-If on-prem AD DS and Azure AD are configured for federated authentication using ADFS then there is no (current/valid) password hash available in Azure DS. Azure AD user accounts created before fed auth was implemented might have an old password hash but this likely doesn't match a hash of their on-prem password. Hence Azure AD DS won't be able to validate the users credentials.

-|`preferred_username` | String | The primary username that represents the user. It could be an email address, phone number, or a generic username without a specified format. Its value is mutable and might change over time. Since this value can be changed, it must not be used to make authorization decisions. The `profile` scope is required to receive this claim.|

-|`email` | String | The `email` claim is present by default for guest accounts that have an email address. Your app can request the email claim for managed users (those from the same tenant as the resource) using the `email` [optional claim](active-directory-optional-claims.md). On the v2.0 endpoint, your app can also request the `email` OpenID Connect scope - you don't need to request both the optional claim and the scope to get the claim. The email claim only supports addressable mail from the user's profile information. |

-description: In this quickstart, learn how a Windows desktop .NET (XAML) application can get an access token and call an API protected by the Microsoft identity platform.

-#Customer intent: As an application developer, I want to learn how my Windows desktop .NET application can get an access token and call an API that's protected by the Microsoft identity platform.

-In this quickstart, you download and run a code sample that demonstrates how a Windows desktop .NET (WPF) application can sign in users and get an access token to call the Microsoft Graph API.

-> [!div renderon="docs"]

-> ## Prerequisites

->

-> * [Visual Studio 2019](https://visualstudio.microsoft.com/vs/) with the [Universal Windows Platform development](/windows/uwp/get-started/get-set-up) workload installed

->

-> ## Register and download your quickstart app

-> You have two options to start your quickstart application:

-> * [Express] [Option 1: Register and auto configure your app and then download your code sample](#option-1-register-and-auto-configure-your-app-and-then-download-your-code-sample)

-> * [Manual] [Option 2: Register and manually configure your application and code sample](#option-2-register-and-manually-configure-your-application-and-code-sample)

->

-> ### Option 1: Register and auto configure your app and then download your code sample

->

-> 1. Go to the <a href="https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade/quickStartType/WinDesktopQuickstartPage/sourceType/docs" target="_blank">Azure portal - App registrations</a> quickstart experience.

-> 1. Enter a name for your application and select **Register**.

-> 1. Follow the instructions to download and automatically configure your new application with just one click.

->

-> ### Option 2: Register and manually configure your application and code sample

->

-> #### Step 1: Register your application

-> To register your application and add the app's registration information to your solution manually, follow these steps:

->

-> 1. Sign in to the <a href="https://portal.azure.com/" target="_blank">Azure portal</a>.

-> 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="./media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the tenant in which you want to register the application.

-> 1. Search for and select **Azure Active Directory**.

-> 1. Under **Manage**, select **App registrations** > **New registration**.

-> 1. Enter a **Name** for your application, for example `Win-App-calling-MsGraph`. Users of your app might see this name, and you can change it later.

-> 1. In the **Supported account types** section, select **Accounts in any organizational directory and personal Microsoft accounts (for example, Skype, Xbox, Outlook.com)**.

-> 1. Select **Register** to create the application.

-> 1. Under **Manage**, select **Authentication**.

-> 1. Select **Add a platform** > **Mobile and desktop applications**.

-> 1. In the **Redirect URIs** section, select `https://login.microsoftonline.com/common/oauth2/nativeclient` and in **Custom redirect URIs** add `ms-appx-web://microsoft.aad.brokerplugin/{client_id}` where `{client_id}` is the application (client) ID of your application (the same GUID that appears in the `msal{client_id}://auth` checkbox).

-> 1. Select **Configure**.

-> [!div class="sxs-lookup" renderon="portal"]

-> #### Step 1: Configure your application in Azure portal

-> For the code sample in this quickstart to work, add a **Redirect URI** of `https://login.microsoftonline.com/common/oauth2/nativeclient` and `ms-appx-web://microsoft.aad.brokerplugin/{client_id}`.

-> > [!div renderon="portal" id="makechanges" class="nextstepaction"]

-> > [Make this change for me]()

->

-> > [!div id="appconfigured" class="alert alert-info"]

-> >  Your application is configured with these attributes.

-#### Step 2: Download your Visual Studio project

-> [!div renderon="docs"]

-> [Download the Visual Studio project](https://github.com/Azure-Samples/active-directory-dotnet-desktop-msgraph-v2/archive/msal3x.zip)

-> [!div class="sxs-lookup" renderon="portal"]

-> Run the project using Visual Studio 2019.

-> [!div renderon="portal" id="autoupdate" class="sxs-lookup nextstepaction"]

-> [!div class="sxs-lookup" renderon="portal"]

-> #### Step 3: Your app is configured and ready to run

-> We have configured your project with values of your app's properties and it's ready to run.

-> [!div class="sxs-lookup" renderon="portal"]

-> [!div renderon="docs"]

-> #### Step 3: Configure your Visual Studio project

-> 1. Extract the zip file to a local folder close to the root of the disk, for example, **C:\Azure-Samples**.

-> 1. Open the project in Visual Studio.

-> 1. Edit **App.Xaml.cs** and replace the values of the fields `ClientId` and `Tenant` with the following code:

->

-> ```csharp

-> private static string ClientId = "Enter_the_Application_Id_here";

-> private static string Tenant = "Enter_the_Tenant_Info_Here";

-> ```

->

-> Where:

-> - `Enter_the_Application_Id_here` - is the **Application (client) ID** for the application you registered.

->

-> To find the value of **Application (client) ID**, go to the app's **Overview** page in the Azure portal.

-> - `Enter_the_Tenant_Info_Here` - is set to one of the following options:

-> - If your application supports **Accounts in this organizational directory**, replace this value with the **Tenant Id** or **Tenant name** (for example, contoso.microsoft.com)

-> - If your application supports **Accounts in any organizational directory**, replace this value with `organizations`

-> - If your application supports **Accounts in any organizational directory and personal Microsoft accounts**, replace this value with `common`.

->

-> To find the values of **Directory (tenant) ID** and **Supported account types**, go to the app's **Overview** page in the Azure portal.

->

- const string[] scopeRequiredByApi = new string[] { "access_as_user" };

-Configuring a BIG-IP with Azure Active Directory (Azure AD) provides many benefits, including:

-Ideally, application access should be managed directly by Azure AD but being legacy it lacks any form of modern authentication protocol. Modernization would take considerable effort and time, introducing inevitable costs and risk of potential downtime. Instead, a BIG-IP deployed between the public internet and the internal application will be used to gate inbound access to the application.

-Having a BIG-IP in front of the application enables us to overlay the service with Azure AD pre-authentication and header-based SSO, significantly improving the overall security posture of the application.

-

-Before a client or service can access Microsoft Graph, it must be trusted by the Microsoft identity platform. Registering with Azure AD establishes a trust relationship between your application and the IdP. BIG-IP must also be registered as a client in Azure AD, before the Easy Button wizard is trusted to access Microsoft Graph.

-Next, step through the Easy Button configurations, and complete the trust to start publishing the internal application. Start by provisioning your BIG-IP with an X509 certificate that Azure AD can use to sign SAML tokens and claims issued for SHA enabled services.

-Configuration steps flow

-> The APM session variables defined within curly brackets are CASE sensitive. If you enter EmployeeID when the Azure AD attribute name is being sent as employeeid, it will cause an attribute mapping failure. In case of any issues, troubleshoot using the session analysis steps to check how the APM has variables defined.

-Configuring BIG-IP published applications with Azure AD provides many benefits, including:

-For this scenario, we have a legacy application using HTTP authorization headers to control access to protected content. Azure AD pre-authentication provides the user identifier, while other attributes fetched from an LDAP connected Human Resource (HR) system provide fine grained application permissions.

-Ideally, application access should be managed directly by Azure AD but being legacy it lacks any form of modern authentication protocol. Modernization would take considerable effort and time, introducing inevitable costs and risk of potential downtime.

-Instead, a BIG-IP deployed between the public internet and the internal application will be used to gate inbound access to the application.

-Having a BIG-IP in front of the application enables us to overlay the service with Azure AD pre-authentication and header-based SSO, significantly improving the overall security posture of the application.

-**Application:** BIG-IP published service to be protected by and Azure AD SHA.

-**Azure AD:** Security Assertion Markup Language (SAML) Identity Provider (IdP) responsible for verification of user credentials, Conditional Access (CA), and SSO to the BIG-IP APM. Trough SSO, Azure AD provides the BIG-IP with any required session attributes.

-There are many methods to deploy BIG-IP for this scenario including a template-driven Guided Configuration wizard, or the manual advanced configuration. This tutorial covers the latest Guided Configuration 16.1 offering an Easy Button template.

-With the **Easy Button**, admins no longer go back and forth between Azure AD and a BIG-IP to enable services for secure hybrid access. The end-to-end deployment and policy management is handled directly between the APMΓÇÖs Guided Configuration wizard and Microsoft Graph. This rich integration between BIG-IP APM and Azure AD ensures applications can quickly, easily support identity federation, SSO, and Azure AD Multi-Factor Authentication (MFA), without management overhead of having to do on a per app basis.

-Before a client or service can access Microsoft Graph, it must be trusted by the Microsoft identity platform by being registered with Azure AD. A BIG-IP must also be registered as a client in Azure AD, before the Easy Button wizard is trusted to access Microsoft Graph.

-Next, step through the Easy Button configurations, and complete the trust to start publishing the internal application. Start by provisioning your BIG-IP with an X509 certificate that Azure AD can use to sign SAML tokens and claims issued for SHA enabled services.

->The APM session variables defined within curly brackets are CASE sensitive. For example, if our queried LDAP attribute was returned as eventroles, then the above variable definition would fail to populate the eventrole header value. In case of any issues, troubleshoot using the session analysis steps to check how the APM has variables defined.

- > These values are not real. Update these values with the actual Identifier and Reply URL. Contact [Facebook Work Accounts Client support team](mailto:WorkplaceSupportPartnerships@fb.com) to get these values. You can also refer to the patterns shown in the **Basic SAML Configuration** section in the Azure portal.

-In this section, you create a user called Britta Simon in Facebook Work Accounts. Work with [Facebook Work Accounts support team](mailto:WorkplaceSupportPartnerships@fb.com) to add the users in the Facebook Work Accounts platform. Users must be created and activated before you use single sign-on.

-1. Navigate to **Enterprise Applications** and then select **All Applications**.

-1. In the **Add from the gallery** section, type **GitHub Enterprise Managed User** in the search box.

-1. Select **GitHub Enterprise Managed User** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.

-GitHub Enterprise Managed User **requires** all accounts to be created through automatic user provisioning, you can find more details [here](./github-enterprise-managed-user-provisioning-tutorial.md) on how to configure automatic user provisioning.

-* [Configure Single Sign-on](./salesforce-sandbox-tutorial.md)

- "selfIssued": {

- "alias": {

- "claim": "name"

- }

- },

- },

- "validityInterval": 25920000,

- "vc": {

- "type": [

- "ProofOfNinjaNinja"

- ],

-1. Run the following PowerShell commands. These commands install and import the `AzureAD` module. For more information, see [Install the Azure Az PowerShell module](/powershell/azure/install-az-ps#installation).

- if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) { Install-Module "AzureAD" -Scope CurrentUser } Import-Module AzureAD

- Connect-AzureAD -TenantId <your-tenant-ID>

- New-AzureADServicePrincipal -AppId "bbb94529-53a3-4be5-a069-7eaf2712b826" -DisplayName "Verifiable Credential Request Service"

-Once Dapr is installed on your AKS cluster, your application services now have the Dapr sidecar running alongside them. This enables you to immediately start using the Dapr building block APIs. For a more in-depth overview of the building block APIs and how to best use them, please see the [Dapr building blocks overview][building-blocks-concepts].

-Part of the AKS cluster lifecycle involves performing periodic upgrades to the latest Kubernetes version. It is important you apply the latest security releases, or upgrade to get the latest features. This article shows you how to upgrade the master components or a single, default node pool in an AKS cluster.

-This article requires that you are running the Azure CLI version 2.0.65 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][azure-cli-install].

-> When you upgrade a supported AKS cluster, Kubernetes minor versions cannot be skipped. All upgrades must be performed sequentially by major version number. For example, upgrades between *1.14.x* -> *1.15.x* or *1.15.x* -> *1.16.x* are allowed, however *1.14.x* -> *1.16.x* is not allowed.

-> > Skipping multiple versions can only be done when upgrading from an _unsupported version_ back to a _supported version_. For example, an upgrade from an unsupported *1.10.x* --> a supported *1.15.x* can be completed.

-If no upgrade is available, you will get the message:

-By default, AKS configures upgrades to surge with one additional node. A default value of one for the max surge settings will enable AKS to minimize workload disruption by creating an additional node before the cordon/drain of existing applications to replace an older versioned node. The max surge value may be customized per node pool to enable a trade-off between upgrade speed and upgrade disruption. By increasing the max surge value, the upgrade process completes faster, but setting a large value for max surge may cause disruptions during the upgrade process.

-AKS accepts both integer values and a percentage value for max surge. An integer such as "5" indicates five additional nodes to surge. A value of "50%" indicates a surge value of half the current node count in the pool. Max surge percent values can be a minimum of 1% and a maximum of 100%. A percent value is rounded up to the nearest node count. If the max surge value is lower than the current node count at the time of upgrade, the current node count is used for the max surge value.

-| `rapid`| automatically upgrade the cluster to the latest supported patch release on the latest supported minor version.| In cases where the cluster is at a version of Kubernetes that is at an *N-2* minor version where *N* is the latest supported minor version, the cluster first upgrades to the latest supported patch version on *N-1* minor version. For example, if a cluster is running version *1.17.7* and versions *1.17.9*, *1.18.4*, *1.18.6*, and *1.19.1* are available, your cluster first is upgraded to *1.18.6*, then is upgraded to *1.19.1*.

-Automatically upgrading a cluster follows the same process as manually upgrading a cluster. For more details, see [Upgrade an AKS cluster][upgrade-cluster].

-If you are using Planned Maintenance as well as Auto-Upgrade, your upgrade will start during your specified maintenance window. For more details on Planned Maintenance, see [Use Planned Maintenance to schedule maintenance windows for your Azure Kubernetes Service (AKS) cluster (preview)][planned-maintenance].

-AKS uses best-effort zone balancing in node groups. During an Upgrade surge, zone(s) for the surge node(s) in virtual machine scale sets is unknown ahead of time. This can temporarily cause an unbalanced zone configuration during an upgrade. However, AKS deletes the surge node(s) once the upgrade has been completed and preserves the original zone balance. If you desire to keep your zones balanced during upgrade, increase the surge to a multiple of 3 nodes. Virtual machine scale sets will then balance your nodes across Availability Zones with best-effort zone balancing.

-If you have PVCs backed by Azure LRS Disks, they will be bound to a particular zone and may fail to recover immediately if the surge node does not match the zone of the PVC. This could cause downtime on your application when the Upgrade operation continues to drain nodes but the PVs are bound to a zone. To handle this case and maintain high availability, configure a [Pod Disruption Budget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) on your application. This allows Kubernetes to respect your availability requirements during Upgrade's drain operation.

-[planned-maintenance]: planned-maintenance.md

-There are many networking features that enable apps in the multi-tenant App Service to reach network isolated resources or become network isolated themselves. These features are enabled at the application level. With an App Service Environment, there's no added configuration required for the apps to be in the virtual network. The apps are deployed into a network isolated environment that is already in a virtual network. If you really need a complete isolation story, you can also get your App Service Environment deployed onto dedicated hardware.

-The App Service Environment feature is a deployment of the Azure App Service into a single subnet in a customer's virtual network. When you deploy an app into an App Service Environment, the app will be exposed on the inbound address assigned to the App Service Environment. If your App Service Environment is deployed with an internal virtual IP (VIP), then the inbound address for all of the apps will be an address in the App Service Environment subnet. If your App Service Environment is deployed with an external VIP, then the inbound address will be an internet addressable address and your apps will be in public DNS.

-The apps in an App Service Environment do not need any features enabled to access resources in the same virtual network that the App Service Environment is in. If the App Service Environment virtual network is connected to another network, then the apps in the App Service Environment can access resources in those extended networks. Traffic can be blocked by user configuration on the network.

-The multi-tenant version of Azure App Service contains numerous features to enable your apps to connect to your various networks. Those networking features enable your apps to act as if they were deployed in a virtual network. The apps in an App Service Environment v3 do not need any configuration to be in the virtual network. A benefit of using an App Service Environment over the multi-tenant service is that any network access controls to the App Service Environment hosted apps is external to the application configuration. With the apps in the multi-tenant service, you must enable the features on an app by app basis and use RBAC or policy to prevent any configuration changes.

-As a customer, you should monitor the App Service plans and the individual apps running and take appropriate actions. For App Service Environment v2, you should also pay attention to the metrics around the platform infrastructure. These metrics will give you insights into how the platform infrastructure and frontend servers are doing, and you can take action if they are heavily utilized and you are not getting maximum throughput.

-Through CLI you can configure the scale ratio of your frontend servers between 5 and 15 (default 15) App Service plan instances per frontend server. An App Service Environment will always have a minimum of two frontend servers. You can also increase the size of the frontend servers through CLI.

-You will see some metrics called Small/Medium/Large App Service Plan Workers and a sub-scope called multiRolePools/default. These are applicable to App Service Environment v1 only.

-| ASE subnet is almost out of space | The specified ASE is in a subnet that is almost out of space. There are {0} remaining addresses. Once these addresses are exhausted, the ASE will not be able to scale. |

-| ASE is unable to reach a dependency | The specified ASE is not able to reach {0}. Ensure the guidelines defined here are followed: [Networking considerations for an App Service Environment](network-info.md). |

-If you integrate with Log Analytics, you can see the logs by selecting **Logs** from the ASE portal and creating a query against **AppServiceEnvironmentPlatformLogs**. Logs are only emitted when your ASE has an event that will trigger it. If your ASE does not have such an event, there will not be any logs. To quickly see an example of logs in your Log Analytics workspace, perform a scale operation with one of the App Service plans in your ASE. You can then run a query against **AppServiceEnvironmentPlatformLogs** to see those logs.

-If the default scale rate of one front end for every 15 App Service plan instances is not fast enough, you can adjust the ratio at which front ends are added or the size of the front ends. When you adjust the ratio or size, you pay for the front-end cores that would not be added by default.

-There are command line capabilities to administer to an ASE. The az cli commands are noted below.

-When you want your apps in your plan to reach a virtual network that's already connected to by apps in another plan, select a different subnet than the one being used by the preexisting virtual network integration.

-You must have at least the following RBAC permissions on the subnet or at a higher level to configure regional virtual network integration through Azure portal, CLI or when setting the `virtualNetworkSubnetId` site property directly:

-Queries to the container are billed at the pricing tier of the Azure resource that's used for the `ApiKey`. You will be billed for each container instance used to process your documents and images. Thus, If you use the business card feature, you will be billed for the Form Recognizer `BusinessCard` and `Compuer Vision Read` container instances. For the invoice feature, you will be billed for the Form Recognizer `Invoice` and `Layout` container instances. *See*, [Form Recognizer](https://azure.microsoft.com/pricing/details/form-recognizer/) and Computer Vision [Read feature](https://azure.microsoft.com/pricing/details/cognitive-services/computer-vision/) container pricing.

- BACKUP DATABASE <database name> TO URL = 'https://<mystorageaccountname>.blob.core.windows.net/<mystorageaccountcontainername>'

- RESTORE DATABASE <database name> FROM URL = 'https://<mystorageaccountname>.blob.core.windows.net/<mystorageaccountcontainername>/<file name>'

-Learn more about backup to URL here:

-[Backup to URL docs](/sql/relational-databases/backup-restore/sql-server-backup-to-url)

-[Backup to URL using SQL Server Management Studio (SSMS)](/sql/relational-databases/tutorial-sql-server-backup-and-restore-to-azure-blob-storage-service)

-TO DISK = 'c:\tmp\test.bak'

-

- secret:

- secretName: azure-arc-guard-manifests

- name: azure-rbac

- readOnly: true

- 1. Add the following `apiserver` arguments:

- ```yml

- - --authentication-token-webhook-config-file=/etc/guard/guard-authn-webhook.yaml

- - --authentication-token-webhook-cache-ttl=5m0s

- - --authorization-webhook-cache-authorized-ttl=5m0s

- - --authorization-webhook-config-file=/etc/guard/guard-authz-webhook.yaml

- - --authorization-webhook-version=v1

- - --authorization-mode=Node,Webhook,RBAC

- If the Kubernetes cluster is version 1.19.0 or later, you also need to set the following `apiserver` argument:

- - --authentication-token-webhook-version=v1

- 1. Save and close the editor to update the `apiserver` pod.

- authorization-mode: Node,Webhook,RBAC

-If you want to run the command-line tool on another platform, download official Redis from [https://redis.io/download](https://redis.io/download).

-3. Using the Azure portal.

-In this section, you will retrieve the keys from the Azure portal.

-1. [Enable the non-TLS port (6379)](cache-configure.md#access-ports) - **This configuration is not recommended** because in this configuration, the access keys are sent via TCP in clear text. This change can compromise access to your cache. The only scenario where you might consider this configuration is when you are just accessing a test cache.

- Right-click the taskbar icon for the stunnel server and select **Show Log Window**.

- On the stunnel Log Window menu, select **Configuration** > **Edit Configuration** to open the current configuration file.

-When using stunnel, run *redis-cli.exe*, and pass only your *port*, and *access key* (primary or secondary) to connect to the cache.

-1. Choose a directory location for your project workspace and choose **Select**.

-*Last updated: December 2021*

-| [Azure Bastion](https://azure.microsoft.com/services/azure-bastion/) | &#x2705; | &#x2705; |

-| [Azure Cognitive Search](https://azure.microsoft.com/services/search/) | &#x2705; | &#x2705; |

-| [Azure Databricks](https://azure.microsoft.com/services/databricks/) **&ast;&ast;** | &#x2705; | &#x2705; |

-| [Azure HPC Cache](https://azure.microsoft.com/services/hpc-cache/) | &#x2705; | &#x2705; |

-| [Azure Monitor](https://azure.microsoft.com/services/monitor/) (incl. [Application Insights](../../azure-monitor/app/app-insights-overview.md), [Log Analytics](../../azure-monitor/logs/data-platform-logs.md), and [Application Change Analysis](../../azure-monitor/app/change-analysis.md)) | &#x2705; | &#x2705; |

-| [Azure Site Recovery](https://azure.microsoft.com/services/site-recovery/) | &#x2705; | &#x2705; |

-| [Azure SQL Database](https://azure.microsoft.com/services/sql-database/) (incl. [Azure SQL Managed Instance](https://azure.microsoft.com/products/azure-sql/managed-instance/)) | &#x2705; | &#x2705; |

-| [Azure Video Analyzer](https://azure.microsoft.com/products/video-analyzer/) | &#x2705; | &#x2705; |

-| [Azure Web Application Firewall)](https://azure.microsoft.com/services/web-application-firewall/) | &#x2705; | &#x2705; |

-| [Network Watcher](https://azure.microsoft.com/services/network-watcher/) incl. [Traffic Analytics](../../network-watcher/traffic-analytics.md) | &#x2705; | &#x2705; |

-| [Power AI Builder](/ai-builder/overview) | &#x2705; | &#x2705; |

-| **Service** | **FedRAMP High** | **DoD IL2** |

-*Last updated: December 2021*

-| [App Configuration](https://azure.microsoft.com/services/app-configuration/) | &#x2705; | &#x2705; | | | |

-| [Azure Cache for Redis](https://azure.microsoft.com/services/cache/) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | &#x2705; |

-| [Azure Cognitive Search](https://azure.microsoft.com/services/search/) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | |

-| [Azure Dedicated HSM](https://azure.microsoft.com/services/azure-dedicated-hsm/) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | |

-| [Azure Form Recognizer](https://azure.microsoft.com/services/form-recognizer/) | &#x2705; | &#x2705; | | | |

-| [Azure Lab Services](https://azure.microsoft.com/services/lab-services/) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | |

-| [Azure Public IP](../../virtual-network/ip-services/public-ip-addresses.md) | &#x2705; | &#x2705; | | | |

-| [Azure Resource Manager](https://azure.microsoft.com/features/resource-manager/) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | &#x2705; |

-| [Azure SQL Managed Instance](https://azure.microsoft.com/products/azure-sql/managed-instance/) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | |

-| [Azure Synapse Link for Dataverse](/powerapps/maker/data-platform/export-to-data-lake) | &#x2705; | &#x2705; | | | |

-| [Azure Web Application Firewall)](https://azure.microsoft.com/services/web-application-firewall/) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | |

-| [GitHub AE](https://docs.github.com/en/github-ae@latest/admin/overview/about-github-ae) | &#x2705; | &#x2705; | | | |

-| [Microsoft 365 Defender](/microsoft-365/security/defender/) (formerly Microsoft Threat Protection) | &#x2705; | &#x2705; | | | |

-| [Microsoft Defender for Identity](/defender-for-identity/what-is) | &#x2705; | &#x2705; | &#x2705; | &#x2705; | |

-| [Planned Maintenance for VMs](../../virtual-machines/maintenance-control-portal.md) | &#x2705; | &#x2705; | | | |

-| [Power AI Builder](/ai-builder/overview) | &#x2705; | &#x2705; | | | |

-| [Power Virtual Agents](/power-virtual-agents/fundamentals-what-is-power-virtual-agents) | &#x2705; | &#x2705; | | | |

-| **Service** | **FedRAMP High** | **DoD IL2** | **DoD IL4** | **DoD IL5** | **DoD IL6** |

-| [Virtual WAN](https://azure.microsoft.com/services/virtual-wan/) | &#x2705; | &#x2705; | | | &#x2705; |

-description: Comprehensive list of Azure Government cloud solution providers, resellers, and distributors.

-Since the launch of [Azure Government services in the Cloud Solution Provider (CSP) program)](https://azure.microsoft.com/blog/announcing-microsoft-azure-government-services-in-the-cloud-solution-provider-program/), we have worked with the partner community to bring them the benefits of this channel, enable them to resell Azure Government, and help them grow their business while providing the cloud services their customers need.

-|[Computer Professionals International](https://cb20.com/)|

-Azure Government supports applications that use Impact Level 5 (IL5) data in all available regions. IL5 requirements are defined in the [US Department of Defense (DoD) Cloud Computing Security Requirements Guide (SRG)](https://dl.dod.cyber.mil/wp-content/uploads/cloud/SRG/https://docsupdatetracker.net/index.html#3INFORMATIONSECURITYOBJECTIVES/IMPACTLEVELS). IL5 workloads have a higher degree of impact to the DoD and must be secured to a higher standard. When you deploy these workloads on Azure Government, you can meet their isolation requirements in various ways. The guidance in this document addresses configurations and settings needed to meet the IL5 isolation requirements. We'll update this document as we enable new isolation options and the Defense Information Systems Agency (DISA) authorizes new services for IL5 data.

-In January 2017, DISA awarded the IL5 Provisional Authorization (PA) to [Azure Government](https://azure.microsoft.com/global-infrastructure/government/get-started/), making it the first IL5 PA awarded to a hyperscale cloud provider. The PA covered two Azure Government regions (US DoD Central and US DoD East) that are [dedicated to the DoD](https://azure.microsoft.com/global-infrastructure/government/dod/). Based on DoD mission owner feedback and evolving security capabilities, Microsoft has partnered with DISA to expand the IL5 PA boundary in December 2018 to cover the remaining Azure Government regions: US Gov Arizona, US Gov Texas, and US Gov Virginia. For service availability in Azure Government, see [Products available by region](https://azure.microsoft.com/global-infrastructure/services/?products=all&regions=non-regional,usgov-non-regional,us-dod-central,us-dod-east,usgov-arizona,usgov-iowa,usgov-texas,usgov-virginia). For a list of services in scope for DoD IL5 PA, see [Azure Government services by audit scope](./compliance/azure-services-in-fedramp-auditscope.md#azure-government-services-by-audit-scope).

-IL5 separation requirements are stated in the SRG [Section 5.2.2.3](https://dl.dod.cyber.mil/wp-content/uploads/cloud/SRG/https://docsupdatetracker.net/index.html#5.2LegalConsiderations). The SRG focuses on compute separation during "processing" of IL5 data. This separation ensures that a virtual machine that could potentially compromise the physical host can't affect a DoD workload. To remove the risk of runtime attacks and ensure long running workloads aren't compromised from other workloads on the same host, **all IL5 virtual machines and virtual machine scale sets** should be isolated via [Azure Dedicated Host](https://azure.microsoft.com/services/virtual-machines/dedicated-host/) or [isolated virtual machines](../virtual-machines/isolation.md). Doing so provides a dedicated physical server to host your Azure Virtual Machines (VMs) for Windows and Linux.

-The DoD requirements for encrypting data at rest are provided in the SRG [Section 5.11](https://dl.dod.cyber.mil/wp-content/uploads/cloud/SRG/https://docsupdatetracker.net/index.html#5.11EncryptionofData-at-RestinCommercialCloudStorage). DoD emphasizes encrypting all data at rest stored in virtual machine virtual hard drives, mass storage facilities at the block or file level, and database records where the mission owner does not have sole control over the database service. For cloud applications where encrypting data at rest with DoD key control is not possible, mission owners must perform a risk analysis with relevant data owners before transmitting data into a cloud service offering.

-> This article tracks Azure services that have received DoD IL5 PA and that require extra configuration options to meet IL5 isolation requirmements. Services with IL5 PA that do not require any extra configuration options are not mentioned in this article. For a list of services in scope for DoD IL5 PA, see **[Azure Government services by audit scope](./compliance/azure-services-in-fedramp-auditscope.md#azure-government-services-by-audit-scope).**

-### [Azure Cache for Redis](https://azure.microsoft.com/services/cache/)

-Azure Cache for Redis supports Impact Level 5 workloads in Azure Government with no extra configuration required.

-cloud: gov

-Azure Government is used by the US Department of Defense (DoD) entities to deploy a broad range of workloads and solutions. Some of these workloads can be subject to the DoD Cloud Computing [Security Requirements Guide](https://dl.dod.cyber.mil/wp-content/uploads/cloud/SRG/https://docsupdatetracker.net/index.html) (SRG) Impact Level 4 (IL4) and Impact Level 5 (IL5) restrictions. Azure Government was the first hyperscale cloud services platform to be awarded a DoD IL5 Provisional Authorization (PA) by the Defense Information Systems Agency (DISA). For more information about DISA and DoD IL5, see [Department of Defense (DoD) Impact Level 5](/azure/compliance/offerings/offering-dod-il5) compliance documentation.

-|US Gov Arizona </br> US Gov Texas </br> US Gov Virginia|FedRAMP High, DoD IL4, DoD IL5|138|

-|US DoD Central </br> US DoD East|DoD IL5|64|

-### What are the Azure Government DoD regions? 

-### What is the difference between Azure Government and the Azure Government DoD regions? 

-Azure provides [extensive support for tenant isolation](./azure-secure-isolation-guidance.md) across compute, storage, and networking services to segregate each customer's applications and data. This approach provides the scale and economic benefits of multi-tenant cloud services while rigorously helping prevent other customers from accessing your data or applications. Moreover, some Azure services deployed in Azure Government regions (US Gov Arizona, US Gov Texas, and US Gov Virginia) require extra configuration to meet DoD IL5 compute and storage isolation requirements, as explained in [Isolation guidelines for Impact Level 5 workloads](./documentation-government-impact-level-5.md).

-### What is IL5 data? 

-### What is the difference between IL4 and IL5 data?  

-### Do Azure Government regions support classified data such as IL6? 

-No. Azure Government regions support only unclassified data up to and including IL5. In contrast, IL6 data is defined as classified information up to Secret, and can be accommodated in [Azure Government Secret](https://azure.microsoft.com/global-infrastructure/government/national-security/).

-### What DoD organizations can use Azure Government? 

-### What services are part of your IL5 authorization scope? 

-For a complete list of services in scope for DoD IL5 PA in Azure Government regions (US Gov Arizona, US Gov Texas, and US Gov Virginia), see [Azure Government services by audit scope](./compliance/azure-services-in-fedramp-auditscope.md#azure-government-services-by-audit-scope). For a complete list of services in scope for DoD IL5 PA in Azure Government DoD regions (US DoD Central and US DoD East), see [Azure Government DoD regions IL5 audit scope](#azure-government-dod-regions-il5-audit-scope).

-description: Overview of Azure Government capabilities, including security and compliance capabilities applicable to federal, state, and local government organizations and their partners

-US government agencies or their partners interested in cloud services that meet government security and compliance requirements, can be confident that [Microsoft Azure Government](https://azure.microsoft.com/global-infrastructure/government/) provides world-class [security, protection, and compliance services](../compliance/index.yml). Azure Government delivers a dedicated cloud enabling government agencies and their partners to transform mission-critical workloads to the cloud. Azure Government services handle data that is subject to various government regulations and requirements, such as FedRAMP, DoD IL4 and IL5, CJIS, IRS 1075, ITAR, CMMC, NIST 800-171, and others. To provide you with the highest level of security and compliance, Azure Government uses physically isolated datacenters and networks located in the US only.

-Azure Government customers (US federal, state, and local government or their partners) are subject to validation of eligibility. If there is a question about eligibility for Azure Government, you should consult your account team. To sign up for trial, request your [trial subscription](https://azure.microsoft.com/global-infrastructure/government/request/?ReqType=Trial).

-Azure Government uses same underlying technologies as global Azure, which includes the core components of [Infrastructure-as-a-Service (IaaS)](https://azure.microsoft.com/overview/what-is-iaas/), [Platform-as-a-Service (PaaS)](https://azure.microsoft.com/overview/what-is-paas/), and [Software-as-a-Service (SaaS)](https://azure.microsoft.com/overview/what-is-saas/). Azure Government includes geo-synchronous data replication, auto scaling, network, storage, data management, identity management, and many other services. For service availability in Azure Government, see [Products available by region](https://azure.microsoft.com/global-infrastructure/services/?products=all&regions=non-regional,usgov-non-regional,us-dod-central,us-dod-east,usgov-arizona,usgov-texas,usgov-virginia). Services available in Azure Government are listed by category and whether they are Generally Available or available through Preview.

-There are some key differences that developers working on applications hosted in Azure Government must be aware of. For detailed information, see [Guidance for developers](./documentation-government-developer-guide.md). As a developer, you must know how to connect to Azure Government and once you connect you will mostly have the same experience as in global Azure. To see feature variations and usage limitations between Azure Government and global Azure, see [Compare Azure Government and global Azure](./compare-azure-government-global-azure.md) and click on individual service.

-Action Group is **Global** service, therefore there is no dependency on a specific Azure region. Requests from client can be processed by action group service in any region, which means, if one region of service is down, the traffic will be routed and process by other regions automatically. Being a *global service* it helps client not to worry about **disaster recovery**.

- c. **Details**: Based on the action type, enter a webhook URI, Azure app, ITSM connection, or Automation runbook. For ITSM Action, additionally specify **Work Item** and other fields your ITSM tool requires.

-1. If you close the window or select **Back to test setup** while the test is running, the test is stopped, and you will not get test results.

-To allow you to check the action groups are working as expected before you enable them in a production environment, you will get email and SMS alerts with the subject: Test.

-## Action specific information

-Send email to the members of the subscription's role. Email will only be sent to **Azure AD user** members of the role. Email will not be sent to Azure AD groups or service principals.

-If you are not receiving Notifications on your *primary email*, then you can try following steps:

-1. In Azure portal go to *Active Directory*.

- :::image type="content" source="media/action-groups/active-directory-user-profile.png" alt-text="Example on how to review user profile." border="true":::

- :::image type="content" source="media/action-groups/active-directory-add-primary-email.png" alt-text="Example on how to add primary email." border="true":::

-While setting up *Email ARM Role* you need to make sure below 3 conditions are met:

-When defining the Function action the the Function's httptrigger endpoint and access key are saved in the action definition. For example: `https://azfunctionurl.azurewebsites.net/api/httptrigger?code=this_is_access_key`. If you change the access key for the function you will need to remove and recreate the Function action in the Action Group.

-2. Enable Action Groups to use your Azure AD Application.

-# This is the Action Groups Azure AD AppId

- Write-Host "The Action Groups role is already defined.`n"

- $newRole = CreateAppRole -Name $actionGroupRoleName -Description "This is a role for Action Groups to join"

- # Create a service principal for the Action Groups Azure AD Application and add it to the role

-> If the Azure portal action group user interface does not let you select your country/region code, then SMS is not supported for your country/region. If your country/region code is not available, you can vote to have your country/region added at [user voice](https://feedback.azure.com/d365community/idea/e527eaa6-2025-ec11-b6e6-000d3a4f09d0). In the meantime, a work around is to have your action group call a webhook to a third-party SMS provider with support in your country/region.

-> If the Azure portal action group user interface does not let you select your country/region code, then voice calls are not supported for your country/region. If your country/region code is not available, you can vote to have your country/region added at [user voice](https://feedback.azure.com/d365community/idea/e527eaa6-2025-ec11-b6e6-000d3a4f09d0). In the meantime, a work around is to have your action group call a webhook to a third-party voice call provider with support in your country/region.

-> Only Country code supported today in Azure portal action group for Voice Notification is +1(United States).

-### Log alert for all resources logs (from API version `2020-08-01`)

-> Azure CLI support is only available for the scheduledQueryRules API version `2020-08-01` and later. Previous API versions can use the Azure Resource Manager CLI with templates as described below. If you use the legacy [Log Analytics Alert API](./api-alerts.md), you will need to switch to use CLI. [Learn more about switching](./alerts-log-api-switch.md).

- > Split by alert dimensions is only available for the current scheduledQueryRules API. If you use the legacy [Log Analytics Alert API](./api-alerts.md), you will need to switch. [Learn more about switching](./alerts-log-api-switch.md). Resource centric alerting at scale is only supported in the API version `2020-08-01` and above.

-> PowerShell is not currently supported in API version `2020-08-01`.

-> Split by alert dimensions is only available for the current scheduledQueryRules API. If you use the legacy [Log Analytics Alert API](./api-alerts.md), you will need to switch. [Learn more about switching](./alerts-log-api-switch.md). Resource centric alerting at scale is only supported in the API version `2020-08-01` and above.

-Stateful alerts feature is currently in preview in the Azure public cloud. You can set this using **Automatically resolve alerts** in the alert details section.

-While you can access Azure Monitor features from the **Monitor** menu in the Azure portal, Azure Monitor features can be access directly from the menu for different Azure services. While different Azure services may have slightly different experiences, they share a common set of monitoring options in the Azure portal. This includes **Overview** and **Activity log** and multiple options in the **Monitoring** section of the menu.

-The Azure virtual machines has the following requirements.

-> The Standard_B2s (2 cpus, 4 GiB memory) virtual machine size will support up to 100 connection strings. You shouldn't allocate more than 100 connections to a single virtual machine.

-### AzAcSnap v5.0.2 (Build_20210827.19086) - Patch update to v5.0.1

-AzAcSnap v5.0.2 (Build_20210827.19086) is provided as a patch update to the v5.0 branch with the following fixes and improvements:

- You might be using the Unix security style with a dual-protocol volume or LDAP with extended groups features in combination with large LDAP topologies. In this case, you might encounter "access denied" errors on Linux clients when interacting with such Azure NetApp Files volumes. You can now use the **LDAP Search Scope** option to specify the LDAP search scope to avoid "access denied" errors.

- In some cases, you might need to transition from one NFS protocol version to another. For instance, when you want an existing NFS NFSv3 volume to take advantage of NFSv4.1 features, you might want to convert the protocol version from NFSv3 to NFSv4.1. Likewise, you might want to convert an existing NFSv4.1 volume to NFSv3 for performance or simplicity reasons. Azure NetApp Files now provides an option that enables you to convert an NFS volume between NFSv3 and NFSv4.1, without requiring creation of new volumes and performing data copies. The conversion operations preserve the data and update the volume export policies as part of the operation.

- Azure NetApp Files provides ways to quickly restore data from snapshots (mainly at the volume level). See [How Azure NetApp Files snapshots work](snapshots-introduction.md). Options for user file self-restore are available via client-side data copy from the `~snapshot` (Windows) or `.snapshot` (Linux) folders. These operations require data (files and directories) to traverse the network twice (upon read and write). As such, the operations are not time and resource efficient, especially with large data sets. If you do not want to restore the entire snapshot to a new volume, revert a volume, or copy large files across the network, you now have the option to use the single-file snapshot restore feature to restore individual files directly on the service from a volume snapshot without requiring data copy using an external client. This approach will drastically reduce RTO and network resource usage when restoring large files.

- Application volume group (AVG) for SAP HANA enables you to deploy all volumes required to install and operate an SAP HANA database according to best practices, including the use of proximity placement group (PPG) with VMs to achieve automated, low-latency deployments. Application volume group for SAP HANA has implemented many technical improvements that simplify and standardize the entire process to help you streamline volume deployments for SAP HANA.

- Azure NetApp Files now supports **Standard** network features for volumes that customers have been asking for since the inception. This capability has been made possible by innovative hardware and software integration. Standard network features provide an enhanced virtual networking experience through a variety of features for a seamless and consistent experience along with security posture of all their workloads including Azure NetApp Files.

- Azure NetApp Files online snapshots are now enhanced with backup of snapshots. With this new backup capability, you can vault your Azure NetApp Files snapshots to cost efficient and ZRS-enabled Azure storage in a fast and cost-effective way, further protecting your data from accidental deletion. Azure NetApp Files backup extends ONTAP's built-in snapshot technology. When snapshots are vaulted to Azure storage, only changed blocks relative to previously vaulted snapshots are copied and stored, in an efficient format. Vaulted snapshots, however, are still represented in full and can be restored to a new volume individually and directly, eliminating the need for an iterative, full-incremental recovery process. This advanced technology minimizes the amount of data required to store to and retrieve from Azure storage, therefore saving data transfer and storage costs. It also shortens the backup vaulting time, so you can achieve a smaller Restore Point Objective (RPO). You can now choose to keep a minimum number of snapshots online on the Azure NetApp Files service for the most immediate, near-instantaneous data recovery needs, and build up a longer history of snapshots at a lower cost for long-term retention purposes in the Azure NetApp Files backup vault. See [How Azure NetApp Files snapshots work](snapshots-introduction.md) for details.

- The change ownership mode (`Chown Mode`) functionality enables you to set the ownership management capabilities of files and directories. You can specify or modify the setting under a volume's export policy. Two options for `Chown Mode` are available: *Restricted* (default), where only the root user can change the ownership of files and directories, and *Unrestricted*, where non-root users can change the ownership for files and directories that they own.

- These new features provide options to move access control of certain files and directories into the hands of the data user instead of the service operator.

- Azure NetApp Files already supports dual-protocol access to NFSv3 and SMB volumes as of [July 2020](#july-2020). You can now create an Azure NetApp Files volume that allows simultaneous dual-protocol (NFSv4.1 and SMB) access with support for LDAP user mapping. This feature enables use cases where you might have a Linux-based workload using NFSv4.1 for its access, and the workload generates and stores data in an Azure NetApp Files volume. At the same time, your staff might need to use Windows-based clients and software to analyze the newly generated data from the same Azure NetApp Files volume. The simultaneous dual-protocol access feature removes the need to copy the workload-generated data to a separate volume with a different protocol for post-analysis, saving storage cost and operational time. This feature is free of charge (normal Azure NetApp Files storage cost still applies) and is generally available. Learn more from the [simultaneous dual-protocol NFSv4.1/SMB access](create-volumes-dual-protocol.md) documentation.

- **NetApp add-ons** is the first category of add-ons introduced under **Storage service add-ons**. It provides access to **NetApp Cloud Compliance**. Clicking the **NetApp Cloud Compliance** tile opens a new browser and directs you to the add-on installation page.

- To date, Azure NetApp Files supports only a single Active Directory (AD) per region, where only a single NetApp account could be configured to access the AD. The new **Shared AD** feature enables all NetApp accounts to share an AD connection created by one of the NetApp accounts that belong to the same subscription and the same region. For example, using this feature, all NetApp accounts in the same subscription and region can use the common AD configuration to create an SMB volume, a NFSv4.1 Kerberos volume, or a dual-protocol volume. When you use this feature, the AD connection will be visible in all NetApp accounts that are under the same subscription and same region.

- By default, LDAP communications between client and server applications are not encrypted. This means that it is possible to use a network monitoring device or software to view the communications between an LDAP client and server computers. This scenario might be problematic in non-isolated or shared VNets when an LDAP simple bind is used, because the credentials (user name and password) used to bind the LDAP client to the LDAP server are passed over the network unencrypted. LDAP over TLS (also known as LDAPS) is a protocol that uses TLS to secure communication between LDAP clients and LDAP servers. Azure NetApp Files now supports the secure communication between an Active Directory Domain Server (ADDS) using LDAP over TLS. Azure NetApp Files can now use LDAP over TLS for setting up authenticated sessions between the Active Directory-integrated LDAP servers. You can enable the LDAP over TLS feature for NFS, SMB, and dual-protocol volumes. By default, LDAP over TLS is disabled on Azure NetApp Files.

- [FSLogix](/fslogix/overview) is a set of solutions that enhance, enable, and simplify non-persistent Windows computing environments. FSLogix solutions are appropriate for virtual environments in both public and private clouds. FSLogix solutions can also be used to create more portable computing sessions when you use physical devices. FSLogix can be used to provide dynamic access to persistent user profile containers stored on SMB shared networked storage, including Azure NetApp Files. To further enhance FSLogix resiliency to storage service maintenance events, Azure NetApp Files has extended support for SMB Transparent Failover via [SMB Continuous Availability (CA) shares on Azure NetApp Files](azure-netapp-files-create-volumes-smb.md#continuous-availability) for user profile containers. See Azure NetApp Files [Azure Virtual Desktop solutions](azure-netapp-files-solution-architectures.md#windows-virtual-desktop) for additional information.

- SMB Transparent Failover enables maintenance operations on the Azure NetApp Files service without interrupting connectivity to server applications storing and accessing data on SMB volumes. To support SMB Transparent Failover, Azure NetApp Files now supports the SMB Continuous Availability shares option for use with SQL Server applications over SMB running on Azure VMs. This feature is currently supported on Windows SQL Server. Linux SQL Server is not currently supported. Enabling this feature provides significant SQL Server performance improvements and scale and cost benefits for [Single Instance, Always-On Failover Cluster Instance and Always-On Availability Group deployments](azure-netapp-files-solution-architectures.md#sql-server). See [Benefits of using Azure NetApp Files for SQL Server deployment](solutions-benefits-azure-netapp-files-sql-server.md).

- In a cross-region replication relationship, a destination volume is automatically resized based on the size of the source volume. As such, you donΓÇÖt need to resize the destination volume separately. This automatic resizing behavior is applicable when the volumes are in an active replication relationship, or when replication peering is broken with the resync operation. For this feature to work, you need to ensure sufficient headroom in the capacity pools for both the source and the destination volumes.

- Azure NetApp Files now supports cross-region replication. With this new disaster recovery capability, you can replicate your Azure NetApp Files volumes from one Azure region to another in a fast and cost-effective way, protecting your data from unforeseeable regional failures. Azure NetApp Files cross region replication leverages NetApp SnapMirror® technology; only changed blocks are sent over the network in a compressed, efficient format. This proprietary technology minimizes the amount of data required to replicate across the regions, therefore saving data transfer costs. It also shortens the replication time, so you can achieve a smaller Restore Point Objective (RPO).

- You can now create an Azure NetApp Files volume that allows simultaneous dual-protocol (NFS v3 and SMB) access with support for LDAP user mapping. This feature enables use cases where you may have a Linux-based workload that generates and stores data in an Azure NetApp Files volume. At the same time, your staff needs to use Windows-based clients and software to analyze the newly generated data from the same Azure NetApp Files volume. The simultaneous dual-protocol access feature removes the need to copy the workload-generated data to a separate volume with a different protocol for post-analysis, saving storage cost, and operational time. This feature is free of charge (normal [Azure NetApp Files storage cost](https://azure.microsoft.com/pricing/details/netapp/) still applies) and is generally available. Learn more from the [simultaneous dual-protocol access documentation](create-volumes-dual-protocol.MD).

-description: Set up you Azure Percept DK and connect it to Azure IoT Hub

-This article shows how to request increases for VM-family vCPU quotas in the [Azure portal](https://portal.azure.com).

-When **Deny public network access** is set to **Yes**, only connections via private endpoints are allowed. When this setting is **No** (default), customers can connect by using either public endpoints (with IP-based firewall rules or with virtual-network-based firewall rules) or private endpoints (by using Azure Private Link), as outlined in the [network access overview](network-access-controls-overview.md).

- ![Diagram showing connectivity when Deny public network access is set to yes versus when Deny public network access is set to no.][2]

-Any attempts to set **Deny public network access** to **Yes** without any existing private endpoints at the logical server will fail with an error message similar to:

-```output

-Error 42102

-Unable to set Deny Public Network Access to Yes since there is no private endpoint enabled to access the server.

-Please set up private endpoints and retry the operation.

-```

-> [!NOTE]

-> To define virtual network firewall rules on a logical server that has already been configured with private endpoints, set **Deny public network access** to **No**.

-When **Deny public network access** is set to **Yes**, any attempts to add or update firewall rules will be denied with an error message similar to:

-| [Polybase](/sql/relational-databases/polybase/polybase-guide) | No. You can query data in the files placed on Azure Blob Storage using `OPENROWSET` function or use [an external table that references a serverless SQL pool in Synapse Analytics](https://devblogs.microsoft.com/azure-sql/read-azure-storage-files-using-synapse-sql-external-tables/). | No. You can query data in the files placed on Azure Blob Storage using `OPENROWSET` function, [a linked server that references a serverless SQL pool in Synapse Analytics](https://devblogs.microsoft.com/azure-sql/linked-server-to-synapse-sql-to-implement-polybase-like-scenarios-in-managed-instance/), or an external table (in public preview) that references [a serverless SQL pool in Synapse Analytics](https://devblogs.microsoft.com/azure-sql/read-azure-storage-files-using-synapse-sql-external-tables/) or SQL Server. |

-### Can I use Data Sync to sync between databases in SQL Database that belong to different subscriptions

-Yes. You can sync between databases that belong to resource groups owned by different subscriptions, even if the subscriptions belong to different tenants.

-### Can I use Data Sync to sync between databases in SQL Database that belong to different clouds (like Azure Public Cloud and Azure China 21Vianet)

-Yes. You can sync between databases that belong to different clouds. You have to use PowerShell to add the sync members that belong to the different subscriptions.

-| Afrikaans (South Africa) | `af-ZA` | Female | `af-ZA-AdriNeural` <sup>New</sup> | General |

-| Afrikaans (South Africa) | `af-ZA` | Male | `af-ZA-WillemNeural` <sup>New</sup> | General |

-| Amharic (Ethiopia) | `am-ET` | Female | `am-ET-MekdesNeural` <sup>New</sup> | General |

-| Amharic (Ethiopia) | `am-ET` | Male | `am-ET-AmehaNeural` <sup>New</sup> | General |

-| Arabic (Algeria) | `ar-DZ` | Female | `ar-DZ-AminaNeural` <sup>New</sup> | General |

-| Arabic (Algeria) | `ar-DZ` | Male | `ar-DZ-IsmaelNeural` <sup>New</sup> | General |

-| Arabic (Bahrain) | `ar-BH` | Female | `ar-BH-LailaNeural` <sup>New</sup> | General |

-| Arabic (Bahrain) | `ar-BH` | Male | `ar-BH-AliNeural` <sup>New</sup> | General |

-| Arabic (Iraq) | `ar-IQ` | Female | `ar-IQ-RanaNeural` <sup>New</sup> | General |

-| Arabic (Iraq) | `ar-IQ` | Male | `ar-IQ-BasselNeural` <sup>New</sup> | General |

-| Arabic (Jordan) | `ar-JO` | Female | `ar-JO-SanaNeural` <sup>New</sup> | General |

-| Arabic (Jordan) | `ar-JO` | Male | `ar-JO-TaimNeural` <sup>New</sup> | General |

-| Arabic (Kuwait) | `ar-KW` | Female | `ar-KW-NouraNeural` <sup>New</sup> | General |

-| Arabic (Kuwait) | `ar-KW` | Male | `ar-KW-FahedNeural` <sup>New</sup> | General |

-| Arabic (Libya) | `ar-LY` | Female | `ar-LY-ImanNeural` <sup>New</sup> | General |

-| Arabic (Libya) | `ar-LY` | Male | `ar-LY-OmarNeural` <sup>New</sup> | General |

-| Arabic (Morocco) | `ar-MA` | Female | `ar-MA-MounaNeural` <sup>New</sup> | General |

-| Arabic (Morocco) | `ar-MA` | Male | `ar-MA-JamalNeural` <sup>New</sup> | General |

-| Arabic (Qatar) | `ar-QA` | Female | `ar-QA-AmalNeural` <sup>New</sup> | General |

-| Arabic (Qatar) | `ar-QA` | Male | `ar-QA-MoazNeural` <sup>New</sup> | General |

-| Arabic (Syria) | `ar-SY` | Female | `ar-SY-AmanyNeural` <sup>New</sup> | General |

-| Arabic (Syria) | `ar-SY` | Male | `ar-SY-LaithNeural` <sup>New</sup> | General |

-| Arabic (Tunisia) | `ar-TN` | Female | `ar-TN-ReemNeural` <sup>New</sup> | General |

-| Arabic (Tunisia) | `ar-TN` | Male | `ar-TN-HediNeural` <sup>New</sup> | General |

-| Arabic (United Arab Emirates) | `ar-AE` | Female | `ar-AE-FatimaNeural` <sup>New</sup> | General |

-| Arabic (United Arab Emirates) | `ar-AE` | Male | `ar-AE-HamdanNeural` <sup>New</sup> | General |

-| Arabic (Yemen) | `ar-YE` | Female | `ar-YE-MaryamNeural` <sup>New</sup> | General |

-| Arabic (Yemen) | `ar-YE` | Male | `ar-YE-SalehNeural` <sup>New</sup> | General |

-| Bangla (Bangladesh) | `bn-BD` | Female | `bn-BD-NabanitaNeural` <sup>New</sup> | General |

-| Bangla (Bangladesh) | `bn-BD` | Male | `bn-BD-PradeepNeural` <sup>New</sup> | General |

-| Burmese (Myanmar) | `my-MM` | Female | `my-MM-NilarNeural` <sup>New</sup> | General |

-| Burmese (Myanmar) | `my-MM` | Male | `my-MM-ThihaNeural` <sup>New</sup> | General |

-| English (Hong Kong) | `en-HK` | Female | `en-HK-YanNeural` | General |

-| English (Hong Kong) | `en-HK` | Male | `en-HK-SamNeural` | General |

-| English (Kenya) | `en-KE` | Female | `en-KE-AsiliaNeural` <sup>New</sup> | General |

-| English (Kenya) | `en-KE` | Male | `en-KE-ChilembaNeural` <sup>New</sup> | General |

-| English (Nigeria) | `en-NG` | Female | `en-NG-EzinneNeural` <sup>New</sup> | General |

-| English (Nigeria) | `en-NG` | Male | `en-NG-AbeoNeural` <sup>New</sup> | General |

-| English (Tanzania) | `en-TZ` | Female | `en-TZ-ImaniNeural` <sup>New</sup> | General |

-| English (Tanzania) | `en-TZ` | Male | `en-TZ-ElimuNeural` <sup>New</sup> | General |

-| English (United Kingdom) | `en-GB` | Female | `en-GB-SoniaNeural` | General |

-| Filipino (Philippines) | `fil-PH` | Female | `fil-PH-BlessicaNeural` <sup>New</sup> | General |

-| Filipino (Philippines) | `fil-PH` | Male | `fil-PH-AngeloNeural` <sup>New</sup> | General |

-| Galician (Spain) | `gl-ES` | Female | `gl-ES-SabelaNeural` <sup>New</sup> | General |

-| Galician (Spain) | `gl-ES` | Male | `gl-ES-RoiNeural` <sup>New</sup> | General |

-| Javanese (Indonesia) | `jv-ID` | Female | `jv-ID-SitiNeural` <sup>New</sup> | General |

-| Javanese (Indonesia) | `jv-ID` | Male | `jv-ID-DimasNeural` <sup>New</sup> | General |

-| Khmer (Cambodia) | `km-KH` | Female | `km-KH-SreymomNeural` <sup>New</sup> | General |

-| Khmer (Cambodia) | `km-KH` | Male | `km-KH-PisethNeural` <sup>New</sup> | General |

-| Persian (Iran) | `fa-IR` | Female | `fa-IR-DilaraNeural` <sup>New</sup> | General |

-| Persian (Iran) | `fa-IR` | Male | `fa-IR-FaridNeural` <sup>New</sup> | General |

-| Somali (Somalia) | `so-SO` | Female | `so-SO-UbaxNeural` <sup>New</sup> | General |

-| Somali (Somalia) | `so-SO`| Male | `so-SO-MuuseNeural` <sup>New</sup> | General |

-| Spanish (Bolivia) | `es-BO` | Female | `es-BO-SofiaNeural` <sup>New</sup> | General |

-| Spanish (Bolivia) | `es-BO` | Male | `es-BO-MarceloNeural` <sup>New</sup> | General |

-| Spanish (Chile) | `es-CL` | Female | `es-CL-CatalinaNeural` <sup>New</sup> | General |

-| Spanish (Chile) | `es-CL` | Male | `es-CL-LorenzoNeural` <sup>New</sup> | General |

-| Spanish (Costa Rica) | `es-CR` | Female | `es-CR-MariaNeural` <sup>New</sup> | General |

-| Spanish (Costa Rica) | `es-CR` | Male | `es-CR-JuanNeural` <sup>New</sup> | General |

-| Spanish (Cuba) | `es-CU` | Female | `es-CU-BelkysNeural` <sup>New</sup> | General |

-| Spanish (Cuba) | `es-CU` | Male | `es-CU-ManuelNeural` <sup>New</sup> | General |

-| Spanish (Dominican Republic) | `es-DO` | Female | `es-DO-RamonaNeural` <sup>New</sup> | General |

-| Spanish (Dominican Republic) | `es-DO` | Male | `es-DO-EmilioNeural` <sup>New</sup> | General |

-| Spanish (Ecuador) | `es-EC` | Female | `es-EC-AndreaNeural` <sup>New</sup> | General |

-| Spanish (Ecuador) | `es-EC` | Male | `es-EC-LuisNeural` <sup>New</sup> | General |

-| Spanish (El Salvador) | `es-SV` | Female | `es-SV-LorenaNeural` <sup>New</sup> | General |

-| Spanish (El Salvador) | `es-SV` | Male | `es-SV-RodrigoNeural` <sup>New</sup> | General |

-| Spanish (Equatorial Guinea) | `es-GQ` | Female | `es-GQ-TeresaNeural` <sup>New</sup> | General |

-| Spanish (Equatorial Guinea) | `es-GQ` | Male | `es-GQ-JavierNeural` <sup>New</sup> | General |

-| Spanish (Guatemala) | `es-GT` | Female | `es-GT-MartaNeural` <sup>New</sup> | General |

-| Spanish (Guatemala) | `es-GT` | Male | `es-GT-AndresNeural` <sup>New</sup> | General |

-| Spanish (Honduras) | `es-HN` | Female | `es-HN-KarlaNeural` <sup>New</sup> | General |

-| Spanish (Honduras) | `es-HN` | Male | `es-HN-CarlosNeural` <sup>New</sup> | General |

-| Spanish (Nicaragua) | `es-NI` | Female | `es-NI-YolandaNeural` <sup>New</sup> | General |

-| Spanish (Nicaragua) | `es-NI` | Male | `es-NI-FedericoNeural` <sup>New</sup> | General |

-| Spanish (Panama) | `es-PA` | Female | `es-PA-MargaritaNeural` <sup>New</sup> | General |

-| Spanish (Panama) | `es-PA` | Male | `es-PA-RobertoNeural` <sup>New</sup> | General |

-| Spanish (Paraguay) | `es-PY` | Female | `es-PY-TaniaNeural` <sup>New</sup> | General |

-| Spanish (Paraguay) | `es-PY` | Male | `es-PY-MarioNeural` <sup>New</sup> | General |

-| Spanish (Peru) | `es-PE` | Female | `es-PE-CamilaNeural` <sup>New</sup> | General |

-| Spanish (Peru) | `es-PE` | Male | `es-PE-AlexNeural` <sup>New</sup> | General |

-| Spanish (Puerto Rico) | `es-PR` | Female | `es-PR-KarinaNeural` <sup>New</sup> | General |

-| Spanish (Puerto Rico) | `es-PR` | Male | `es-PR-VictorNeural` <sup>New</sup> | General |

-| Spanish (Uruguay) | `es-UY` | Female | `es-UY-ValentinaNeural` <sup>New</sup> | General |

-| Spanish (Uruguay) | `es-UY` | Male | `es-UY-MateoNeural` <sup>New</sup> | General |

-| Spanish (Venezuela) | `es-VE` | Female | `es-VE-PaolaNeural` <sup>New</sup> | General |

-| Spanish (Venezuela) | `es-VE` | Male | `es-VE-SebastianNeural` <sup>New</sup> | General |

-| Sundanese (Indonesia) | `su-ID` | Female | `su-ID-TutiNeural` <sup>New</sup> | General |

-| Sundanese (Indonesia) | `su-ID` | Male | `su-ID-JajangNeural` <sup>New</sup> | General |

-| Swahili (Tanzania) | `sw-TZ` | Female | `sw-TZ-RehemaNeural` <sup>New</sup> | General |

-| Swahili (Tanzania) | `sw-TZ` | Male | `sw-TZ-DaudiNeural` <sup>New</sup> | General |

-| Tamil (Singapore) | `ta-SG` | Female | `ta-SG-VenbaNeural` <sup>New</sup> | General |

-| Tamil (Singapore) | `ta-SG` | Male | `ta-SG-AnbuNeural` <sup>New</sup> | General |

-| Tamil (Sri Lanka) | `ta-LK` | Female | `ta-LK-SaranyaNeural` <sup>New</sup> | General |

-| Tamil (Sri Lanka) | `ta-LK` | Male | `ta-LK-KumarNeural` <sup>New</sup> | General |

-| Urdu (India) | `ur-IN` | Female | `ur-IN-GulNeural` <sup>New</sup> | General |

-| Urdu (India) | `ur-IN` | Male | `ur-IN-SalmanNeural` <sup>New</sup> | General |

-| Uzbek (Uzbekistan) | `uz-UZ` | Female | `uz-UZ-MadinaNeural` <sup>New</sup> | General |

-| Uzbek (Uzbekistan) | `uz-UZ` | Male | `uz-UZ-SardorNeural` <sup>New</sup> | General |

-| Zulu (South Africa) | `zu-ZA` | Female | `zu-ZA-ThandoNeural` <sup>New</sup> | General |

-| Zulu (South Africa) | `zu-ZA` | Male | `zu-ZA-ThembaNeural` <sup>New</sup> | General |

-| English (United States) | `en-US` | Female | `en-US-JennyMultilingualNeural` <sup>New</sup> | General，multilingual capabilities available [using SSML](speech-synthesis-markup.md#create-an-ssml-document) |

-| Chinese (Mandarin, Simplified) | `zh-CN` | Female | `zh-CN-XiaochenNeural` <sup>New</sup> | Optimized for spontaneous conversation |

-| Chinese (Mandarin, Simplified) | `zh-CN` | Female | `zh-CN-XiaoyanNeural` <sup>New</sup> | Optimized for customer service |

-| Chinese (Mandarin, Simplified) | `zh-CN` | Female | `zh-CN-XiaoshuangNeural` <sup>New</sup> | Child voice，optimized for child story and chat; multiple voice styles available [using SSML](speech-synthesis-markup.md#adjust-speaking-styles)|

-| Chinese (Mandarin, Simplified) | `zh-CN` | Female | `zh-CN-XiaoqiuNeural` <sup>New</sup> | Optimized for narrating |

-The question answering is continually improving the algorithms that extract question answer pairs from content and expanding the list of supported file and HTML formats. In general, FAQ pages should be stand-alone and not combined with other information. Product manuals should have clear headings and preferably an index page.

-### Good questions

-The best questions are simple. Consider the key word or phrase for each question then create a simple question for that key word or phrase.

-Add as many alternate questions as you need but keep the alterations simple. Adding more words or phrasings that are not part of the main goal of the question does not help the question answering algorithms find a match.

-### Add relevant alternative questions

-Your user may enter questions with either a conversational style of text, `How do I add a toner cartridge to my printer?` or a keyword search such as `toner cartridge`. The project should have both styles of questions in order to correctly return the best answer. If you aren't sure what keywords a customer is entering, use the [Azure Monitor](../how-to/analytics.md) data to analyze queries.

-### Good answers

-The best answers are simple answers but not too simple. Do not use answers such as `yes` and `no`. If your answer should link to other sources or provide a rich experience with media and links, use metadata tagging to distinguish between answers, then submit the query with metadata tags in the `strictFilters` property to get the correct answer version.

-|Answer|Follow-up prompts|

-|--|--|

-|Power down the Surface laptop with the power button on the keyboard.|* Key-combinations to sleep, shut down, and restart.<br>* How to hard-boot a Surface laptop<br>* How to change the BIOS for a Surface laptop<br>* Differences between sleep, shut down and restart|

-|Customer service is available via phone, Skype, and text message 24 hours a day.|* Contact information for sales.<br> * Office and store locations and hours for an in-person visit.<br> * Accessories for a Surface laptop.|

-### Searching questions only when answer is not relevant

-An example of this is when the knowledge base is a catalog of acronyms as questions with their full form as the answer. The value of the answer will not help to search for the appropriate answer.

-Make sure you are making the best use of the supported ranking features. Doing so will improve the likelihood that a given user query is answered with an appropriate response.

- |Hi|Yo<br>Hey there!|word-style or slang|

-Metadata adds the ability for a client application to know it should not take all answers but instead to narrow down the results of a user query based on metadata tags. The project/knowledge base answer can differ based on the metadata tag, even if the query is the same. For example, *"where is parking located"* can have a different answer if the location of the restaurant branch is different - that is, the metadata is *Location: Seattle* versus *Location: Redmond*.

-While there is some support for synonyms in the English language, use case-insensitive [word alterations](../tutorials/adding-synonyms.md) to add synonyms to keywords that take different forms.

-[Active learning](../tutorials/active-learning.md) does the best job of suggesting alternative questions when it has a wide range of quality and quantity of user-based queries. It is important to allow client-applications' user queries to participate in the active learning feedback loop without censorship. Once questions are suggested in the Language Studio portal, you can review and accept or reject those suggestions.

-|**Current supported platform**|[Python 2.7](https://www.python.org/downloads/) and [Python 3.6+](https://www.python.org/downloads/)|

-## Release history

-## 4.2.0

-**Bug fixes**

-**New features**

-## 4.1.0

-**New features**

-**Bug fixes**

-## 4.0.0

-* Stable release.

-* Added HttpLoggingPolicy to pipeline to enable passing in a custom logger for request and response headers.

-### 4.0.0b6

-* Fixed bug in synchronized_request for media APIs.

-* Removed MediaReadMode and MediaRequestTimeout from ConnectionPolicy as media requests are not supported.

-### 4.0.0b5

-* azure.cosmos.errors module deprecated and replaced by azure.cosmos.exceptions

-* The access condition parameters (`access_condition`, `if_match`, `if_none_match`) have been deprecated in favor of separate `match_condition` and `etag` parameters.

-* Fixed bug in routing map provider.

-* Added query Distinct, Offset, and Limit support.

-* Default document query execution context now used for

- * Change Feed queries

- * single partition queries (`partitionkey`, `partitionKeyRangeId` is present in options)

- * Non-document queries

-* Errors out for aggregates on multiple partitions, with enable cross partition query set to true, but no "value" keyword present

-* Hits query plan endpoint for other scenarios to fetch query plan

-* Added `__repr__` support for Cosmos entity objects.

-* Updated documentation.

-### 4.0.0b4

-* Added support for a `timeout` keyword argument to all operations to specify an absolute timeout in seconds within which the operation must be completed. If the timeout value is exceeded, a `azure.cosmos.errors.CosmosClientTimeoutError` will be raised.

-* Added a new `ConnectionRetryPolicy` to manage retry behavior during HTTP connection errors.

-* Added new constructor and per-operation configuration keyword arguments:

- * `retry_total` - Maximum retry attempts.

- * `retry_backoff_max` - Maximum retry wait time in seconds.

- * `retry_fixed_interval` - Fixed retry interval in milliseconds.

- * `retry_read` - Maximum number of sockets read retry attempts.

- * `retry_connect` - Maximum number of connection error retry attempts.

- * `retry_status` - Maximum number of retry attempts on error status codes.

- * `retry_on_status_codes` - A list of specific status codes to retry on.

- * `retry_backoff_factor` - Factor to calculate wait time between retry attempts.

-### 4.0.0b3

-* Added `create_database_if_not_exists()` and `create_container_if_not_exists` functionalities to CosmosClient and Database respectively.

-### 4.0.0b2

-* Version 4.0.0b2 is the second iteration in our efforts to build a client library that suits the Python language best practices.

-**Breaking changes**

-* The client connection has been adapted to consume the HTTP pipeline defined in `azure.core.pipeline`.

-* Interactive objects have now been renamed as proxies. This includes:

- * `Database` -> `DatabaseProxy`

- * `User` -> `UserProxy`

- * `Container` -> `ContainerProxy`

- * `Scripts` -> `ScriptsProxy`

-* The constructor of `CosmosClient` has been updated:

- * The `auth` parameter has been renamed to `credential` and will now take an authentication type directly. This means the primary key value, a dictionary of resource tokens, or a list of permissions can be passed in. However the old dictionary format is still supported.

- * The `connection_policy` parameter has been made a keyword only parameter, and while it is still supported, each of the individual attributes of the policy can now be passed in as explicit keyword arguments:

- * `request_timeout`

- * `media_request_timeout`

- * `connection_mode`

- * `media_read_mode`

- * `proxy_config`

- * `enable_endpoint_discovery`

- * `preferred_locations`

- * `multiple_write_locations`

-* A new constructor has been added to `CosmosClient` to enable creation via a connection string retrieved from the Azure portal.

-* Some `read_all` operations have been renamed to `list` operations:

- * `CosmosClient.read_all_databases` -> `CosmosClient.list_databases`

- * `Container.read_all_conflicts` -> `ContainerProxy.list_conflicts`

- * `Database.read_all_containers` -> `DatabaseProxy.list_containers`

- * `Database.read_all_users` -> `DatabaseProxy.list_users`

- * `User.read_all_permissions` -> `UserProxy.list_permissions`

-* All operations that take `request_options` or `feed_options` parameters, these have been moved to keyword only parameters. In addition, while these options dictionaries are still supported, each of the individual options within the dictionary are now supported as explicit keyword arguments.

-* The error hierarchy is now inherited from `azure.core.AzureError`:

- * `HTTPFailure` has been renamed to `CosmosHttpResponseError`

- * `JSONParseFailure` has been removed and replaced by `azure.core.DecodeError`

- * Added additional errors for specific response codes:

- * `CosmosResourceNotFoundError` for status 404

- * `CosmosResourceExistsError` for status 409

- * `CosmosAccessConditionFailedError` for status 412

-* `CosmosClient` can now be run in a context manager to handle closing the client connection.

-* Iterable responses (for example, query responses and list responses) are now of type `azure.core.paging.ItemPaged`. The method `fetch_next_block` has been replaced by a secondary iterator, accessed by the `by_page` method.

-### 4.0.0b1

-Version 4.0.0b1 is the first preview of our efforts to create a user-friendly client library that suits the Python language best practices. For more information about this, and preview releases of other Azure SDK libraries, please visit https://aka.ms/azure-sdk-preview1-python.

-**Breaking changes: New API design**

-* Operations are now scoped to a particular client:

- * `CosmosClient`: This client handles account-level operations. This includes managing service properties and listing the databases within an account.

- * `Database`: This client handles database-level operations. This includes creating and deleting containers, users, and stored procedures. It can be accessed from a cosmosClient` instance by name.

- * `Container`: This client handles operations for a particular container. This includes querying and inserting items and managing properties.

- * `User`: This client handles operations for a particular user. This includes adding and deleting permissions and managing user properties.

- These clients can be accessed by navigating down the client hierarchy using the `get_<child>_client` method. For full details on the new API, please see the [reference documentation](https://aka.ms/azsdk-python-cosmos-ref).

-* Clients are accessed by name rather than by ID. No need to concatenate strings to create links.

-* No more need to import types and methods from individual modules. The public API surface area is available directly in the `azure.cosmos` package.

-* Individual request properties can be provided as keyword arguments rather than constructing a separate `RequestOptions` instance.

-### 3.0.2

-* Added Support for MultiPolygon Datatype

-* Bug Fix in Session Read Retry Policy

-* Bug Fix for Incorrect padding issues while decoding base 64 strings

-### 3.0.1

-* Bug fix in LocationCache

-* Bug fix endpoint retry logic

-* Fixed documentation

-### 3.0.0

-* Multi-regions write support added

-* Naming changes

- * DocumentClient to CosmosClient

- * Collection to Container

- * Document to Item

- * Package name updated to "azure-cosmos"

- * Namespace updated to "azure.cosmos"

-### 2.3.3

-* Added support for proxy

-* Added support for reading change feed

-* Added support for collection quota headers

-* Bugfix for large session tokens issue

-* Bugfix for ReadMedia API

-* Bugfix in partition key range cache

-### 2.3.2

-* Added support for default retries on connection issues.

-### 2.3.1

-* Updated documentation to reference Azure Cosmos DB instead of Azure DocumentDB.

-### 2.3.0

-* This SDK version requires the latest version of Azure Cosmos DB Emulator available for download from https://aka.ms/cosmosdb-emulator.

-### 2.2.1

-* bugfix for aggregate dict

-* bugfix for trimming slashes in the resource link

-* tests for unicode encoding

-### 2.2.0

-* Added support for Request Unit per Minute (RU/m) feature.

-* Added support for a new consistency level called ConsistentPrefix.

-### 2.1.0

-* Added support for aggregation queries (COUNT, MIN, MAX, SUM, and AVG).

-* Added an option for disabling SSL verification when running against DocumentDB Emulator.

-* Removed the restriction of dependent requests module to be exactly 2.10.0.

-* Lowered minimum throughput on partitioned collections from 10,100 RU/s to 2500 RU/s.

-* Added support for enabling script logging during stored procedure execution.

-* REST API version bumped to '2017-01-19' with this release.

-### 2.0.1

-* Made editorial changes to documentation comments.

-### 2.0.0

-* Added support for Python 3.5.

-* Added support for connection pooling using the requests module.

-* Added support for session consistency.

-* Added support for TOP/ORDERBY queries for partitioned collections.

-### 1.9.0

-* Added retry policy support for throttled requests. (Throttled requests receive a request rate too large exception, error code 429.)

- By default, DocumentDB retries nine times for each request when error code 429 is encountered, honoring the retryAfter time in the response header.

- A fixed retry interval time can now be set as part of the RetryOptions property on the ConnectionPolicy object if you want to ignore the retryAfter time returned by server between the retries.

- DocumentDB now waits for a maximum of 30 seconds for each request that is being throttled (irrespective of retry count) and returns the response with error code 429.

- This time can also be overridden in the RetryOptions property on ConnectionPolicy object.

-* DocumentDB now returns x-ms-throttle-retry-count and x-ms-throttle-retry-wait-time-ms as the response headers in every request to denote the throttle retry count

- and the cumulative time the request waited between the retries.

-* Removed the RetryPolicy class and the corresponding property (retry_policy) exposed on the document_client class and instead introduced a RetryOptions class

- exposing the RetryOptions property on ConnectionPolicy class that can be used to override some of the default retry options.

-### 1.8.0

-* Added the support for geo-replicated database accounts.

-* Test fixes to move the global host and masterKey into the individual test classes.

-### 1.7.0

-* Added the support for Time To Live(TTL) feature for documents.

-### 1.6.1

-* Bug fixes related to server-side partitioning to allow special characters in partition key path.

-### 1.6.0

-* Added the support for server-side partitioned collections feature.

-### 1.5.0

-* Added Client-side sharding framework to the SDK. Implemented HashPartionResolver and RangePartitionResolver classes.

-### 1.4.2

-* Implement Upsert. New UpsertXXX methods added to support Upsert feature.

-* Implement ID-Based Routing. No public API changes, all changes internal.

-### 1.3.0

-* Release skipped to bring version number in alignment with other SDKs

-### 1.2.0

-* Supports GeoSpatial index.

-* Validates ID property for all resources. Ids for resources cannot contain `?, /, #, \\` characters or end with a space.

-* Adds new header "index transformation progress" to ResourceResponse.

-### 1.1.0

-* Implements V2 indexing policy

-### 1.0.1

-* Supports proxy connection

-| [4.2.0](#420) |Oct 09, 2020 | |

-| [4.1.0](#410) |Aug 10, 2020 | |

-| [4.0.0](#400) |May 20, 2020 | |

-| [3.0.2](#302) |Nov 15, 2018 | |

-| [3.0.1](#301) |Oct 04, 2018 | |

-| [2.3.3](#233) |Sept 08, 2018 |August 31, 2022 |

-| [2.3.2](#232) |May 08, 2018 |August 31, 2022 |

-| [2.3.1](#231) |December 21, 2017 |August 31, 2022 |

-| [2.3.0](#230) |November 10, 2017 |August 31, 2022 |

-| [2.2.1](#221) |Sep 29, 2017 |August 31, 2022 |

-| [2.2.0](#220) |May 10, 2017 |August 31, 2022 |

-| [2.1.0](#210) |May 01, 2017 |August 31, 2022 |

-| [2.0.1](#201) |October 30, 2016 |August 31, 2022 |

-| [2.0.0](#200) |September 29, 2016 |August 31, 2022 |

-| [1.9.0](#190) |July 07, 2016 |August 31, 2022 |

-| [1.8.0](#180) |June 14, 2016 |August 31, 2022 |

-| [1.7.0](#170) |April 26, 2016 |August 31, 2022 |

-| [1.6.1](#161) |April 08, 2016 |August 31, 2022 |

-| [1.6.0](#160) |March 29, 2016 |August 31, 2022 |

-| [1.5.0](#150) |January 03, 2016 |August 31, 2022 |

-| [1.4.2](#142) |October 06, 2015 |August 31, 2022 |

-| [1.2.0](#120) |August 06, 2015 |August 31, 2022 |

-| [1.1.0](#110) |July 09, 2015 |August 31, 2022 |

-| [1.0.1](#101) |May 25, 2015 |August 31, 2022 |

-To learn more about Cosmos DB, see [Microsoft Azure Cosmos DB](https://azure.microsoft.com/services/cosmos-db/) service page.

-Azure Reservations provide flexibility to help meet your evolving needs. You can exchange reservations for another reservation of the same type. For example, you can return multiple compute reservations including Azure Dedicated Host, Azure VMware Solution, and Azure Virtual Machines with each other all at once. In other words, reservation products are interchangeable with each other if they're the same type of reservation. In an other example, you can exchange multiple SQL database reservation types including Managed Instances and Elastic Pool with each other.

-Azure Databricks reserved capacity, Azure VMware solution by CloudSimple reservation, Azure Red Hat Open Shift reservation, Red Hat plans and, SUSE Linux plans aren't eligible for refunds.

-You can buy a reservation for JBoss EAP Integrated Support in the [Azure portal](https://portal.azure.com/#blade/Microsoft_Azure_Reservations/CreateBlade/referrer/documentation/filters/%7B%22reservedResourceType%22%3A%22VirtualMachines%22%7D). Pay for the reservation [up front or with monthly payments](prepare-buy-reservation.md)

-Save the workflow. Make a note of the Workflow URL for your new workflow then:

-See [Monitor pipelines using Azure Monitor](monitor-using-azure-monitor.md) article to learn about using Azure Monitor to monitor Data Factory pipelines.

- :::image type="content" source="media/solution-template-move-files/move-files1.png" alt-text="Create a new connection to the source":::

- :::image type="content" source="media/solution-template-move-files/move-files2.png" alt-text="Create a new connection to the destination":::

-You can also add standards such as:

-Standards are added to the dashboard as they become available.

-1. From the **Add regulatory compliance standards** page, you can search for any of the available standards, including:

- - **NIST SP 800-53**

- - **NIST SP 800 171**

- - **SWIFT CSP CSCF v2020**

- - **UKO and UK NHS**

- - **Canada Federal PBMM**

- - **HIPAA HITRUST**

- - **Azure CIS 1.3.0**

- - **CMMC Level 3**

- - **New Zealand ISM Restricted**

-You will be attaching Time Series Insights to Azure Digital Twins through the path below.

-## Create event hub namespace

-Before creating the event hubs, you'll first create an event hub namespace that will receive events from your Azure Digital Twins instance. You can either use the Azure CLI instructions below, or use the Azure portal by following [Create an event hub using Azure portal](../event-hubs/event-hubs-create.md). To see what regions support Event Hubs, visit [Azure products available by region](https://azure.microsoft.com/global-infrastructure/services/?products=event-hubs).

-az eventhubs eventhub create --name <name-for-your-twins-hub> --resource-group <your-resource-group> --namespace-name <your-Event-Hubs-namespace-from-above>

-az eventhubs eventhub authorization-rule create --rights Listen Send --name <name-for-your-twins-hub-auth-rule> --resource-group <your-resource-group> --namespace-name <your-Event-Hubs-namespace-from-earlier> --eventhub-name <your-twins-hub-from-above>

-az dt endpoint create eventhub --dt-name <your-Azure-Digital-Twins-instance-name> --eventhub-resource-group <your-resource-group> --eventhub-namespace <your-Event-Hubs-namespace-from-earlier> --eventhub <your-twins-hub-name-from-above> --eventhub-policy <your-twins-hub-auth-rule-from-earlier> --endpoint-name <name-for-your-twins-hub-endpoint>

-az dt route create --dt-name <your-Azure-Digital-Twins-instance-name> --endpoint-name <your-twins-hub-endpoint-from-above> --route-name <name-for-your-twins-hub-event-route> --filter "type = 'Microsoft.DigitalTwins.Twin.Update'"

-az eventhubs eventhub authorization-rule keys list --resource-group <your-resource-group> --namespace-name <your-Event-Hubs-namespace-from-earlier> --eventhub-name <your-twins-hub-from-above> --name <your-twins-hub-auth-rule-from-earlier>

-az eventhubs eventhub authorization-rule create --rights Listen Send --name <name-for-your-time-series-hub-auth-rule> --resource-group <your-resource-group> --namespace-name <your-Event-Hub-namespace-from-earlier> --eventhub-name <your-time-series-hub-name-from-above>

-In this section, you'll create an Azure function that will convert twin update events from their original form as JSON Patch documents to JSON objects, containing only updated and added values from your twins.

-In this section, you'll set up Time Series Insights instance to receive data from your time series hub. For more information about this process, see [Set up an Azure Time Series Insights Gen2 PAYG environment](../time-series-insights/tutorial-set-up-environment.md). Follow the steps below to create a time series insights environment.

-The self-serve experience to [create an Event Hubs cluster](event-hubs-dedicated-cluster-create-portal.md) through the [Azure portal](https://aka.ms/eventhubsclusterquickstart) is now in Preview. If you have any questions or need help with onboarding to Event Hubs Dedicated, contact the [Event Hubs team](mailto:askeventhubs@microsoft.com).

-If you want to upgrade your gateway to a more powerful gateway SKU, in most cases you can use the 'Resize-AzVirtualNetworkGateway' PowerShell cmdlet. This will work for upgrades to Standard and HighPerformance SKUs. However, to upgrade a non Availability Zone (AZ) gateway to the UltraPerformance SKU, you will need to recreate the gateway. Recreating a gateway incurs downtime. You do not need to delete and recreate the gateway to upgrade an AZ-enabled SKU.

- Get-AzVirtualNewtork @virtualnetwork

-# FQDN filtering in network rules (preview)

-> [!IMPORTANT]

-> FQDN filtering in network rules is currently in public preview.

-> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.

-> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).

-A fully qualified domain name (FQDN) represents a domain name of a host or IP address(es). You can use FQDNs in network rules based on DNS resolution in Azure Firewall and Firewall policy. This capability allows you to filter outbound traffic with any TCP/UDP protocol (including NTP, SSH, RDP, and more). You must enable DNS Proxy to use FQDNs in your network rules. For more information see [Azure Firewall policy DNS settings (preview)](dns-settings.md).

-In Azure Front Door [Rules Engine](front-door-rules-engine.md) and Azure Front Door Standard/Premium [Rule Set](standard-premium/concept-rule-set.md), a rule consists of none or some match conditions and an action. This article provides detailed descriptions of match conditions you can use in Azure Front Door Rule Set or Rules Engine.

-Use the **device type** match condition to identify requests that have been made from a mobile device or desktop device.

-| Case transform | `Lowercase`, `Uppercase` |

-| Case transform | `Lowercase`, `Uppercase` |

-| Case transform | `Lowercase`, `Uppercase` |

-| Case transform | `Lowercase`, `Uppercase` |

-| Case transform | `Lowercase`, `Uppercase` |

-| Case transform | `Lowercase`, `Uppercase` |

-| Case transform | `Lowercase`, `Uppercase` |

-| Case transform | `Lowercase`, `Uppercase` |

-Azure Front Door:

-Azure Front Door Standard/Premium:

-If your DNS server updates IP addresses, the associated NFS storage targets will become temporarily unavailable. Read how to update your custom DNS system IP addresses in [View and manage storage targets](manage-storage-targets.md#update-ip-address-specific-configurations-only).

-* **Resume** - Put a suspended storage target back into service

-Some storage targets also have a **Refresh DNS** option on this menu, which updates the storage target IP address from a custom DNS server or from an Azure Storage private endpoint.

-The **Flush** option tells the cache to immediately copy any changed files stored in the cache to the back-end storage system. For example, if your client machines are updating a particular file repeatedly, it's held in the cache for quicker access and not written to the long-term storage system for a period ranging from several minutes to more than an hour.

-### Update IP address (specific configurations only)

-In some situations, you might need to update your storage target's IP address. This can happen in two scenarios:

-* Your cache uses a custom DNS system instead of the default setup, and the network infrastructure has changed.

-* Your storage target uses a private endpoint to access Azure Blob or NFS-mounted blob storage, and you have updated the endpoint's configuration. (You should suspend storage targets before modifying their private endpoints, as described in the [prerequisites article](hpc-cache-prerequisites.md#work-with-private-endpoints).)

-With a custom DNS system, it's possible for your NFS storage target's IP address to change because of back-end DNS changes. If your DNS server changes the back-end storage system's IP address, Azure HPC Cache can lose access to the storage system. Ideally, you should work with the manager of your cache's custom DNS system to plan for any updates, because these changes make storage unavailable.

-If you use a private endpoint for secure storage access, the endpoint's IP addresses can change if you modify its configuration. If you need to change your private endpoint configuration, you should suspend the storage target (or targets) that use the endpoint, then refresh their IP addresses when you re-activate them. Read [Work with private endpoints](hpc-cache-prerequisites.md#work-with-private-endpoints) for additional information.

-If you need to update a storage target's IP address, use the **Storage targets** page. Click the **...** symbol in the right column to open the context menu. Choose **Refresh DNS** to query the custom DNS server or private endpoint for a new IP address.

-

-If successful, the update should take less than two minutes. You can only refresh one storage target at a time; wait for the previous operation to complete before trying another.

-* **Provisioning state** tells you whether the last action to add or edit the storage target was successful. This value is only updated if you edit the storage target.

-To change the percentage of messages to be traced from the cloud, you must update the device twin. You can accomplish this multiple ways including the JSON editor in portal and the IoT Hub service SDK. The following subsections provide examples.

-### Application Map

-To visualize the flow of IoT messages, set up the Application Map sample app. The sample app sends the distributed tracing logs to [Application Map](../azure-monitor/app/app-map.md) using an Azure Function and an Event Hub.

-> [!div class="button"]

-> <a href="https://github.com/Azure-Samples/e2e-diagnostic-provision-cli" target="_blank">Get the sample on GitHub</a>

-This image below shows distributed tracing in App Map with three routing endpoints:

-

-description: Learn how to set up a lab using Azure Lab Services to teach ethical hacking with VirtualBox.

-# Set up a lab to teach ethical hacking class with VirtualBox

-This article shows you how to set up a class that focuses on forensics side of ethical hacking. Penetration testing, a practice used by the ethical hacking community, occurs when someone attempts to gain access to the system or network to demonstrate vulnerabilities that a malicious attacker may exploit.

-In an ethical hacking class, students can learn modern techniques for defending against vulnerabilities. Each student gets a host virtual machine that has three nested virtual machines ΓÇô two virtual machine with [Seed](https://seedsecuritylabs.org/lab_env.html) image and another machine with [Kali Linux](https://www.kali.org/) image. The Seed virtual machine is used for exploiting purposes and Kali virtual machine provides access to the tools needed to execute forensic tasks.

-This article has two main sections. The first section covers how to create the classroom lab. The second section covers how to create the template machine with nested virtualization enabled and with the tools and images needed. In this case, two Seed images and a Kali Linux image on a machine that has [VirtualBox](https://www.virtualbox.org/) enabled to host the images.

-## Lab configuration

-To set up this lab, you need an Azure subscription to get started. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/) before you begin. Once you get an Azure subscription, you can either create a new lab account in Azure Lab Services or use an existing account. See the following tutorial for creating a new lab account: [Tutorial to setup a lab account](tutorial-setup-lab-account.md).

-Follow [this tutorial](tutorial-setup-classroom-lab.md) to create a new lab and then apply the following settings:

-| Virtual machine size | Image |

-| -- | -- |

-| Medium (Nested Virtualization) | Windows Server 2019 Datacenter |

-| Medium (Nested Virtualization) | Windows 10 |

-## Template machine

-After the template machine is created, start the machine and connect to it to complete the following three major tasks.

-1. Set up the machine to use [VirtualBox](https://www.virtualbox.org/) for nested virtual machines.

-2. Set up the [Kali](https://www.kali.org/) Linux image. Kali is a Linux distribution that includes tools for penetration testing and security auditing.

-3. Set up the Seed image. For this example, the [Seed](https://seedsecuritylabs.org/lab_env.html) image will be used. This image is created specifically for security training.

-The rest of this article will cover the manual steps to completing the tasks above.

-### Installing VirtualBox

-1. Download the [VirtualBox platform packages](https://www.virtualbox.org/wiki/Downloads) by selecting the Windows hosts option.

-2. Run the installation executable, and use the default options to complete the installation.

-### Set up a nested virtual machine with Kali Linux Image

-Kali is a Linux distribution that includes tools for penetration testing and security auditing.

-1. Download the ova image from [Kali Linux VM VirtualBox images](https://www.kali.org/get-kali/#kali-virtual-machines). We recommend the 32bit version, the 64bit version loads with errors. Remember the default username and password noted on the download page.

-2. Open VirtualBox Manager and [import the .ova image.](https://docs.oracle.com/cd/E26217_01/E26796/html/qs-import-vm.html). The Kali licensing agreement will need to be reviewed and accepted to continue.

->[!Note]

->- The VirtualBox default Ram for the Kali VM is 2 gig (2048), We recommend increasing the Ram to at least 4 gig (4096) or more depending on your needs. This can be changed by the students on their VMs. Changing the RAM size within VirtualBox does not change the Lab's VM size.

->- By default the Hard disk is set to an 80 gig limit, but is dynamically allocated. Lab Service machines are limited to 128 gigs of hard drive space, so be careful not to exceed this disk size.

->- The Kali image has USB 2.0 enable which requires [Oracle VM VirtualBox Extension Pack](https://www.virtualbox.org/wiki/Downloads) or set the USB controller to 1.0 under the USB tab.

-### Setup Seed lab images

-1. Download and extract the [SEED Labs VM image.](https://seedsecuritylabs.org/labsetup.html).

-2. Follow the directions to [create a VM in VirtualBox.](https://github.com/seed-labs/seed-labs/blob/master/manuals/vm/seedvm-manual.md)

- If you need multiple SEED VMs make copies of the .iso for each machine, using the same .iso for different machines will not work properly.

->[!IMPORTANT]

->Make sure that all the nested virtual machines are powered off before publishing the template. Leaving them powered on has had unexpected side effects, including damaging the virtual machines.

-## Cost

-If you would like to estimate the cost of this lab, you can use the following example:

-For a class of 25 students with 20 hours of scheduled class time and 10 hours of quota for homework or assignments, the price for the lab would be:

-25 students \* (20 + 10) hours \* 55 Lab Units \* 0.01 USD per hour = 412.50 USD

->[!IMPORTANT]

->Cost estimate is for example purposes only. For current details on pricing, see [Azure Lab Services Pricing](https://azure.microsoft.com/pricing/details/lab-services/).

-## Conclusion

-This article walked you through the steps to create a lab for ethical hacking class. It includes steps to set up nested virtualization for creating two virtual machines inside the host virtual machine for penetrating testing.

-## Next steps

-Next steps are common to setting up any lab:

-## Ethical hacking with VirtualBox

-You can set up a lab for a class that focuses on forensics side of ethical hacking. Penetration testing, a practice used by the ethical hacking community, occurs when someone attempts to gain access to the system or network to demonstrate vulnerabilities that a malicious attacker may exploit.

-In an ethical hacking class, students can learn modern techniques for defending against vulnerabilities. Each student gets a Windows Server host virtual machine that has two nested virtual machines ΓÇô one virtual machine with [SEED Labs](https://seedsecuritylabs.org/) image and another machine with [Kali Linux](https://www.kali.org/) image. The SEED virtual machine is used for exploiting purposes. The Kali Linux virtual machine provides access to the tools needed to execute forensic tasks.

-For detailed information on how to set up this type of lab, see [Set up a lab to teach ethical hacking class](class-type-ethical-hacking-virtualbox.md).

-Learn about machine learning fairness and how the [Fairlearn](https://fairlearn.github.io/) open-source Python package can help you assess and mitigate unfairness issues in machine learning models.

-## Responsible ML: Privacy and fairness

-description: Learn what responsible machine learning is and how to use it with Azure Machine Learning to understand models, protect data and control the model lifecycle.

-#Customer intent: As a data scientist, I want to know learn what responsible machine learning is and how I can use it in Azure Machine Learning.

-# What is responsible machine learning? (preview)

-In this article, you'll learn what responsible machine learning (ML) is and ways you can put it into practice with Azure Machine Learning.

-## Responsible machine learning principles

-Throughout the development and use of AI systems, trust must be at the core. Trust in the platform, process, and models. At Microsoft, responsible machine learning encompasses the following values and principles:

-* **.in.applicationinsights.azure.com**

-For more information on configuring Azure Firewall, see [Tutorial: Deploy and configure Azure Firewall using the Azure portal](../firewall/tutorial-firewall-deploy-portal.md).

-See the [SupportedModels reference documentation](/python/api/azureml-train-automl-client/azureml.train.automl.constants.supportedmodels) for a summarization of the supported models by task type.

-| **Responsible ML** | | | |

-description: In this tutorial, you build a machine learning pipeline to perform batch scoring. Focus on machine learning instead of infrastructure and automation.

-# Tutorial: Build an Azure Machine Learning pipeline for batch scoring

-In this advanced tutorial, you learn how to build an [Azure Machine Learning pipeline](concept-ml-pipelines.md) to run a batch scoring job. Machine learning pipelines optimize your workflow with speed, portability, and reuse, so you can focus on machine learning instead of infrastructure and automation. After you build and publish a pipeline, you configure a REST endpoint that you can use to trigger the pipeline from any HTTP library on any platform.

-The example uses a pretrained [Inception-V3](https://arxiv.org/abs/1512.00567) convolutional neural network model implemented in Tensorflow to classify unlabeled images.

-In this tutorial, you complete the following tasks:

-> [!div class="checklist"]

-> * Configure workspace

-> * Download and store sample data

-> * Create dataset objects to fetch and output data

-> * Download, prepare, and register the model in your workspace

-> * Provision compute targets and create a scoring script

-> * Use the `ParallelRunStep` class for async batch scoring

-> * Build, run, and publish a pipeline

-> * Enable a REST endpoint for the pipeline

-If you don't have an Azure subscription, create a free account before you begin. Try the [free or paid version of Azure Machine Learning](https://azure.microsoft.com/free/) today.

-## Prerequisites

-* Complete the [Quickstart: Get started with Azure Machine Learning](quickstart-create-resources.md) if you don't already have an Azure Machine Learning workspace or a compute instance.

-* After you complete the quickstart:

- 1. Select **Notebooks** in the studio.

- 1. Select the **Samples** tab.

- 1. Open the *tutorials/machine-learning-pipelines-advanced/tutorial-pipeline-batch-scoring-classification.ipynb* notebook.

-If you want to run the setup tutorial in your own [local environment](how-to-configure-environment.md#local), you can access the tutorial on [GitHub](https://github.com/Azure/MachineLearningNotebooks/tree/master/tutorials). Run `pip install azureml-sdk[notebooks] azureml-pipeline-core azureml-pipeline-steps pandas requests` to get the required packages.

-## Configure workspace and create a datastore

-Create a workspace object from the existing Azure Machine Learning workspace.

-```python

-from azureml.core import Workspace

-ws = Workspace.from_config()

-```

-> [!IMPORTANT]

-> This code snippet expects the workspace configuration to be saved in the current directory or its parent. For more information on creating a workspace, see [Create and manage Azure Machine Learning workspaces](how-to-manage-workspace.md). For more information on saving the configuration to file, see [Create a workspace configuration file](how-to-configure-environment.md#workspace).

-## Create a datastore for sample images

-On the `pipelinedata` account, get the ImageNet evaluation public data sample from the `sampledata` public blob container. Call `register_azure_blob_container()` to make the data available to the workspace under the name `images_datastore`. Then, set the workspace default datastore as the output datastore. Use the output datastore to score output in the pipeline.

-For more information on accessing data, see [How to access data](./how-to-access-data.md).

-```python

-from azureml.core.datastore import Datastore

-batchscore_blob = Datastore.register_azure_blob_container(ws,

- datastore_name="images_datastore",

- container_name="sampledata",

- account_name="pipelinedata",

- overwrite=True)

-def_data_store = ws.get_default_datastore()

-```

-## Create dataset objects

-When building pipelines, `Dataset` objects are used for reading data from workspace datastores, and `OutputFileDatasetConfig` objects are used for transferring intermediate data between pipeline steps.

-> [!Important]

-> The batch scoring example in this tutorial uses only one pipeline step. In use cases that have multiple steps, the typical flow will include these steps:

->

-> 1. Use `Dataset` objects as *inputs* to fetch raw data, perform some transformation, and then *output* with an `OutputFileDatasetConfig` object.

->

-> 2. Use the `OutputFileDatasetConfig` *output object* in the preceding step as an *input object*. Repeat it for subsequent steps.

-In this scenario, you create `Dataset` objects that correspond to the datastore directories for both the input images and the classification labels (y-test values). You also create an `OutputFileDatasetConfig` object for the batch scoring output data.

-```python

-from azureml.core.dataset import Dataset

-from azureml.data import OutputFileDatasetConfig

-input_images = Dataset.File.from_files((batchscore_blob, "batchscoring/images/"))

-label_ds = Dataset.File.from_files((batchscore_blob, "batchscoring/labels/"))

-output_dir = OutputFileDatasetConfig(name="scores")

-```

-Register the datasets to the workspace if you want to reuse it later. This step is optional.

-```python

-input_images = input_images.register(workspace = ws, name = "input_images")

-label_ds = label_ds.register(workspace = ws, name = "label_ds")

-```

-## Download and register the model

-Download the pretrained Tensorflow model to use it for batch scoring in a pipeline. First, create a local directory where you store the model. Then, download and extract the model.

-```python

-import os

-import tarfile

-import urllib.request

-if not os.path.isdir("models"):

- os.mkdir("models")

-

-response = urllib.request.urlretrieve("http://download.tensorflow.org/models/inception_v3_2016_08_28.tar.gz", "model.tar.gz")

-tar = tarfile.open("model.tar.gz", "r:gz")

-tar.extractall("models")

-```

-Next, register the model to your workspace, so you can easily retrieve the model in the pipeline process. In the `register()` static function, the `model_name` parameter is the key you use to locate your model throughout the SDK.

-```python

-from azureml.core.model import Model

-

-model = Model.register(model_path="models/inception_v3.ckpt",

- model_name="inception",

- tags={"pretrained": "inception"},

- description="Imagenet trained tensorflow inception",

- workspace=ws)

-```

-## Create and attach the remote compute target

-Machine learning pipelines can't be run locally, so you run them on cloud resources or *remote compute targets*. A remote compute target is a reusable virtual compute environment where you run experiments and machine learning workflows.

-Run the following code to create a GPU-enabled [`AmlCompute`](/python/api/azureml-core/azureml.core.compute.amlcompute.amlcompute) target, and then attach it to your workspace. For more information about compute targets, see the [conceptual article](./concept-compute-target.md).

-```python

-from azureml.core.compute import AmlCompute, ComputeTarget

-from azureml.exceptions import ComputeTargetException

-compute_name = "gpu-cluster"

-# checks to see if compute target already exists in workspace, else create it

-try:

- compute_target = ComputeTarget(workspace=ws, name=compute_name)

-except ComputeTargetException:

- config = AmlCompute.provisioning_configuration(vm_size="STANDARD_NC6",

- vm_priority="lowpriority",

- min_nodes=0,

- max_nodes=1)

- compute_target = ComputeTarget.create(workspace=ws, name=compute_name, provisioning_configuration=config)

- compute_target.wait_for_completion(show_output=True, min_node_count=None, timeout_in_minutes=20)

-```

-## Write a scoring script

-To do the scoring, create a batch scoring script called `batch_scoring.py`, and then write it to the current directory. The script takes input images, applies the classification model, and then outputs the predictions to a results file.

-The `batch_scoring.py` script takes the following parameters, which get passed from the `ParallelRunStep` you create later:

-The pipeline infrastructure uses the `ArgumentParser` class to pass parameters into pipeline steps. For example, in the following code, the first argument `--model_name` is given the property identifier `model_name`. In the `init()` function, `Model.get_model_path(args.model_name)` is used to access this property.

-```python

-%%writefile batch_scoring.py

-import os

-import argparse

-import datetime

-import time

-import tensorflow as tf

-from math import ceil

-import numpy as np

-import shutil

-from tensorflow.contrib.slim.python.slim.nets import inception_v3

-from azureml.core import Run

-from azureml.core.model import Model

-from azureml.core.dataset import Dataset

-slim = tf.contrib.slim

-image_size = 299

-num_channel = 3

-def get_class_label_dict(labels_dir):

- label = []

- labels_path = os.path.join(labels_dir, 'labels.txt')

- proto_as_ascii_lines = tf.gfile.GFile(labels_path).readlines()

- for l in proto_as_ascii_lines:

- label.append(l.rstrip())

- return label

-def init():

- global g_tf_sess, probabilities, label_dict, input_images

- parser = argparse.ArgumentParser(description="Start a tensorflow model serving")

- parser.add_argument('--model_name', dest="model_name", required=True)

- parser.add_argument('--labels_dir', dest="labels_dir", required=True)

- args, _ = parser.parse_known_args()

- label_dict = get_class_label_dict(args.labels_dir)

- classes_num = len(label_dict)

- with slim.arg_scope(inception_v3.inception_v3_arg_scope()):

- input_images = tf.placeholder(tf.float32, [1, image_size, image_size, num_channel])

- logits, _ = inception_v3.inception_v3(input_images,

- num_classes=classes_num,

- is_training=False)

- probabilities = tf.argmax(logits, 1)

- config = tf.ConfigProto()

- config.gpu_options.allow_growth = True

- g_tf_sess = tf.Session(config=config)

- g_tf_sess.run(tf.global_variables_initializer())

- g_tf_sess.run(tf.local_variables_initializer())

- model_path = Model.get_model_path(args.model_name)

- saver = tf.train.Saver()

- saver.restore(g_tf_sess, model_path)

-def file_to_tensor(file_path):

- image_string = tf.read_file(file_path)

- image = tf.image.decode_image(image_string, channels=3)

- image.set_shape([None, None, None])

- image = tf.image.resize_images(image, [image_size, image_size])

- image = tf.divide(tf.subtract(image, [0]), [255])

- image.set_shape([image_size, image_size, num_channel])

- return image

-def run(mini_batch):

- result_list = []

- for file_path in mini_batch:

- test_image = file_to_tensor(file_path)

- out = g_tf_sess.run(test_image)

- result = g_tf_sess.run(probabilities, feed_dict={input_images: [out]})

- result_list.append(os.path.basename(file_path) + ": " + label_dict[result[0]])

- return result_list

-```

-> [!TIP]

-> The pipeline in this tutorial has only one step, and it writes the output to a file. For multi-step pipelines, you also use `ArgumentParser` to define a directory to write output data for input to subsequent steps. For an example of passing data between multiple pipeline steps by using the `ArgumentParser` design pattern, see the [notebook](https://github.com/Azure/MachineLearningNotebooks/blob/master/how-to-use-azureml/machine-learning-pipelines/nyc-taxi-data-regression-model-building/nyc-taxi-data-regression-model-building.ipynb).

-## Build the pipeline

-Before you run the pipeline, create an object that defines the Python environment and creates the dependencies that your `batch_scoring.py` script requires. The main dependency required is Tensorflow, but you also install `azureml-core` and `azureml-dataprep[fuse]` which are required by ParallelRunStep. Also, specify Docker and Docker-GPU support.

-```python

-from azureml.core import Environment

-from azureml.core.conda_dependencies import CondaDependencies

-from azureml.core.runconfig import DEFAULT_GPU_IMAGE

-cd = CondaDependencies.create(pip_packages=["tensorflow-gpu==1.15.2",

- "azureml-core", "azureml-dataprep[fuse]"])

-env = Environment(name="parallelenv")

-env.python.conda_dependencies = cd

-env.docker.base_image = DEFAULT_GPU_IMAGE

-```

-### Create the configuration to wrap the script

-Create the pipeline step using the script, environment configuration, and parameters. Specify the compute target you already attached to your workspace.

-```python

-from azureml.pipeline.steps import ParallelRunConfig

-parallel_run_config = ParallelRunConfig(

- environment=env,

- entry_script="batch_scoring.py",

- source_directory=".",

- output_action="append_row",

- mini_batch_size="20",

- error_threshold=1,

- compute_target=compute_target,

- process_count_per_node=2,

- node_count=1

-)

-```

-### Create the pipeline step

-A pipeline step is an object that encapsulates everything you need to run a pipeline, including:

-* Environment and dependency settings

-* The compute resource to run the pipeline on

-* Input and output data, and any custom parameters

-* Reference to a script or SDK logic to run during the step

-Multiple classes inherit from the parent class [`PipelineStep`](/python/api/azureml-pipeline-core/azureml.pipeline.core.builder.pipelinestep). You can choose classes to use specific frameworks or stacks to build a step. In this example, you use the `ParallelRunStep` class to define your step logic by using a custom Python script. If an argument to your script is either an input to the step or an output of the step, the argument must be defined *both* in the `arguments` array *and* in either the `input` or the `output` parameter, respectively.

-In scenarios where there is more than one step, an object reference in the `outputs` array becomes available as an *input* for a subsequent pipeline step.

-```python

-from azureml.pipeline.steps import ParallelRunStep

-from datetime import datetime

-parallel_step_name = "batchscoring-" + datetime.now().strftime("%Y%m%d%H%M")

-label_config = label_ds.as_named_input("labels_input")

-batch_score_step = ParallelRunStep(

- name=parallel_step_name,

- inputs=[input_images.as_named_input("input_images")],

- output=output_dir,

- arguments=["--model_name", "inception",

- "--labels_dir", label_config],

- side_inputs=[label_config],

- parallel_run_config=parallel_run_config,

- allow_reuse=False

-)

-```

-For a list of all the classes you can use for different step types, see the [steps package](/python/api/azureml-pipeline-steps/azureml.pipeline.steps).

-## Submit the pipeline

-Now, run the pipeline. First, create a `Pipeline` object by using your workspace reference and the pipeline step you created. The `steps` parameter is an array of steps. In this case, there's only one step for batch scoring. To build pipelines that have multiple steps, place the steps in order in this array.

-Next, use the `Experiment.submit()` function to submit the pipeline for execution. The `wait_for_completion` function outputs logs during the pipeline build process. You can use the logs to see current progress.

-> [!IMPORTANT]

-> The first pipeline run takes roughly *15 minutes*. All dependencies must be downloaded, a Docker image is created, and the Python environment is provisioned and created. Running the pipeline again takes significantly less time because those resources are reused instead of created. However, total run time for the pipeline depends on the workload of your scripts and the processes that are running in each pipeline step.

-```python

-from azureml.core import Experiment

-from azureml.pipeline.core import Pipeline

-pipeline = Pipeline(workspace=ws, steps=[batch_score_step])

-pipeline_run = Experiment(ws, 'Tutorial-Batch-Scoring').submit(pipeline)

-pipeline_run.wait_for_completion(show_output=True)

-```

-### Download and review output

-Run the following code to download the output file that's created from the `batch_scoring.py` script. Then, explore the scoring results.

-```python

-import pandas as pd

-batch_run = next(pipeline_run.get_children())

-batch_output = batch_run.get_output_data("scores")

-batch_output.download(local_path="inception_results")

-for root, dirs, files in os.walk("inception_results"):

- for file in files:

- if file.endswith("parallel_run_step.txt"):

- result_file = os.path.join(root, file)

-df = pd.read_csv(result_file, delimiter=":", header=None)

-df.columns = ["Filename", "Prediction"]

-print("Prediction has ", df.shape[0], " rows")

-df.head(10)

-```

-## Publish and run from a REST endpoint

-Run the following code to publish the pipeline to your workspace. In your workspace in Azure Machine Learning studio, you can see metadata for the pipeline, including run history and durations. You can also run the pipeline manually from the studio.

-Publishing the pipeline enables a REST endpoint that you can use to run the pipeline from any HTTP library on any platform.

-```python

-published_pipeline = pipeline_run.publish_pipeline(

- name="Inception_v3_scoring", description="Batch scoring using Inception v3 model", version="1.0")

-published_pipeline

-```

-To run the pipeline from the REST endpoint, you need an OAuth2 Bearer-type authentication header. The following example uses interactive authentication (for illustration purposes), but for most production scenarios that require automated or headless authentication, use service principal authentication as [described in this article](how-to-setup-authentication.md).

-Service principal authentication involves creating an *App Registration* in *Azure Active Directory*. First, you generate a client secret, and then you grant your service principal *role access* to your machine learning workspace. Use the [`ServicePrincipalAuthentication`](/python/api/azureml-core/azureml.core.authentication.serviceprincipalauthentication) class to manage your authentication flow.

-Both [`InteractiveLoginAuthentication`](/python/api/azureml-core/azureml.core.authentication.interactiveloginauthentication) and `ServicePrincipalAuthentication` inherit from `AbstractAuthentication`. In both cases, use the [`get_authentication_header()`](/python/api/azureml-core/azureml.core.authentication.abstractauthentication#get-authentication-header--) function in the same way to fetch the header:

-```python

-from azureml.core.authentication import InteractiveLoginAuthentication

-interactive_auth = InteractiveLoginAuthentication()

-auth_header = interactive_auth.get_authentication_header()

-```

-Get the REST URL from the `endpoint` property of the published pipeline object. You can also find the REST URL in your workspace in Azure Machine Learning studio.

-Build an HTTP POST request to the endpoint. Specify your authentication header in the request. Add a JSON payload object that has the experiment name.

-Make the request to trigger the run. Include code to access the `Id` key from the response dictionary to get the value of the run ID.

-```python

-import requests

-rest_endpoint = published_pipeline.endpoint

-response = requests.post(rest_endpoint,

- headers=auth_header,

- json={"ExperimentName": "Tutorial-Batch-Scoring",

- "ParameterAssignments": {"process_count_per_node": 6}})

-run_id = response.json()["Id"]

-```

-Use the run ID to monitor the status of the new run. The new run takes another 10-15 min to finish.

-The new run will look similar to the pipeline you ran earlier in the tutorial. You can choose not to view the full output.

-```python

-from azureml.pipeline.core.run import PipelineRun

-from azureml.widgets import RunDetails

-published_pipeline_run = PipelineRun(ws.experiments["Tutorial-Batch-Scoring"], run_id)

-RunDetails(published_pipeline_run).show()

-```

-## Clean up resources

-Don't complete this section if you plan to run other Azure Machine Learning tutorials.

-### Stop the compute instance

-### Delete everything

-If you don't plan to use the resources you created, delete them, so you don't incur any charges:

-1. In the Azure portal, in the left menu, select **Resource groups**.

-1. In the list of resource groups, select the resource group you created.

-1. Select **Delete resource group**.

-1. Enter the resource group name. Then, select **Delete**.

-You can also keep the resource group but delete a single workspace. Display the workspace properties, and then select **Delete**.

-## Next steps

-In this machine learning pipelines tutorial, you did the following tasks:

-> [!div class="checklist"]

-> * Built a pipeline with environment dependencies to run on a remote GPU compute resource.

-> * Created a scoring script to run batch predictions by using a pretrained Tensorflow model.

-> * Published a pipeline and enabled it to be run from a REST endpoint.

-For more examples of how to build pipelines by using the machine learning SDK, see the [notebook repository](https://github.com/Azure/MachineLearningNotebooks/tree/master/how-to-use-azureml/machine-learning-pipelines).

-description: This article describes the requirements for publishing a managed application in Azure Marketplace.

-# Publishing guide for Azure managed applications

-An Azure *managed application* offer is one way to publish an Azure application in Azure Marketplace. Managed applications are transact offers that are deployed and billed through Azure Marketplace. The listing option that a user sees is *Get It Now*.

-This article explains the requirements for the managed application offer type.

-Use the managed application offer type under the following conditions:

->[!NOTE]

->For example, a partner can be a systems integrator or a managed service provider (MSP).

-## Managed application offer requirements

-|Requirements |Details |

-|||

-|An Azure subscription | Managed applications must be deployed to a customer's subscription, but they can be managed by a third party. |

-|Billing and metering | The resources are provided in a customer's Azure subscription. Azure Resources that use the pay-as-you-go payment model are transacted with the customer via Microsoft and billed via the customer's Azure subscription. <br><br> For bring-your-own-license Azure Resources, Microsoft bills any infrastructure costs that are incurred in the customer subscription, but you transact software licensing fees with the customer directly. |

-|An Azure Managed Application package | The configured Azure Resource Manager Template and Create UI Definition that will be used to deploy your application to the customer's subscription.<br><br>For more information about creating a Managed Application, see [Managed Application Overview](../azure-resource-manager/managed-applications/publish-service-catalog-app.md).|

-> [!NOTE]

-> Managed applications must be deployable through Azure Marketplace. If customer communication is a concern, reach out to interested customers after you've enabled lead sharing.

-> [!Note]

-> A Cloud Solution Provider (CSP) partner channel opt-in is now available. For more information about marketing your offer through the Microsoft CSP partner channels, see [Cloud Solution Providers](./cloud-solution-providers.md).

-## Next steps

-If you haven't already done so, learn how to [Grow your cloud business with Azure Marketplace](https://azuremarketplace.microsoft.com/sell).

-To register for and start working in Partner Center:

-description: This article describes the requirements for publishing solution templates on Azure Marketplace.

-# Publishing guide for Azure applications solution template offers

-This article explains the requirements for publishing solution template offers, which is one way to publish Azure application offers in Azure Marketplace. The solution template offer type requires an [Azure Resource Manager template (ARM template)](../azure-resource-manager/templates/overview.md) to automatically deploy your solution infrastructure.

-Use the Azure application *solution template* offer type under the following conditions:

-The listing option that a customer sees for this offer type is *Get It Now*.

-## Requirements for solution template offers

-| **Requirements** | **Details** |

-| | -- |

-|Billing and metering | Solution template offers are not transaction offers, but they can be used to deploy paid VM offers that are billed through the Microsoft commercial marketplace. The resources that the solution's ARM template deploys are set up in the customer's Azure subscription. Pay-as-you-go virtual machines are transacted with the customer via Microsoft and billed via the customer's Azure subscription.<br/> For bring-your-own-license (BYOL) billing, although Microsoft bills infrastructure costs that are incurred in the customer subscription, you transact your software licensing fees with the customer directly. |

-|Azure-compatible virtual hard disk (VHD) | VMs must be built on Windows or Linux. For more information, see: <ul> <li>[Create an Azure application offer](azure-app-offer-setup.md) (for Windows VHDs).</li><li>[Linux distributions endorsed on Azure](../virtual-machines/linux/endorsed-distros.md) (for Linux VHDs).</li></ul> |

-| Customer usage attribution | Enabling customer usage attribution is required on all solution templates that are published on Azure Marketplace. For more information about customer usage attribution and how to enable it, see [Azure partner customer usage attribution](./azure-partner-customer-usage-attribution.md). |

-| Use managed disks | [Managed disks](../virtual-machines/managed-disks-overview.md) is the default option for persisted disks of infrastructure as a service (IaaS) VMs in Azure. You must use managed disks in solution templates. <ul><li>To update your solution templates, follow the guidance in [Use managed disks in Azure Resource Manager templates](../virtual-machines/using-managed-disks-template-deployments.md), and use the provided [samples](https://github.com/Azure/azure-quickstart-templates).<br><br> </li><li>To publish the VHD as an image in Azure Marketplace, import the underlying VHD of the managed disks to a storage account by using either of the following methods:<ul><li>[Azure PowerShell](/previous-versions/azure/virtual-machines/scripts/virtual-machines-powershell-sample-copy-managed-disks-vhd) </li> <li> [The Azure CLI](/previous-versions/azure/virtual-machines/scripts/virtual-machines-cli-sample-copy-managed-disks-vhd) </li> </ul></ul> |

-## Next steps

-If you haven't already done so, learn how to [Grow your cloud business with Azure Marketplace](https://azuremarketplace.microsoft.com/sell).

-To register for and start working in Partner Center:

-> Flexible servers configured with zone-redundant high availability provide a recovery point objective (RPO) of **Zero** (no data loss.The recovery tome objective (RTO) is expected to be **less than 120s** in typical cases. However, depending on the activity in the primary database server at the time of the failover, the failover may take longer.

-description: This article explains how Azure Purview enables data discovery through search features.

-# Understand search features in Azure Purview

-This article provides an overview of the search experience in Azure Purview. Search is a core platform capability of Azure Purview, that powers the data discovery and data use governance experiences in an organization.

-## Search

-The Azure Purview search experience is powered by a managed search index. After a data source is registered with Azure Purview, its metadata is indexed by the search service to allow easy discovery. The index provides search relevance capabilities and completes search requests by querying millions of metadata assets. Search helps you to discover, understand, and use the data to get the most value out of it.

-The search experience in Azure Purview is a three stage process:

-1. The search box shows the history containing recently used keywords and assets.

-1. When you begin typing the keystrokes, the search suggests the matching keywords and assets.

-1. The search result page is shown with assets matching the keyword entered.

-## Reduce the time to discover data

-Data discovery is the first step for a data analytics or data governance workload for data consumers. Data discovery can be time consuming, because you may not know where to find the data that you want. Even after finding the data, you may have doubts about whether or not you can trust the data and take a dependencies on it.

-The goal of search in Azure Purview is to speed up the process of data discovery by providing gestures, to quickly find the data that matters.

-## Recent search and suggestions

-Many times, you may be working on multiple projects at the same time. To make it easier to resume previous projects, Azure Purview search provides the ability to see recent search keywords and suggestions. Also, you can manage the recent search history by selecting **View all** from the search box drop-down.

-## Filters

-Filters (also known as *facets*) are designed to complement searching. Filters are shown in the search result page. The filters in the search result page include classification, sensitivity label, data source, and owners. Users can select specific values in a filter to see only matching data assets, and restrict the search result to the matching assets.

-## Hit highlighting

-Matching keywords in the search result page are highlighted to make it easier to identify why a data asset was returned by search. The keyword match can occur in multiple fields such as data asset name, description, and owner.

-It may not be obvious why a data asset is included in search, even with hit highlighting enabled. All properties are searched by default. Therefore, a data asset might be returned because of a match on a column-level property. And because multiple users can annotate the data assets with their own classifications and descriptions, not all metadata is displayed in the list of search results.

-## Sort

-Users have two options to sort the search results. They can sort by the name of the asset or by default search relevance.

-## Search relevance

-Relevance is the default sort order in the search result page. The search relevance finds documents that include the search keyword (some or all). Assets that contain many instances of the search keyword are ranked higher. Also, custom scoring mechanisms are constantly tuned to improve search relevance.

-## Next steps

-* [Quickstart: Create an Azure Purview account in the Azure portal](create-catalog-portal.md)

-* [Quickstart: Create an Azure Purview account using Azure PowerShell/Azure CLI](create-catalog-powershell.md)

-* [Use the Azure Purview Studio](use-purview-studio.md)

-description: Step-by-step guide on how to integrate Azure Storage with Azure Purview to enable data owners to create access policies.

-# Dataset provisioning by data owner for Azure Storage (preview)

-This guide describes how a data owner can enable access to data stored in Azure Storage from Azure Purview. The Azure Purview policy authoring supports the following capabilities:

-> [!Note]

-> These capabilities are currently in preview. This preview version is provided without a service level agreement, and should not be used for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure

-Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).

-## Prerequisites

->[!IMPORTANT]

-> The access policy feature is only available on **new** Azure Purview and Azure Storage accounts.

-## Configuration

-### Register Azure Purview as a resource provider in other subscriptions

-Execute this step only if the Storage and Azure Purview accounts are in different subscriptions. Register Azure Purview as a resource provider in the subscription for the Azure Storage account by following this guide: [Azure resource providers and types](../azure-resource-manager/management/resource-providers-and-types.md)

-### Configure permissions for policy management actions

-#### Storage account permissions

-User needs to have **either one of these** role combinations in the Azure Storage account to be able to register it for *Data use Governance* in Azure Purview:

-

-You can follow this [guide to configure Azure RBAC permissions](../role-based-access-control/check-access.md)

-#### Azure Purview account permissions

->[!IMPORTANT]

-> - Policy operations are only supported at **root collection level** and not child collection level.

- - Register a source for *Data use governance*.

- - Publish a policy.

-Check the section on managing Azure Purview role assignments in this [guide](how-to-create-and-manage-collections.md).

->[!WARNING]

-> **Known issues** related to permissions

-> - In addition to Azure Purview *Policy authors* role, user requires *Directory Reader* permission in Azure Active Directory to create data owner policy. Learn more about permissions for [Azure AD Directory Reader](../active-directory/roles/permissions-reference.md#directory-readers)

-> - Azure Purview *Policy author* role is not sufficient to create policies. It also requires Azure Purview *Data source admin* role as well.

-### Register and scan data sources in Azure Purview

-Register and scan each data source with Azure Purview to later define access policies. You can follow these guides:

->[!Important]

-> Make sure you write down the **Name** you use when registering a source in Azure Purview. You will need it when you publish a policy. The recommended practice is to make the registered name exactly the same as the endpoint name (i.e. the Storage account name).

-If you would like to use a data source to create access policies in Azure Purview, enable it for access policy through the **Data use governance** toggle, as shown in the picture.

-

->[!Note]

-> - To disable a source for *Data use Governance*, remove it first from being bound (i.e. published) in any policy.

-> - While user needs to have both Azure Storage *Owner* and Azure Purview *Data source admin* to enable a source for *Data use governance*, any of those roles can independently disable it.

-> - Disabling *Data use governance* for a subscription will disable it also for all assets registered in that subscription.

-> [!WARNING]

-> **Known issues** related to source registration

-> - Moving data sources to a different resource group or subscription is not yet supported. If want to do that, de-register the data source in Azure Purview before moving it and then register it again after that happens.

-### Data use governance best practices

- - **Case 1** shows a valid configuration where a Storage account is registered in an Azure Purview account in the same subscription.

- - **Case 2** shows a valid configuration where a Storage account is registered in an Azure Purview account in a different subscription.

- - **Case 3** shows an invalid configuration arising because Storage accounts S3SA1 and S3SA2 both belong to Subscription 3, but are registered to different Azure Purview accounts. In that case, the *Data use governance* toggle will only work in the Azure Purview account that wins and registers a data source in that subscription first. The toggle will then be greyed out for the other data source.

-"

-## Policy authoring

-This section describes the steps for creating, updating, and publishing Azure Purview access policies.

-### Create a new policy

-This section describes the steps to create a new policy in Azure Purview.

-1. Log in to Azure Purview portal.

-1. Navigate to **Policy management** app using the left side panel.

-1. Select the **New Policy** button in the policy page.

- 

-1. The new policy page will appear. Enter the policy **Name** and **Description**.

-1. To add policy statements to the new policy, select the **New policy statement** button. This will bring up the policy statement builder.

- "

-1. Select the **Effect** button and choose *Allow* from the drop-down list.

-1. Select the **Action** button and choose *Read* or *Modify* from the drop-down list.

-1. Select the **Data Resources** button to bring up the options to provide the data asset path, which will open on the right.

-1. Use the **Assets** box if you scanned the data source, otherwise use the **Data sources** box above. Assuming the first, in the **Assets** box, enter the **Data Source Type** and select the **Name** of a previously registered data source.

- 

-1. Select the **Continue** button and transverse the hierarchy to select the folder or file. Then select the **Add** button. This will take you back to the policy editor.

- "

-1. Select the **Subjects** button and enter the subject identity as a principal, group, or MSI. Then select the **OK** button. This will take you back to the policy editor

- 

-1. Repeat the steps #5 to #11 to enter any more policy statements.

-1. Select the **Save** button to save the policy

-> [!Note]

-> - Policy statements set below container level on a Storage account are supported. If no access has been provided at Storage account level or container level, then the App that will execute the access will need to provide a fully qualified name (i.e., a direct absolute path) to the data object. The following documents show examples of how to do that:

-> - [*abfs* for ADLS Gen2](../hdinsight/hdinsight-hadoop-use-data-lake-storage-gen2.md#access-files-from-the-cluster)

-> - [*az storage blob download* for Blob Storage](../storage/blobs/storage-quickstart-blobs-cli.md#download-a-blob)

-> - Creating a policy at Storage account level will enable the Subjects to access system containers e.g., *$logs*. If this is undesired, first scan the data source and then create the policy at container or sub-container level.

-> [!WARNING]

-> **Known issues** related to Policy creation

-> - Do not create policy statements based on Azure Purview resource sets. Even if displayed in Azure Purview policy authoring UI, they are not yet enforced. Learn more about [resource sets](concept-resource-sets.md).

-> - Once subscription gets disabled for *Data use governance* any underlying assets that are enabled for *Data use governance* will be disabled, which is the right behavior. However, policy statements based on those assets will still be allowed after that.

-### Update or delete a policy

-Steps to create a new policy in Azure Purview are as follows.

-1. Log in to Azure Purview portal.

-1. Navigate to Azure Purview Policy management app using the left side panel.

- 

-1. The Policy portal will present the list of existing policies in Azure Purview. Select the policy that needs to be updated.

-1. The policy details page will appear, including Edit and Delete options. Select the **Edit** button, which brings up the policy statement builder for the statements in this policy. Now, any parts of the statements in this policy can be updated. To delete the policy, use the **Delete** button.

- 

-### Publish the policy

-A newly created policy is in the draft state. The process of publishing associates the new policy with one or more data sources under governance. This is called "binding" a policy to a data source.

-The steps to publish a policy are as follows

-1. Log in to Azure Purview portal.

-1. Navigate to the Azure Purview Policy management app using the left side panel.

- 

-1. The Policy portal will present the list of existing policies in Azure Purview. Locate the policy that needs to be published. Select the **Publish** button on the right top corner of the page.

- 

-1. A list of data sources is displayed. You can enter a name to filter the list. Then, select each data source where this policy is to be published and then select the **Publish** button.

- 

->[!Important]

-> - Publish is a background operation. It can take up to **2 hours** for the changes to be reflected in the data source.

-> - There is no need to publish a policy again for it to take effect if the data resource continues to be the same.

-## Additional information

-### Limits

-The limit for Azure Purview policies that can be enforced by Storage accounts is 100MB per subscription, which roughly equates to 5000 policies.

-### Policy action mapping

-This section contains a reference of how actions in Azure Purview data policies map to specific actions in Azure Storage.

-| **Azure Purview policy action** | **Data source specific actions** |

-||--|

-|||

-| *Read* |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/read |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read |

-|||

-| *Modify* |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/read |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/write |

-| |<sub>Microsoft.Storage/storageAccounts/blobServices/containers/delete |

-|||

-## Next steps

-Check the blog and demo related to the capabilities mentioned in this how-to guide

-* [What's New in Azure Purview at Microsoft Ignite 2021](https://techcommunity.microsoft.com/t5/azure-purview/what-s-new-in-azure-purview-at-microsoft-ignite-2021/ba-p/2915954)

-* [Demo of access policy for Azure Storage](https://www.youtube.com/watch?v=CFE8ltT19Ss)

-This article describes how to tag multiple glossary terms, classifications, owners and experts to a list of selected assets in a single action.

-## Add Assets to View selected list using search

-1. Search on the data asset you want to add to the list for bulk editing.

-1. In the search result page, hover on the asset you want to add to the bulk edit **View selected** list to see a checkbox.

- :::image type="content" source="media/how-to-bulk-edit-assets/asset-checkbox.png" alt-text="Screenshot of the checkbox.":::

-1. Select the checkbox to add it to the bulk edit **View selected** list. Once added, you will see the selected items icon at the bottom of the page.

- :::image type="content" source="media/how-to-bulk-edit-assets/selected-list.png" alt-text="Screenshot of the list.":::

-1. Repeat the above steps to add all the data assets to the list.

-## Add Assets to View selected list from asset detail page

-You can also add an asset to the bulk edit list in the asset detail page. Select the checkbox at the top right corner to add the asset to the bulk edit list.

- :::image type="content" source="media/how-to-bulk-edit-assets/asset-list.png" alt-text="Screenshot of the asset.":::

-## Bulk edit assets in the View selected list to add, replace, or remove glossary terms.

-1. When you're done with the identification of all the data assets which needs to be bulk-edited, Select **View selected** list from search results page or asset details page.

-1. Select **Bulk edit** to add, remove or replace glossary terms for all the selected assets.

-1. To add glossary terms, select Operation as **Add**. Select all the glossary terms you want to add in the New value. Select Apply when complete.

- - Add operation will append New value to the list of glossary terms already tagged to data assets.

-1. To replace glossary terms select Operation as **Replace with**. Select all the glossary terms you want to replace in the New value. Select Apply when complete.

- - Replace operation will replace all the glossary terms for selected data assets with the terms selected in New value.

-

-1. To remove glossary terms select Operation as **Remove**. Select Apply when complete.

- - Remove operation will remove all the glossary terms for selected data assets.

-

- :::image type="content" source="media/how-to-bulk-edit-assets/replace-list.png" alt-text="Screenshot of the remove terms.":::

-1. Repeat the above for classifications, owners and experts.

- :::image type="content" source="media/how-to-bulk-edit-assets/all-list.png" alt-text="Screenshot of the classifications and contacts.":::

-1. Once complete close the bulk edit blade by selecting **Close** or **Remove all and close**. Close will not remove the selected assets whereas remove all and close will remove all the selected assets.

- > [!Important]

- > The recommended number of assets for bulk edit are 25. Selecting more than 25 might cause performance issues.

- > The **View Selected** box will be visible only if there is at least one asset selected.

-Collections in Azure Purview can be used to organize assets and sources by your business's flow, but they are also the tool used to manage access across Azure Purview. This guide will take you through the creation and management of these collections, as well as cover steps about how to register sources and add assets into your collections.

-In order to create and manage collections in Azure Purview, you will need to be a **Collection Admin** within Azure Purview. We can check these permissions in the [Azure Purview Studio](https://web.purview.azure.com/resource/). You can find the studio by going to your Azure Purview resource in the [Azure portal](https://portal.azure.com), and selecting the Open Azure Purview Studio tile on the overview page.

-1. Select your root collection. This is the top collection in your collection list and will have the same name as your Azure Purview resource. In our example below, it is called Contoso Azure Purview. Alternatively, if collections already exist you can select any collection where you want to create a subcollection.

-1. To create a collection, you will need to be in the collection admin list under role assignments. If you created the Azure Purview resource, you should be listed as a collection admin under the root collection already. If not, you will need to contact the collection admin to grant you permission.

-You will need to be a collection admin in order to create a collection. If you are not sure, follow the [guide above](#check-permissions) to check permissions.

-1. Select **Edit** either from the collection detail page, or from the collection's drop down menu.

-You will need to be a collection admin in order to delete a collection. If you are not sure, follow the guide above to check permissions. Collection can be deleted only if no child collections, assets, data sources or scans are associated with it.

-The guide below will discuss the roles, how to manage them, and permissions inheritance.

-* **Collection admins** - can edit the collection, its details, and add subcollections. They can also add data curators, data readers, and other Azure Purview roles to a collection scope. Collection admins that are automatically inherited from a parent collection can't be removed.

-* **Data source admins** - can manage data sources and data scans.

-* **Data curators** - can perform create, read, modify, and delete actions on catalog data objects and establish relationships between objects.

-* **Data readers** - can access but not modify catalog data objects.

-The goal of search in Azure Purview is to speed up the process of data discovery to quickly find the data that matters. This article outlines how to search the Azure Purview data catalog to quickly find the data you are looking for.

-Once you click on the search bar, you will be presented with your search history and the assets recently accessed in the data catalog. This allows you to quickly pick up from previous data exploration that was already done.

-The Azure Purview relevance engine sorts through all the matches and ranks them based on what it believes their usefulness is to a user. For example, a table that matches on multiple keywords that a data steward has assigned glossary terms and given a description is likely going to be more interesting to a data consumer than a folder which has been unannotated. A large set of factors determine an assetΓÇÖs relevance score and the Azure Purview search team is constantly tuning the relevance engine to ensure the top search results have value to you.

-If the top results donΓÇÖt include the assets you are looking for, you can use the facets on the left-hand side to filter down by business metadata such glossary terms, classifications and the containing collection. If you are interested in a particular data source type such as Azure Data Lake Storage Gen2 or Azure SQL Database, you can use the source type pill filter to narrow down your search.

-> Search will only return assets in collections you are a data reader or curator for. For more information, see [create and manage Collections](how-to-create-and-manage-collections.md).

-Once you find the asset you are looking for, you can select it to view details such as schema, lineage, and a detailed classification list. To learn more about the asset details page, see [Manage catalog assets](catalog-asset-details.md).

-If you are looking to make changes to multiple assets returned by search, Azure Purview lets you modify glossary terms, classifications, and contacts in bulk. To learn more, see the [bulk edit assets](how-to-bulk-edit-assets.md) guide.

-While searching is great if you know what you are looking for, there are times where data consumers wish to explore the data available to them. The Azure Purview data catalog offers a browse experience that enables users to explore what data is available to them either by collection or through traversing the hierarchy of each data source in the catalog. For more information, see [browse the data catalog](how-to-browse-catalog.md).

-All search queries consist of keywords and operators. A keyword is a something that would be part of an asset's properties. Potential keywords can be a classification, glossary term, asset description, or an asset name. A keyword can be just a part of the property you are looking to match to. Use keywords and the operators listed below to ensure Azure Purview returns the assets you are looking for.

-Below are the operators that can be used to compose a search query. Operators can be combined as many times as need in a single query.

-| NOT | Specifies that an asset can't contain the keyword to the right of the NOT clause | The query `hive NOT database` returns assets that contain 'hive', but not 'database'. |

-| * | A wildcard that matches on one to many characters. Can't be the first character in a keyword. | The query `dat*` returns assets that have properties that start with 'dat' such as 'data' or 'database'. |

-| ? | A wildcard that matches on a single character. Can't be the first character in a keyword | The query `dat?` returns assets that have properties that start with 'dat' and are four letters such as 'date' or 'data'. |

-> [!Note]

-> Always specify Boolean operators (**AND**, **OR**, **NOT**) in all caps. Otherwise, case doesn't matter, nor do extra spaces.

-For more information, see our [introduction to search using Data Catalog](concept-search.md).

-Information that is associated with data assets in Azure Azure Purview, for example, glossary terms and classifications. After they are applied, annotations can be used within Search to aid in the discovery of the data assets. 

-Any single object that is stored within an Azure Azure Purview data catalog.

-A single Azure Azure Purview resource. 

-Follow this configuration guide to [enable access policies on an Azure Storage account](./how-to-access-policies-storage.md)

-Follow this configuration guide to [enable access policies on an Azure Storage account](./how-to-access-policies-storage.md)

-Cognitive Search uses API keys as its primary authentication methodology. For inbound requests to the search services, such as requests that create or query an index, API keys are the only authentication option you have. A few outbound request scenarios, particularly those involving indexers, can use Azure Active Directory identities and roles.

-API keys are generated when the service created. Passing a valid API key on the request is considered proof that the request is from an authorized client. There are two kinds of keys. *Admin keys* convey write permissions on the service and also grant rights to query system information. *Query keys* convey read permissions and can be used by apps to query a specific index.

-> Authorization for data plane operations using Azure role-based access control (RBAC) is now in preview. You can use this preview capability to supplement or replace API keys [with Azure roles for Search](search-security-rbac.md).

-This article walks you through the steps of setting up customer-managed key encryption. Here are some points to keep in mind:

-+ Customer-managed key encryption depends on [Azure Key Vault](../key-vault/general/overview.md). You can create your own encryption keys and store them in a key vault, or you can use Azure Key Vault APIs to generate encryption keys.

-+ Encryption with customer-managed keys is enabled when objects are created, on a per object basis. You cannot encrypt content that already exists.

-Encryption is computationally expensive to decrypt so only sensitive content is encrypted. This includes all content within indexes and synonym lists. For indexers, data sources, and skillsets, only those fields that store connection strings, descriptions, keys, and user inputs are encrypted. For example, skillsets have Cognitive Services keys, and some skills accept user inputs, such as custom entities. Keys and user inputs into skills are encrypted.

-Double encryption is an extension of customer-managed key (CMK) encryption. CMK encryption applies to long-term storage that is written to a data disk. The term *double encryption* refers to the additional encryption of short-term storage (of content written to temporary disks). There is no configuration required. When you apply CMK to objects, double encryption is invoked automatically.

-Although double encryption is available in all regions, support was rolled out in two phases. The first roll out was in August 2020 and included the five regions listed below. The second roll out in May 2021 extended double encryption to all remaining regions. If you are using CMK on an older service and want double encryption, you will need to create a new search service in your region of choice.

-+ [Azure Key Vault](../key-vault/general/overview.md), you can create key vault using [Azure portal](../key-vault//general/quick-create-portal.md), [Azure CLI](../key-vault//general/quick-create-cli.md), or [Azure PowerShell](../key-vault//general/quick-create-powershell.md). in the same subscription as Azure Cognitive Search. The key vault must have **soft-delete** and **purge protection** enabled.

-You should have a search application that can create the encrypted object. Into this code, you'll reference a key vault key and Active Directory registration information. This code could be a working app, or prototype code such as the [C# code sample DotNetHowToEncryptionUsingCMK](https://github.com/Azure-Samples/search-dotnet-getting-started/tree/master/DotNetHowToEncryptionUsingCMK).

-> You can use [Postman](search-get-started-rest.md), [Visual Studio Code](search-get-started-vs-code.md), or [Azure PowerShell](search-get-started-powershell.md), to call REST APIs that create indexes and synonym maps that include an encryption key parameter. You can also use Azure SDKs. Portal support for adding a key to indexes or synonym maps is not supported.

-If you are new to Azure Key Vault, review this quickstart to learn about basic tasks: [Set and retrieve a secret from Azure Key Vault using PowerShell](../key-vault/secrets/quick-create-powershell.md). Here are some tips for using Key Vault:

-+ Use as many key vaults as you need. Managed keys can be in different key vaults. A search service can have multiple encrypted objects, each one encrypted with a different customer-managed encryption keys, stored in different key vaults.

-+ Remember to follow strict procedures during routine rotation of key vault keys and Active Directory application secrets and registration. Always update all [encrypted content](search-security-get-encryption-keys.md) to use new secrets and keys before deleting the old ones. If you miss this step, your content cannot be decrypted.

-As a first step, make sure [soft-delete](../key-vault/general/soft-delete-overview.md) and [purge protection](../key-vault/general/soft-delete-overview.md#purge-protection) are enabled on the key vault. Due to the nature of encryption with customer-managed keys, no one can retrieve your data if your Azure Key vault key is deleted.

-To prevent data loss caused by accidental Key Vault key deletions, soft-delete and purge protection must be enabled on the key vault. Soft-delete is enabled by default, so you will only encounter issues if you purposely disabled it. Purge protection is not enabled by default, but it is required for customer-managed key encryption in Cognitive Search.

-### Using Azure portal

-### Using PowerShell

-### Using Azure CLI

-Skip key generation if you already have a key in Azure Key Vault that you want to use, but collect the Key Identifier. You will need this information when creating an encrypted object.

-1. Make a note of the Key Identifier ΓÇô it's composed of the **key value Uri**, the **key name**, and the **key version**. You will need the identifier to define an encrypted index in Azure Cognitive Search.

- :::image type="content" source="media/search-manage-encryption-keys/cmk-key-identifier.png" alt-text="Create a new key vault key":::

-## 3 - Register an app

- If you are stepping through the [DotNetHowToEncryptionUsingCMK](https://github.com/Azure-Samples/search-dotnet-getting-started/tree/master/DotNetHowToEncryptionUsingCMK), paste this value into the **appsettings.json** file.

-1. Copy the application secret. If you are stepping through the sample, paste this value into the **appsettings.json** file.

-In this step, you will create an access policy in Key Vault. This policy gives the application you registered with Active Directory permission to use your customer-managed key.

-Access permissions could be revoked at any given time. Once revoked, any search service index or synonym map that uses that key vault will become unusable. Restoring Key vault access permissions at a later time will restore index\synonym map access. For more information, see [Secure access to a key vault](../key-vault/general/security-features.md).

-1. Select the **Access policies** on the left, and select **+ Add Access Policy**.

- :::image type="content" source="media/search-manage-encryption-keys/cmk-add-access-policy.png" alt-text="Add new key vault access policy":::

-1. Choose **Select principal** and select the application you registered with Active Directory. You can search for it by name.

- :::image type="content" source="media/search-manage-encryption-keys/cmk-access-policy-permissions.png" alt-text="Select key vault access policy principal":::

-1. In **Key permissions**, choose *Get*, *Unwrap Key* and *Wrap Key*.

-1. In **Secret Permissions**, select *Get*.

-1. In **Certificate Permissions**, select *Get*.

-1. Select **Add** and then **Save**.

-> Encrypted content in Azure Cognitive Search is configured to use a specific Azure Key Vault key with a specific **version**. If you change the key or version, the index or synonym map must be updated to use the new key\version **before** deleting the previous key\version.

-> Failing to do so will render the index or synonym map unusable, at you won't be able to decrypt the content once key access is lost.

-To add a customer-managed key on an index, synonym map, indexer, data source, or skillset, use the [Search REST API](/rest/api/searchservice/) or an Azure SDK to create an object that has encryption enabled. The portal does not expose synonym maps or encryption properties.

-1. Insert the encryptionKey construct into the object definition. This property is a first-level property, on the same level as name and description. The [examples below](#rest-examples) show property placement. If you are using the same key vault, key, and version, you can paste in the same encryptionKey construct into each object for which you are enabling encryption.

- The following JSON example shows an encryptionKey, with placeholder values for Azure Key Vault and application registration in Azure Active Directory:

-> None of these key vault details are considered secret and could be easily retrieved by browsing to the relevant Azure Key Vault key page in Azure portal.

-This section shows the JSON for several objects so that you can see where to locate `encryptionKey` in an object definition.

-Create an encrypted synonym map using the [Create Synonym Map Azure Cognitive Search REST API](/rest/api/searchservice/create-synonym-map). Use the `encryptionKey` property to specify which encryption key to use.

-Create an encrypted data source using the [Create Data Source (REST API)](/rest/api/searchservice/create-data-source). Use the `encryptionKey` property to specify which encryption key to use.

-Create an encrypted skillset using the [Create Skillset REST API](/rest/api/searchservice/create-skillset). Use the `encryptionKey` property to specify which encryption key to use.

-Create an encrypted indexer using the [Create Indexer REST API](/rest/api/searchservice/create-indexer). Use the `encryptionKey` property to specify which encryption key to use.

-> While `encryptionKey` cannot be added to existing search indexes or synonym maps, it may be updated by providing different values for any of the three key vault details (for example, updating the key version).

-> Failing to do so will render the index or synonym map unusable, as it won't be able to decrypt the content once key access is lost. Although restoring Key vault access permissions at a later time will restore content access.

-## Simpler alternative: Trusted service

-Depending on tenant configuration and authentication requirements, you might be able to implement a simpler approach for accessing a key vault key. Instead of creating and using an Active Directory application, you can either make a search service a trusted service by enabling a system-managed identity for it or assign a user-assigned managed identity to your search service. You would then either use the trusted search service or user-assigned managed identity as a security principle, rather than an AD-registered application, to access the key vault key.

-Both of these approaches allow you to omit the steps for application registration and application secrets, and simplifies the encryption key definition.

-### System-assigned managed identity

-In general, a managed identity enables your search service to authenticate to Azure Key Vault without storing credentials (ApplicationID or ApplicationSecret) in code. The lifecycle of this type of managed identity is tied to the lifecycle of your search service, which can only have one managed identity. For more information about how managed identities work, see [What are managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).

-1. Make your search service a trusted service.

- 

-1. When setting up an access policy in Azure Key Vault, choose the trusted search service as the principle (instead of the AD-registered application). Assign the same permissions (multiple GETs, WRAP, UNWRAP) as instructed in the grant access key permissions step.

-1. Use a simplified construction of the `encryptionKey` that omits the Active Directory properties.

- ```json

- {

- "encryptionKey": {

- "keyVaultUri": "https://demokeyvault.vault.azure.net",

- "keyVaultKeyName": "myEncryptionKey",

- "keyVaultKeyVersion": "eaab6a663d59439ebb95ce2fe7d5f660"

- }

- }

- ```

-Conditions that will prevent you from adopting this simplified approach include:

-+ You cannot directly grant your search service access permissions to the Key vault (for example, if the search service is in a different Active Directory tenant than the Azure Key Vault).

-+ A single search service is required to host multiple encrypted indexes\synonym maps, each using a different key from a different Key vault, where each key vault must use **a different identity** for authentication. Because a search service can only have one managed identity, a requirement for multiple identities will disqualify the simplified approach for your scenario.

-### User-assigned managed identity (preview)

-> [!IMPORTANT]

-> User-assigned managed identity support is in public preview under [supplemental terms of use](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).

->

-> The REST API version 2021-04-30-Preview and [Management REST API 2021-04-01-Preview](/rest/api/searchmanagement/2021-04-01-preview/services/create-or-update) provide this feature.

-Assigning a user-assigned managed identity to your search service will enable your search service to authenticate to Azure Key Vault without storing credentials (ApplicationID or ApplicationSecret) in code. The lifecycle of this type of managed identity is independent to the lifecycle of your search service. For more information about how managed identities work, see [What are managed identities for Azure resources](../active-directory/managed-identities-azure-resources/overview.md).

-1. If you don't already have a user-assigned managed identity created, you'll need to create one. To create a user-assigned managed identity follow the below steps:

- 1. Sign into the [Azure portal](https://portal.azure.com/).

- 1. Select **+ Create a new resource**.

- 1. In the "Search services and marketplace" search bar, search for "User Assigned Managed Identity" and then select **Create**.

- 1. Give the identity a descriptive name.

-1. Next, assign the user-assigned managed identity to the search service. This can be done using the [2021-04-01-preview](/rest/api/searchmanagement/management-api-versions) management API.

- The identity property takes a type and one or more fully-qualified user-assigned identities:

-

- * **type** is the type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an identity created by the system and a set of user assigned identities. The type 'None' will remove all identities from the service.

- * **userAssignedIdentities** includes the details of the user assigned managed identity.

- * User-assigned managed identity format:

- * /subscriptions/**subscription ID**/resourcegroups/**resource group name**/providers/Microsoft.ManagedIdentity/userAssignedIdentities/**managed identity name**

-

- Example of how to assign a user-assigned managed identity to a search service:

-

- ```http

- PUT https://management.azure.com/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Search/searchServices/[search service name]?api-version=2021-04-01-preview

- Content-Type: application/json

- {

- "location": "[region]",

- "sku": {

- "name": "[sku]"

- },

- "properties": {

- "replicaCount": [replica count],

- "partitionCount": [partition count],

- "hostingMode": "default"

- },

- "identity": {

- "type": "UserAssigned",

- "userAssignedIdentities": {

- "/subscriptions/[subscription ID]/resourcegroups/[resource group name]/providers/Microsoft.ManagedIdentity/userAssignedIdentities/[managed identity name]": {}

- }

- }

- }

- ```

-1. When setting up an access policy in Azure Key Vault, choose the user-assigned managed identity as the principle (instead of the AD-registered application). Assign the same permissions (multiple GETs, WRAP, UNWRAP) as instructed in the grant access key permissions step.

-1. Use a simplified construction of the `encryptionKey` that omits the Active Directory properties and add an identity property. Make sure to use the 2021-04-30-preview REST API version.

- ```json

- {

- "encryptionKey": {

- "keyVaultUri": "https://[key vault name].vault.azure.net",

- "keyVaultKeyName": "[key vault key name]",

- "keyVaultKeyVersion": "[key vault key version]",

- "identity" : {

- "@odata.type": "#Microsoft.Azure.Search.DataUserAssignedIdentity",

- "userAssignedIdentity" : "/subscriptions/[subscription ID]/resourceGroups/[resource group name]/providers/Microsoft.ManagedIdentity/userAssignedIdentities/[managed identity name]"

- }

- }

- }

- ```

-With customer-managed key encryption, you will notice latency for both indexing and queries due to the extra encrypt/decrypt work. Azure Cognitive Search does not log encryption activity, but you can monitor key access through key vault logging. We recommend that you [enable logging](../key-vault/general/logging.md) as part of key vault configuration.

-For performance reasons, the search service caches the key for up to several hours. If you disable or delete the key without providing a new one, queries will continue to work on a temporary basis until the cache expires. However, once the search service cannot decrypt content, you will get this message: "Access forbidden. The query key used might have been revoked - please retry."

-If you are unfamiliar with Azure security architecture, review the [Azure Security documentation](../security/index.yml), and in particular, this article:

-## Data flow and points of entry

-Inbound requests range from creating objects, loading data, and querying. For inbound access to data and operations, you can implement a progression of security measures, starting with API keys on the request. You can then supplement with either inbound rules in an IP firewall, or create private endpoints that fully shield your service from the public internet. You can also use Azure Active Directory and role-based access control for data plane operations (currently in preview).

-Outbound requests can include both read and write operations. The primary agent of an outbound call is an indexer and constituent skillsets. For indexers, read operations include [document cracking](search-indexer-overview.md#document-cracking) and data ingestion. An indexer can also write to Azure Storage when creating knowledge stores, persisting cached enrichments, and persisting debug sessions. Finally, a skillset can also include custom skills that run external code, for example in Azure Functions or in a web app.

-Internal requests include service-to-service calls for tasks like diagnostic logging, encryption, authentication and authorization through Azure Active Directory, private endpoint connections, and requests made to Cognitive Services for built-in skills.

-## Network security

-### Encrypted data at rest

-### Service-managed keys

-### Customer-managed keys (CMK)

-### Double encryption

-Microsoft Sentinel *content* is Security Information and Event Management (SIEM) that assists customers with ingesting, monitoring, alerting, hunting, and more in Microsoft Sentinel. For example, Microsoft Sentinel content includes data connectors, parsers, workbooks, and analytics rules. For more information, see [About Microsoft Sentinel content and solutions](sentinel-solutions.md).

-You can find and query the data for each resource type using the table name that appears in the section for the resource's connector in the [Data connectors reference](data-connectors-reference.md) page.

-| Standard general-purpose v2 |  ² | ² |  ² |  ² |

-| Premium block blobs |  ²| ² |  ² |  ² |

-| [Logging in Azure Monitor](./monitor-blob-storage.md) |  ² |  ² |  ² |  ² |

-| [Logging in Azure Monitor](./monitor-blob-storage.md) |  ² |  ² |  ² |  ² |

-This article helps you unlock capabilities such as file and directory-level security and faster operations. These capabilities are widely used by big data analytics workloads and are referred to collectively as Azure Data Lake Storage Gen2.

-This article helps you unlock capabilities such as file and directory-level security and faster operations. These capabilities are widely used by big data analytics workloads and are referred to collectively as Azure Data Lake Storage Gen2. The most popular capabilities include:

-Next, use an Azure Monitor log query to determine whether a SAS has expired. Create a new query in your Log Analytics workspace, add the following query text, and press **Run**.

-```azurecli-interactive

- ```azurecli-interactive

-1. Select the **Set rotation reminder** link.

-```powershell

-$account = Set-AzStorageAccount -ResourceGroupName <resource-group> -Name `

- <storage-account-name> -KeyExpirationPeriodInDay <period-in-days>

-```

-You can also set the key expiration policy as you create a storage account by setting the `-KeyExpirationPeriodInDay` parameter of the [New-AzStorageAccount](/powershell/module/az.storage/new-azstorageaccount) command.

-To verify that the policy has been applied, check the storage account's `KeyPolicy` property.

-```powershell

-$account.KeyPolicy

-```

-The key expiration period appears in the console output.

-> [!div class="mx-imgBorder"]

-> 

-To find out when a key was created or last rotated, use the `KeyCreationTime` property.

-$account.KeyCreationTime

-The access key creation time for both access keys appears in the console output.

-> [!div class="mx-imgBorder"]

-> 

-To create a key expiration policy with Azure CLI, use the [az storage account update](/cli/azure/storage/account#az_storage_account_update) command and set the `--key-exp-days` parameter to the number of days an access key can be active before it should be rotated.

-```azurecli-interactive

-az storage account update \

- -n <storage-account-name> \

- -g <resource-group> --key-exp-days <period-in-days>

-You can also set the key expiration policy as you create a storage account by setting the `-KeyExpirationPeriodInDay` parameter of the [az storage account create](/cli/azure/storage/account#az_storage_account_create) command.

-```azurecli-interactive

- "keyExpirationPeriodInDays": 5

-To find out when a key was created or last rotated, use the [az storage account show](/cli/azure/storage/account#az_storage_account_show) command, and then use the string `keyCreationTime` for the `-query` parameter.

-```azurecli-interactive

-az storage account show \

- -n <storage-account-name> \

- -g <resource-group-name> \

- --query "keyCreationTime"

-```

-In the textbox labeled **Name** provide the name of the folder. Select **Add...** to add folder targets for this folder. The resulting **Add Folder Target** dialog provides a textbox labeled **Path to folder target** where you can provide the UNC path to the desired folder. Select **OK** on the **Add Folder Target** dialog. If you are adding a UNC path to an Azure file share, you may receive a message reporting that the server `storageaccount.file.core.windows.net` cannot be contacts. This is expected; select **Yes** to continue. Finally, select **OK** on the **New Folder** dialog to create the folder and folder targets.

-* For **Resource type**, select **Microsoft.Synapse/storageAccounts**.

-The user accounts must be [hybrid user identities](../active-directory/hybrid/whatis-hybrid-identity.md), which means you'll also need Active Directory Domain Services (AD DS) and Azure AD Connect. You must create these accounts in Active Directory and sync them to Azure AD.

- Connect-AzAccount

- $Subscription = $(Get-AzContext).Subscription.Id;

- $ApiVersion = '2021-04-01'

- $Uri = ('https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}?api-version={3}' -f $Subscription, $ResourceGroupName, $StorageAccountName, $ApiVersion);

- $json =

- @{properties=@{azureFilesIdentityBasedAuthentication=@{directoryServiceOptions="AADKERB"}}};

- $apiVersion = '1.6'

- $Uri = ('https://graph.windows.net/{0}/{1}/{2}?api-version={3}' -f $azureAdPrimaryDomain, 'servicePrincipals', $servicePrincipal.ObjectId, $apiVersion)

- $json = $json -replace "<STORAGEACCOUNTENDDATE>", $now.AddMonths(12).ToString("s")

-To prevent users from accessing the user profile of other users, you must also assign directory-level permissions. This section provides the steps to configure the permissions. Learn more about the recommended list of permissions for FSLogix profiles at [Configure the storage permissions for profile containers](/fslogix/fslogix-storage-config-ht)

-2. Set the storage account's ActiveDirectoryProperties to support the Shell experience. Because Azure AD doesn't currently support configuring ACLs in Shell, it must instead rely on Active Directory. To configure Shell, run the following command in PowerShell:

- function Set-StorageAccountAadKerberosADProperties {

- [CmdletBinding()]

- param(

- [Parameter(Mandatory=$true, Position=0)]

- [string]$ResourceGroupName,

- [Parameter(Mandatory=$true, Position=1)]

- [string]$StorageAccountName,

- [Parameter(Mandatory=$false, Position=2)]

- [string]$Domain

- )

- $AzContext = Get-AzContext;

- if ($null -eq $AzContext) {

- Write-Error "No Azure context found. Please run Connect-AzAccount and then retry." -ErrorAction Stop;

- }

-

- $AdModule = Get-Module ActiveDirectory;

- if ($null -eq $AdModule) {

- Write-Error "Please install and/or import the ActiveDirectory PowerShell module." -ErrorAction Stop;

- }

-

- if ([System.String]::IsNullOrEmpty($Domain)) {

- $domainInformation = Get-ADDomain

- $Domain = $domainInformation.DnsRoot

- } else {

- $domainInformation = Get-ADDomain -Server $Domain

- }

- $domainGuid = $domainInformation.ObjectGUID.ToString()

- $domainName = $domainInformation.DnsRoot

- $domainSid = $domainInformation.DomainSID.Value

- $forestName = $domainInformation.Forest

- $netBiosDomainName = $domainInformation.DnsRoot

- $azureStorageSid = $domainSid + "-123454321";

- Write-Verbose "Setting AD properties on $StorageAccountName in $ResourceGroupName : `

- $Subscription = $AzContext.Subscription.Id;

- $ApiVersion = '2021-04-01'

- $Uri = ('https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}?api-version={3}' `

- -f $Subscription, $ResourceGroupName, $StorageAccountName, $ApiVersion);

- $json=

- @{

- properties=

- @{azureFilesIdentityBasedAuthentication=

- @{directoryServiceOptions="AADKERB";

- activeDirectoryProperties=@{domainName="$($domainName)";

- netBiosDomainName="$($netBiosDomainName)";

- forestName="$($forestName)";

- domainGuid="$($domainGuid)";

- domainSid="$($domainSid)";

- azureStorageSid="$($azureStorageSid)"}

- }

- }

- };

- $json = $json | ConvertTo-Json -Depth 99

- $token = $(Get-AzAccessToken).Token

- $headers = @{ Authorization="Bearer $token" }

- try {

- Invoke-RestMethod -Uri $Uri -ContentType 'application/json' -Method PATCH -Headers $Headers -Body $json

- } catch {

- Write-Host $_.Exception.ToString()

- Write-Host "Error setting Storage Account AD properties. StatusCode:" $_.Exception.Response.StatusCode.value__

- Write-Host "Error setting Storage Account AD properties. StatusDescription:" $_.Exception.Response.StatusDescription

- Write-Error -Message "Caught exception setting Storage Account AD properties: $_" -ErrorAction Stop

- }

- }

- ```

-3. Call the function by running the following PowerShell cmdlets:

- ```powershell

- Connect-AzAccount

- Set-StorageAccountAadKerberosADProperties -ResourceGroupName $resourceGroupName -StorageAccountName $storageAccountName

-Finally, follow the instructions in [Configure directory and file level permissions](../storage/files/storage-files-identity-ad-ds-configure-permissions.md) to finish configuring your permissions with icacls or Windows Explorer.

-*Supported* features in DCasv5-series VMs:

-*Unsupported* features in DCasv5-series VMs:

- echo 'DefaultEnvironment="CLOUD_CFG=/etc/cloud/cloud.cfg.d/00-azure-swap.cfg"' >> /etc/systemd/system.conf

- - ["ephemeral0.2", "none", "swap", "sw", "0", "0"]

-You're now ready to use your CentOS Linux virtual hard disk to create new virtual machines in Azure. If this is the first time that you're uploading the .vhd file to Azure, see [Create a Linux VM from a custom disk](upload-vhd.md#option-1-upload-a-vhd).

- }

-The Azure VM Image Builder service doesn't store/process customer data outside regions that have strict single region data residency requirements when a customer requests a build in that region. In the event of a service outage for regions that have data residency requirements, you will need to create templates in a different region and geography.

-Distribution supports zone redundancy, VHDs are distributed to a Zone Redundant Storage account by default and the Azure Compute Gallery (formerly known as Shared Image Gallery) version will support a [ZRS storage type](../disks-redundancy.md#zone-redundant-storage-for-managed-disks) if specified.

-By default Image Builder will use a "Standard_D1_v2" build VM for Gen1 images and a "Standard_D2ds_v4" build VM for Gen2 images, this is built from the image you specify in the `source`. You can override this and may wish to do this for these reasons:

-4. Customize an Image that require specific hardware, e.g. for a GPU VM, you need a GPU VM size.

-If you do not specify any VNET properties, then Image Builder will create its own VNET, Public IP, and NSG. The Public IP is used for the service to communicate with the build VM, however if you do not want a Public IP or want Image Builder to have access to your existing VNET resources, such as configuration servers (DSC, Chef, Puppet, Ansible), file shares etc., then you can specify a VNET. For more information, review the [networking documentation](image-builder-networking.md), this is optional.

-Image Builder support for a User-Assigned Identity:

-* Does not support custom domain names

-The `source` section contains information about the source image that will be used by Image Builder. Image Builder currently only natively supports creating Hyper-V generation (Gen1) 1 images to the Azure Compute Gallery (SIG) or Managed Image. If you want to create Gen2 images, then you need to use a source Gen2 image, and distribute to VHD. After, you will then need to create a Managed Image from the VHD, and inject it into the SIG as a Gen2 image.

-The API requires a 'SourceType' that defines the source for the image build, currently there are three types:

-You can use 'latest' in the version, the version is evaluated when the image build takes place, not when the template is submitted. If you use this functionality with the Azure Compute Gallery destination, you can avoid resubmitting the template, and rerun the image build at intervals, so your images are recreated from the most recent images.

-If you do not specify a buildTimeoutInMinutes value, or set it to 0, this will use the default value. You can increase or decrease the value, up to the maximum of 960mins (16hrs). For Windows, we do not recommend setting this below 60 minutes. If you find you are hitting the timeout, review the [logs](image-builder-troubleshoot.md#customization-log), to see if the customization step is waiting on something like user input.

-If you find you need more time for customizations to complete, set this to what you think you need, with a little overhead. But, do not set it too high because you might have to wait for it to timeout before seeing an error.

-Image Builder supports multiple ΓÇÿcustomizersΓÇÖ. Customizers are functions that are used to customize your image, such as running scripts, or rebooting servers.

-There is no Linux Restart customizer, however, if you are installing drivers, or components that require a restart, you can install them and invoke a restart using the Shell customizer, there is a 20min SSH timeout to the build VM.

-By default, Azure Image Builder will also run ΓÇÿdeprovisionΓÇÖ code at the end of each image customization phase, to ΓÇÿgeneralizeΓÇÖ the image. Generalizing is a process where the image is set up so it can be reused to create multiple VMs. For Windows VMs, Azure Image Builder uses Sysprep. For Linux, Azure Image Builder runs ΓÇÿwaagent -deprovisionΓÇÖ.

-If you are migrating existing customization, and you are using different Sysprep/waagent commands, you can use the Image Builder generic commands, and if the VM creation fails, use your own Sysprep or waagent commands.

-If Azure Image Builder creates a Windows custom image successfully, and you create a VM from it, then find that the VM creation fails or does not complete successfully, you will need to review the Windows Server Sysprep documentation or raise a support request with the Windows Server Sysprep Customer Services Support team, who can troubleshoot and advise on the correct Sysprep usage.

-Image Builder will read these commands, these are written out to the AIB logs, ΓÇÿcustomization.logΓÇÖ. See [troubleshooting](image-builder-troubleshoot.md#customization-log) on how to collect logs.

-> The default AIB sysprep command does not include "/mode:vm", however this maybe required when create images that will have the HyperV role installed. If you need to add this command argument, you must override the sysprep command.

- `/subscriptions/<subscriptionID>/resourceGroups/<rgName>/providers/Microsoft.Compute/galleries/<sharedImageGalName>/images/<imageDefName>/versions/<version e.g. 1.1.1>`

-> If the image template and referenced `image definition` are not in the same location, you will see additional time to create images. Image Builder currently does not have a `location` parameter for the image version resource, we take it from its parent `image definition`. For example, if an image definition is in westus and you want the image version replicated to eastus, a blob is copied to westus, from this, an image version resource in westus is created, and then replicate to eastus. To avoid the additional replication time, ensure the `image definition` and image template are in the same location.

-Azure Image Builder does not allow the user to specify a storage account location, but you can query the status of the `runOutputs` to get the location.

-If you are running an image build that you believe is incorrect, waiting for user input, or you feel will never complete successfully, then you can cancel the build.

-The build can be canceled any time. If the distribution phase has started you can still cancel, but you will need to clean up any images that may not be completed. The cancel command does not wait for cancel to complete, please monitor `lastrunstatus.runstate` for canceling progress, using these status [commands](image-builder-troubleshoot.md#customization-log).

- - ["ephemeral0.2", "none", "swap", "sw", "0", "0"]

-[Nested Virtualization](/virtualization/hyper-v-on-windows/user-guide/nested-virtualization): Supported <br>

-Nvidia NVLink Interconnect: Not Supported

-New-AzResourceGroup -Name myResourceGroup -Location EastUS

- -ResourceGroupName "myResourceGroup" `

- -Name "myVM" `

- -Location "East US" `

- -VirtualNetworkName "myVnet" `

- -SubnetName "mySubnet" `

- -SecurityGroupName "myNetworkSecurityGroup" `

- -PublicIpAddressName "myPublicIpAddress" `

-```powershell

-Get-AzPublicIpAddress -ResourceGroupName "myResourceGroup" | Select "IpAddress"

-Use the following command to create a remote desktop session from your local computer. Replace the IP address with the public IP address of your VM.

-Install-WindowsFeature -name Web-Server -IncludeManagementTools

-In this quickstart, you deployed a simple virtual machine, open a network port for web traffic, and installed a basic web server. To learn more about Azure virtual machines, continue to the tutorial for Windows VMs.

-* Three remote user connections connecting to the Azure virtual hub P2S gateway would cost $0.03*3/hr.