Service Identity Credential](../../azure-sql/database/vnet-service-endpoint-rule-overview.md?bc=%2fazure%2fsynapse-analytics%2fbreadcrumb%2ftoc.json&preserve-view=true&toc=%2fazure%2fsynapse-analytics%2ftoc.json&view=azure-sqldw-latest&preserve-view=true) | Yes, using `Managed Identity` credential. | -| **Storage Application identity authentication** | [Yes](/sql/t-sql/statements/create-external-data-source-transact-sql?view=azure-sqldw-latest&preserve-view=true) | No | -| **Server-level roles** | No | Yes, sysadmin, public, and other server-roles are supported | +| **Storage [Managed Identity](../../data-factory/data-factory-service-identity.md?context=/azure/synapse-analytics/context/context&tabs=synapse-analytics) authentication** | Yes, using [Managed Service Identity Credential](../../azure-sql/database/vnet-service-endpoint-rule-overview.md?bc=%2fazure%2fsynapse-analytics%2fbreadcrumb%2ftoc.json&preserve-view=true&toc=%2fazure%2fsynapse-analytics%2ftoc.json&view=azure-sqldw-latest&preserve-view=true) | Yes, using [Managed Identity](develop-storage-files-storage-access-control.md?tabs=managed-identity#database-scoped-credential) credential. | +| **Storage Application identity authentication** | [Yes](/sql/t-sql/statements/create-external-data-source-transact-sql?view=azure-sqldw-latest&preserve-view=true) | Yes, you can create a [credential](develop-storage-files-storage-access-control.md?tabs=service-principal#database-scoped-credential) with a [service principal application ID](develop-storage-files-storage-access-control.md?tabs=service-principal#supported-storage-authorization-types) that will be used to authenticate on the storage. | +| **Server-level roles** | No | Yes, sysadmin, public, and other server-roles are supported. | | **SERVER SCOPED CREDENTIAL** | No | Yes, the server scoped credentials are used by the `OPENROWSET` function that do not uses explicit data source. | | **Permissions - [Server-level](/sql/relational-databases/security/authentication-access/server-level-roles)** | No | Yes, for example, `CONNECT ANY DATABASE` and `SELECT ALL USER SECURABLES` enable a user to read data from any databases. | | **Database-scoped roles** | Yes | Yes, you can use `db_owner`, `db_datareader` and `db_ddladmin` roles. | Synapse SQL pools enable you to use built-in security features to secure your da | **Data Discovery & Classification** | [Yes](../../azure-sql/database/data-discovery-and-classification-overview.md) | No | | **Vulnerability Assessment** | [Yes](../../azure-sql/database/sql-vulnerability-assessment.md) | No | | **Advanced Threat Protection** | [Yes](../../azure-sql/database/threat-detection-overview.md)-| **Auditing** | [Yes](../../azure-sql/database/auditing-overview.md) | Yes | +| **Auditing** | [Yes](../../azure-sql/database/auditing-overview.md) | [Yes](../../azure-sql/database/auditing-overview.md) | | **[Firewall rules](../security/synapse-workspace-ip-firewall.md)**| Yes | Yes | | **[Private endpoint](../security/synapse-workspace-managed-private-endpoints.md)**| Yes | Yes | Data that is analyzed can be stored on various storage types. The following tabl | | Dedicated | Serverless | | | | |-| **Internal storage** | Yes | No, data is placed in Azure Data Lake or cosmos DB analytical storage. | +| **Internal storage** | Yes | No, data is placed in Azure Data Lake or Cosmos DB analytical storage. | | **Azure Data Lake v2** | Yes | Yes, you can use external tables and the `OPENROWSET` function to read data from ADLS. | | **Azure Blob Storage** | Yes | Yes, you can use external tables and the `OPENROWSET` function to read data from Azure Blob Storage. | | **Azure SQL/SQL Server (remote)** | No | No, serverless SQL pool cannot reference Azure SQL database. You can reference serverless SQL pools from Azure SQL using [elastic queries](https://devblogs.microsoft.com/azure-sql/read-azure-storage-files-using-synapse-sql-external-tables/) or [linked servers](https://devblogs.microsoft.com/azure-sql/linked-server-to-synapse-sql-to-implement-polybase-like-scenarios-in-managed-instance). | |
| synapse-analytics | Whats New | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/synapse-analytics/whats-new.md | The following updates are new to Azure Synapse Analytics this month. ### Apache Spark for Synapse +* Accelerate Spark workloads with NVIDIA GPU acceleration [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--16536080) [article](./spark/apache-spark-rapids-gpu.md) +* Mount remote storage to a Synapse Spark pool [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--1823990543) [article](./spark/synapse-file-mount-api.md) +* Natively read & write data in ADLS with Pandas [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-663522290) [article](./spark/tutorial-use-pandas-spark-pool.md) +* Dynamic allocation of executors for Spark [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--1143932173) [article](./spark/apache-spark-autoscale.md) ++### Machine Learning ++* The Synapse Machine Learning library [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--463873803) [article](https://microsoft.github.io/SynapseML/docs/about/) +* Getting started with state-of-the-art pre-built intelligent models [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-2023639030) [article](./machine-learning/tutorial-form-recognizer-use-mmlspark.md) +* Building responsible AI systems with the Synapse ML library [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-914346508) [article](https://microsoft.github.io/SynapseML/docs/features/responsible_ai/Model%20Interpretation%20on%20Spark/) +* PREDICT is now GA for Synapse Dedicated SQL pools [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-1594404878) [article](./machine-learning/tutorial-sql-pool-model-scoring-wizard.md) +* Simple & scalable scoring with PREDICT and MLFlow for Apache Spark for Synapse [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--213049585) [article](./machine-learning/tutorial-score-model-predict-spark-pool.md) +* Retail AI solutions [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--2020504048) [article](./machine-learning/quickstart-industry-ai-solutions.md) ++### Security ++* User-Assigned managed identities now supported in Synapse Pipelines in preview [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--1340445678) [article](../data-factory/credentials.md?context=%2Fazure%2Fsynapse-analytics%2Fcontext%2Fcontext&tabs=data-factory) +* Browse ADLS Gen2 folders in an Azure Synapse Analytics workspace in preview [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-1147067155) [article](how-to-access-container-with-access-control-lists.md) ++### Data Integration ++* Pipeline Fail activity [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-1827125525) [article](../data-factory/control-flow-fail-activity.md) +* Mapping Data Flow gets new native connectors [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-717833003) [article](https://techcommunity.microsoft.com/t5/azure-data-factory-blog/mapping-data-flow-gets-new-native-connectors/ba-p/2866754) * Additional notebook export formats: HTML, Python, and LaTeX [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-december-2021-update/ba-p/3042904#REF3) * Three new chart types in notebook view: box plot, histogram, and pivot table [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-december-2021-update/ba-p/3042904#REF4) * Reconnect to lost notebook session [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-december-2021-update/ba-p/3042904#REF5) + ### Integrate +* Synapse Link for Dataverse [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId-1397891373) [article](/powerapps/maker/data-platform/azure-synapse-link-synapse) +* Custom partitions for Synapse link for Azure Cosmos DB in preview [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-november-2021-update/ba-p/3020740#toc-hId--409563090) [article](../cosmos-db/custom-partitioning-analytical-store.md) * Map data tool (Public Preview), a no-code guided ETL experience [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-december-2021-update/ba-p/3042904#REF7) [article](/database-designer/overview-map-data.md) * Quick reuse of spark cluster [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-december-2021-update/ba-p/3042904#REF7) [article](../data-factory/concepts-integration-runtime-performance.md#time-to-live) * External Call transformation [blog](https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/azure-synapse-analytics-december-2021-update/ba-p/3042904#REF9) [article](../data-factory/data-flow-external-call.md) |
| virtual-desktop | Environment Setup | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-desktop/environment-setup.md | By default, a desktop app group (named "Desktop Application Group") is automatic To publish resources to users, you must assign them to app groups. When assigning users to app groups, consider the following things: -- A user can be assigned to both a desktop app group and a RemoteApp app group in the same host pool. However, users can only launch one type of app group per session. Users can't launch both types of app groups at the same time in a single session.+- We don't recommend assigning both the RemoteApp and desktop app groups in a single host pool to the same user. Doing so will cause a single user to have two user sessions in a single host pool. Users aren't supposed to have two active user sessions at the same time, as this can cause the following things to happen: + - The session hosts become overloaded + - Users get stuck when trying to login + - Connections won't work + - The screen turns black + - The application crashes + - Other negative effects on end-user experience and session performance - A user can be assigned to multiple app groups within the same host pool, and their feed will be an accumulation of both app groups. ## Workspaces |
| virtual-desktop | Security Guide | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-desktop/security-guide.md | Enabling audit log collection lets you view user and admin activity related to A - [Azure Active Directory Activity Log](../active-directory/reports-monitoring/concept-activity-logs-azure-monitor.md) - [Azure Active Directory](../active-directory/fundamentals/active-directory-whatis.md) - [Session hosts](../azure-monitor/agents/agent-windows.md)-- [Azure Virtual Desktop Diagnostic Log](../virtual-desktop/diagnostics-log-analytics.md) - [Key Vault logs](../key-vault/general/logging.md) ### Use RemoteApps |
| virtual-machines | Create Gallery | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-machines/create-gallery.md | -An [Azure Compute Gallery](./shared-image-galleries.md) (formerly known as Shared Image Gallery)simplifies sharing resources, like images and application packages, across your organization. +An [Azure Compute Gallery](./shared-image-galleries.md) (formerly known as Shared Image Gallery) simplifies sharing resources, like images and application packages, across your organization. The Azure Compute Gallery lets you share custom VM images and application packages with others in your organization, within or across regions, within an AAD tenant. Choose what you want to share, which regions you want to make them available in, and who you want to share them with. You can create multiple galleries so that you can logically group resources. |
| virtual-machines | Image Builder Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-machines/image-builder-overview.md | When you register for the (AIB), this grants the AIB Service permission to creat To allow Azure VM Image Builder to distribute images to either the managed images or to an Azure Compute Gallery, you will need to create an Azure user-assigned identity that has permissions to read and write images. If you are accessing Azure storage, then this will need permissions to read private and public containers. -Permissions are explained in more detail for [PowerShell](./linux/image-builder-permissions-powershell.md), and [AZ CLI](./linux/image-builder-permissions-cli.md). +In API version 2021-10-01 and beyond, Azure VM Image Builder supports adding Azure user-assigned identities to the build VM to enable scenarios where you will need to authenticate with services like Azure Key Vault in your subscription. ++For more information on permissions, please see the following links: [PowerShell](./linux/image-builder-permissions-powershell.md), [AZ CLI](./linux/image-builder-permissions-cli.md) and [Image Builder template reference: Identity](https://docs.microsoft.com/azure/virtual-machines/linux/image-builder-json#identity). ## Costs You will incur some compute, networking and storage costs when creating, building and storing images with Azure Image Builder. These costs are similar to the costs incurred in manually creating custom images. For the resources, you will be charged at your Azure rates. |
| virtual-machines | Vm Applications | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-machines/vm-applications.md | -VM Applications are a resource type in Azure Compute Gallery (formerly known as Shared Image Gallery) that simplifies management,sharing and global distribution of applications for your virtual machines. +VM Applications are a resource type in Azure Compute Gallery (formerly known as Shared Image Gallery) that simplifies management, sharing, and global distribution of applications for your virtual machines. > [!IMPORTANT] > **VM applications in Azure Compute Gallery** are currently in public preview. Get-AzVmss -name <VMSS name> -ResourceGroupName <resource group name> -InstanceV ## Next steps -- Learn how to [create and deploy VM application packages](vm-applications-how-to.md).+- Learn how to [create and deploy VM application packages](vm-applications-how-to.md). |
| virtual-machines | Run Command Managed | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-machines/windows/run-command-managed.md | az vm run-command list --name "myVM" --resource-group "myRG" This command will retrieve current execution progress, including latest output, start/end time, exit code, and terminal state of the execution. ```azurecli-interactive-az vm run-command show --name "myRunCommand" --vm-name "myVM" --resource-group "myRG" ΓÇôexpand +az vm run-command show --name "myRunCommand" --vm-name "myVM" --resource-group "myRG" --expand ``` ### Delete RunCommand resource from the VM |
| virtual-machines | Get Started | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-machines/workloads/sap/get-started.md | ms.assetid: ad8e5c75-0cf6-4564-ae62-ea1246b4e5f2 vm-linux Previously updated : 12/08/2021 Last updated : 01/12/2022 In this section, you find documents about Microsoft Power BI integration into SA ## Change Log +- January 12, 2022: Change in [HA for SAP NetWeaver on Azure VMs on Windows with Azure NetApp Files(SMB)](./high-availability-guide-windows-netapp-files-smb.md) to remove obsolete information for the SAP kernel that supports the scenario. - December 08, 2021: Change in [SQL Server Azure Virtual Machines DBMS deployment for SAP NetWeaver](./dbms_guide_sqlserver.md) to clarify Azure Load Balancer settings. - December 08, 2021: Release of scenario [HA of SAP HANA Scale-up with Azure NetApp Files on SLES](./sap-hana-high-availability-netapp-files-suse.md). - December 07, 2021: Change in [Setting up Pacemaker on RHEL in Azure](./high-availability-guide-rhel-pacemaker.md) to clarify that the instructions are applicable for both RHEL 7 and RHEL 8 |
| virtual-machines | High Availability Guide Windows Netapp Files Smb | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-machines/workloads/sap/high-availability-guide-windows-netapp-files-smb.md | Perform the following steps, as preparation for using Azure NetApp Files. You need the following software from SAP: * SAP Software Provisioning Manager (SWPM) installation tool version SPS25 or later.- * SAP Kernel 7.49 or later + * SAP Kernel 7.22 or later * Create a virtual host name (cluster network name) for the clustered SAP ASCS/SCS instance, as described in [Create a virtual host name for the clustered SAP ASCS/SCS instance](./sap-high-availability-installation-wsfc-shared-disk.md#a97ad604-9094-44fe-a364-f89cb39bf097). -> [!NOTE] -> Clustering SAP ASCS/SCS instances by using a file share is supported for SAP NetWeaver 7.40 (and later), with SAP Kernel 7.49 (and later). - ### Install an ASCS/SCS instance on the first ASCS/SCS cluster node 1. Install an SAP ASCS/SCS instance on the first cluster node. Start the SAP SWPM installation tool, then navigate to: |
| virtual-network | Nat Overview | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-network/nat-gateway/nat-overview.md | NAT will not impact the network bandwidth of your compute resources since it is ## VNet NAT basics -NAT can be created in a specific Availability Zone and has redundancy built in within the specified zone. NAT is non zonal by default. When creating [availability zones](../../availability-zones/az-overview.md) scenarios, NAT can be isolated in a specific zone. This is known as a zonal deployment. +NAT can be created in a specific Availability Zone and has redundancy built in within the specified zone. NAT is non-zonal by default. When creating [availability zones](../../availability-zones/az-overview.md) scenarios, NAT can be isolated in a specific zone. This is known as a zonal deployment. NAT is fully scaled out from the start. There's no ramp up or scale-out operation required. Azure manages the operation of NAT for you. NAT always has multiple fault domains and can sustain multiple failures without service outage. NAT is fully scaled out from the start. There's no ramp up or scale-out operatio * NAT is compatible with Standard SKU public IP address or public IP prefix resources or a combination of both. You can use a public IP prefix directly or distribute the public IP addresses of the prefix across multiple NAT gateway resources. NAT will groom all traffic to the range of IP addresses of the prefix. Basic resources, such as Basic Load Balancer or Basic Public IP aren't compatible with NAT. Basic resources must be placed on a subnet not associated to a NAT Gateway. Basic Load Balancer and Basic Public IP can be upgraded to standard in order to work with NAT gateway. * To upgrade a basic load balancer to standard, see [Upgrade Azure Public Load Balancer](/azure/load-balancer/upgrade-basic-standard) * To upgrade a basic public IP to standard, see [Upgrade a public IP address](/azure/virtual-network/ip-services/public-ip-upgrade-portal)+* NAT is the recommended method for outbound connectivity. A NAT gateway does not have the same limitations of SNAT port exhaustion as does [default outbound access](/azure/virtual-network/ip-services/default-outbound-access) and [outbound rules of a load balancer](/azure/load-balancer/outbound-rules). + * To migrate outbound access to NAT gateway from default outbound access or from outbound rules of a load balancer, see [Migrate outbound access to Azure Virtual Network NAT](/azure/virtual-network/nat-gateway/tutorial-migrate-outbound-nat) * NAT cannot be associated to an IPv6 Public IP address or IPv6 Public IP Prefix. However, it can be associated to a dual stack subnet. * NAT allows flows to be created from the virtual network to the services outside your VNet. Return traffic from the Internet is only allowed in response to an active flow. Services outside your VNet cannot initiate a connection to instances.-* NAT can't span multiple virtual networks. +* NAT cannot span multiple virtual networks. * Multiple NATs cannot be attached to a single subnet. * NAT cannot be deployed in a [Gateway Subnet](../../vpn-gateway/vpn-gateway-about-vpn-gateway-settings.md#gwsub) * The private side of NAT (virtual machine instances or other compute resources) sends TCP Reset packets for attempts to communicate on a TCP connection that doesn't exist. One example is connections that have reached idle timeout. The next packet received will return a TCP Reset to the private IP address to signal and force connection closure. The public side of NAT doesn't generate TCP Reset packets or any other traffic. Only traffic produced by the customer's virtual network is emitted. |
| virtual-network | Tutorial Migrate Outbound Nat | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-network/nat-gateway/tutorial-migrate-outbound-nat.md | + + Title: 'Tutorial: Migrate outbound access to NAT gateway' ++description: Learn how to migrate outbound access in your virtual network to a Virtual Network NAT gateway. +++++ Last updated : 1/11/2022++++# Tutorial: Migrate outbound access to Azure Virtual Network NAT ++In this article, you'll learn how to migrate your outbound connectivity from [default outbound access](../ip-services/default-outbound-access.md) to a NAT gateway. You'll learn how to change your outbound connectivity from load balancer outbound rules to a NAT gateway. You'll reuse the IP address from the outbound rule configuration for the NAT gateway. ++Azure Virtual Network NAT is the recommended method for outbound connectivity. A NAT gateway is a fully managed and highly resilient Network Address Translation (NAT) service. A NAT gateway doesn't have the same limitations of SNAT port exhaustion as default outbound access. A NAT gateway replaces the need for outbound rules in a load balancer for outbound connectivity. ++For more information about Azure Virtual Network NAT, see [What is Azure Virtual Network NAT](nat-overview.md) ++In this tutorial, you learn how to: ++> [!div class="checklist"] +> * Migrate default outbound access to a NAT gateway. +> * Migrate load balancer outbound connectivity and IP address to a NAT gateway. ++## Prerequisites ++* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). ++* A standard public load balancer in your subscription. The load balancer must have a separate frontend IP address and outbound rules configured. For more information on creating an Azure Load Balancer, see [Quickstart: Create a public load balancer to load balance VMs using the Azure portal](../../load-balancer/quickstart-load-balancer-standard-public-portal.md) + * The load balancer name used in the examples is **myLoadBalancer**. ++> [!NOTE] +> Virtual Network NAT provides outbound connectivity for standard internal load balancers. To configure create a NAT gateway resource and associate it to your subnet. For more information on integrating a NAT gateway with your internal load balancers, see [Tutorial: Integrate NAT gateway with an internal load balancer - Azure portal - Virtual Network NAT](tutorial-nat-gateway-load-balancer-internal-portal.md). ++## Migrate default outbound access ++In this section, youΓÇÖll learn how to change your outbound connectivity method from default outbound access to a NAT gateway. ++1. Sign in to the [Azure portal](https://portal.azure.com). ++2. In the search box at the top of the portal, enter **NAT gateway**. Select **NAT gateways**. ++3. In **NAT gateways**, select **+ Create**. ++4. In **Create network address translation (NAT) gateway**, enter or select the following information. ++ | Setting | Value | + | - | -- | + | **Project details** | | + | Subscription | Select your subscription. | + | Resource group | Select **Create new**. </br> Enter **myResourceGroup**. </br> Select **OK**. | + | **Instance details** | | + | NAT gateway name | Enter **myNATgateway**. | + | Region | Select the region of your virtual network. In this example, it's **West Europe**. | + | Availability zone | Leave the default of **None**. | + | Idle timeout (minutes) | Enter **10**. | ++5. Select the **Outbound IP** tab, or select **Next: Outbound IP** at the bottom of the page. ++6. In **Public IP addresses** in the **Outbound IP** tab, select **Create a new public IP address**. ++7. In **Add a public IP address**, enter **myNATgatewayIP** in **Name**. Select **OK**. ++8. Select the **Subnet** tab, or select **Next: Subnet** at the bottom of the page. ++9. In the pull-down box for **Virtual network**, select your virtual network. ++10. In **Subnet name**, select the checkbox next to your subnet. ++11. Select the **Review + create** tab, or select **Review + create** at the bottom of the page. ++12. Select **Create**. ++## Migrate load balancer outbound connectivity ++In this section, youΓÇÖll learn how to change your outbound connectivity method from outbound rules to a NAT gateway. You'll keep the same frontend IP address used for the outbound rules. You'll remove the outbound ruleΓÇÖs frontend IP configuration then create a NAT gateway with the same frontend IP address. A public load balancer is used throughout this section. ++### Remove outbound rule frontend IP configuration ++You remove the outbound rule and the associated frontend IP configuration from your load balancer. The load balancer name used in this example is **myLoadBalancer**. ++1. Sign in to the [Azure portal](https://portal.azure.com). ++2. In the search box at the top of the portal, enter **Load balancer**. Select **Load balancers** in the search results. ++3. Select **myLoadBalancer** or your load balancer. ++4. In **myLoadBalancer**, select **Frontend IP configuration** in **Settings**. ++5. Note the **IP address** in **Frontend IP configuration** that you wish to migrate to a **NAT gateway**. You'll need this information in the next section. In this example, it's **myFrontendIP-outbound**. ++6. Select **Delete** next to the IP configuration you wish to remove. In this example, it's **myFrontendIP-outbound**. ++ :::image type="content" source="./media/tutorial-migrate-outbound-nat/frontend-ip.png" alt-text="Screenshot of frontend IP address removal for NAT gateway."::: +++7. Select **Delete**. ++8. In **Delete myFrontendIP-outbound**, select the check box next to **I have read and understood that this frontend IP configuration as well as the associated resources listed above will be deleted**. ++9. Select **Delete**. This procedure will delete the frontend IP configuration and the outbound rule associated with the frontend. ++ :::image type="content" source="./media/tutorial-migrate-outbound-nat/delete-frontend-ip.png" alt-text="Screenshot of confirmation of frontend IP address removal for NAT gateway."::: ++### Create NAT gateway ++In this section, youΓÇÖll create a NAT gateway with the IP address previously used for outbound rule and assign it to your pre-created subnet within your virtual network. The subnet name for this example is **myBackendSubnet**. ++1. In the search box at the top of the portal, enter **NAT gateway**. Select **NAT gateways**. ++2. In **NAT gateways**, select **+ Create**. ++3. In **Create network address translation (NAT) gateway**, enter or select the following information. ++ | Setting | Value | + | - | -- | + | **Project details** | | + | Subscription | Select your subscription. | + | Resource group | Select **Create new**. </br> Enter **myResourceGroup**. </br> Select **OK**. | + | **Instance details** | | + | NAT gateway name | Enter **myNATgateway**. | + | Region | Select the region of your virtual network. In this example, it's **West Europe**. | + | Availability zone | Leave the default of **None**. | + | Idle timeout (minutes) | Enter **10**. | ++4. Select the **Outbound IP** tab, or select **Next: Outbound IP** at the bottom of the page. ++5. In **Public IP addresses** in the **Outbound IP** tab, select the IP address you noted from the previous section. In this example, it's **myPublicIP-outbound**. ++6. Select the **Subnet** tab, or select **Next: Subnet** at the bottom of the page. ++7. In the pull-down box for **Virtual network**, select your virtual network. ++8. In **Subnet name**, select the checkbox for your subnet. In this example, it's **myBackendSubnet**. ++9. Select the **Review + create** tab, or select **Review + create** at the bottom of the page. ++10. Select **Create**. ++## Clean up resources ++If you're not going to continue to use this application, delete +the NAT gateway with the following steps: ++1. From the left-hand menu, select **Resource groups**. ++2. Select the **myResourceGroup** resource group. ++3. Select **Delete resource group**. ++4. Enter **myResourceGroup** and select **Delete**. ++## Next steps ++In this article, you learned how to: ++* Migrate default outbound access to a NAT gateway. ++* Migrate load balancer outbound connectivity and IP address to a NAT gateway. ++For more information about NAT gateway and the connectivity benefits it provides, see [Design virtual networks with NAT gateway](nat-gateway-resource.md). ++Advance to the next article to learn how to integrate a NAT gateway with a public load balancer: +> [!div class="nextstepaction"] +> [Integrate a NAT gateway with a public load balancer using the Azure portal](tutorial-nat-gateway-load-balancer-public-portal.md) |
| virtual-wan | Quickstart Any To Any Template | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/virtual-wan/quickstart-any-to-any-template.md | Title: 'Quickstart: Create an any-to-any configuration using an ARM template' -description: This quickstart shows you how to create an any-to-any configuration using an Azure Resource Manager template (ARM template). +description: Learn how to create an any-to-any configuration using an Azure Resource Manager template (ARM template). If your environment meets the prerequisites and you're familiar with using ARM t ## Prerequisites * If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.-* Public key certificate data is required for this configuration. Sample data is provided in the article. However, the sample data is provided only to satisfy the template requirements in order to create a P2S gateway. After the template completes and the resources are deployed, you must update this field with your own certificate data in order for the configuration to work. See [Generate and export certificates](certificates-point-to-site.md#cer) for information and steps. +* Public key certificate data is required for this configuration. See [Generate and export certificates](certificates-point-to-site.md#cer) for steps to generate and export the required certificates. Sample certificate data is provided in the article only to satisfy the template requirements in order to create a P2S gateway. ## <a name="review"></a>Review the template Multiple Azure resources are defined in the template: > [!NOTE] > This ARM template doesn't create the customer-side resources required for hybrid connectivity. After you deploy the template, you still need to create and configure the P2S VPN clients, the VPN branches (Local Sites), and connect the ExpressRoute circuits. - To find more templates, see [Azure Quickstart Templates](https://azure.microsoft.com/resources/templates/?resourceType=Microsoft.Network&pageNumber=1&sort=Popular). ## <a name="deploy"></a>Deploy the template To deploy this template properly, you must use **Deploy to Azure** button in the [](https://portal.azure.com/#create/Microsoft.Template/uri/https%3a%2f%2fraw.githubusercontent.com%2fAzure%2fazure-quickstart-templates%2fmaster%2fquickstarts%2fmicrosoft.network%2fvirtual-wan-with-all-gateways%2fazuredeploy.json) 1. To view the template, click **Edit template**. On this page, you can adjust some of the values such as address space or the name of certain resources. **Save** to save your changes, or **Discard**.-1. On the template page, enter the values. For this template, the P2S public certificate data is required. If you are using this article as an exercise, you can use the following example data from this .cer file as sample data for both hubs. Once the template runs and deployment is complete, in order to use the P2S configuration, you must replace this information with the public key certificate data for your own deployment. For more information, see [Generate and export certificates](certificates-point-to-site.md#cer). +1. On the template page, enter the values. For the **Hub_Public Certificate Data for P2S** fields, you need to input the public key certificate data from the root certificate that you want to use (as mentioned in the prerequisites). If you haven't generated a root certificate and you are using these steps as only an exercise to run the template and observe the results, you can use the following example certificate data for both hubs. If you choose to use this example data and later want P2S clients to connect, you must replace this information with the certificate data from your own environment. > [!NOTE]- > The certificate data in example below is supplied for demonstration purposes only. You must replace this information with the public key [certificate data](certificates-point-to-site.md#cer) for your own deployment if you want this configuration to work properly. - > + > This certificate data is supplied for example purposes only. Replace this example data with the public key [certificate data](certificates-point-to-site.md#cer) from your own certificate if you want P2S clients to connect. ```certificate-data MIIC9zCCAd+gAwIBAgIQOn0lVXm3E5hH/A7CdSuPyDANBgkqhkiG9w0BAQsFADAe To deploy this template properly, you must use **Deploy to Azure** button in the ## <a name="complete"></a>Complete the hybrid configuration -The template does not configure all of the settings necessary for a hybrid network. You need to complete the following configurations and settings, depending on your requirements. +The template does not configure all of the settings necessary for a hybrid network. Complete the following configurations and settings, depending on your requirements: * [Configure the VPN branches - local sites](virtual-wan-site-to-site-portal.md#site) * [Complete the P2S VPN configuration](virtual-wan-point-to-site-portal.md) |
| vpn-gateway | Point To Site About | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/vpn-gateway/point-to-site-about.md | The validation of the client certificate is performed by the VPN gateway and hap ### Authenticate using native Azure Active Directory authentication -Azure AD authentication allows users to connect to Azure using their Azure Active Directory credentials. Native Azure AD authentication is only supported for OpenVPN protocol and Windows 10 and requires the use of the [Azure VPN Client](https://go.microsoft.com/fwlink/?linkid=2117554). +Azure AD authentication allows users to connect to Azure using their Azure Active Directory credentials. Native Azure AD authentication is only supported for OpenVPN protocol and Windows 10 and 11 and also requires the use of the [Azure VPN Client](https://go.microsoft.com/fwlink/?linkid=2117554). With native Azure AD authentication, you can leverage Azure AD's conditional access as well as Multi-Factor Authentication (MFA) features for VPN. |
| web-application-firewall | Waf Front Door Tuning | https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/web-application-firewall/afds/waf-front-door-tuning.md | In the following example, we explore a `FrontdoorWebApplicationFirewallLog` log ```kusto AzureDiagnostics-| where Category == 'FrontDoorWebApplicationFirewallLog' +| where Category == 'FrontdoorWebApplicationFirewallLog' | where TimeGenerated > ago(1d) | where action_s == 'Block' |