-| [Language service][ta-containers-cner] | **Custom Named Entity Recognition** ([image](https://mcr.microsoft.com/product/azure-cognitive-services/textanalytics/customner/about))| Extract named entities from text, using a custom model you create using your data. | Preview |

- "sentenceCount": 1

-If you don't specify `sentenceCount`, the model determines the summary length. Note that `sentenceCount` is the approximation of the sentence count of the output summary, range 1 to 20.

-## Query based extractive summarization

-The query-based extractive summarization API is an extension to the existing document summarization API.

-The biggest difference is a new `query` field in the request body (under `tasks` > `parameters` > `query`). Additionally, there's a new way to specify the preferred `summaryLength` in "buckets" of short/medium/long, which we recommend using instead of `sentenceCount`. Below is an example request:

- "sentenceCount": 1

-## Query based abstractive summarization

-The query-based abstractive summarization API is an extension to the existing document summarization API.

-The biggest difference is a new `query` field in the request body (under `tasks` > `parameters` > `query`). Additionally, there's a new way to specify the preferred `summaryLength` in "buckets" of short/medium/long, which we recommend using instead of `sentenceCount`. Below is an example request:

-```bash

-curl -i -X POST https://<your-language-resource-endpoint>/language/analyze-text/jobs?api-version=2023-11-15-preview \

-'

-{

- "displayName": "Document Abstractive Summarization Task Example",

- "analysisInput": {

- "documents": [

- {

- "id": "1",

- "language": "en",

- "text": "At Microsoft, we have been on a quest to advance AI beyond existing techniques, by taking a more holistic, human-centric approach to learning and understanding. As Chief Technology Officer of Azure AI services, I have been working with a team of amazing scientists and engineers to turn this quest into a reality. In my role, I enjoy a unique perspective in viewing the relationship among three attributes of human cognition: monolingual text (X), audio or visual sensory signals, (Y) and multilingual (Z). At the intersection of all three, thereΓÇÖs magicΓÇöwhat we call XYZ-code as illustrated in Figure 1ΓÇöa joint representation to create more powerful AI that can speak, hear, see, and understand humans better. We believe XYZ-code enables us to fulfill our long-term vision: cross-domain transfer learning, spanning modalities and languages. The goal is to have pretrained models that can jointly learn representations to support a broad range of downstream AI tasks, much in the way humans do today. Over the past five years, we have achieved human performance on benchmarks in conversational speech recognition, machine translation, conversational question answering, machine reading comprehension, and image captioning. These five breakthroughs provided us with strong signals toward our more ambitious aspiration to produce a leap in AI capabilities, achieving multi-sensory and multilingual learning that is closer in line with how humans learn and understand. I believe the joint XYZ-code is a foundational component of this aspiration, if grounded with external knowledge sources in the downstream AI tasks."

- }

- ]

- },

- "tasks": [

- {

- "kind": "AbstractiveSummarization",

- "taskName": "Document Abstractive Summarization Task 1",

- "parameters": {

- "query": "XYZ-code",

- "summaryLength": "short"

- }

- }

- ]

-}

-'

-```

-|Region |Document abstractive summarization|Conversation issue and resolution summarization|Conversation narrative summarization with chapters|Custom summarization|

-||-|--|--|--|

-|Azure Gov Virginia|&#9989; |&#9989; |&#9989; |&#10060; |

-|North Europe |&#9989; |&#9989; |&#9989; |&#10060; |

-|East US |&#9989; |&#9989; |&#9989; |&#9989; |

-|UK South |&#9989; |&#9989; |&#9989; |&#10060; |

-|Southeast Asia |&#9989; |&#9989; |&#9989; |&#10060; |

-|Central Sweden |&#9989; |&#10060; |&#10060; |&#10060; |

-| [GPT-4](#gpt-4) | A set of models that improve on GPT-3.5 and can understand and generate natural language and code. |

-## GPT-4

-### GPT-4 models

-| | :: | :: |

-> Regions where GPT-4 is listed as available have access to both the 8K and 32K versions of the model

-### GPT-4 model availability

-| Model Availability | gpt-4 (0314) | gpt-4 (0613) |

-||:|:|

-| Available to all subscriptions with Azure OpenAI access | | Australia East <br> Canada East <br> France Central <br> Sweden Central <br> Switzerland North |

-| `gpt-35-turbo`¹ (0301) | East US <br> France Central <br> South Central US <br> UK South <br> West Europe | 4096 | Sep 2021 |

-¹ This model will accept requests > 4096 tokens. It is not recommended to exceed the 4096 input token limit as the newer version of the model are capped at 4096 tokens. If you encounter issues when exceeding 4096 input tokens with this model this configuration is not officially supported.

-Batch transcription jobs are scheduled on a best-effort basis. You can't estimate when a job will change into the running state, but it should happen within minutes under normal system load. When the job is in the running state, the transcription occurs faster than the audio runtime playback speed.

-The following [speech to text](speech-to-text.md) models are available: de-DE, en-AU, en-CA, en-GB, en-IE, en-IN, en-NZ, en-US, es-ES, es-MX, fr-CA, fr-FR, hi-IN, it-IT, ja-JP, ko-KR, nl-NL, pt-BR, ru-RU, sv-SE, tr-TR, zh-CN, zh-HK, and zh-TW.

-> Content score is currently available on the following regions: `westcentralus`, `eastasia`, `eastus`, `northeurope`, `westeurope`, and `westus2`. All other regions will have Content score available starting from Nov 30, 2023.

- - Custom Voice

- - Custom Commands

-| Disabled | Inbound and outbound traffic isn't restricted or you're using your own Azure Virtual Network to protect resources. | You want public inbound and outbound from the Azure AI, or you're handling network isolation with your own Azure VNet. |

-Azure CLI version `2.49.0` or later. If you haven't yet, follow the instructions to [Install Azure CLI][install-azure-cli]. Run `az --version` to find the version, and run `az upgrade` to upgrade the version if not already on the latest.

- az aks enable-addons -g <ResourceGroupName> -n <ClusterName> --addons web_application_routing

-[app-routing-dns-create]: ./app-routing-configuration.md#create-a-global-azure-dns-zone

-[app-routing-dns-configure]: ./app-routing-configuration.md#configure-the-add-on-to-use-azure-dns-to-manage-dns-zones

-To enable application routing on a new cluster, use the [`az aks create`][az-aks-create] command, specifying `web_application_routing` with the `enable-addons` argument.

-az aks create -g <ResourceGroupName> -n <ClusterName> -l <Location> --enable-addons web_application_routing --generate-ssh-keys

-To enable application routing on an existing cluster, use the [`az aks enable-addons`][az-aks-enable-addons] command specifying `web_application_routing` with the `--addons` argument.

-az aks enable-addons -g <ResourceGroupName> -n <ClusterName> --addons web_application_routing

-# [Open Service Mesh (OSM)](#tab/with-osm)

-Enable application routing on a new AKS cluster using the [`az aks create`][az-aks-create] command and the `--enable-addons` parameter with the following add-ons:

-az aks create -g <ResourceGroupName> -n <ClusterName> -l <Location> --enable-addons open-service-mesh,web_application_routing --generate-ssh-keys

-Enable application routing on an existing cluster using the [`az aks enable-addons`][az-aks-enable-addons] command and the `--addons` parameter with the following add-ons:

-az aks enable-addons -g <ResourceGroupName> -n <ClusterName> --addons open-service-mesh,web_application_routing

-Enable application routing on a new AKS cluster using the [`az aks create`][az-aks-create] command and the `--enable-addons` parameter with the following add-ons:

-az aks create -g <ResourceGroupName> -n <ClusterName> -l <Location> --enable-addons web_application_routing --generate-ssh-keys

-Enable application routing on an existing cluster using the [`az aks enable-addons`][az-aks-enable-addons] command and the `--addons` parameter with the following add-ons:

-az aks enable-addons -g <ResourceGroupName> -n <ClusterName> --addons web_application_routing --enable-secret-rotation

- - host: <Hostname>

- - host: <Hostname>

-To remove the application routing add-on from your cluster, use the [`az aks disable-addons`][az-aks-disable-addons] command.

-az aks disable-addons --addons web_application_routing --name myAKSCluster --resource-group myResourceGroup

-[custom-ingress-configurations]: app-routing-configuration.md

-### Enable Artifact Streaming on an existing node pool

-* Enable Artifact Streaming on an existing node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--enable-artifact-streaming` flag.

- ```azurecli-interactive

- az aks nodepool update \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name myNodePool \

- --enable-artifact-streaming

- ```

-## Disable Artifact Streaming on AKS

-You can disable Artifact Streaming at the node pool level. The change takes effect on the next node pool upgrade.

-> [!NOTE]

-> Artifact Streaming requires connection to and enablement on an ACR. If you disconnect or disable from ACR, Artifact Streaming is automatically disabled on the node pool. If you don't disable Artifact Streaming at the node pool level, it begins working immediately once you resume the connection to and enablement on ACR.

-### Disable Artifact Streaming on an existing node pool

-* Disable Artifact Streaming on an existing node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--disable-artifact-streaming` flag.

- ```azurecli-interactive

- az aks nodepool update \

- --resource-group myResourceGroup \

- --cluster-name myAKSCluster \

- --name myNodePool \

- --disable-artifact-streaming

- ```

-1. Create a key vault using the [`az keyvault create`][az-keyvault-create] command. The name of the key vault must be globally unique.

- az keyvault create -n <keyvault-name> -g myResourceGroup -l eastus2

-> This method requires you to use the Azure CLI version 2.53 or later. This method isn't recommended, as deprecated APIs in the targeted Kubernetes version may not work long term. We recommend removing them as soon as possible after the upgrade completes.

-## Long Term Support (LTS)

-AKS provides a Long Term Support (LTS) version of Kubernetes for a two-year period. There's only a single minor version of Kubernetes deemed LTS at any one time.

-| | Community Support |Long Term Support |

-||||

-| **When to use** | When you can keep up with upstream Kubernetes releases | When you need control over when to migrate from one version to another |

-| **Support versions** | Three GA minor versions | One Kubernetes version (currently *1.27*) for two years |

-| **Pricing** | Included | Per hour cluster cost |

-The upstream community maintains a minor release of Kubernetes for one year from release. After this period, Microsoft creates and applies security updates to the LTS version of Kubernetes to provide a total of two years of support on AKS.

-> [!IMPORTANT]

-> Kubernetes version 1.27 will be the first supported LTS version of Kubernetes on AKS. It is not yet available.

-> AKS creates a user-assigned kubelet identity in the node resource group if you don't [specify your own kubelet managed identity][Use a pre-created kubelet managed identity].

-> AKS creates a user-assigned kubelet identity in the node resource group if you don't [specify your own kubelet managed identity][Use a pre-created kubelet managed identity].

-| C++ | [azure-identity-cpp](https://github.com/Azure/azure-sdk-for-cpp/blob/main/sdk/identity/azure-identity/README.md) | 1.6.0-beta.2 |

-From **30 October 2023**, all agent-based and extension-based User Hybrid Runbook Workers using Transport Layer Security (TLS) 1.0 and 1.1 protocols would no longer be able to connect to Azure Automation and all jobs running or scheduled on these machines would fail.

-If you prefer to try out things without provisioning a full environment yourself, get started quickly with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_data/) on Azure Kubernetes Service (AKS), AWS Elastic Kubernetes Service (EKS), Google Cloud Kubernetes Engine (GKE) or in an Azure VM.

-> Get started quickly with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_data/) on AKS, Amazon EKS, or GKE, or in an Azure VM.

-> Get started quickly with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_data/) on Azure Kubernetes Service (AKS), AWS Elastic Kubernetes Service (EKS), Google Cloud Kubernetes Engine (GKE) or in an Azure VM.

->In addition, deploy [Jumpstart ArcBox for DataOps](https://aka.ms/ArcBoxDataOps), an easy to deploy sandbox for all things Azure Arc-enabled SQL Managed Instance. ArcBox is designed to be completely self-contained within a single Azure subscription and resource group, which will make it easy for you to get hands-on with all available Azure Arc-enabled technology with nothing more than an available Azure subscription.

-> Get started quickly with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_data/) on AKS, Amazon EKS, or GKE, or in an Azure VM.

-> Get started quickly with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_data/) on AKS, AWS Elastic Kubernetes Service (EKS), Google Cloud Kubernetes Engine (GKE) or in an Azure VM.

-* Experience Azure Arc-enabled Kubernetes automated scenarios with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_k8s/).

-* Try out Arc-enabled Kubernetes without provisioning a full environment by using the [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_k8s/).

-For a conceptual look at connecting clusters to Azure Arc, see [Azure Arc-enabled Kubernetes agent overview](./conceptual-agent-overview.md). To try things out in a sample/practice experience, visit the [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_k8s/).

-* Experience Azure Arc-enabled Kubernetes automated scenarios with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_k8s/).

-* Try out Arc-enabled servers by using the [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_servers/).

-> If you prefer to try out things in a sample/practice experience, get started quickly with [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_servers/).

-1. To manually install the module, download the source code and unzip the contents of the project directory to the

-`$env:ProgramFiles\WindowsPowerShell\Modules folder`. Or, run the following command to install from the PowerShell gallery using PowerShellGet (in PowerShell 5.0):

- Find-Module -Name AzureConnectedMachineDsc -Repository PSGallery | Install-Module

-* Try out Arc-enabled servers by using the [Azure Arc Jumpstart](https://azurearcjumpstart.io/azure_arc_jumpstart/azure_arc_servers/).

-[Azure Maps & Azure Active Directory Samples]: https://github.com/Azure-Samples/Azure-Maps-AzureAD-Samples

-ms.contributor: cawa

-In this guide, you'll learn the two ways to enable Change Analysis for Azure Functions and web app in-guest changes:

-For web app in-guest changes, separate enablement is required for scanning code files within a web app. For more information, see [Change Analysis in the Diagnose and solve problems tool](change-analysis-visualizations.md#diagnose-and-solve-problems-tool) section.

-### Pre-requisites

-Enable Change Analysis for web application in guest changes by using the [Diagnose and solve problems tool](./change-analysis-visualizations.md#diagnose-and-solve-problems-tool).

-ms.contributor: cawa

-# Track a web app outage using Change Analysis

-When issues happen, one of the first things to check is what changed in application, configuration and resources to triage and root cause issues. Change Analysis provides a centralized view of the changes in your subscriptions for up to the past 14 days to provide the history of changes for troubleshooting issues.

-## Pre-requisites

-```bash

-az login

-az account set --s {azure-subscription-id}

-```

-```bash

-git clone https://github.com/Azure-Samples/changeanalysis-webapp-storage-sample.git

-```

-```bash

-cd changeanalysis-webapp-storage-sample

-```

-1. Open `Publish-WebApp.ps1`.

-In the Azure portal, [navigate to the Change Analysis standalone UI](./change-analysis-visualizations.md). Page loading may take a few minutes as the `Microsoft.ChangeAnalysis` resource provider is registered.

-In the Azure portal, navigate to the Change Analysis overview page. Since you've triggered a web app outage, you'll see an entry of change for `AzureStorageConnection`:

-Now that you've discovered the web app in-guest change and understand next steps, you can proceed with troubleshooting the issue.

-ms.contributor: cawa

-ms.contributor: cawa

-# Scenarios for using Change Analysis in Azure Monitor

-Change Analysis provides data for various management and troubleshooting scenarios to help you understand what changes to your application might have caused the issues.

-You can access the Change Analysis overview portal under Azure Monitor, where you can view all changes and application dependency/resource insights. You can access Change Analysis through a couple of entry points:

-### Monitor home page

-### Search

-## Diagnose and solve problems tool

-From your resource's overview page in Azure portal, you can view change data by selecting **Diagnose and solve problems** the left menu. As you enter the Diagnose and Solve Problems tool, the **Microsoft.ChangeAnalysis** resource provider will automatically be registered.

-### Diagnose and solve problems tool for Web App

-### Diagnose and solve problems tool for Virtual Machines

-### Diagnose and solve problems tool for Azure SQL Database and other resources

-You can view Change Analysis data for [multiple Azure resources](./change-analysis.md#supported-resource-types), but we highlight Azure SQL Database below.

-## Activity Log change history

-Use the [View change history](../essentials/activity-log.md#view-change-history) feature to call the Azure Monitor Change Analysis service backend to view changes associated with an operation. Changes returned include:

-1. From within your resource, select **Activity Log** from the side menu.

-1. Select a change from the list.

-1. Select the **Change history** tab.

-1. For the Azure Monitor Change Analysis service to scan for changes in users' subscriptions, a resource provider needs to be registered. Upon selecting the **Change history** tab, the tool will automatically register **Microsoft.ChangeAnalysis** resource provider.

-1. Once registered, you can view changes from **Azure Resource Graph** immediately from the past 14 days.

- - Changes from other sources will be available after ~4 hours after subscription is onboard.

- :::image type="content" source="./media/change-analysis/activity-log-change-history.png" alt-text="Activity Log change history integration":::

-## VM Insights integration

-If you've enabled [VM Insights](../vm/vminsights-overview.md), you can view changes in your virtual machines that may have caused any spikes in a metric chart, such as CPU or Memory.

-## Drill to Change Analysis logs

-## Browse using custom filters and search bar

-### Filters

-### Search bar

-## Pin and share a Change Analysis query to the Azure dashboard

-## Pin to the Azure dashboard

-Once you have applied filters to the Change Analysis homepage:

-A side pane will open to configure the dashboard where you'll place your pin. You can select one of two dashboard types:

-### Select an existing dashboard

-1. If you've selected **Shared**, select the subscription in which you'd like to place the dashboard.

-### Create a new dashboard

-1. From the Azure portal home menu, select **Dashboard**. Use the **Manage Sharing** button in the top menu to handle access or "unshare". Click on the pin to navigate to the curated view of changes.

-## Share a single change with your team

-ms.contributor: cawa

-While standard monitoring solutions might alert you to a live site issue, outage, or component failure, they often don't explain the cause. For example, your site worked five minutes ago, and now it's broken. What changed in the last five minutes?

-We've designed Change Analysis to answer that question in Azure Monitor.

-Using [Azure Resource Graph](../../governance/resource-graph/overview.md), Change Analysis provides a historical record of how the Azure resources that host your application have changed over time. The following basic configuration settings are set using Azure Resource Manager and tracked by Azure Resource Graph:

-These setting changes are not captured by Azure Resource Graph. Change Analysis fills this gap by capturing snapshots of changes in those main configuration properties, like changes to the connection string, etc. Snapshots are taken of configuration changes and change details every up to 6 hours. [See known limitations.](#limitations)

-If you don't see file changes within 30 minutes or configuration changes within 6 hours, refer to [our troubleshooting guide](./change-analysis-troubleshoot.md#cannot-see-in-guest-changes-for-newly-enabled-web-app).

-[See known limitations.](#limitations)

-As another example, if port 22 was closed in a virtual machine's Network Security Group, it will cause connectivity errors.

-To detect changes in dependencies, Change Analysis checks the web app's DNS record. In this way, it identifies changes in all app components that could cause issues.

-Currently the following dependencies are supported in **Web App Diagnose and solve problems | Navigator**:

-# Authentication for Container Insights

-Container Insights now defaults to managed identity authentication. This secure and simplified authentication model has a monitoring agent that uses the cluster's managed identity to send data to Azure Monitor. It replaces the existing legacy certificate-based local authentication and removes the requirement of adding a Monitoring Metrics Publisher role to the cluster.

-> [!Note]

-> [ContainerLogV2](container-insights-logging-v2.md) will be default schema for customers who will be onboarding container insights with Managed Identity Auth using ARM, Bicep, Terraform, Policy and Portal onboarding. ContainerLogV2 can be explicitly enabled through CLI version 2.51.0 or higher using Data collection settings.

-## How to enable

-Click on the relevant tab for instructions to enable Managed identity authentication on your clusters.

-When creating a new cluster from the Azure portal: On the **Integrations** tab, first check the box for *Enable Container Logs*, then check the box for *Use managed identity*.

-For existing clusters, you can switch to Managed Identity authentication from the *Monitor settings* panel: Navigate to your AKS cluster, scroll through the menu on the left till you see the **Monitoring** section, there click on the **Insights** tab. In the Insights tab, click on the *Monitor Settings* option and check the box for *Use managed identity*

-See [Migrate to managed identity authentication](container-insights-enable-aks.md?tabs=azure-cli#migrate-to-managed-identity-authentication)

-## [Resource Manager template](#tab/arm)

-See instructions for migrating

-* [AKS clusters](container-insights-enable-aks.md?tabs=arm#existing-aks-cluster)

-* [Arc-enabled clusters](container-insights-enable-arc-enabled-clusters.md?tabs=create-cli%2Cverify-portal%2Cmigrate-arm)

-## [Bicep](#tab/bicep)

-**Enable Monitoring with MSI without syslog**

-1. Download Bicep templates and Parameter files

-```

-curl -L https://aka.ms/enable-monitoring-msi-bicep-template -o existingClusterOnboarding.bicep

-curl -L https://aka.ms/enable-monitoring-msi-bicep-parameters -o existingClusterParam.json

-```

-2. Edit the values in the parameter file

-

-3. Onboard with the following commands:

-```

-az login

-az account set --subscription "Subscription Name"

-az deployment group create --resource-group <ClusterResourceGroupName> --template-file ./existingClusterOnboarding.bicep --parameters ./existingClusterParam.json

-```

-**Enable Monitoring with MSI with syslog**

-1. Download Bicep templates and Parameter files

-```

- curl -L https://aka.ms/enable-monitoring-msi-syslog-bicep-template -o existingClusterOnboarding.bicep

- curl -L https://aka.ms/enable-monitoring-msi-syslog-bicep-parameters -o existingClusterParam.json

-```

-2. Edit the values in the parameter file

-3. Onboarding with the following commands:

-```

-az login

-az account set --subscription "Subscription Name"

-az deployment group create --resource-group <ClusterResourceGroupName> --template-file ./existingClusterOnboarding.bicep --parameters ./existingClusterParam.json

-```

-For new AKS cluster:

-Replace and use the managed cluster resources in this [guide](../../aks/learn/quick-kubernetes-deploy-bicep.md?tabs=azure-cli)

-## [Terraform](#tab/terraform)

-**Enable Monitoring with MSI without syslog for new AKS cluster**

-1. Download Terraform template for enable monitoring msi with syslog enabled:

-https://aka.ms/enable-monitoring-msi-terraform

-2. Adjust the azurerm_kubernetes_cluster resource in main.tf based on what cluster settings you're going to have

-3. Update parameters in variables.tf to replace values in "<>"

-4. Run `terraform init -upgrade` to initialize the Terraform deployment.

-5. Run `terraform plan -out main.tfplan` to initialize the Terraform deployment.

-6. Run `terraform apply main.tfplan` to apply the execution plan to your cloud infrastructure.

-**Enable Monitoring with MSI with syslog for new AKS cluster**

-1. Download Terraform template for enable monitoring msi with syslog enabled:

-https://aka.ms/enable-monitoring-msi-syslog-terraform

-2. Adjust the azurerm_kubernetes_cluster resource in main.tf based on what cluster settings you're going to have

-3. Update parameters in variables.tf to replace values in "<>"

-4. Run `terraform init -upgrade` to initialize the Terraform deployment.

-5. Run `terraform plan -out main.tfplan` to initialize the Terraform deployment.

-6. Run `terraform apply main.tfplan` to apply the execution plan to your cloud infrastructure.

-**Enable Monitoring with MSI for existing AKS cluster:**

-1. Import the existing cluster resource first with this command: ` terraform import azurerm_kubernetes_cluster.k8s <aksResourceId>`

-2. Add the oms_agent add-on profile to the existing azurerm_kubernetes_cluster resource.

-```

-oms_agent {

- log_analytics_workspace_id = var.workspace_resource_id

- msi_auth_for_monitoring_enabled = true

- }

-```

-3. Copy the dcr and dcra resources from the Terraform templates

-4. Run `terraform plan -out main.tfplan` and make sure the change is adding the oms_agent property. Note: If the azurerm_kubernetes_cluster resource defined is different during terraform plan, the existing cluster will get destroyed and recreated.

-5. Run `terraform apply main.tfplan` to apply the execution plan to your cloud infrastructure.

-> [!TIP]

-> - Edit the `main.tf` file appropriately before running the terraform template

-> - Data will start flowing after 10 minutes since the cluster needs to be ready first

-> - WorkspaceID needs to match the format `/subscriptions/12345678-1234-9876-4563-123456789012/resourceGroups/example-resource-group/providers/Microsoft.OperationalInsights/workspaces/workspaceValue`

-> - If resource group already exists, run `terraform import azurerm_resource_group.rg /subscriptions/<Subscription_ID>/resourceGroups/<Resource_Group_Name>` before terraform plan

-## [Azure Policy](#tab/policy)

-1. Download Azure Policy templates and parameter files using the following commands:

-```

-curl -L https://aka.ms/enable-monitoring-msi-azure-policy-template -o azure-policy.rules.json

-curl -L https://aka.ms/enable-monitoring-msi-azure-policy-parameters -o azure-policy.parameters.json

-```

-2. Activate the policies:

-You can create the policy definition using a command:

-```

-az policy definition create --name "AKS-Monitoring-Addon-MSI" --display-name "AKS-Monitoring-Addon-MSI" --mode Indexed --metadata version=1.0.0 category=Kubernetes --rules azure-policy.rules.json --params azure-policy.parameters.json

-```

-You can create the policy assignment with the following command like:

-```

-az policy assignment create --name aks-monitoring-addon --policy "AKS-Monitoring-Addon-MSI" --assign-identity --identity-scope /subscriptions/<subscriptionId> --role Contributor --scope /subscriptions/<subscriptionId> --location <location> --role Contributor --scope /subscriptions/<subscriptionId> -p "{ \"workspaceResourceId\": { \"value\": \"/subscriptions/<subscriptionId>/resourcegroups/<resourceGroupName>/providers/microsoft.operationalinsights/workspaces/<workspaceName>\" } }"

-```

-> [!TIP]

-> - Make sure when performing remediation task, the policy assignment has access to workspace you specified.

-> - Download all files under AddonPolicyTemplate folder before running the policy template.

-> - For assign policy, parameters and remediation task from portal, use the following guides:

-> o After creating the policy definition through the above command, go to Azure portal -> Policy -> Definitions and select the definition you created.

-> o Click on 'Assign' and then go to the 'Parameters' tab and fill in the details. Then click 'Review + Create'.

-> o Once the policy is assigned to the subscription, whenever you create a new cluster, the policy will run and check if Container Insights is enabled. If not, it will deploy the resource. If you want to apply the policy to existing AKS cluster, create a 'Remediation task' for that resource after going to the 'Policy Assignment'.

-## Limitations

-1. Ingestion Transformations are not supported: See [Data collection transformation](../essentials/data-collection-transformations.md) to read more.

-2. Dependency on DCR/DCRA for region availability - For new AKS region, there might be chances that DCR is still not supported in the new region. In that case, onboarding Container Insights with MSI will fail. One workaround is to onboard to Container Insights through CLI with the old way (with the use of Container Insights solution)

-This article describes how to set up Container insights to monitor a managed Kubernetes cluster hosted on an [Azure Kubernetes Service (AKS)](../../aks/index.yml) cluster.

-If you're connecting an existing AKS cluster to a Log Analytics workspace in another subscription, the *Microsoft.ContainerService* resource provider must be registered in the subscription with the Log Analytics workspace. For more information, see [Register resource provider](../../azure-resource-manager/management/resource-providers-and-types.md#register-resource-provider).

-> When you enable Container Insights on legacy auth clusters, a managed identity is automatically created. This identity will not be available in case the cluster migrates to MSI Auth or if the Container Insights is disabled and hence this managed identity should not be used for anything else.

-## New AKS cluster

-You can enable monitoring for an AKS cluster when it's created by using any of the following methods:

-## Existing AKS cluster

-Use any of the following methods to enable monitoring for an existing AKS cluster.

-> Managed identity authentication will be default in CLI version 2.49.0 or higher. If you need to use legacy/non-managed identity authentication, use CLI version < 2.49.0. For CLI version 2.54.0 or higher the logging schema will be configured to [ContainerLogV2](./container-insights-logging-v2.md) via the ConfigMap

-The output will resemble the following example:

-```output

-provisioningState : Succeeded

-## [Terraform](#tab/terraform)

-1. Add the **oms_agent** add-on profile to the existing [azurerm_kubernetes_cluster resource](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/kubernetes_cluster) depending on the version of the [Terraform AzureRM provider version](/azure/developer/terraform/provider-version-history-azurerm).

- * If the Terraform AzureRM provider version is 3.0 or higher, add the following:

- ```

- oms_agent {

- log_analytics_workspace_id = "${azurerm_log_analytics_workspace.test.id}"

- }

- ```

- * If the Terraform AzureRM provider is less than version 3.0, add the following:

- ```

- addon_profile {

- oms_agent {

- enabled = true

- log_analytics_workspace_id = "${azurerm_log_analytics_workspace.test.id}"

- }

- }

- ```

-2. Add the [azurerm_log_analytics_solution](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/log_analytics_solution) by following the steps in the Terraform documentation.

-3. Enable collection of custom metrics by following the guidance at [Enable custom metrics](container-insights-custom-metrics.md).

-## [Azure portal](#tab/portal-azure-monitor)

-> [!NOTE]

-> You can initiate this same process from the **Insights** option in the AKS menu for your cluster in the Azure portal.

-To enable monitoring of your AKS cluster in the Azure portal from Azure Monitor:

-1. In the Azure portal, select **Monitor**.

-1. Select **Containers** from the list.

-1. On the **Monitor - containers** page, select **Unmonitored clusters**.

-1. From the list of unmonitored clusters, find the cluster in the list and select **Enable**.

-1. On the **Configure Container insights** page, select **Configure**.

- :::image type="content" source="media/container-insights-enable-aks/container-insights-configure.png" lightbox="media/container-insights-enable-aks/container-insights-configure.png" alt-text="Screenshot that shows the configuration screen for an AKS cluster.":::

-1. On the **Configure Container insights** page, fill in the following information:

- | Option | Description |

- |:|:|

- | Log Analytics workspace | Select a [Log Analytics workspace](../logs/log-analytics-workspace-overview.md) from the dropdown list or select **Create new** to create a default Log Analytics workspace. The Log Analytics workspace must be in the same subscription as the AKS container. |

- | Enable Prometheus metrics | Select this option to collect Prometheus metrics for the cluster in [Azure Monitor managed service for Prometheus](../essentials/prometheus-metrics-overview.md). |

- | Azure Monitor workspace | If you select **Enable Prometheus metrics**, you must select an [Azure Monitor workspace](../essentials/azure-monitor-workspace-overview.md). The Azure Monitor workspace must be in the same subscription as the AKS container and the Log Analytics workspace. |

- | Grafana workspace | To use the collected Prometheus metrics with dashboards in [Azure-managed Grafana](../../managed-grafan#enable-prometheus-metric-collection) to the Azure Monitor workspace if it isn't already. |

-

-1. Select **Use managed identity** if you want to use [managed identity authentication with Azure Monitor Agent](container-insights-onboard.md#authentication).

-After you've enabled monitoring, it might take about 15 minutes before you can view health metrics for the cluster.

-## [Resource Manager template](#tab/arm)

->[!NOTE]

->The template must be deployed in the same resource group as the cluster.

-### Create or download templates

-You'll either download template and parameter files or create your own depending on the authentication mode you're using.

-To enable [managed identity authentication](container-insights-onboard.md#authentication):

-1. Download the template in the [GitHub content file](https://aka.ms/aks-enable-monitoring-msi-onboarding-template-file) and save it as **existingClusterOnboarding.json**.

-1. Download the parameter file in the [GitHub content file](https://aka.ms/aks-enable-monitoring-msi-onboarding-template-parameter-file) and save it as **existingClusterParam.json**.

-1. Edit the values in the parameter file:

- - `aksResourceId`: Use the values on the **AKS Overview** page for the AKS cluster.

- - `aksResourceLocation`: Use the values on the **AKS Overview** page for the AKS cluster.

- - `workspaceResourceId`: Use the resource ID of your Log Analytics workspace.

- - `resourceTagValues`: Match the existing tag values specified for the existing Container insights extension data collection rule (DCR) of the cluster and the name of the DCR. The name will be *MSCI-\<clusterRegion\>-\<clusterName\>* and this resource created in an AKS clusters resource group. If this is the first time onboarding, you can set the arbitrary tag values.

-To enable [managed identity authentication](container-insights-onboard.md#authentication):

-1. Save the following JSON as **existingClusterOnboarding.json**.

- ```json

- {

- "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",

- "contentVersion": "1.0.0.0",

- "parameters": {

- "aksResourceId": {

- "type": "string",

- "metadata": {

- "description": "AKS Cluster Resource ID"

- }

- },

- "aksResourceLocation": {

- "type": "string",

- "metadata": {

- "description": "Location of the AKS resource e.g. \"East US\""

- }

- },

- "aksResourceTagValues": {

- "type": "object",

- "metadata": {

- "description": "Existing all tags on AKS Cluster Resource"

- }

- },

- "workspaceResourceId": {

- "type": "string",

- "metadata": {

- "description": "Azure Monitor Log Analytics Resource ID"

- }

- }

- },

- "resources": [

- {

- "name": "[split(parameters('aksResourceId'),'/')[8]]",

- "type": "Microsoft.ContainerService/managedClusters",

- "location": "[parameters('aksResourceLocation')]",

- "tags": "[parameters('aksResourceTagValues')]",

- "apiVersion": "2018-03-31",

- "properties": {

- "mode": "Incremental",

- "id": "[parameters('aksResourceId')]",

- "addonProfiles": {

- "omsagent": {

- "enabled": true,

- "config": {

- "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]"

- }

- }

- }

- }

- }

- ]

- }

- ```

-1. Save the following JSON as **existingClusterParam.json**.

- ```json

- {

- "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",

- "contentVersion": "1.0.0.0",

- "parameters": {

- "aksResourceId": {

- "value": "/subscriptions/<SubscriptionId>/resourcegroups/<ResourceGroup>/providers/Microsoft.ContainerService/managedClusters/<ResourceName>"

- },

- "aksResourceLocation": {

- "value": "<aksClusterLocation>"

- },

- "workspaceResourceId": {

- "value": "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroup>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>"

- },

- "aksResourceTagValues": {

- "value": {

- "<existing-tag-name1>": "<existing-tag-value1>",

- "<existing-tag-name2>": "<existing-tag-value2>",

- "<existing-tag-nameN>": "<existing-tag-valueN>"

- }

- }

- }

- }

- ```

-1. Download the parameter file in the [GitHub content file](https://aka.ms/aks-enable-monitoring-msi-onboarding-template-parameter-file) and save as **existingClusterParam.json**.

-1. Edit the values in the parameter file:

- - `aksResourceId`: Use the values on the **AKS Overview** page for the AKS cluster.

- - `aksResourceLocation`: Use the values on the **AKS Overview** page for the AKS cluster.

- - `workspaceResourceId`: Use the resource ID of your Log Analytics workspace.

- - `resourceTagValues`: Use the existing tag values specified for the AKS cluster.

-### Deploy the template

-Deploy the template with the parameter file by using any valid method for deploying Resource Manager templates. For examples of different methods, see [Deploy the sample templates](../resource-manager-samples.md#deploy-the-sample-templates).

-#### Deploy with Azure PowerShell

-```powershell

-New-AzResourceGroupDeployment -Name OnboardCluster -ResourceGroupName <ResourceGroupName> -TemplateFile .\existingClusterOnboarding.json -TemplateParameterFile .\existingClusterParam.json

-```

-The configuration change can take a few minutes to complete. When it's finished, a message similar to the following example includes this result:

-```output

-provisioningState : Succeeded

-```

-#### Deploy with Azure CLI

-```azurecli

-az login

-az account set --subscription "Subscription Name"

-az deployment group create --resource-group <ResourceGroupName> --template-file ./existingClusterOnboarding.json --parameters @./existingClusterParam.json

-```

-The configuration change can take a few minutes to complete. When it's finished, a message similar to the following example includes this result:

-```output

-provisioningState : Succeeded

-```

-After you've enabled monitoring, it might take about 15 minutes before you can view health metrics for the cluster.

-Run the following command to verify that the agent is deployed successfully.

-After a few minutes, the command completes and returns JSON-formatted information about the solution. The results of the command should show the monitoring add-on profile and resemble the following example output:

-## Migrate to managed identity authentication

-This section explains two methods for migrating to managed identity authentication.

-### Existing clusters with a service principal

-AKS clusters with a service principal must first disable monitoring and then upgrade to managed identity. Only Azure public cloud, Microsoft Azure operated by 21Vianet cloud, and Azure Government cloud are currently supported for this migration.

-> [!NOTE]

-> Minimum Azure CLI version 2.49.0 or higher.

-1. Get the configured Log Analytics workspace resource ID:

- ```cli

- az aks show -g <resource-group-name> -n <cluster-name> | grep -i "logAnalyticsWorkspaceResourceID"

- ```

-1. Disable monitoring with the following command:

- ```cli

- az aks disable-addons -a monitoring -g <resource-group-name> -n <cluster-name>

- ```

-1. Upgrade cluster to system managed identity with the following command:

- ```cli

- az aks update -g <resource-group-name> -n <cluster-name> --enable-managed-identity

- ```

-1. Enable the monitoring add-on with the managed identity authentication option by using the Log Analytics workspace resource ID obtained in step 1:

- ```cli

- az aks enable-addons -a monitoring -g <resource-group-name> -n <cluster-name> --workspace-resource-id <workspace-resource-id>

- ```

-### Existing clusters with system or user-assigned identity

-AKS clusters with system-assigned identity must first disable monitoring and then upgrade to managed identity. Only Azure public cloud, Azure operated by 21Vianet cloud, and Azure Government cloud are currently supported for clusters with system identity. For clusters with user-assigned identity, only Azure public cloud is supported.

-> [!NOTE]

-> Minimum Azure CLI version 2.49.0 or higher.

-1. Get the configured Log Analytics workspace resource ID:

- ```cli

- az aks show -g <resource-group-name> -n <cluster-name> | grep -i "logAnalyticsWorkspaceResourceID"

- ```

-1. Disable monitoring with the following command:

- ```cli

- az aks disable-addons -a monitoring -g <resource-group-name> -n <cluster-name>

- ```

-1. Enable the monitoring add-on with the managed identity authentication option by using the Log Analytics workspace resource ID obtained in step 1:

- ```cli

- az aks enable-addons -a monitoring -g <resource-group-name> -n <cluster-name> --workspace-resource-id <workspace-resource-id>

- ```

-## Private link

-Use one of the following procedures to enable network isolation by connecting your cluster to the Log Analytics workspace by using [Azure Private Link](../logs/private-link-security.md).

-### Managed identity authentication

-Use the following procedure if your cluster is using managed identity authentication with Azure Monitor Agent.

-1. Follow the steps in [Enable network isolation for the Azure Monitor agent](../agents/azure-monitor-agent-data-collection-endpoint.md) to create a data collection endpoint and add it to your Azure Monitor private link service.

-1. Create an association between the cluster and the data collection endpoint by using the following API call. For information on this call, see [Data collection rule associations - Create](/rest/api/monitor/data-collection-rule-associations/create). The DCR association name must beΓÇ»**configurationAccessEndpoint**, and `resourceUri` is the resource ID of the AKS cluster.

- ```rest

- PUT https://management.azure.com/{cluster-resource-id}/providers/Microsoft.Insights/dataCollectionRuleAssociations/configurationAccessEndpoint?api-version=2021-04-01

- {

- "properties": {

- "dataCollectionEndpointId": "{data-collection-endpoint-resource-id}"

- }

- }

- ```

- The following snippet is an example of this API call:

- ```rest

- PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/managedClusters/my-aks-cluster/providers/Microsoft.Insights/dataCollectionRuleAssociations/configurationAccessEndpoint?api-version=2021-04-01

- {

- "properties": {

- "dataCollectionEndpointId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Insights/dataCollectionEndpoints/myDataCollectionEndpoint"

- }

- }

- ```

-1. Enable monitoring with the managed identity authentication option by using the steps in [Migrate to managed identity authentication](#migrate-to-managed-identity-authentication).

-### Without managed identity authentication

-Use the following procedure if you're not using managed identity authentication. This requires a [private AKS cluster](../../aks/private-clusters.md).

-1. Create a private AKS cluster following the guidance in [Create a private Azure Kubernetes Service cluster](../../aks/private-clusters.md).

-2. Disable public Ingestion on your Log Analytics workspace.

- Use the following command to disable public ingestion on an existing workspace.

- ```cli

- az monitor log-analytics workspace update --resource-group <azureLogAnalyticsWorkspaceResourceGroup> --workspace-name <azureLogAnalyticsWorkspaceName> --ingestion-access Disabled

- ```

- Use the following command to create a new workspace with public ingestion disabled.

- ```cli

- az monitor log-analytics workspace create --resource-group <azureLogAnalyticsWorkspaceResourceGroup> --workspace-name <azureLogAnalyticsWorkspaceName> --ingestion-access Disabled

- ```

-3. Configure private link by following the instructions at [Configure your private link](../logs/private-link-configure.md). Set ingestion access to public and then set to private after the private endpoint is created but before monitoring is enabled. The private link resource region must be same as AKS cluster region.

-4. Enable monitoring for the AKS cluster.

- ```cli

- az aks enable-addons -a monitoring --resource-group <AKSClusterResourceGorup> --name <AKSClusterName> --workspace-resource-id <workspace-resource-id>

- ```

- **Azure public cloud**

- | Endpoint | Port |

- |-||

- | `*.ods.opinsights.azure.com` | 443 |

- | `*.oms.opinsights.azure.com` | 443 |

- | `dc.services.visualstudio.com` | 443 |

- | `*.monitoring.azure.com` | 443 |

- | `login.microsoftonline.com` | 443 |

- The following table lists the additional firewall configuration required for managed identity authentication.

- |Agent resource| Purpose | Port |

- |--|||

- | `global.handler.control.monitor.azure.com` | Access control service | 443 |

- | `<cluster-region-name>.handler.control.monitor.azure.com` | Fetch data collection rules for specific AKS cluster | 443 |

- **Azure Government cloud**

- If your Azure Arc-enabled Kubernetes resource is in Azure US Government environment, following endpoints need to be enabled for outbound access:

- | Endpoint | Port |

- |-||

- | `*.ods.opinsights.azure.us` | 443 |

- | `*.oms.opinsights.azure.us` | 443 |

- | `dc.services.visualstudio.com` | 443 |

- The following table lists the additional firewall configuration required for managed identity authentication.

- |Agent resource| Purpose | Port |

- |--|||

- | `global.handler.control.monitor.azure.cn` | Access control service | 443 |

- | `<cluster-region-name>.handler.control.monitor.azure.cn` | Fetch data collection rules for specific AKS cluster | 443 |

-Checkout the [resource requests and limits section of Helm chart](https://github.com/microsoft/Docker-Provider/blob/ci_prod/charts/azuremonitor-containers/values.yaml) for the available configuration settings.

-## Migrate to managed identity authentication

-Use the flowing guidance to migrate an existing extension instance to managed identity authentication.

->[!NOTE]

-> Managed identity authentication is not supported for Arc-enabled Kubernetes clusters with **ARO**.

-## [CLI](#tab/migrate-cli)

-First retrieve the Log Analytics workspace configured for Container insights extension.

-```cli

-az k8s-extension show --name azuremonitor-containers --cluster-name \<cluster-name\> --resource-group \<resource-group\> --cluster-type connectedClusters -n azuremonitor-containers

-```

-Enable Container insights extension with managed identity authentication option using the workspace returned in the first step.

-```cli

-az k8s-extension create --name azuremonitor-containers --cluster-name \<cluster-name\> --resource-group \<resource-group\> --cluster-type connectedClusters --extension-type Microsoft.AzureMonitor.Containers --configuration-settings amalogs.useAADAuth=true logAnalyticsWorkspaceResourceID=\<workspace-resource-id\>

-```

-## [Resource Manager](#tab/migrate-arm)

-1. Download the template at [https://aka.ms/arc-k8s-azmon-extension-msi-arm-template](https://aka.ms/arc-k8s-azmon-extension-msi-arm-template) and save it as **arc-k8s-azmon-extension-msi-arm-template.json**.

-2. Download the parameter file at [https://aka.ms/arc-k8s-azmon-extension-msi-arm-template-params](https://aka.ms/arc-k8s-azmon-extension-msi-arm-template) and save it as **arc-k8s-azmon-extension-msi-arm-template-params.json**.

-

-3. Edit the values in the parameter file.

- - For **workspaceDomain**, use *opinsights.azure.com* for Azure public cloud and *opinsights.azure.us* for Azure Government cloud.

- - Specify the tags in the **resourceTagValues** parameter if you want to use any Azure tags on the Azure resources that will be created as part of the Container insights extension.

-4. Deploy the template to create Container Insights extension.

-```cli

-az login

-az account set --subscription "Subscription Name"

-az deployment group create --resource-group <resource-group> --template-file ./arc-k8s-azmon-extension-msi-arm-template.json --parameters @./arc-k8s-azmon-extension-msi-arm-template-params.json

-```

-> DCR based configuration is not supported for service principal based clusters. Please [migrate your clusters with service principal to managed identity](./container-insights-enable-aks.md#migrate-to-managed-identity-authentication) to use this experience.

-This article provides an overview of the requirements and options that are available for configuring Container insights to monitor the performance of workloads that are deployed to Kubernetes environments. You can enable Container insights for a new deployment or for one or more existing deployments of Kubernetes by using several supported methods.

-The versions of Kubernetes and support policy are the same as those versions [supported in AKS](../../aks/supported-kubernetes-versions.md).

-### Differences between Windows and Linux clusters

-The main differences in monitoring a Windows Server cluster compared to a Linux cluster include:

->[!NOTE]

-> Container insights support for the Windows Server 2022 operating system is in preview.

-## Installation options

-Before you start, make sure that you've met the following requirements:

-### Log Analytics workspace

-Container insights stores its data in a [Log Analytics workspace](../logs/log-analytics-workspace-overview.md). It supports workspaces in the regions that are listed in [Products available by region](https://azure.microsoft.com/global-infrastructure/services/?regions=all&products=monitor). For a list of the supported mapping pairs to use for the default workspace, see [Region mappings supported by Container insights](container-insights-region-mapping.md).

-You can let the onboarding experience create a Log Analytics workspace in the default resource group of the AKS cluster subscription. If you already have a workspace, you'll probably want to use that one. For more information, see [Designing your Azure Monitor Logs deployment](../logs/design-logs-deployment.md).

- You can attach an AKS cluster to a Log Analytics workspace in a different Azure subscription in the same Microsoft Entra tenant. Currently, you can't do it with the Azure portal, but you can use the Azure CLI or an Azure Resource Manager template.

-### Azure Monitor workspace (preview)

-If you're going to configure the cluster to [collect Prometheus metrics](container-insights-prometheus.md) with [Azure Monitor managed service for Prometheus](../essentials/prometheus-metrics-overview.md), you must have an Azure Monitor workspace where Prometheus metrics are stored. You can let the onboarding experience create an Azure Monitor workspace in the default resource group of the AKS cluster subscription or use an existing Azure Monitor workspace.

-### Permissions

-To enable Container insights, you require the following permissions:

-To view data after container monitoring is enabled, you require the following permissions:

-### Kubelet secure port

-The containerized Linux agent (replicaset pod) makes API calls to all the Windows nodes on Kubelet secure port (10250) within the cluster to collect node and container performance-related metrics. Kubelet secure port (:10250) should be opened in the cluster's virtual network for both inbound and outbound for Windows node and container performance-related metrics collection to work.

-If you have a Kubernetes cluster with Windows nodes, review and configure the network security group and network policies to make sure the Kubelet secure port (:10250) is opened for both inbound and outbound in the cluster's virtual network.

-## Authentication

-Container insights defaults to managed identity authentication. This secure and simplified authentication model has a monitoring agent that uses the cluster's managed identity to send data to Azure Monitor. It replaces the existing legacy certificate-based local authentication and removes the requirement of adding a *Monitoring Metrics Publisher* role to the cluster. Read more in [Authentication for Container Insights](container-insights-authentication.md)

-## Agent

-This section reviews the agents used by Container insights.

-### Azure Monitor agent

-When Container insights uses managed identity authentication (in preview), it relies on a containerized Azure Monitor agent for Linux. This specialized agent collects performance and event data from all nodes in the cluster. The agent is automatically deployed and registered with the specified Log Analytics workspace during deployment.

-### Log Analytics agent

-When Container insights doesn't use managed identity authentication, it relies on a containerized Log Analytics agent for Linux. This specialized agent collects performance and event data from all nodes in the cluster. The agent is automatically deployed and registered with the specified Log Analytics workspace during deployment.

-The agent version is *microsoft/oms:ciprod04202018* or later. It's represented by a date in the following format: *mmddyyyy*. When a new version of the agent is released, it's automatically upgraded on your managed Kubernetes clusters that are hosted on AKS. To track which versions are released, see [Agent release announcements](https://github.com/microsoft/docker-provider/tree/ci_feature_prod).

-With the general availability of Windows Server support for AKS, an AKS cluster with Windows Server nodes has a preview agent installed as a daemonset pod on each individual Windows Server node to collect logs and forward them to Log Analytics. For performance metrics, a Linux node that's automatically deployed in the cluster as part of the standard deployment collects and forwards the data to Azure Monitor for all Windows nodes in the cluster.

-> [!NOTE]

-> If you've already deployed an AKS cluster and enabled monitoring by using either the Azure CLI or a Resource Manager template, you can't use `kubectl` to upgrade, delete, redeploy, or deploy the agent. The template needs to be deployed in the same resource group as the cluster.

-|Agent resource|Port |

-|Agent resource| Purpose | Port |

-If you have registered your cluster and/or configured HCI Insights before November, 2023, features that use the AMA agent on HCI, such as Arc for Servers Insights, VM Insights, Container Insights, Defender for Cloud or Sentinel may not be collecting logs and event data properly. See [Repair AMA agent for HCI](/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later) for steps to reconfigure the AMA agent and HCI Insights.

-With the upgraded offering of ContainerLogV2 becoming generally available, on 30th September 2026, the ContainerLog table will be retired. If you currently ingest container insights data to the ContainerLog table, please transition to using ContainerLogV2 prior to that date.

-2. Assess the impact migrating to ContainerLogV2 may have on your existing queries, alerts, or dashboards

-4. Validate that you are now ingesting ContainerLogV2 to your Log Analytics workspace.

-> DCR based configuration is not supported for service principal based clusters. Please [migrate your clusters with service principal to managed identity](./container-insights-enable-aks.md#migrate-to-managed-identity-authentication) to use this experience.

-If you are currently using ContainerLog in your alerts, then migrating to ContainerLogV2 requires updates to your alert queries for them to continue functioning as expected.

-To scan for alerts that may be referencing the ContainerLog table, run the following Azure Resource Graph query:

-4. Container insights is already enabled. Select the checkboxes for **Enable Prometheus metrics** and **Enable Grafana**. If you have existing Azure Monitor workspace and Garafana workspace, then they're selected for you. Click **Advanced settings** to select alternate workspaces or create new ones.