+|[Business card](concept-business-card.md) | deprecated|✔️|✔️|✔️ |

+|[General document](concept-general-document.md) | deprecated| ✔️| ✔️| n/a|

+|[Health insurance card](concept-health-insurance-card.md)| ✔️| ✔️| ✔️| n/a|

+|[ID document](concept-id-document.md) | ✔️| ✔️| ✔️| ✔️|

+## Custom classifier

+## Custom neural

+## [**Printed text**](#tab/printed)

+|Chinese Simplified| `zh-Hans`|

+|Chinese Traditional|`zh-Hant`|

+## [**Handwritten text**](#tab/handwritten)

+The following table lists the supported languages for extracting **handwritten** texts.

+|Language| Language code (optional) | Language| Language code (optional) |

+|:--|:-:|:--|:-:|

+|English|`en`|Japanese |`ja`|

+|Chinese Simplified |`zh-Hans`|Korean |`ko`|

+|French |`fr`|Portuguese |`pt`|

+|German |`de`|Spanish |`es`|

+|Italian |`it`|

+## Custom template

+## [**Printed**](#tab/printed)

+The following table lists the supported languages for **printed** text.</br>

+## [**Handwritten**](#tab/handwritten)

+The following table lists the supported languages for extracting handwritten texts.

+|Language| Language code (optional) | Language| Language code (optional) |

+|:--|:-:|:--|:-:|

+|English|`en`|Japanese |`ja`|

+|Chinese Simplified |`zh-Hans`|Korean |`ko`|

+|French |`fr`|Portuguese |`pt`|

+|German |`de`|Spanish |`es`|

+|Italian |`it`|

+>

+> * Don't provide the language code as the parameter unless you are sure of the language and want to force the service to apply only the relevant model. Otherwise, the service may return incomplete and incorrect text.

+## Read model

+##### Model ID: **prebuilt-read**

+### [**Read: handwritten text**](#tab/read-hand)

+### [**Read: printed text**](#tab/read-print)

+ |Language| Code (optional) |

+ |Language| Code (optional) |

+### [**Read: language detection**](#tab/read-detection)

+### [**Layout: handwritten text**](#tab/layout-hand)

+### [**Layout: printed text**](#tab/layout-print)

+## Business card

+ > [!IMPORTANT]

+> Starting with Document Intelligence **v4.0 (preview)**, and going forward, the business card model (prebuilt-businessCard) is deprecated. To extract data from business card formats, use the following:

+| Feature | version| Model ID |

+|- ||--|

+| Business card model|&bullet; v3.1:2023-07-31 (GA)</br>&bullet; v3.0:2022-08-31 (GA)</br>&bullet; v2.1 (GA)|**`prebuilt-businessCard`**|

+## Contract

+## Health insurance card

+## ID document

+| Region | Document types |

+|--|-|

+|Worldwide|Passport Book, Passport Card|

+|United States|Driver License, Identification Card

+## Invoice

+### [Supported languages](#tab/languages)

+| Languages | Details |

+### [Supported Currency Codes](#tab/currency)

+| Currency Code | Details |

+### [Supported languages](#tab/languages)

+### [Supported Currency Codes](#tab/currency)

+ | Supported languages | Details |

+ |:-|:|

+ |English (`en`) | United States (`us`)

+## Receipt

+***Model ID: prebuilt-receipt***

+### [Thermal receipts](#tab/thermal)

+### [Hotel receipts](#tab/hotel)

+| Supported Languages|Language code |

+|:--|:|

+|English (United States)|`en-US`|

+|French|`fr-FR`|

+|German|`de-DE`|

+|Italian|`it-IT`|

+|Japanese|`ja-JP`|

+|Portuguese|`pt-PT`|

+|Spanish|`es-ES`|

+## Tax documents

+ | Model ID | LanguageΓÇöLocale code | Default |

+ |--|:-|:|

+ |**prebuilt-tax.us.w2**|English (United States)|English (United States)ΓÇöen-US|

+ |**prebuilt-tax.us.1098**|English (United States)|English (United States)ΓÇöen-US|

+ |**prebuilt-tax.us.1098E**|English (United States)|English (United States)ΓÇöen-US|

+ |**prebuilt-tax.us.1098T**|English (United States)|English (United States)ΓÇöen-US|

+ |**prebuilt-tax.us.1099**|English (United States)|English (United States)ΓÇöen-US|

+ | Model ID | LanguageΓÇöLocale code | Default |

+ |--|:-|:|

+ |**prebuilt-tax.us.w2**|English (United States)|English (United States)ΓÇöen-US|

+ |**prebuilt-tax.us.1098**|English (United States)|English (United States)ΓÇöen-US|

+ |**prebuilt-tax.us.1098E**|English (United States)|English (United States)ΓÇöen-US|

+ |**prebuilt-tax.us.1098T**|English (United States)|English (United States)ΓÇöen-US|

+ | Model ID | LanguageΓÇöLocale code | Default |

+ |--|:-|:|

+ |**prebuilt-tax.us.w2**|English (United States)|English (United States)ΓÇöen-US|

+)

+| Europe | Sweden Central | `swedentcentral`⁸ |

+⁶ The region doesn't support Speaker Recognition.

+⁸ The region doesn't support Custom Neural Voice.

+#### Real-time text to speech avatar

+| Quota | Free (F0)| Standard (S0) |

+|--|--|--|

+| New connections per minute | Not available for F0 | 2 new connections per minute |

+To enable support for DNS zones, review the following prerequisite:

+* The app routing add-on can be configured to automatically create records on one or more Azure public and private DNS zones for hosts defined on Ingress resources. All public Azure DNS zones need to be in the same resource group, and all private Azure DNS zones need to be in the same resource group. If you don't have an Azure DNS zone, you can [create one][create-an-azure-dns-zone].

+### Create a public Azure DNS zone

+ The following example output shows the certificate URI returned from the command:

+ ```output

+ https://KeyVaultName.vault.azure.net/certificates/KeyVaultCertificateName/ea62e42260f04f17a9309d6b87aceb44

+ ```

+ Update *`<Hostname>`* with the name of your DNS host and *`<KeyVaultCertificateUri>`* with the URI returned from the command to query Azure Key Vault in step 1 above. The string value for `*<KeyVaultCertificateUri>*` should only include `https://yourkeyvault.vault.azure.net/certificates/certname`. The *Certificate Version* at the end of the URI string should be omitted in order to get the current version.

+ The *`secretName`* key in the `tls` section defines the name of the secret that contains the certificate for this Ingress resource. This certificate is presented in the browser when a client browses to the URL specified in the `<Hostname>` key. Make sure that the value of `secretName` is equal to `keyvault-` followed by the value of the Ingress resource name (from `metadata.name`). In the example YAML, `secretName` needs to be equal to `keyvault-<your Ingress name>`.

+[create-an-azure-dns-zone]: #create-a-public-azure-dns-zone

+[app-routing-dns-create]: ./app-routing-dns-ssl.md#create-a-public-azure-dns-zone

+| *container runtime* | Allows containerized applications to run and interact with additional resources, such as the virtual network or storage. AKS clusters using Kubernetes version 1.19+ for Linux node pools use `containerd` as their container runtime. Beginning in Kubernetes version 1.20 for Windows node pools, `containerd` can be used in preview for the container runtime, but Docker is still the default container runtime. AKS clusters using prior versions of Kubernetes for node pools use Docker as their container runtime. |

+- *StatefulSets* maintain the state of applications beyond an individual pod lifecycle.

+For specific log collection or monitoring, you may need to run a pod on all nodes or a select set of nodes. You can use *DaemonSets* to deploy to one or more identical pods. The DaemonSet Controller ensures that each node specified runs an instance of the pod.

+Make sure you have installed [Azure CLI](/cli/azure/install-azure-cli) version 2.47.0 or later. Run `az --version` to find your current version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].

+ - name: ai-service

+| 1.25 | Aug 2022 | Oct 2022 | Dec 2022 | Jan 14, 2024 | Until 1.29 GA |

+- *Cluster Kubernetes version*: Part of the AKS cluster lifecycle involves performing upgrades to the latest Kubernetes version. ItΓÇÖs important that you upgrade to apply the latest security releases and to get access to the latest Kubernetes features, as well as to stay within the [AKS support window][supported-k8s-versions].

+[node-updates-kured]: ./node-updates-kured.md

+If the storage account is **[firewall][azure-storage-ip-firewall] enabled**, it's recommended to use the API Management instance's system-assigned managed identity for access to the account. Ensure that the storage account [grants access to trusted Azure services](../storage/common/storage-network-security.md?tabs=azure-portal#grant-access-to-trusted-azure-services).

+In Azure API Management, API publishers can change API behavior through configuration using *policies*. Policies are a collection of statements that are run sequentially on the request or response of an API. API Management provides more than 50 policies out of the box that you can configure to address common API scenarios such as authentication, rate limiting, caching, and transformation of requests or responses. For a complete list, see [API Management policy reference](api-management-policies.md).

+Popular policies include:

+## Related content

+## Related content

+> * We recommend using the indicated [service tags](../virtual-network/service-tags-overview.md) instead of IP addresses in NSG and other network rules to specify network sources and destinations. Service tags prevent downtime when infrastructure improvements necessitate IP address changes.

+> Control plane IP addresses for Azure API Management should be configured for network access rules only when needed in certain networking scenarios. We recommend using the **ApiManagement** [service tag](../virtual-network/service-tags-overview.md) instead of control plane IP addresses to prevent downtime when infrastructure improvements necessitate IP address changes.

+## Related content

+For more guidance on configuration issues, see:

+* [API Management - Networking FAQs (Demystifying series I)](https://techcommunity.microsoft.com/t5/azure-paas-blog/api-management-networking-faqs-demystifying-series-i/ba-p/1500996)

+* [API Management - Networking FAQs (Demystifying series II)](https://techcommunity.microsoft.com/t5/azure-paas-blog/api-management-networking-faqs-demystifying-series-ii/ba-p/1502056)

+ Title: Perform ongoing administration for Arc-enabled System Center Virtual Machine Manager

+description: Learn how to perform administrator operations related to Azure Arc-enabled System Center Virtual Machine Manager

+# Perform ongoing administration for Arc-enabled System Center Virtual Machine Manager

+In this article, you learn how to perform various administrative operations related to Azure Arc-enabled System Center Virtual Machine Manager (SCVMM):

+- Upgrade the Azure Arc resource bridge manually

+- Update the SCVMM account credentials

+- Collect logs from the Arc resource bridge

+Each of these operations requires either SSH key to the resource bridge VM or the kubeconfig file that provides access to the Kubernetes cluster on the resource bridge VM.

+## Upgrade the Arc resource bridge manually

+Azure Arc-enabled SCVMM requires the Arc resource bridge to connect your SCVMM environment with Azure. Periodically, new images of Arc resource bridge are released to include security and feature updates. The Arc resource bridge can be manually upgraded from the SCVMM server. You must meet all upgrade [prerequisites](../resource-bridge/upgrade.md#prerequisites) before attempting to upgrade. The SCVMM server must have the kubeconfig and appliance configuration files stored locally. If the SCVMM account credentials changed after the initial deployment of the resource bridge, [update the new account credentials](administer-arc-scvmm.md#update-the-scvmm-account-credentials-using-a-new-password-or-a-new-scvmm-account-after-onboarding) before attempting manual upgrade.

+> [!NOTE]

+> The manual upgrade feature is available for resource bridge version 1.0.14 and later. Resource bridges below version 1.0.14 must [perform the recovery option](./disaster-recovery.md) to upgrade to version 1.0.15 or later.

+The manual upgrade generally takes between 30-90 minutes, depending on the network speed. The upgrade command takes your Arc resource bridge to the immediate next version, which might not be the latest available version. Multiple upgrades could be needed to reach a [supported version](../resource-bridge/upgrade.md#supported-versions). You can check your resource bridge version by checking the Azure resource of your Arc resource bridge.

+To manually upgrade your Arc resource bridge, make sure you've installed the latest `az arcappliance` CLI extension by running the extension upgrade command from the SCVMM server:

+```azurecli

+az extension add --upgrade --name arcappliance

+```

+To manually upgrade your resource bridge, use the following command:

+```azurecli

+az arcappliance upgrade scvmm --config-file <file path to ARBname-appliance.yaml>

+```

+## Update the SCVMM account credentials (using a new password or a new SCVMM account after onboarding)

+Azure Arc-enabled SCVMM uses the SCVMM account credentials you provided during the onboarding to communicate with your SCVMM management server. These credentials are only persisted locally on the Arc resource bridge VM.

+As part of your security practices, you might need to rotate credentials for your SCVMM accounts. As credentials are rotated, you must also update the credentials provided to Azure Arc to ensure the functioning of Azure Arc-enabled SCVMM. You can also use the same steps in case you need to use a different SCVMM account after onboarding. You must ensure the new account also has all the [required SCVMM permissions](quickstart-connect-system-center-virtual-machine-manager-to-arc.md#prerequisites).

+There are two different sets of credentials stored on the Arc resource bridge. You can use the same account credentials for both.

+- **Account for Arc resource bridge**. This account is used for deploying the Arc resource bridge VM and will be used for upgrade.

+- **Account for SCVMM cluster extension**. This account is used to discover inventory and perform all the VM operations through Azure Arc-enabled SCVMM.

+To update the credentials of the account for Arc resource bridge, run the following Azure CLI commands. Run the commands from a workstation that can access cluster configuration IP address of the Arc resource bridge locally:

+```azurecli

+az account set -s <subscription id>

+az arcappliance get-credentials -n <name of the appliance> -g <resource group name>

+az arcappliance update-infracredentials scvmm --kubeconfig kubeconfig

+```

+For more information on the commands, see [`az arcappliance get-credentials`](/cli/azure/arcappliance#az-arcappliance-get-credentials) and [`az arcappliance update-infracredentials scvmm`](/cli/azure/arcappliance/update-infracredentials#az-arcappliance-update-infracredentials-scvmm).

+To update the credentials used by the SCVMM cluster extension on the resource bridge. This command can be run from anywhere with `connectedscvmm` CLI extension installed.

+```azurecli

+az connectedscvmm scvmm connect --custom-location <name of the custom location> --location <Azure region> --name <name of the SCVMM resource in Azure> --resource-group <resource group for the SCVMM resource> --username <username for the SCVMM account> --password <password to the SCVMM account>

+```

+## Collect logs from the Arc resource bridge

+For any issues encountered with the Azure Arc resource bridge, you can collect logs for further investigation. To collect the logs, use the Azure CLI [`Az arcappliance log`](/cli/azure/arcappliance/logs#az-arcappliance-logs-scvmm) command.

+To save the logs to a destination folder, run the following commands. These commands need connectivity to cluster configuration IP address.

+```azurecli

+az account set -s <subscription id>

+az arcappliance get-credentials -n <name of the appliance> -g <resource group name>

+az arcappliance logs scvmm --kubeconfig kubeconfig --out-dir <path to specified output directory>

+```

+If the Kubernetes cluster on the resource bridge isn't in functional state, you can use the following commands. These commands require connectivity to IP address of the Azure Arc resource bridge VM via SSH.

+```azurecli

+az account set -s <subscription id>

+az arcappliance get-credentials -n <name of the appliance> -g <resource group name>

+az arcappliance logs scvmm --out-dir <path to specified output directory> --ip XXX.XXX.XXX.XXX

+```

+## Next steps

+- [Troubleshoot common issues related to resource bridge](../resource-bridge/troubleshoot-resource-bridge.md).

+- [Understand disaster recovery operations for resource bridge](./disaster-recovery.md).

+ Title: Create or edit an activity log, service health, or resource health alert rule

+description: This article shows you how to create a new activity log, service health, and resource health alert rule.

+# Create or edit an activity log, service health, or resource health alert rule

+This article shows you how to create or edit an activity log, service health, or resource health alert rule. To learn more about alerts, see the [alerts overview](alerts-overview.md).

+You create an alert rule by combining the resources to be monitored, the monitoring data from the resource, and the conditions that you want to trigger the alert. You can then define [action groups](./action-groups.md) and [alert processing rules](alerts-action-rules.md) to determine what happens when an alert is triggered.

+Alerts triggered by these alert rules contain a payload that uses the [common alert schema](alerts-common-schema.md).

+## Configure the alert rule conditions

+1. On the **Condition** tab, when you select the **Signal name** field, the most commonly used signals are displayed in the drop-down list. Select one of these popular signals, or select **See all signals** if you want to choose a different signal for the condition.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-popular-signals.png" alt-text="Screenshot that shows popular signals when creating an alert rule.":::

+1. (Optional) If you chose to **See all signals** in the previous step, use the **Select a signal** pane to search for the signal name or filter the list of signals. Filter by:

+ - **Signal type**: The [type of alert rule](alerts-overview.md#types-of-alerts) you're creating.

+ - **Signal source**: The service sending the signal.

+ This table describes the services available for activity log alert rules:

+ | Signal source | Description |

+ |--|--|

+ | Activity log ΓÇô Policy | The service that provides the Policy activity log events. |

+ | Activity log ΓÇô Autoscale | The service that provides the Autoscale activity log events. |

+ | Activity log ΓÇô Security | The service that provides the Security activity log events. |

+ | Resource health | The service that provides the resource-level health status. |

+ | Service health | The service that provides the subscription-level health status. |

+ Select the **Signal name** and **Apply**.

+ #### [Activity log alert](#tab/activity-log)

+ 1. On the **Conditions** pane, select the **Chart period**.

+ 1. The **Preview** chart shows you the results of your selection.

+ 1. Select values for each of these fields in the **Alert logic** section:

+ |Field |Description |

+ |||

+ |Event level| Select the level of the events for this alert rule. Values are **Critical**, **Error**, **Warning**, **Informational**, **Verbose**, and **All**.|

+ |Status|Select the status levels for the alert.|

+ |Event initiated by|Select the user or service principal that initiated the event.|

+ #### [Resource Health alert](#tab/resource-health)

+ 1. On the **Conditions** pane, select values for each of these fields:

+ |Field |Description |

+ |||

+ |Event status| Select the statuses of Resource Health events. Values are **Active**, **In Progress**, **Resolved**, and **Updated**.|

+ |Current resource status|Select the current resource status. Values are **Available**, **Degraded**, and **Unavailable**.|

+ |Previous resource status|Select the previous resource status. Values are **Available**, **Degraded**, **Unavailable**, and **Unknown**.|

+ |Reason type|Select the causes of the Resource Health events. Values are **Platform Initiated**, **Unknown**, and **User Initiated**.|

+

+ #### [Service Health alert](#tab/service-health)

+ 1. On the **Conditions** pane, select values for each of these fields:

+ |Field |Description |

+ |||

+ |Services| Select the Azure services.|

+ |Regions|Select the Azure regions.|

+ |Event types|Select the types of Service Health events. Values are **Service issue**, **Planned maintenance**, **Health advisories**, and **Security advisories**.|

+

+## Configure the alert rule details

+1. Enter values for the **Alert rule name** and the **Alert rule description**.

+1. Select **Enable upon creation** for the alert rule to start running as soon as you're done creating it.

+1. [!INCLUDE [alerts-wizard-custom=properties](../includes/alerts-wizard-custom-properties.md)]

+## Next steps

+ [View and manage your alert instances](alerts-manage-alert-instances.md)

+ Title: Create Azure Monitor log alert rules

+description: This article shows you how to create a new log alert rule.

+# Create or edit a log alert rule

+This article shows you how to create a new log alert rule or edit an existing log alert rule. To learn more about alerts, see the [alerts overview](alerts-overview.md).

+You create an alert rule by combining the resources to be monitored, the monitoring data from the resource, and the conditions that you want to trigger the alert. You can then define [action groups](./action-groups.md) and [alert processing rules](alerts-action-rules.md) to determine what happens when an alert is triggered.

+Alerts triggered by these alert rules contain a payload that uses the [common alert schema](alerts-common-schema.md).

+## Configure the alert rule conditions

+1. On the **Condition** tab, when you select the **Signal name** field, the most commonly used signals are displayed in the drop-down list. Select one of these popular signals, or select **See all signals** if you want to choose a different signal for the condition.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-popular-signals.png" alt-text="Screenshot that shows popular signals when creating an alert rule.":::

+1. (Optional) If you chose to **See all signals** in the previous step, use the **Select a signal** pane to search for the signal name or filter the list of signals. Filter by:

+ - **Signal type**: The [type of alert rule](alerts-overview.md#types-of-alerts) you're creating.

+ - **Signal source**: The service that sends the "Custom log search" and "Log (saved query)" signals.

+ Select the **Signal name** and **Apply**.

+1. On the **Logs** pane, write a query that returns the log events for which you want to create an alert.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-log-rule-query-pane.png" alt-text="Screenshot that shows the Query pane when creating a new log alert rule.":::

+ To use one of the predefined alert rule queries, expand the **Schema and filter** pane on the left of the **Logs** pane. Then select the **Queries** tab, and select one of the queries.

+1. (Optional) If you're querying an ADX or ARG cluster, Log Analytics can't automatically identify the column with the event timestamp, so we recommend that you add a time range filter to the query. For example:

+ ```KQL

+ adx('https://help.kusto.windows.net/Samples').table

+ | where MyTS >= ago(5m) and MyTS <= now()

+ ```

+

+ ```KQL

+ arg("").Resources

+ | where type =~ 'Microsoft.Compute/virtualMachines'

+ | project _ResourceId=tolower(id), tags

+ ```

+

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-logs-conditions-tab.png" alt-text="Screenshot that shows the Condition tab when creating a new log alert rule.":::

+1. Select **Run** to run the alert.

+1. The **Preview** section shows you the query results. When you're finished editing your query, select **Continue Editing Alert**.

+1. The **Condition** tab opens populated with your log query. By default, the rule counts the number of results in the last five minutes. If the system detects summarized query results, the rule is automatically updated with that information.

+1. In the **Measurement** section, select values for these fields:

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-log-measurements.png" alt-text="Screenshot that shows the Measurement tab when creating a new log alert rule.":::

+ |Field |Description |

+ |||

+ |Measure|Log alerts can measure two different things, which can be used for different monitoring scenarios:<br> **Table rows**: The number of rows returned can be used to work with events such as Windows event logs, Syslog, and application exceptions. <br>**Calculation of a numeric column**: Calculations based on any numeric column can be used to include any number of resources. An example is CPU percentage. |

+ |Aggregation type| The calculation performed on multiple records to aggregate them to one numeric value by using the aggregation granularity. Examples are Total, Average, Minimum, or Maximum. |

+ |Aggregation granularity| The interval for aggregating multiple records to one numeric value.|

+1. <a name="dimensions"></a>(Optional) In the **Split by dimensions** section, you can use dimensions to help provide context for the triggered alert.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-create-log-rule-dimensions.png" alt-text="Screenshot that shows the splitting by dimensions section of a new log alert rule.":::

+ Dimensions are columns from your query results that contain additional data. When you use dimensions, the alert rule groups the query results by the dimension values and evaluates the results of each group separately. If the condition is met, the rule fires an alert for that group. The alert payload includes the combination that triggered the alert.

+ You can apply up to six dimensions per alert rule. Dimensions can only be string or numeric columns. If you want to use a column that isn't a number or string type as a dimension, you must convert it to a string or numeric value in your query. If you select more than one dimension value, each time series that results from the combination triggers its own alert and is charged separately.

+ For example:

+ - You could use dimensions to monitor CPU usage on multiple instances running your website or app. Each instance is monitored individually, and notifications are sent for each instance where the CPU usage exceeds the configured value.

+ - You could decide not to split by dimensions when you want a condition applied to multiple resources in the scope. For example, you wouldn't use dimensions if you want to fire an alert if at least five machines in the resource group scope have CPU usage above the configured value.

+ Select values for these fields:

+ - **Resource ID column**: In general, if your alert rule scope is a workspace, the alerts are fired on the workspace. If you want a separate alert for each affected Azure resource, you can:

+ - use the ARM **Azure Resource ID** column as a dimension

+ - specify it as a dimension in the Azure Resource ID property, which makes the resource returned by your query the target of the alert, so alerts are fired on the resource returned by your query, such as a virtual machine or a storage account, as opposed to in the workspace. When you use this option, if the workspace gets data from resources in more than one subscription, alerts can be triggered on resources from a subscription that is different from the alert rule subscription.

+ |Field |Description |

+ |||

+ |Dimension name|Dimensions can be either number or string columns. Dimensions are used to monitor specific time series and provide context to a fired alert.|

+ |Operator|The operator used on the dimension name and value. |

+ |Dimension values|The dimension values are based on data from the last 48 hours. Select **Add custom value** to add custom dimension values. |

+ |Include all future values| Select this field to include any future values added to the selected dimension. |

+1. In the **Alert logic** section, select values for these fields:

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-create-log-rule-logic.png" alt-text="Screenshot that shows the Alert logic section of a new log alert rule.":::

+ |Field |Description |

+ |||

+ |Operator| The query results are transformed into a number. In this field, select the operator to use to compare the number against the threshold.|

+ |Threshold value| A number value for the threshold. |

+ |Frequency of evaluation|How often the query is run. Can be set anywhere from one minute to one day (24 hours).|

+ > [!NOTE]

+ > There are some limitations to using a <a name="frequency">one minute</a> alert rule frequency. When you set the alert rule frequency to one minute, an internal manipulation is performed to optimize the query. This manipulation can cause the query to fail if it contains unsupported operations. The following are the most common reasons a query are not supported:

+ > * The query contains the **search**, **union** or **take** (limit) operations

+ > * The query contains the **ingestion_time()** function

+ > * The query uses the **adx** pattern

+ > * The query calls a function that calls other tables

+1. (Optional) In the **Advanced options** section, you can specify the number of failures and the alert evaluation period required to trigger an alert. For example, if you set **Aggregation granularity** to 5 minutes, you can specify that you only want to trigger an alert if there were three failures (15 minutes) in the last hour. Your application business policy determines this setting.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-rule-preview-advanced-options.png" alt-text="Screenshot that shows the Advanced options section of a new log alert rule.":::

+ Select values for these fields under **Number of violations to trigger the alert**:

+ |Field |Description |

+ |||

+ |Number of violations|The number of violations that trigger the alert.|

+ |Evaluation period|The time period within which the number of violations occur. |

+ |Override query time range| If you want the alert evaluation period to be different than the query time range, enter a time range here.<br> The alert time range is limited to a maximum of two days. Even if the query contains an **ago** command with a time range of longer than two days, the two-day maximum time range is applied. For example, even if the query text contains **ago(7d)**, the query only scans up to two days of data. If the query requires more data than the alert evaluation you can change the time range manually. If the query contains **ago** command, it will be changed automatically to 2 days (48 hours).|

+ > [!NOTE]

+ > If you or your administrator assigned the Azure Policy **Azure Log Search Alerts over Log Analytics workspaces should use customer-managed keys**, you must select **Check workspace linked storage**. If you don't, the rule creation will fail because it won't meet the policy requirements.

+1. The **Preview** chart shows query evaluations results over time. You can change the chart period or select different time series that resulted from a unique alert splitting by dimensions.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-create-alert-rule-preview.png" alt-text="Screenshot that shows a preview of a new alert rule.":::

+1. Select **Done**. From this point on, you can select the **Review + create** button at any time.

+## Configure the alert rule details

+1. On the **Details** tab, define the **Project details**.

+ - Select the **Subscription**.

+ - Select the **Resource group**.

+1. Define the **Alert rule details**.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-log-rule-details-tab.png" alt-text="Screenshot that shows the Details tab when creating a new log alert rule.":::

+ 1. Select the **Severity**.

+ 1. Enter values for the **Alert rule name** and the **Alert rule description**.

+ 1. Select the **Region**.

+ 1. <a name="managed-id"></a>In the **Identity** section, select which identity is used by the log alert rule to send the log query. This identity is used for authentication when the alert rule executes the log query.

+ Keep these things in mind when selecting an identity:

+ - A managed identity is required if you're sending a query to Azure Data Explorer.

+ - Use a managed identity if you want to be able to see or edit the permissions associated with the alert rule.

+ - If you don't use a managed identity, the alert rule permissions are based on the permissions of the last user to edit the rule, at the time the rule was last edited.

+ - Use a managed identity to help you avoid a case where the rule doesn't work as expected because the user that last edited the rule didn't have permissions for all the resources added to the scope of the rule.

+ The identity associated with the rule must have these roles:

+ - If the query is accessing a Log Analytics workspace, the identity must be assigned a **Reader role** for all workspaces accessed by the query. If you're creating resource-centric log alerts, the alert rule may access multiple workspaces, and the identity must have a reader role on all of them.

+ - If you are querying an ADX or ARG cluster you must add **Reader role** for all data sources accessed by the query. For example, if the query is resource centric, it needs a reader role on that resources.

+ - If the query is [accessing a remote Azure Data Explorer cluster](../logs/azure-monitor-data-explorer-proxy.md), the identity must be assigned:

+ - **Reader role** for all data sources accessed by the query. For example, if the query is calling a remote Azure Data Explorer cluster using the adx() function, it needs a reader role on that ADX cluster.

+ - **Database viewer** for all databases the query is accessing.

+ For detailed information on managed identities, see [managed identities for Azure resources](../../active-directory/managed-identities-azure-resources/overview.md).

+ Select one of the following options for the identity used by the alert rule:

+ |Identity |Description |

+ |||

+ |None|Alert rule permissions are based on the permissions of the last user who edited the rule, at the time the rule was edited.|

+ |System assigned managed identity| Azure creates a new, dedicated identity for this alert rule. This identity has no permissions and is automatically deleted when the rule is deleted. After creating the rule, you must assign permissions to this identity to access the workspace and data sources needed for the query. For more information about assigning permissions, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md). |

+ |User assigned managed identity|Before you create the alert rule, you [create an identity](../../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md#create-a-user-assigned-managed-identity) and assign it appropriate permissions for the log query. This is a regular Azure identity. You can use one identity in multiple alert rules. The identity isn't deleted when the rule is deleted. When you select this type of identity, a pane opens for you to select the associated identity for the rule. |

+1. (Optional) In the **Advanced options** section, you can set several options:

+ |Field |Description |

+ |||

+ |Enable upon creation| Select for the alert rule to start running as soon as you're done creating it.|

+ |Automatically resolve alerts (preview) |Select to make the alert stateful. When an alert is stateful, the alert is resolved when the condition is no longer met for a specific time range. The time range differs based on the frequency of the alert:<br>**1 minute**: The alert condition isn't met for 10 minutes.<br>**5-15 minutes**: The alert condition isn't met for three frequency periods.<br>**15 minutes - 11 hours**: The alert condition isn't met for two frequency periods.<br>**11 to 12 hours**: The alert condition isn't met for one frequency period. <br><br>Note that stateful log alerts have these limitations:<br> - they can trigger up to 300 alerts per evaluation.<br> - you can have a maximum of 5000 alerts with the `fired` alert condition.|

+ |Mute actions |Select to set a period of time to wait before alert actions are triggered again. If you select this checkbox, the **Mute actions for** field appears to select the amount of time to wait after an alert is fired before triggering actions again.|

+ |Check workspace linked storage|Select if logs workspace linked storage for alerts is configured. If no linked storage is configured, the rule isn't created.|

+1. [!INCLUDE [alerts-wizard-custom=properties](../includes/alerts-wizard-custom-properties.md)]

+## Next steps

+ [View and manage your alert instances](alerts-manage-alert-instances.md)

+ Title: Create Azure Monitor metric alert rules

+description: This article shows you how to create a new metric alert rule.

+# Create or edit a metric alert rule

+This article shows you how to create a new metric alert rule or edit an existing metric alert rule. To learn more about alerts, see the [alerts overview](alerts-overview.md).

+You create an alert rule by combining the resources to be monitored, the monitoring data from the resource, and the conditions that you want to trigger the alert. You can then define [action groups](./action-groups.md) and [alert processing rules](alerts-action-rules.md) to determine what happens when an alert is triggered.

+Alerts triggered by these alert rules contain a payload that uses the [common alert schema](alerts-common-schema.md).

+## Configure the alert rule conditions

+1. On the **Condition** tab, when you select the **Signal name** field, the most commonly used signals are displayed in the drop-down list. Select one of these popular signals, or select **See all signals** if you want to choose a different signal for the condition.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-popular-signals.png" alt-text="Screenshot that shows popular signals when creating an alert rule.":::

+1. (Optional) If you chose to **See all signals** in the previous step, use the **Select a signal** pane to search for the signal name or filter the list of signals. Filter by:

+ - **Signal type**: The [type of alert rule](alerts-overview.md#types-of-alerts) you're creating.

+ - **Signal source**: The service sending the signal.

+ This table describes the services available for metric alert rules:

+ |Signal source |Description |

+ |||

+ |Platform |For metric signals, the monitor service is the metric namespace. "Platform" means the metrics are provided by the resource provider, namely, Azure.|

+ |Azure.ApplicationInsights|Customer-reported metrics, sent by the Application Insights SDK. |

+ |Azure.VM.Windows.GuestMetrics |VM guest metrics, collected by an extension running on the VM. Can include built-in operating system perf counters and custom perf counters. |

+ |\<your custom namespace\>|A custom metric namespace, containing custom metrics sent with the Azure Monitor Metrics API. |

+ Select the **Signal name** and **Apply**.

+1. Preview the results of the selected metric signal in the **Preview** section. Select values for the following fields.

+ |Field|Description|

+ |||

+ |Time range|The time range to include in the results. Can be from the last six hours to the last week.|

+ |Time series|The time series to include in the results.|

+1. In the **Alert logic** section:

+ |Field |Description |

+ |||

+ |Threshold|Select if the threshold should be evaluated based on a static value or a dynamic value.<br>A **static threshold** evaluates the rule by using the threshold value that you configure.<br>**Dynamic thresholds** use machine learning algorithms to continuously learn the metric behavior patterns and calculate the appropriate thresholds for unexpected behavior. You can learn more about using [dynamic thresholds for metric alerts](alerts-types.md#apply-advanced-machine-learning-with-dynamic-thresholds). |

+ |Operator|Select the operator for comparing the metric value against the threshold. <br>If you're using dynamic thresholds, alert rules can use tailored thresholds based on metric behavior for both upper and lower bounds in the same alert rule. Select one of these operators: <br> - Greater than the upper threshold or lower than the lower threshold (default) <br> - Greater than the upper threshold <br> - Lower than the lower threshold|

+ |Aggregation type|Select the aggregation function to apply on the data points: Sum, Count, Average, Min, or Max.|

+ |Threshold value|If you selected a **static** threshold, enter the threshold value for the condition logic.|

+ |Unit|If the selected metric signal supports different units, such as bytes, KB, MB, and GB, and if you selected a **static** threshold, enter the unit for the condition logic.|

+ |Threshold sensitivity|If you selected a **dynamic** threshold, enter the sensitivity level. The sensitivity level affects the amount of deviation from the metric series pattern that's required to trigger an alert. <br> - **High**: Thresholds are tight and close to the metric series pattern. An alert rule is triggered on the smallest deviation, resulting in more alerts. <br> - **Medium**: Thresholds are less tight and more balanced. There are fewer alerts than with high sensitivity (default). <br> - **Low**: Thresholds are loose, allowing greater deviation from the metric series pattern. Alert rules are only triggered on large deviations, resulting in fewer alerts.|

+ |Aggregation granularity| Select the interval that's used to group the data points by using the aggregation type function. Choose an **Aggregation granularity** (period) that's greater than the **Frequency of evaluation** to reduce the likelihood of missing the first evaluation period of an added time series.|

+ |Frequency of evaluation|Select how often the alert rule is to be run. Select a frequency that's smaller than the aggregation granularity to generate a sliding window for the evaluation.|

+1. (Optional) You can configure splitting by dimensions.

+ Dimensions are name-value pairs that contain more data about the metric value. By using dimensions, you can filter the metrics and monitor specific time-series, instead of monitoring the aggregate of all the dimensional values.

+

+ If you select more than one dimension value, each time series that results from the combination triggers its own alert and is charged separately. For example, the transactions metric of a storage account can have an API name dimension that contains the name of the API called by each transaction (for example, GetBlob, DeleteBlob, and PutPage). You can choose to have an alert fired when there's a high number of transactions in a specific API (the aggregated data). Or you can use dimensions to alert only when the number of transactions is high for specific APIs.

+

+ |Field |Description |

+ |||

+ |Dimension name|Dimensions can be either number or string columns. Dimensions are used to monitor specific time series and provide context to a fired alert.<br>Splitting on the **Azure Resource ID** column makes the specified resource into the alert target. If detected, the **ResourceID** column is selected automatically and changes the context of the fired alert to the record's resource.|

+ |Operator|The operator used on the dimension name and value.|

+ |Dimension values|The dimension values are based on data from the last 48 hours. Select **Add custom value** to add custom dimension values.|

+ |Include all future values| Select this field to include any future values added to the selected dimension.|

+1. (Optional) In the **When to evaluate** section:

+ |Field |Description |

+ |||

+ |Check every|Select how often the alert rule checks if the condition is met. |

+ |Lookback period|Select how far back to look each time the data is checked. For example, every 1 minute, look back 5 minutes.|

+1. (Optional) In the **Advanced options** section, you can specify how many failures within a specific time period trigger an alert. For example, you can specify that you only want to trigger an alert if there were three failures in the last hour. Your application business policy should determine this setting.

+ Select values for these fields:

+

+ |Field |Description |

+ |||

+ |Number of violations|The number of violations within the configured time frame that trigger the alert.|

+ |Evaluation period|The time period within which the number of violations occur.|

+ |Ignore data before|Use this setting to select the date from which to start using the metric historical data for calculating the dynamic thresholds. For example, if a resource was running in testing mode and is moved to production, you may want to disregard the metric behavior while the resource was in testing.|

+1. Select **Done**. From this point on, you can select the **Review + create** button at any time.

+## Configure the alert rule details

+1. On the **Details** tab, define the **Project details**.

+ - Select the **Subscription**.

+ - Select the **Resource group**.

+1. Define the **Alert rule details**.

+ :::image type="content" source="media/alerts-create-new-alert-rule/alerts-metric-rule-details-tab.png" alt-text="Screenshot that shows the Details tab when creating a new alert rule.":::

+1. Select the **Severity**.

+1. Enter values for the **Alert rule name** and the **Alert rule description**.

+1. (Optional) If you're creating a metric alert rule that monitors a custom metric with the scope defined as one of the following regions and you want to make sure that the data processing for the alert rule takes place within that region, you can select to process the alert rule in one of these regions:

+ - North Europe

+ - West Europe

+ - Sweden Central

+ - Germany West Central

+1. (Optional) In the **Advanced options** section, you can set several options.

+ |Field |Description |

+ |||

+ |Enable upon creation| Select for the alert rule to start running as soon as you're done creating it.|

+ |Automatically resolve alerts (preview) |Select to make the alert stateful. When an alert is stateful, the alert is resolved when the condition is no longer met.<br> If you don't select this checkbox, metric alerts are stateless. Stateless alerts fire each time the condition is met, even if alert already fired.<br> The frequency of notifications for stateless metric alerts differs based on the alert rule's configured frequency:<br>**Alert frequency of less than 5 minutes**: While the condition continues to be met, a notification is sent somewhere between one and six minutes.<br>**Alert frequency of more than 5 minutes**: While the condition continues to be met, a notification is sent between the configured frequency and doubles the value of the frequency. For example, for an alert rule with a frequency of 15 minutes, a notification is sent somewhere between 15 to 30 minutes.|

+1. [!INCLUDE [alerts-wizard-custom=properties](../includes/alerts-wizard-custom-properties.md)]

+## Next steps

+ [View and manage your alert instances](alerts-manage-alert-instances.md)

+ |Threshold|Select if the threshold should be evaluated based on a static value or a dynamic value.<br>A **static threshold** evaluates the rule by using the threshold value that you configure.<br>**Dynamic thresholds** use machine learning algorithms to continuously learn the metric behavior patterns and calculate the appropriate thresholds for unexpected behavior. You can learn more about using [dynamic thresholds for metric alerts](alerts-types.md#apply-advanced-machine-learning-with-dynamic-thresholds). |

+ Title: Create Azure Monitor alert rules using the CLI, PowerShell or an ARM template

+description: This article shows you how to create a new alert rule using the CLI, PowerShell or an ARM template.

+# Create a new alert rule using the CLI, PowerShell, or an ARM template

+You can create a new alert rule using the [Create a new alert rule using the CLI](#create-a-new-alert-rule-using-the-cli), [PowerShell](#create-a-new-alert-rule-using-powershell), or an [Azure Resource Manager template](#create-a-new-alert-rule-using-an-arm-template).

+## Create a new alert rule using the CLI

+You can create a new alert rule using the [Azure CLI](/cli/azure/get-started-with-azure-cli). The following code examples use [Azure Cloud Shell](../../cloud-shell/overview.md). You can see the full list of the [Azure CLI commands for Azure Monitor](/cli/azure/azure-cli-reference-for-monitor#azure-monitor-references).

+1. In the [portal](https://portal.azure.com/), select **Cloud Shell**. At the prompt, use the commands that follow.

+ To create a metric alert rule, use the `az monitor metrics alert create` command. You can see detailed documentation on the metric alert rule create command in the `az monitor metrics alert create` section of the [CLI reference documentation for metric alerts](/cli/azure/monitor/metrics/alert).

+ To create a metric alert rule that monitors if average Percentage CPU on a VM is greater than 90:

+ ```azurecli

+ az monitor metrics alert create -n {nameofthealert} -g {ResourceGroup} --scopes {VirtualMachineResourceID} --condition "avg Percentage CPU > 90" --description {descriptionofthealert}

+ ```

+## Create a new alert rule using PowerShell

+- To create a metric alert rule using PowerShell, use the [Add-AzMetricAlertRuleV2](/powershell/module/az.monitor/add-azmetricalertrulev2) cmdlet.

+- To create a log alert rule using PowerShell, use the [New-AzScheduledQueryRule](/powershell/module/az.monitor/new-azscheduledqueryrule) cmdlet.

+- To create an activity log alert rule using PowerShell, use the [Set-AzActivityLogAlert](/powershell/module/az.monitor/set-azactivitylogalert) cmdlet.

+## Create a new alert rule using an ARM template

+You can use an [Azure Resource Manager template (ARM template)](../../azure-resource-manager/templates/syntax.md) to configure alert rules consistently in all of your environments.

+1. Create a new resource, using the following resource types:

+ - For metric alerts: `Microsoft.Insights/metricAlerts`

+ - For log alerts: `Microsoft.Insights/scheduledQueryRules`

+ - For activity log, service health, and resource health alerts: `microsoft.Insights/activityLogAlerts`

+ > [!NOTE]

+ > - Metric alerts for an Azure Log Analytics workspace resource type (`Microsoft.OperationalInsights/workspaces`) are configured differently than other metric alerts. For more information, see [Resource Template for Metric Alerts for Logs](alerts-metric-logs.md#resource-template-for-metric-alerts-for-logs).

+ > - We recommend that you create the metric alert using the same resource group as your target resource.

+1. Copy one of the templates from these sample ARM templates.

+ - For metric alerts: [Resource Manager template samples for metric alert rules](resource-manager-alerts-metric.md)

+ - For log alerts: [Resource Manager template samples for log alert rules](resource-manager-alerts-log.md)

+ - For activity log alerts: [Resource Manager template samples for activity log alert rules](resource-manager-alerts-activity-log.md)

+ - For resource health alerts: [Resource Manager template samples for resource health alert rules](resource-manager-alerts-resource-health.md)

+1. Edit the template file to contain appropriate information for your alert, and save the file as \<your-alert-template-file\>.json.

+1. Edit the corresponding parameters file to customize the alert, and save as \<your-alert-template-file\>.parameters.json.

+1. Set the `metricName` parameter, using one of the values in [Azure Monitor supported metrics](../essentials/metrics-supported.md).

+1. Deploy the template using [PowerShell](../../azure-resource-manager/templates/deploy-powershell.md#deploy-local-template) or the [CLI](../../azure-resource-manager/templates/deploy-cli.md#deploy-local-template).

+## Next steps

+[Manage alert rules](alerts-manage-alert-rules.md)

+[Manage alert instances](alerts-manage-alert-instances.md)

+

+For more information about multi-resource alert rules and the resource types supported for this capability, see [Monitoring at scale using metric alerts in Azure Monitor](alerts-types.md#monitor-multiple-resources-with-one-alert-rule).

+# Choosing the right type of alert rule

+For more information about pricing, see the [pricing page](https://azure.microsoft.com/pricing/details/monitor/).

+## Types of Azure Monitor alerts

+- You can use [dynamic thresholds](#apply-advanced-machine-learning-with-dynamic-thresholds), which are driven by machine learning.

+- [Multiple resources](#monitor-multiple-resources-with-one-alert-rule) of the same type in the same Azure region, such as a resource group.

+### Applying multiple conditions to a metric alert rule

+### Narrow the target using dimensions

+### Monitor the same condition on multiple resources using splitting by dimensions

+### Monitor multiple resources with one alert rule

+### Apply advanced machine learning with dynamic thresholds

+### Monitor multiple instances of a resource using dimensions

+### Monitor the same condition on multiple resources using splitting by dimensions

+### Use the API for log alert rules

+### Log alerts on your Azure bill

+> If you're new to Azure Monitor or want to monitor a single Azure resource, start with the [Monitor Azure resources with Azure Monitor tutorial](essentials/monitor-azure-resource.md). The tutorial provides general concepts for Azure Monitor and guidance for monitoring a single Azure resource. This article provides recommendations for preparing your environment to leverage all features of Azure Monitor to monitoring your entire set of applications and resources together at scale.

+| Azure Active Directory | [AADDomainServicesDNSAuditsGeneral](/azure/azure-monitor/reference/tables/AADDomainServicesDNSAuditsGeneral)<br> [AADDomainServicesDNSAuditsDynamicUpdates](/azure/azure-monitor/reference/tables/AADDomainServicesDNSAuditsDynamicUpdates)<br>[AADServicePrincipalSignInLogs](/azure/azure-monitor/reference/tables/AADServicePrincipalSignInLogs) |

+* Following the pipe is the [`take` operator](#take).

+ We could run the query even without adding `| take 10`. The command would still be valid, but it could return up to 30,000 results.

+#### Take

+Use the [`take` operator](/azure/data-explorer/kusto/query/takeoperator) to view a small sample of records by returning up to the specified number of records. The selected results are arbitrary and displayed in no particular order. If you need to return results in a particular order, use the [`sort` and `top` operators](#sort-and-top).

+This section describes the `sort` and `top` operators and their `desc` and `asc` arguments. Although [`take`](#take) is useful for getting a few records, you can't select or sort the results in any particular order. To get an ordered view, use `sort` and `top`.

+### Desc and asc

+#### Desc

+Use the `desc` argument to sort records in descending order. Descending is the default sorting order for `sort` and `top`, so you can usually omit the `desc` argument.

+For example, the data returned by both of the following queries is sorted by the [TimeGenerated column](./log-standard-columns.md#timegenerated), in descending order:

+- ```Kusto

+ SecurityEvent

+ | sort by TimeGenerated desc

+ ```

+- ```Kusto

+ SecurityEvent

+ | sort by TimeGenerated

+ ```

+

+#### Asc

+To sort in ascending order, specify `asc`.

+### Sort

+You can use the [`sort` operator](/azure/data-explorer/kusto/query/sort-operator). `sort` sorts the query results by the column you specify. However, `sort` doesn't limit the number of records that are returned by the query.

+For example, the following query returns all available records for the `SecurityEvent` table, which is up to a maximum of 30,000 records, and sorts them by the TimeGenerated column.

+| sort by TimeGenerated

+The preceding query could return too many results. Also, it might also take some time to return the results. The query sorts the entire `SecurityEvent` table by the `TimeGenerated` column. The Analytics portal then limits the display to only 30,000 records. This approach isn't optimal. The best way to only get the latest records is to use the [`top` operator](#top).

+### Top

+Use the [`top` operator](/azure/data-explorer/kusto/query/topoperator) to sort the entire table on the server side and then only return the top records.

+For example, the following query returns the latest 10 records:

+The output looks like this example.

+To add a filter to a query, use the [`where` operator](/azure/data-explorer/kusto/query/whereoperator) followed by one or more conditions. For example, the following query returns only `SecurityEvent` records where `Level equals _8`:

+ - **Health history**: Indicates whether Azure Service Health has detected latency or query execution issues in the specific Log Analytics workspace. To further investigate latency issues related to your workspace, see [Investigate latency](#investigate-log-analytics-workspace-health-issues).

+ This table describes the possible resource health status values for a Log Analytics workspace:

+ | Resource health status | Description |

+ |-|-|

+ |Available| [Average latency](../logs/data-ingestion-time.md#average-latency) and no query execution issues detected.|

+ |Unavailable|Higher than average latency detected.|

+ |Degraded|Query failures detected.|

+ |Unknown|Currently unable to determine Log Analytics workspace health because you haven't run queries or ingested data to this workspace recently.|

+ | AvailabilityRate_Query | Percentage of successful user queries in the Log Analytics workspace within the selected time range.<br>This number includes all queries that return 2XX, 4XX, and 504 response codes; in other words, all user queries that don't result in a service error. |

+

+Here's a video about the fundamentals of Azure Monitor Logs and best practices and design considerations for designing your Azure Monitor Logs deployment:

+> [!VIDEO https://www.youtube.com/embed/pqUvZqoQV4o]

+- Here's a video on designing the proper structure for your Log Analytics workspace: [ITOps Talk:Log Analytics workspace design deep dive](/shows/it-ops-talk/ops115-log-analytics-workspace-design-deep-dive)

+<a name="regions-edit-network-features"></a>The option to *[edit network features for existing volumes (preview)](configure-network-features.md#edit-network-features-option-for-existing-volumes)* is supported for the following regions:

+* East US*

+* South Central US*

+* West US 2*

+\* Not all volume in this region are available for conversion. All volumes will be available for conversion in the future.

+* [Microsoft Ignite 2019: Run your most demanding enterprise file workloads with Azure NetApp Files](https://www.youtube.com/watch?v=inVjDxF5Y8w) provides a brief introduction to Azure NetApp Files, highlighting use cases and demonstrating Azure NetApp Files features.

+## <a name="edit-network-features-option-for-existing-volumes"></a> Edit network features option for existing volumes (preview)

+To use the publish command, you must have [Bicep CLI version 0.14.X or higher](./install.md). To use the `--documentationUri`/`-d` parameter, you must have [Bicep CLI version 0.14.X or higher](./install.md).

+## MABS V4 UR1 Refresh known issues and workarounds

+## MABS V4 UR1 known issues and workarounds

+Microsoft is recalling the release of Update Rollup 1 for Microsoft Azure Backup Server V4 due to the following known issues:

+- Hyper-V scheduled backups take a long time to complete because each backup job triggers a consistency check.

+ **Error Message**: The replica of Microsoft Hyper-V RCT on `<Machine Name>` is not consistent with the protected data source. MABS has detected changes in file locations or volume configurations of protected objects since the data source was configured for protection. (ID 30135)

+- MABS console occasionally crashes when SMTP alerts or reports are configured.

+ The updated build **Update Rollup 1 Refresh for MABS V4** is released that fixes these known issues.

+>[!Important]

+>If you had installed Update Rollup 1 for MABS V4 (14.0.42.0), we recommend that you install **Update Rollup1 Refresh (14.0.46.0)** on your MABS server and update the protection agents from *KB 5033756*.

+>

+>For any queries or additional information, contact **Microsoft Support**.

+## What's new in MABS V4 Update Rollup 1 Refresh (UR1 Refresh)?

+Microsoft Azure Backup Server version 4 (MABS V4) Update *Rollup 1 Refresh* includes critical bug fixes and feature enhancements. For information about the bugs fixed and the installation instructions of MABS V4 UR1 Refresh, see [KB article 5033756](https://support.microsoft.com/home/contact?SourceApp=smcivr2).

+

+>[!Important]

+>MABS V4 UR1 Refresh supersedes MABS V4 UR1 that has the same feature enhancements, but fixes the known issues in MABS V4 UR1. [Learn more](backup-mabs-release-notes-v3.md).

+The following table lists the new features added in MABS V4 UR1:

+| Feature | Supportability |

+| | |

+| Item-level recovery for VMware VMs running Windows directly from online recovery points. | Use MARS version *2.0.9251.0* or above for this feature. |

+| Windows and Basic SMTP Authentication for MABS email reports and alerts. | This enables MABS to send reports and alerts using any vendor supporting SMTP Basic Authentication. [Learn more](/system-center/dpm/monitor-dpm?view=sc-dpm-2022&preserve-view=true#configure-email-for-dpm). <br><br> Note that if you're using Microsoft 365 SMTP with a MABS V4 private fix, re-enter the credential using Basic Authentication. |

+| Fall back to crash-consistent backups for VMware VMs. | Use a registry key for VMware VMs when backups fail with ApplicationQuiesceFault. [Learn more](backup-azure-backup-server-vmware.md#applicationquiescefault). |

+| Experience improvements for MABS backups to Azure. | |

+| List online recovery points for a data source along with the expiry time and soft-delete status. | To view the list of recovery points along with their expiration dates, right-click a data source and select **List recovery points**. |

+| Stop protection and retaining data using the policy duration for immutable vaults directly from the console. | This helps you save the backup costs when stopping protection for a data source backed up to an immutable vault. [Learn more](backup-azure-security-feature.md#immutability-support).

+| Windows and Basic SMTP Authentication for MABS email reports and alerts. | This enables MABS to send reports and alerts using any vendor supporting SMTP Basic Authentication. [Learn more](/system-center/dpm/monitor-dpm?view=sc-dpm-2022&preserve-view=true#configure-email-for-dpm). <br><br> Note that if you are using Microsoft 365 SMTP with a MABS V4 private fix, re-enter the credential using Basic Authentication. |

+With MABS v3 UR1, support for 32-bit protection agent is no longer supported. You won't be able to protect 32-bit workloads after upgrading the MABS v3 server to UR1. Any existing 32-bit protection agents will be in a disabled state and scheduled backups will fail with the **agent is disabled** error. If you want to retain the backup data for these agents, you can stop the protection with the retained data option. Otherwise, the protection agent can be removed.

+| | Any VM|[az network bastion tunnel](connect-vm-native-client-windows.md#connect-to-a-vmtunnel-command) |No |[Upload](vm-upload-download-native.md#tunnel-command)| No | No |

+> During Preview, Bastion Developer SKU is free of charge. Pricing details will be released at GA for a usage-based pricing model.

+ const token = "<Enter your Azure Communication Services token here>";

+ communicationUserId: "<Enter your Azure Communication Services ID here>",

+- Please try again [Azure Communication Services failed to submit survey, due to network or other error].

+# Enable file sharing using UI Library in Azure Communication Services Chat with Azure Blob storage

+In an Azure Communication Services Chat, we can enable file sharing between communication users. Note, Azure Communication Services Chat is different from the Teams Interoperability Chat ("Interop Chat"). If you want to enable file sharing in an Interop Chat, refer to [Add file sharing with UI Library in Teams Interoperability Chat](./file-sharing-tutorial-interop-chat.md).

+If you want to clean up and remove a Communication Services subscription, you can delete the resource or resource group. Deleting the resource group also deletes any other resources associated with it. You can find out more about [cleaning up Azure Communication Services resources](../quickstarts/create-communication-resource.md#clean-up-resources) and [cleaning Azure Function Resources](../../azure-functions/create-first-function-vs-code-csharp.md#clean-up-resources).

+- [Add file sharing with UI Library in Azure Communication Services Chat](./file-sharing-tutorial-acs-chat.md)

+In a Teams Interoperability Chat ("Interop Chat"), we can enable file sharing between Azure Communication Services end users and Teams users. Note, Interop Chat is different from the Azure Communication Services Chat. If you want to enable file sharing in an Azure Communication Services Chat, refer to [Add file sharing with UI Library in Azure Communication Services Chat](./file-sharing-tutorial-acs-chat.md). Currently, the Azure Communication Services end user is only able to receive file attachments from the Teams user. Please refer to [UI Library Use Cases](../concepts/ui-library/ui-library-use-cases.md) to learn more.

+First of all, we need to understand that Teams Interop Chat has to part of a Teams meeting currently. When the Teams user creates an online meeting, a chat thread would be created and associated with the meeting. To enable the Azure Communication Services end user joining the chat and starting to send/receive messages, a meeting participant (a Teams user) would need to admit them to the call first. Otherwise, they don't have access to the chat.

+Once the Azure Communication Services end user is admitted to the call, they would be able to start to chat with other participants on the call. In this tutorial, we're checking out how inline image works in Interop chat.

+And this is all you need! And there's no other setup needed to enable the Azure Communication Services end user to receive file attachments from the Teams user.

+Specifically, the UI library currently only supports "Anyone" and "People you choose" (with email address) and all other permissions aren't supported. If Teams user sent a file with unsupported permissions, the Azure Communication Services end user might be prompted to a login page or denied access when they click on the file attachment in the chat thread.

+

+

+

+

+

+- [Add file sharing with UI Library in Azure Azure Communication Services end user Service Chat](./file-sharing-tutorial-acs-chat.md)

+

+

+

+1. Run the following cmdlet, replacing *`<TenantID>`* with the tenant ID you noted down in step 5.

+ Connect-AzureAD -TenantId "<TenantID>"

+Each Azure Communications Gateway resource automatically receives a [system-assigned managed identity](../active-directory/managed-identities-azure-resources/overview.md), which Azure Communications Gateway uses to connect to the Operator Connect environment. You need to find the Object ID and Application ID of the managed identity, so that you can connect Azure Communications Gateway to the Operator Connect or Teams Phone Mobile environment in [Set up application roles for Azure Communications Gateway](#set-up-application-roles-for-azure-communications-gateway) and [Add the Application IDs for Azure Communications Gateway to Operator Connect](#add-the-application-ids-for-azure-communications-gateway-to-operator-connect).

+> Granting permissions has two parts: configuring the system-assigned managed identity for Azure Communications Gateway with the appropriate roles (this step) and adding the application ID of the managed identity to the Operator Connect or Teams Phone Mobile environment. You'll add the application ID to the Operator Connect or Teams Phone Mobile environment later, in [Add the Application IDs for Azure Communications Gateway to Operator Connect](#add-the-application-ids-for-azure-communications-gateway-to-operator-connect).

+1. Run the following cmdlet, replacing *`<TenantID>`* with the tenant ID you noted down in step 5.

+ Connect-AzureAD -TenantId "<TenantID>"

+## Add the Application IDs for Azure Communications Gateway to Operator Connect

+You must enable Azure Communications Gateway within the Operator Connect or Teams Phone Mobile environment. This process requires configuring your environment with two Application IDs:

+- The Application ID of the system-assigned managed identity that you found in [Find the Object ID and Application ID for your Azure Communication Gateway resource](#find-the-object-id-and-application-id-for-your-azure-communication-gateway-resource). This Application ID allows Azure Communications Gateway to use the roles that you set up in [Set up application roles for Azure Communications Gateway](#set-up-application-roles-for-azure-communications-gateway).

+- A standard Application ID for Azure Communications Gateway. This ID always has the value `8502a0ec-c76d-412f-836c-398018e2312b`.

+To add the Application IDs:

+1. Add a new **Application Id** for the Application ID that you found for the managed identity.

+1. Add a second **Application Id** for the value `8502a0ec-c76d-412f-836c-398018e2312b`.

+Confirm that you have **Reader** access to your subscription and appropriate permissions for the Project Synergy enterprise application:

+<!-- Must be kept in sync with provision-user-roles.md - steps for understanding and configuring -->

+* To view existing configuration: **PartnerSettings.Read**, **TrunkManagement.Read**, and **NumberManagement.Read**

+* To make changes to consents (which represent your relationships with enterprises) and numbers: **PartnerSettings.Read**, **TrunkManagement.Read**, and **NumberManagement.Write**

+If you don't have these permissions, ask your administrator to set them up by following [Set up user roles for Azure Communications Gateway](provision-user-roles.md).

+If you're uploading new numbers for an enterprise customer:

+* You must know the numbers you need to upload (as E.164 numbers). Each number must:

+* You must know the following information for each number.

+|Information for each number |Notes |

+|Ticket number (optional) |The ID of any ticket or other request that you want to associate with this number. Up to 64 characters. |

+If you're uploading multiple numbers, prepare a `.csv` file with the heading `Numbers` and one number per line (up to 10,000 numbers), as in the following example. You can use this file to upload multiple numbers at once with the same settings (for example, the same calling profile).

+```

+Numbers

+```

+When an enterprise customer uses the Teams Admin Center to request service, the Operator Connect APIs create a *consent*. This consent represents the relationship between you and the enterprise.

+1. From the overview page for your Communications Gateway resource, find the **Number Management** section in the sidebar. Select **Consents**.

+Uploading numbers for an enterprise allows IT administrators at the enterprise to allocate those numbers to their users.

+ * Otherwise, find the **Number Management** section in the sidebar and select **Numbers**. Search for the enterprise using the enterprise's Microsoft Entra tenant ID.

+1. To upload new numbers for an enterprise:

+ 1. In **Telephone numbers**, add the numbers:

+ * If you created a `.csv` file with multiple numbers as described in [Prerequisites](#prerequisites), select **Upload CSV file** and upload the file when prompted.

+ * Otherwise, select **Manual input** and add each number individually.

+ 1. Wait 30 seconds, then refresh the order status. When the order status is **Complete**, the numbers have been removed.

+ * Otherwise, find the **Number Management** section in the sidebar and select **Civic addresses**. Search for the enterprise using the enterprise's Microsoft Entra tenant ID.

+|Using the Number Management Portal| **Reader** access to your subscription and appropriate roles for the Project Synergy enterprise application: <!-- Must be kept in sync with step below for configuring and with manage-enterprise-operator-connect.md --><br> - To view existing configuration: **PartnerSettings.Read**, **TrunkManagement.Read**, and **NumberManagement.Read**<br>- To configure your relationship to an enterprise (a _consent_) and numbers: **PartnerSettings.Read**, **TrunkManagement.Read**, and **NumberManagement.Write**|

+> [!TIP]

+> To allow staff to manage consents in the Number Management Portal without managing numbers, assign the **NumberManagement.Read**, **TrunkManagement.Read** and **PartnerSettings.Write** roles.

+1. If you're managing access to the Number Management Portal, follow [Assign users and groups to an application](/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal) to assign suitable roles for each user in the Project Synergy application.

+ <!-- Must be kept in sync with step 1 and with manage-enterprise-operator-connect.md -->

+ * To view existing configuration: **PartnerSettings.Read**, **TrunkManagement.Read**, and **NumberManagement.Read**

+ * To make changes to consents and numbers: **PartnerSettings.Read**, **TrunkManagement.Read**, and **NumberManagement.Write**

+az keyvault key create --exportable true --vault-name "vault name from step 1" --kty RSA-HSM --name "keyname" --policy "jsonpolicyfromstep3 -can be a path to JSON"

+The [Azure Managed HSM](../key-vault/managed-hsm/overview.md) offering is [built on Confidential Computing technologies](../key-vault/managed-hsm/managed-hsm-technical-details.md) and can be used to enhance access control of secrets & keys for an application.

+The Managed Application can be found in the Azure Marketplace here: [Blob Storage Digests Backed by Confidential Ledger (preview)](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azureconfidentialledger.acl-blob-storage?tab=Overview).

+> [Restore an Azure Cosmos DB for MongoDB vCore cluster](how-to-restore-cluster.md)

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+### Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+### Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+## Related content

+For consistency, our data manager uses the following formula at 10 m^2 base for all Sentinel-2 calls:

+

+| **Malicious file uploaded to storage account**<br>Storage.Blob_AM.MalwareFound | The alert indicates that a malicious blob was uploaded to a storage account. This security alert is generated by the Malware Scanning feature in Defender for Storage. <br>Potential causes may include an intentional upload of malware by a threat actor or an unintentional upload of a malicious file by a legitimate user. <br>Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2 or premium block blobs) storage accounts with the new Defender for Storage plan with the Malware Scanning feature enabled. | Lateral Movement | High |

+| **Malicious blob was downloaded from a storage account (Preview)**<br>Storage.Blob_MalwareDownload | The alert indicates that a malicious blob was downloaded from a storage account. Potential causes may include malware that was uploaded to the storage account and not removed or quarantined, thereby enabling a threat actor to download it, or an unintentional download of the malware by legitimate users or applications. <br>Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2 or premium block blobs) storage accounts with the new Defender for Storage plan with the Malware Scanning feature enabled. | Lateral Movement | High, if Eicar - low |

+ > The artifactName 'CodeAnalysisLogs' is required for integration with Defender for Cloud. For additional tool configuration options, see [the Microsoft Security DevOps wiki](https://github.com/microsoft/security-devops-action/wiki)

+Defender for APIs is available in the Azure commercial cloud, in these regions:

+ > [!NOTE]

+ > For additional tool configuration options, see [the Microsoft Security DevOps wiki](https://github.com/microsoft/security-devops-action/wiki)

+## December 2023

+| Date | Update |

+|--|--|

+| December 4 | [Defender for Storage alert released for preview: malicious blob was downloaded from a storage account](#defender-for-storage-alert-released-for-preview-malicious-blob-was-downloaded-from-a-storage-account)

+### Defender for Storage alert released for preview: malicious blob was downloaded from a storage account

+December 4, 2023

+The following alert is being released for preview:

+|Alert (alert type)|Description|MITRE tactics|Severity|

+|-|-|-|-|

+| **Malicious blob was downloaded from a storage account (Preview)**<br>Storage.Blob_MalwareDownload | The alert indicates that a malicious blob was downloaded from a storage account. Potential causes may include malware that was uploaded to the storage account and not removed or quarantined, thereby enabling a threat actor to download it, or an unintentional download of the malware by legitimate users or applications. <br>Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2 or premium block blobs) storage accounts with the new Defender for Storage plan with the Malware Scanning feature enabled. | Lateral Movement | High, if Eicar - low |

+See the [extension-based alerts in Defender for Storage](alerts-reference.md#alerts-azurestorage).

+For a complete list of alerts, see the [reference table for all security alerts in Microsoft Defender for Cloud](alerts-reference.md).

+# Quickstart: Create and access an environment in Azure Deployment Environments

+ :::image type="content" source="media/quickstart-create-access-environments/dev-new-environment.png" alt-text="Screenshot showing the new menu with new environment highlighted." lightbox="media/quickstart-create-access-environments/dev-new-environment-expanded.png":::

+1. In the **Add an environment** pane, select the following information:

+ |Project | Select the project you want to create the environment in. If you have access to more than one project, you see a list of available projects. |

+ |Type | Select the environment type you want to create. If you have access to more than one environment type, you see a list of available types. |

+ :::image type="content" source="media/quickstart-create-access-environments/dev-add-environment.png" alt-text="Screenshot showing add environment pane." lightbox="media/quickstart-create-access-environments/dev-add-environment-expanded.png":::

+ If your environment is configured to accept parameters, you can enter them on a separate pane. In this example, you don't need to specify any parameters.

+1. You can view all of your existing environments. To access the specific resources created as part of an environment, select the **Environment Resources** link.

+ :::image type="content" source="media/quickstart-create-access-environments/dev-environment-resources.png" alt-text="Screenshot showing an environment card, with the environment resources link highlighted." lightbox="media/quickstart-create-access-environments/dev-environment-resources-expanded.png":::

+1. You can view the resources in your environment listed in the Azure portal.

+ :::image type="content" source="media/quickstart-create-access-environments/azure-portal-view-of-environment.png" alt-text="Screenshot showing Azure portal list of environment resources." lightbox="media/quickstart-create-access-environments/azure-portal-view-of-environment.png":::

+ Creating an environment automatically creates a resource group that stores the environment's resources. The resource group name follows the pattern `{projectName}-{environmentName}`. You can view the resource group in the Azure portal.

+- [Add and configure a catalog](how-to-configure-catalog.md)

+- [Add and configure an environment definition](configure-environment-definition.md)

+ Title: Create and configure a dev center for Azure Deployment Environments

+description: Learn how to configure a dev center, attach an identity, and attach a catalog in Azure Deployment Environments.

+In this quickstart, you set up all the resources in Azure Deployment Environments to enable self-service deployment environments for development teams. Learn how to create and configure a dev center, add a catalog to the dev center, and define an environment type.

+A platform engineering team typically sets up a dev center, attaches external catalogs to the dev center, creates projects, and provides access to development teams. Development teams then create [environments](concept-environments-key-concepts.md#environments) by using [environment definitions](concept-environments-key-concepts.md#environment-definitions), connect to individual resources, and deploy applications. To learn more about the components of Azure Deployment Environments, see [Key concepts for Azure Deployment Environments](concept-environments-key-concepts.md).

+The following diagram shows the steps to configure a dev center for Azure Deployment Environments in the Azure portal.

+You need to perform the steps in this quickstart and then [create a project](quickstart-create-and-configure-projects.md) before you can [create a deployment environment](quickstart-create-access-environments.md).

+ - Import the [Deployment Environments sample catalog](https://github.com/azure/deployment-environments) into the project you created.

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/deployment-environments-add-devcenter.png" alt-text="Screenshot that shows how to create a dev center in Azure Deployment Environments." lightbox="media/quickstart-create-and-configure-devcenter/deployment-environments-add-devcenter.png":::

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/create-devcenter.png" alt-text="Screenshot that shows the Review tab of a dev center to validate the deployment details." lightbox="media/quickstart-create-and-configure-devcenter/create-devcenter-expanded.png":::

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/azure-notifications.png" alt-text="Screenshot that shows portal notifications to confirm the creation of a dev center." lightbox="media/quickstart-create-and-configure-devcenter/azure-notifications.png":::

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/deployment-environments-devcenter-created.png" alt-text="Screenshot that shows the dev centers overview, to confirm that the dev center was created." lightbox="media/quickstart-create-and-configure-devcenter/deployment-environments-devcenter-created.png":::

+1. In **Dev centers**, select your dev center.

+1. In the left menu under **Settings**, select **Identity**.

+1. Under **System assigned**, set **Status** to **On**, and then select **Save**.

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/system-assigned-managed-identity-on.png" alt-text="Screenshot that shows a system-assigned managed identity." lightbox="media/quickstart-create-and-configure-devcenter/system-assigned-managed-identity-on.png":::

+1. In the **Enable system assigned managed identity** dialog, select **Yes**. It might take a while for the rest of the fields to appear.

+The managed identity that represents your dev center requires access to the subscription where you configure the [project environment types](concept-environments-key-concepts.md#project-environment-types), and to the Azure DevOps repository that stores your catalog.

+1. Navigate to your dev center.

+1. On the left menu under **Settings**, select **Identity**.

+1. Under **System assigned** > **Permissions**, select **Azure role assignments**.

+ :::image type="content" source="media/quickstart-create-configure-projects/system-assigned-managed-identity.png" alt-text="Screenshot that shows a system-assigned managed identity with Role assignments highlighted." lightbox="media/quickstart-create-configure-projects/system-assigned-managed-identity.png":::

+1. Sign in to your [Azure DevOps organization](https://dev.azure.com).

+ > [!NOTE]

+ > Your Azure DevOps organization must be in the same directory as the Azure subscription that contains your dev center.

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/devops-organization-settings.png" alt-text="Screenshot showing the Azure DevOps organization page, with Organization Settings highlighted." lightbox="media/quickstart-create-and-configure-devcenter/devops-organization-settings.png":::

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/devops-organization-overview.png" alt-text="Screenshot showing the Organization overview page, with Users highlighted." lightbox="media/quickstart-create-and-configure-devcenter/devops-organization-overview.png":::

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/devops-add-user.png" alt-text="Screenshot showing the Users page, with Add user highlighted." lightbox="media/quickstart-create-and-configure-devcenter/devops-add-user.png":::

+ |**Users or Service Principals**|Enter the name of your dev center. <br><br> When you use a system-assigned managed account, specify the name of the dev center, not the Object ID of the managed account. When you use a user-assigned managed account, use the name of the managed account. |

+ |**Add to projects**|Select the project you created in the prerequisites section that contains your repository.|

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/add-user-blade.png" alt-text="Screenshot showing Add users, with example entries and Add highlighted." lightbox="media/quickstart-create-and-configure-devcenter/add-user-blade-expanded.png":::

+In Azure Deployment Environments, you can attach Azure DevOps repositories or GitHub repositories. You can store a set of curated IaC templates in a repository. Attaching the repository to a dev center as a catalog gives your development teams access to the templates and enables them to quickly create consistent environments.

+1. Go back to the Azure portal and navigate to your dev center.

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/catalogs-page.png" alt-text="Screenshot that shows the Catalogs pane." lightbox="media/quickstart-create-and-configure-devcenter/catalogs-page.png":::

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/add-catalog.png" alt-text="Screenshot showing the add catalog pane with examples entries and Add highlighted." lightbox="media/quickstart-create-and-configure-devcenter/add-catalog-expanded.png":::

+ :::image type="content" source="media/quickstart-create-and-configure-devcenter/create-environment-type.png" alt-text="Screenshot that shows the Create environment type pane." lightbox="media/quickstart-create-and-configure-devcenter/create-environment-type.png":::

+1. Confirm that the environment type was added by checking your Azure portal notifications.

+ Title: Create and configure an Azure Deployment Environments project

+This quickstart shows you how to create a project in Azure Deployment Environments, then associate the project with the dev center you created in [Quickstart: Create and configure a dev center](./quickstart-create-and-configure-devcenter.md). After you complete this quickstart, developers can use the developer portal to create environments to deploy their applications.

+The following diagram shows the steps to configure a project associated with a dev center for Deployment Environments in the Azure portal.

+- Azure role-based access control role with permissions to create and manage resources in the subscription, such as [Contributor](../role-based-access-control/built-in-roles.md#contributor) or [Owner](../role-based-access-control/built-in-roles.md#owner).

+1. In the [Azure portal](https://portal.azure.com), go to Azure Deployment Environments.

+ |**Subscription** |Select the subscription in which you want to create the project. |

+ :::image type="content" source="media/quickstart-create-configure-projects/review-create-project.png" alt-text="Screenshot that shows selecting the create project basics tab." lightbox="media/quickstart-create-configure-projects/review-create-project-expanded.png":::

+ :::image type="content" source="media/quickstart-create-configure-projects/created-project.png" alt-text="Screenshot that shows the project overview pane." lightbox="media/quickstart-create-configure-projects/created-project.png":::

+ :::image type="content" source="media/quickstart-create-configure-projects/add-environment-types.png" alt-text="Screenshot that shows the Environment types pane." lightbox="media/quickstart-create-configure-projects/add-environment-types.png":::

+ :::image type="content" source="media/quickstart-create-configure-projects/add-project-environment-type.png" alt-text="Screenshot that shows adding details in the Add project environment type pane." lightbox="media/quickstart-create-configure-projects/add-project-environment-type-expanded.png":::

+> At least one identity (system-assigned or user-assigned) must be enabled for deployment identity. The identity is used to perform the environment deployment on behalf of the developer. Additionally, the identity attached to the dev center should be [assigned the Contributor and the User Access Admistrator roles](how-to-configure-managed-identity.md) for access to the deployment subscription for each environment type.

+Before developers can create environments based on the environment types in a project, you must provide access for them through a role assignment at the level of the project. The Deployment Environments User role enables users to create, manage, and delete their own environments. You must have sufficient permissions to a project before you can add users to it.

+ :::image type="content" source="media/quickstart-create-configure-projects/add-role-assignment.png" alt-text="Screenshot that shows the Add role assignment pane." lightbox="media/quickstart-create-configure-projects/add-role-assignment.png":::

+description: Known issues, limitations, and troubleshooting guide for Azure SQL Migration extension for Azure Data Studio

+This article provides a list of known issues and troubleshooting steps associated with the Azure SQL Migration extension for Azure Data Studio.

+> [!IMPORTANT]

+## Error code: 2007 - CutoverFailedOrCancelled

+- **Message**: `Cutover failed or cancelled for database <DatabaseName>. Error details: The restore plan is broken because firstLsn <First LSN> of log backup <URL of backup in Azure Storage container>' is not <= lastLsn <last LSN> of Full backup <URL of backup in Azure Storage container>'. Restore to point in time.`

+- **Cause**: The error can occur due to the backups being placed incorrectly in the Azure Storage container. If the backups are placed in the network file share, this error could also occur due to network connectivity issues.

+- **Recommendation**: Ensure the database backups in your Azure Storage container are correct. If you're using network file share, there can be network-related issues and lags that are causing this error. Wait for the process to be completed.

+- **Recommendation**: Migrate the TDE certificate to the target instance and retry the process. For more information about migrating TDE-enabled databases, see [Tutorial: Migrate TDE-enabled databases (preview) to Azure SQL in Azure Data Studio](/azure/dms/tutorial-transparent-data-encryption-migration-ads).

+- **Recommendation**: See [Issues that affect database restoration between different SQL Server versions](/support/sql/admin/backup-restore-operations) for troubleshooting steps.

+- **Recommendation**: For more information about storage limits, see [Overview of Azure SQL Managed Instance resource limits](/azure/azure-sql/managed-instance/resource-limits).

+- **Recommendation**: See [OS errors 1450 and 665 are reported for database files during DBCC CHECKDB or Database Snapshot Creation](/support/sql/admin/1450-and-665-errors-running-dbcc-checkdb#symptoms) for troubleshooting steps.

+- **Cause**: The error can occur due to the backups being placed incorrectly in the Azure Storage container. If the backups are placed in the network file share, this error could also occur due to network connectivity issues.

+- **Recommendation**: Ensure the database backups in your Azure Storage container are correct. If you're using network file share, there can be network related issues and lags that are causing this error. Wait for the process to complete.

+- **Message**: `Migration for Database <Database Name> failed with error 'Non retriable error occurred while restoring backup with index 1 - 12824 The sp_configure value 'contained database authentication' must be set to 1 in order to restore a contained database. You may need to use RECONFIGURE to set the value_in_use. RESTORE DATABASE is terminating abnormally.`

+ ```sql

+ -- Enable "contained database authentication"

+ EXEC sp_configure 'contained', 1;

+ RECONFIGURE;

+ ```

+ > [!NOTE]

+ > For more information on general troubleshooting steps for Azure SQL Managed Instance errors, see [Known issues with Azure SQL Managed Instance](/azure/azure-sql/managed-instance/doc-changes-updates-known-issues)

+- **Recommendation**: See [Troubleshoot Self-Hosted Integration Runtime](../data-factory/self-hosted-integration-runtime-troubleshoot-guide.md) for general troubleshooting steps for Integration Runtime connectivity errors.

+- **Recommendation**: Make sure the Self-hosted Integration Runtime is registered and online. To perform the registration, you can use scripts from [Automating self-hosted integration runtime installation using local PowerShell scripts](../data-factory/self-hosted-integration-runtime-automation-scripts.md). Also, see [Troubleshoot self-hosted integration runtime](../data-factory/self-hosted-integration-runtime-troubleshoot-guide.md) for general troubleshooting steps for Integration Runtime connectivity errors.

+- **Recommendation**: Wait until the Azure SQL Managed Instance has finished deploying and is ready, then retry the process.

+- **Recommendation**: Check the MigrationStatusDetails page for more detailed error information.

+- **Recommendation**: No action required. Migration succeeded.

+- **Recommendation**: No action required. Migration is ongoing or completed.

+- **Recommendation**: No action is required; the migration was canceled.

+- **Recommendation**: If desired, the target database can be returned to its original state by running the first query and all of the returned queries, then running the second query and doing the same.

+ ```sql

+ SELECT [ROLLBACK] FROM [dbo].[__migration_status]

+ WHERE STEP in (3,4,6);

+ SELECT [ROLLBACK] FROM [dbo].[__migration_status]

+ WHERE STEP in (5,7,8) ORDER BY STEP DESC;

+ ```

+## Error code: 2042 - PreCopyStepsCompletedDuringCancel

+- **Recommendation**: If desired, target database can be returned to its original state by running the following query and all of the returned queries.

+ ```sql

+ SELECT [ROLLBACK] FROM [dbo].[__migration_status]

+ WHERE STEP in (3,4,6);

+ ```

+- **Recommendation**: For more troubleshooting steps, see [Troubleshoot Azure Data Factory and Synapse pipelines](../data-factory/data-factory-troubleshoot-guide.md#error-code-2108).

+- **Recommendation**: The latest version of Integration Runtime (**5.28.8488**) prevents access to a network file share on a local host. Ensure you run Integration Runtime on a different machine than the network share hosting. If hosting the self-hosted Integration Runtime and the network share on different machines isn't possible with your current migration setup, you can use the option to opt out using `DisableLocalFolderPathValidation`.

+ > [!NOTE]

+ > For more information, see [Set up an existing self-hosted IR via local PowerShell](../data-factory/create-self-hosted-integration-runtime.md#set-up-an-existing-self-hosted-ir-via-local-powershell). Use the disabling option with discretion as this is less secure.

+- **Message**: `CollationMismatch: Source database collation <CollationOptionSource> is not the same as the target database <CollationOptionTarget>. Source database: <SourceDatabaseName> Target database: <TargetDatabaseName>.`

+- **Message**: `DatabaseSizeMoreThanMax: No tables were found in the target Azure SQL Database. Check if schema migration was completed beforehand.`

+- **Message**: `DatabaseSizeMoreThanMax: The source database size <Source Database Size> exceeds the maximum allowed size of the target database <Target Database Size>. Check if the target database has enough space.`

+- **Message**: `NoTablesFound: Some of the source tables don't exist in the target database. Missing tables: <TableList>`.

+- **Message**: `SqlVersionOutOfRange: Source instance version is lower than 2008, which is not supported to migrate. Source instance: <InstanceName>`.

+- **Recommendation**: Upgrade your source SQL Server instance to a newer version of SQL Server. For more information, see [Upgrade SQL Server](/sql/database-engine/install-windows/upgrade-sql-server).

+- **Message**: `TableMappingMismatch: Some of the source tables don't exist in the target database. Missing tables: <TableList>`.

+- **Message**: `The SELECT permission was denied on the object 'sql_logins', database 'master', schema 'sys'.`

+- **Cause**: The account customers use to connect Azure SQL Database lacks the permission to access `sys.sql_logins` table.

+ 1. Add 'sysadmin' role to the account, which grants the admin permission.

+ 1. If customers can't use admin account or can't grant admin permission to the account, they can create a user in master and grant **dbmanager** and **loginmanager** permission to the user. For example,

+ ```sql

+ -- Run the script in the master

+ CREATE USER testuser FROM LOGIN testlogin;

+ EXEC sp_addRoleMember 'dbmanager', 'testuser';

+ EXEC sp_addRoleMember 'loginmanager', 'testuser';

+ ```

+- **Message**: `Failed to get service token from ADF service.`

+- **Cause**: The customer's SHIR fails to connect data factory.

+- **Recommendation**: This is sample doc how to solve it: [Integration runtime Unable to connect to Data Factory](/answers/questions/139976/integration-runtime-unable-to-connect-to-data-fact)

+- **Message**: `IR Nodes are offline.`

+- **Message**: `Deployed failure: {0}. Object element: {1}.`

+- **Cause**: This is the most common error customers might encounter. It means that the object can't be deployed to the target because it's unsupported on the target.

+- **Recommendation**: Customers need to check the assessment results ([Assessment rules](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules)). This is the list of assessment issues that might fail the schema migration:

+ [BULK INSERT](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#BulkInsert)

+ [COMPUTE clause](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#ComputeClause)

+ [Cryptographic provider](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#CryptographicProvider)

+ [Cross database references](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#CrossDatabaseReferences)

+ [Database principal alias](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#DatabasePrincipalAlias)

+ [DISABLE_DEF_CNST_CHK option](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#DisableDefCNSTCHK)

+ [FASTFIRSTROW hint](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#FastFirstRowHint)

+ [FILESTREAM](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#FileStream)

+ [MS DTC](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#MSDTCTransactSQL)

+ [OPENROWSET (bulk)](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#OpenRowsetWithNonBlobDataSourceBulk)

+ [OPENROWSET (provider)](/azure/azure-sql/migration-guides/database/sql-server-to-sql-database-assessment-rules#OpenRowsetWithSQLAndNonSQLProvider)

+ > [!NOTE]

+ > To view error detail, Open the Microsoft Integration runtime configuration manager, and navigate to **Diagnostics > Logging > View logs**. In the Event viewer, navigate to **Application and Service logs > Connectors - Integration runtime**, and filter for errors.

+- **Message**: `Deployed failure: Index cannot be created on computed column '{0}' of table '{1}' because the underlying object '{2}' has a different owner. Object element: {3}.`

+ Sample Generated Script: `IF NOT EXISTS (SELECT * FROM sys.indexes WHERE object_id = OBJECT_ID(N'[Sales].[Customer]') AND name = N'AK_Customer_AccountNumber') CREATE UNIQUE NONCLUSTERED INDEX [AK_Customer_AccountNumber] ON [Sales].[Customer] ( [AccountNumber] ASC )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, SORT_IN_TEMPDB = OFF, IGNORE_DUP_KEY = OFF, DROP_EXISTING = OFF, ONLINE = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON)`

+- **Cause**: All function references in the computed column must have the same owner as the table.

+- **Recommendation**: See [Ownership Requirements](/sql/relational-databases/indexes/indexes-on-computed-columns#ownership-requirements).

+- **Message**: `Unable to read blobs in storage container, exception: The remote server returned an error: (403) Forbidden.; The remote server returned an error: (403) Forbidden`

+- **Message**: `Failed to create restore job. Unable to read blobs in storage container, exception: The remote name could not be resolved.`

+## Azure SQL Database limitations

+Migrating to Azure SQL Database by using the Azure SQL extension for Azure Data Studio has the following limitations:

+## Azure SQL Managed Instance limitations

+Migrating to Azure SQL Managed Instance by using the Azure SQL extension for Azure Data Studio has the following limitations:

+## SQL Server on Azure VMs limitations

+Migrating to SQL Server on Azure VMs by using the Azure SQL extension for Azure Data Studio has the following limitations:

+## Azure Data Studio limitations

+### Failed to start Sql Migration Service: Error: Request error:

+- **Cause**: This issue occurs when Azure Data Studio isn't able to download the MigrationService package from https://github.com/microsoft/sqltoolsservice/releases. The download failure can be due to disconnected network work or unresolved proxy settings.

+## Related content

+- [Azure SQL migration extension for Azure Data Studio](/azure-data-studio/extensions/azure-sql-migration-extension)

+- [Migrate databases from SQL Server to SQL Managed Instance by using Log Replay Service (Preview)](/azure/azure-sql/managed-instance/log-replay-service-migrate#limitations)

+- [Checklist: Best practices for SQL Server on Azure VMs](/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist)

+The multiple strings in a DNS record shouldn't be confused with the multiple TXT records in a TXT record set. A TXT record set can contain multiple records, *each of which* can contain multiple strings. Azure DNS supports a total string length of up to 4096 characters`*` in each TXT record set (across all records combined).

+`*` 4096 character support is currently only available in the Azure Public Cloud. National clouds are limited to 1024 characters until 4k support rollout is complete.

+1. **Data groups** are used to enable authorization for data.

+ 1. Some examples are data.welldb.viewers and data.welldb.owners.

+ 2. The data groups are added in the ACL of individual data records to enable viewer and owner access of the data.

+ 3. Individual users who are part of the data groups are authorized to view or own the data depending on the scope of the data group.

+2. **Service groups** are used to enable authorization for services.

+ 1. Some examples are service.storage.user and service.storage.admin.

+ 2. The service groups are predefined when OSDU services are provisioned in each data partition of Azure Data Manager for Energy instance.

+ 3. These groups enable viewer, editor, and admin access to call the OSDU APIs corresponding to the OSDU services.

+3. **User groups** are used for hierarchical grouping of user and service groups.

+ 1. Some examples are users.datalake.viewers and users.datalake.editors.

+ 2. Some user groups are created by default when a data partition is provisioned. Details of these groups and their hierarchy scope is in [Bootstrapped OSDU Entitlements Groups](https://community.opengroup.org/osdu/platform/deployment-and-operations/infra-azure-provisioning/-/blob/master/docs/osdu-entitlement-roles.md).

+

+Individual users can be added to a `user group`. The `user group` is then added to a `data group`. The data group is added to the ACL of the data record. It enables abstraction for the data groups since individual users need not be added one by one to the data group and instead can be added to the `user group`. This structure thus helps provide scalability to manage memberships in OSDU.

+ "Message": "Great to connect with Azure Communication Services events",

+Aside from `IncomingCall`, Calling events are only available for Azure Communication Services VoIP users. PSTN, bots, echo bot and Teams users events are excluded.

+No calling events will be available for Azure Communication Services - Teams meeting interop call.

+`IncomingCall` events have support for Azure Communication Services VoIP users and PSTN numbers. For more details on which scenarios can trigger `IncomingCall` events, see the following [Incoming call concepts](../communication-services/concepts/call-automation/incoming-call-notification.md) documentation.

+For more information about these properties, see [Create or Update Network Rule Set](/rest/api/eventhub/namespaces/create-or-update-network-rule-set) and [Create or Update Private Endpoint Connections](/rest/api/eventhub/private-endpoint-connections/create-or-update).

+For more information about these properties, see [Create or Update Network Rule Set](/rest/api/eventhub/namespaces/create-or-update-network-rule-set) and [Create or Update Private Endpoint Connections](/rest/api/eventhub/private-endpoint-connections/create-or-update).

+* [**Microsoft.Cdn/profiles**](/azure/templates/microsoft.cdn/profiles) (Azure Front Door Standard/Premium profile)

+> The wildcard character `*` is only valid for paths that don't have any other characters after it. Additionally, the wildcard character `*` must be preceded by a slash `/`. Paths without a wildcard are considered to be exact-match paths. A path that ends in a slash `/` is also an exact-match path. Ensure that your paths follow these rules to avoid any errors.

+> We do not index extended query tags if the value is null or empty.

+> All UIDs must be between 1 and 64 characters long, and only contain alpha numeric characters or the following special characters: `.`, `-`. `PatientID` continues to be a required tag and can have the value as null in the input. `PatientID` is validated based on its `LO` `VR` type.

+> [!NOTE]

+> We do not support searching using empty string for any attributes.

+> [!NOTE]

+> We do not support searching using empty string for any attributes.

+ "source": {

+#### Prerequisites if the storage account is behind a private endpoint (preview):

+1. Ensure you have the Azure CLI version 2.54.0 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install the Azure CLI](/cli/azure/install-azure-cli).

+You notice the destination port doesn't change in the example. In floating IP scenarios, Azure Load Balancer also supports defining a load balancing rule to change the backend destination port and to make it different from the frontend destination port.

+Some services in Azure have a special focused prebuilt monitoring dashboard in the Azure portal that provides a starting point for monitoring your service. These special dashboards are called "insights".

+If you're creating or running an application that runs on Load Balancer, [Azure Monitor Application Insights](../azure-monitor/app/app-insights-overview.md) offers other types of alerts.

+* Explore the [model catalog in Azure Machine Learning studio](https://ml.azure.com/model/catalog). You need an [Azure Machine Learning workspace](./quickstart-create-resources.md) to explore the catalog.

+* All the docker images run as non-root user.

+* We recommend using `latest` tag for docker images. Prebuilt docker images for inference are published to Microsoft container registry (MCR), to query list of tags available, follow [instructions on the GitHub repository](https://github.com/microsoft/ContainerRegistry#browsing-mcr-content).

+* If you want to use a specific tag for any inference docker image, we support from `latest` to the tag that is *6 months* old from the `latest`.

+**Inference minimal base images**

+Framework version | CPU/GPU | Pre-installed packages | MCR Path

+ | | | |

+NA | CPU | NA | `mcr.microsoft.com/azureml/minimal-ubuntu18.04-py37-cpu-inference:latest`

+NA | GPU | NA | `mcr.microsoft.com/azureml/minimal-ubuntu18.04-py37-cuda11.0.3-gpu-inference:latest`

+NA | CPU | NA | `mcr.microsoft.com/azureml/minimal-ubuntu20.04-py38-cpu-inference:latest`

+NA | GPU | NA | `mcr.microsoft.com/azureml/minimal-ubuntu20.04-py38-cuda11.6.2-gpu-inference:latest`

+> [!IMPORTANT]

+> A compute instance or compute cluster without a public IP does not need inbound traffic from Azure Batch management and Azure Machine Learning services. However, if you have multiple computes and some of them use a public IP address, you will need to allow this traffic.

+When using Azure Machine Learning __compute instance__ or __compute cluster__ (_with a public IP address_), allow inbound traffic from the Azure Machine Learning service. A compute instance or compute cluster _with no public IP_ (preview) __doesn't__ require this inbound communication. A Network Security Group allowing this traffic is dynamically created for you, however you may need to also create user-defined routes (UDR) if you have a firewall. When creating a UDR for this traffic, you can use either **IP Addresses** or **service tags** to route the traffic.

+# [IP Address routes](#tab/ipaddress)

+For the Azure Machine Learning service, you must add the IP address of both the __primary__ and __secondary__ regions. To find the secondary region, see the [Cross-region replication in Azure](/azure/availability-zones/cross-region-replication-azure). For example, if your Azure Machine Learning service is in East US 2, the secondary region is Central US.

+To get a list of IP addresses of the Azure Machine Learning service, download the [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519) and search the file for `AzureMachineLearning.<region>`, where `<region>` is your Azure region.

+> [!IMPORTANT]

+> The IP addresses may change over time.

+When creating the UDR, set the __Next hop type__ to __Internet__. This means the inbound communication from Azure skips your firewall to access the load balancers with public IPs of Compute Instance and Compute Cluster. UDR is required because Compute Instance and Compute Cluster will get random public IPs at creation, and you cannot know the public IPs before creation to register them on your firewall to allow the inbound from Azure to specific IPs for Compute Instance and Compute Cluster. The following image shows an example IP address based UDR in the Azure portal:

+# [Service tag routes](#tab/servicetag)

+Create user-defined routes for the `AzureMachineLearning` service tag.

+The following command demonstrates adding a route for this service tag:

+```azurecli

+az network route-table route create -g MyResourceGroup --route-table-name MyRouteTable -n AzureMLRoute --address-prefix AzureMachineLearning --next-hop-type Internet

+```

+For information on configuring UDR, see [Route network traffic with a routing table](/azure/virtual-network/tutorial-create-route-table-portal).

+With the new backend that runs on [Azure Machine Learning pipelines](concept-ml-pipelines.md), you can additionally use any image classification model from the [HuggingFace Hub](https://huggingface.co/models?pipeline_tag=image-classification&library=transformers) which is part of the transformers library (such as microsoft/beit-base-patch16-224), as well as any object detection or instance segmentation model from the [MMDetection Version 3.1.0 Model Zoo](https://mmdetection.readthedocs.io/en/v3.1.0/model_zoo.html) (such as `atss_r50_fpn_1x_coco`).

+In addition to supporting any model from HuggingFace Transfomers and MMDetection 3.1.0, we also offer a list of curated models from these libraries in the azureml registry. These curated models have been tested thoroughly and use default hyperparameters selected from extensive benchmarking to ensure effective training. The table below summarizes these curated models.

+Image classification<br> (multi-class and multi-label)| **BEiT** <br> **ViT** <br> **DeiT** <br> **SwinV2** | [`microsoft/beit-base-patch16-224-pt22k-ft22k`](https://ml.azure.com/registries/azureml/models/microsoft-beit-base-patch16-224-pt22k-ft22k/version/5)<br> [`google/vit-base-patch16-224`](https://ml.azure.com/registries/azureml/models/google-vit-base-patch16-224/version/5)<br> [`facebook/deit-base-patch16-224`](https://ml.azure.com/registries/azureml/models/facebook-deit-base-patch16-224/version/5)<br> [`microsoft/swinv2-base-patch4-window12-192-22k`](https://ml.azure.com/registries/azureml/models/microsoft-swinv2-base-patch4-window12-192-22k/version/5)

+Object Detection | **Sparse R-CNN** <br> **Deformable DETR** <br> **VFNet** <br> **YOLOF** <br> **Swin** | [`mmd-3x-sparse-rcnn_r50_fpn_300-proposals_crop-ms-480-800-3x_coco`](https://ml.azure.com/registries/azureml/models/mmd-3x-sparse-rcnn_r50_fpn_300-proposals_crop-ms-480-800-3x_coco/version/8)<br> [`mmd-3x-sparse-rcnn_r101_fpn_300-proposals_crop-ms-480-800-3x_coco`](https://ml.azure.com/registries/azureml/models/mmd-3x-sparse-rcnn_r101_fpn_300-proposals_crop-ms-480-800-3x_coco/version/8) <br> [`mmd-3x-deformable-detr_refine_twostage_r50_16xb2-50e_coco`](https://ml.azure.com/registries/azureml/models/mmd-3x-deformable-detr_refine_twostage_r50_16xb2-50e_coco/version/8) <br> [`mmd-3x-vfnet_r50-mdconv-c3-c5_fpn_ms-2x_coco`](https://ml.azure.com/registries/azureml/models/mmd-3x-vfnet_r50-mdconv-c3-c5_fpn_ms-2x_coco/version/8) <br> [`mmd-3x-vfnet_x101-64x4d-mdconv-c3-c5_fpn_ms-2x_coco`](https://ml.azure.com/registries/azureml/models/mmd-3x-vfnet_x101-64x4d-mdconv-c3-c5_fpn_ms-2x_coco/version/8) <br> [`mmd-3x-yolof_r50_c5_8x8_1x_coco`](https://ml.azure.com/registries/azureml/models/mmd-3x-yolof_r50_c5_8x8_1x_coco/version/8)

+Instance Segmentation | **Swin** | [`mmd-3x-mask-rcnn_swin-t-p4-w7_fpn_1x_coco`](https://ml.azure.com/registries/azureml/models/mmd-3x-mask-rcnn_swin-t-p4-w7_fpn_1x_coco/version/8)

+ml_client = MLClient(credential, registry_name="azureml")

+ operator = "less Than",

+ threshold = 30

+ value = 1,

+- [Troubleshooting Azure autoscale](../azure-monitor/autoscale/autoscale-troubleshoot.md)

+> The `v1-legacy-mode` parameter is only available in version 1.41.0 or newer of the Azure CLI extension for machine learning v1 (`azure-cli-ml`). The parameter is __not__ available in the v2 (`ml`) extension. Use the `az version` command to view version information, including the extension and version that is installed.

+If you use Apache Airflow, the [airflow-provider-azure-machinelearning](https://github.com/Azure/airflow-provider-azure-machinelearning) package is a provider that enables you to submit workflows to Azure Machine Learning from Apache AirFlow.

+> [!IMPORTANT]

+> You should use only models that you create or obtain from a trusted source. You should treat serialized models as code, because security vulnerabilities have been discovered in a number of popular formats. Also, models might be intentionally trained with malicious intent to provide biased or inaccurate output.

+The [Azure Machine Learning Algorithm Cheat Sheet](./algorithm-cheat-sheet.md?WT.mc_id=docs-article-lazzeri) helps you with the first consideration: **What you want to do with your data**? On the Machine Learning Algorithm Cheat Sheet, look for task you want to do, and then find an [Azure Machine Learning designer](./concept-designer.md?WT.mc_id=docs-article-lazzeri) algorithm for the predictive analytics solution.

+>[!NOTE]

+> - Azure Databricks is not supported as a compute target for model training. You can use Azure Databricks for data preparation and deployment tasks.

+> - To create and attach a compute target for training on Azure Arc-enabled Kubernetes cluster, see [Configure Azure Arc-enabled Machine Learning](../how-to-attach-kubernetes-anywhere.md)

+ The following table summarizes the key differences between ML Studio (classic) and Azure Machine Learning.

+ | Feature | ML Studio (classic) | Azure Machine Learning |

+ || | |

+ | Drag and drop interface | Classic experience | Updated experience - [Azure Machine Learning designer](../concept-designer.md)|

+ | Code SDKs | Not supported | Fully integrated with [Azure Machine Learning Python](/python/api/overview/azure/ml/) and [R](https://github.com/Azure/azureml-sdk-for-r) SDKs |

+ | Experiment | Scalable (10-GB training data limit) | Scale with compute target |

+ | Training compute targets | Proprietary compute target, CPU support only | Wide range of customizable [training compute targets](../concept-compute-target.md#training-compute-targets). Includes GPU and CPU support |

+ | Deployment compute targets | Proprietary web service format, not customizable | Wide range of customizable [deployment compute targets](../concept-compute-target.md#compute-targets-for-inference). Includes GPU and CPU support |

+ | ML Pipeline | Not supported | Build flexible, modular [pipelines](../concept-ml-pipelines.md) to automate workflows |

+ | MLOps | Basic model management and deployment; CPU only deployments | Entity versioning (model, data, workflows), workflow automation, integration with CICD tooling, CPU and GPU deployments [and more](../concept-model-management-and-deployment.md) |

+ | Model format | Proprietary format, Studio (classic) only | Multiple supported formats depending on training job type |

+ | Automated model training and hyperparameter tuning | Not supported | [Supported](../concept-automated-ml.md). Code-first and no-code options. |

+ | Data drift detection | Not supported | [Supported](../v1/how-to-monitor-datasets.md) |

+ | Data labeling projects | Not supported | [Supported](../how-to-create-image-labeling-projects.md) |

+ | Role-Based Access Control (RBAC) | Only contributor and owner role | [Flexible role definition and RBAC control](../how-to-assign-roles.md) |

+ | AI Gallery | Supported ([https://gallery.azure.ai/](https://gallery.azure.ai/)) | Unsupported <br><br> Learn with [sample Python SDK notebooks](https://github.com/Azure/MachineLearningNotebooks). |

+The entries in the `inferenceconfig.json` document map to the parameters for the [InferenceConfig](/python/api/azureml-core/azureml.core.model.inferenceconfig) class. The following table describes the mapping between entities in the JSON document and the parameters for the method:

+| JSON entity | Method parameter | Description |

+| -- | -- | -- |

+| `entryScript` | `entry_script` | Path to a local file that contains the code to run for the image. |

+| `sourceDirectory` | `source_directory` | Optional. Path to folders that contain all files to create the image, which makes it easy to access any files within this folder or subfolder. You can upload an entire folder from your local machine as dependencies for the Webservice. Note: your entry_script, conda_file, and extra_docker_file_steps paths are relative paths to the source_directory path. |

+| `environment` | `environment` | Optional. Azure Machine Learning [environment](/python/api/azureml-core/azureml.core.environment.environment).|

+You can include full specifications of an Azure Machine Learning [environment](/python/api/azureml-core/azureml.core.environment.environment) in the inference configuration file. If this environment doesn't exist in your workspace, Azure Machine Learning will create it. Otherwise, Azure Machine Learning will update the environment if necessary. The following JSON is an example:

+```json

+{

+ "entryScript": "score.py",

+ "environment": {

+ "docker": {

+ "arguments": [],

+ "baseDockerfile": null,

+ "baseImage": "mcr.microsoft.com/azureml/intelmpi2018.3-ubuntu18.04",

+ "enabled": false,

+ "sharedVolumes": true,

+ "shmSize": null

+ },

+ "environmentVariables": {

+ "EXAMPLE_ENV_VAR": "EXAMPLE_VALUE"

+ },

+ "name": "my-deploy-env",

+ "python": {

+ "baseCondaEnvironment": null,

+ "condaDependencies": {

+ "channels": [

+ "conda-forge"

+ ],

+ "dependencies": [

+ "python=3.7",

+ {

+ "pip": [

+ "azureml-defaults",

+ "azureml-telemetry",

+ "scikit-learn==0.22.1",

+ "inference-schema[numpy-support]"

+ ]

+ }

+ ],

+ "name": "project_environment"

+ },

+ "condaDependenciesFile": null,

+ "interpreterPath": "python",

+ "userManagedDependencies": false

+ },

+ "version": "1"

+ }

+}

+```

+You can also use an existing Azure Machine Learning [environment](/python/api/azureml-core/azureml.core.environment.environment) in separated CLI parameters and remove the "environment" key from the inference configuration file. Use -e for the environment name, and --ev for the environment version. If you don't specify --ev, the latest version will be used. Here is an example of an inference configuration file:

+```json

+{

+ "entryScript": "score.py",

+ "sourceDirectory": null

+}

+```

+The following command demonstrates how to deploy a model using the previous inference configuration file (named myInferenceConfig.json).

+It also uses the latest version of an existing Azure Machine Learning [environment](/python/api/azureml-core/azureml.core.environment.environment) (named AzureML-Minimal).

+```azurecli-interactive

+az ml model deploy -m mymodel:1 --ic myInferenceConfig.json -e AzureML-Minimal --dc deploymentconfig.json

+```

+ i. Download the certificate needed to communicate over SSL with your Azure Database for MySQL server from [here](https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem).

+## High CPU causes

+CPU spikes can occur for various reasons, primarily due to spikes in connections and poorly written SQL queries, or a combination of both:

+#### Spike in connections

+An increase in connections can lead to an increase in threads, which in turn can cause a rise in CPU usage as it has to manage these connections along with their queries and resources. To troubleshoot a spike in connections, you should check the [Total Connections](./../flexible-server/concepts-monitoring.md#list-of-metrics) metric and refer to the next section for more details about these connections. You can utilize the performance_schema to identify the hosts and users currently connected to the server with the following commands:

+Current connected hosts

+```

+ select HOST,CURRENT_CONNECTIONS From performance_schema.hosts

+ where CURRENT_CONNECTIONS > 0

+ and host not in ('NULL','localhost');

+```

+Current connected users

+```

+ select USER,CURRENT_CONNECTIONS from performance_schema.users

+ where CURRENT_CONNECTIONS >0

+ and USER not in ('NULL','azure_superuser');

+```

+#### Poorly written SQL queries

+Queries that are expensive to execute and scan a large number of rows without an index, or those that perform temporary sorts along with other inefficient plans, can lead to CPU spikes. While some queries may execute quickly in a single session, they can cause CPU spikes when run in multiple sessions. Therefore, itΓÇÖs crucial to always explain your queries that you capture from the [show processlist](https://dev.mysql.com/doc/refman/5.7/en/show-processlist.html) and ensure their execution plans are efficient. This can be achieved by ensuring they scan a minimal number of rows by using filters/where clause, utilize indexes and avoid using large temporary sort along with other bad execution plans. For more information about execution plans, see [EXPLAIN Output Format](https://dev.mysql.com/doc/refman/5.7/en/explain-output.html).

+- To enable Microsoft Defender for Endpoint for on-premises bare metal machines (BMMs), you must have selected a Defender for Servers plan in your Operator Nexus subscription prior to deployment. Additional information available [here](./howto-set-up-defender-for-cloud-security.md).

+Azure Orbital Ground Station offers a common data plane and API to access all antenna in the global network. An active contract with the partner network(s) you wish to integrate with Azure Orbital Ground Station is required to onboard with a partner. Once you have the proper contract(s) and regulatory approval(s) in place, your subscription is approved to access partner ground station sites by the Azure Orbital Ground Station team. Learn how to [request authorization of a spacecraft](register-spacecraft.md#request-authorization-of-the-new-spacecraft-resource) and [configure a contact profile](concepts-contact-profile.md#configure-a-contact-profile-for-applicable-partner-ground-stations) for partner ground stations.

+# Ground station contact profile resource

+You can create many contact profiles to represent different types of passes depending on your mission operations. For example, you can create a contact profile for a command and control pass or a contact profile for a downlink-only pass. These resources are mutable and don't undergo an authorization process like spacecraft resources do. One contact profile can be used with many spacecraft resources.

+## Understand links and channels

+You can specify EIRP and G/T requirements for each link. EIRP applies to uplinks and G/T applies to downlinks. You can provide a name for each link and channel to keep track of these properties. Each channel has a modem associated with it. Follow the steps in [how to set up a software modem](modem-chain.md) to understand the options.

+## Contact profile parameters

+| **Parameter** | **Description** |

+| | |

+| **Pass parameters** | |

+| Minimum viable contact duration | The minimum duration of a contact in ISO 8601 format. Acts as a prerequisite to show available time slots to communicate with your spacecraft. If an available time window is less than this time, it won't be in the list of available options. Avoid changing on a pass-by-pass basis and instead create multiple contact profiles if you require flexibility. |

+| Minimum elevation | The minimum elevation of a contact, after acquisition of signal (AOS), in decimal degrees. Acts as a prerequisite to show available time slots to communicate with your spacecraft. Using a higher value might reduce the duration of the contact. Avoid changing on a pass-by-pass basis and instead create multiple contact profiles if you require flexibility. |

+| Auto track configuration | The frequency band to be used for autotracking during the contact (X band, S band, or Disabled). |

+| Event Hubs Namespace and Instance | The Event Hubs namespace/instance to send telemetry data of your contacts. |

+| **Network Configuration** | |

+| Virtual Network | The virtual network used for a contact. This VNET must be in the same region as the contact profile. |

+| Subnet | The subnet used for a contact. This subnet must be within the above VNET, be delegated to the Microsoft.Orbital service, and have a minimum address prefix of size /24. |

+| Third-party configuration | Mission configuration and provider name associated with a partner ground network. |

+| **Links** | |

+| Direction | Direction of the link (uplink or downlink). |

+| Gain/Temperature | Required gain to noise temperature in dB/K. |

+| EIRP in dBW | Required effective isotropic radiated power in dBW. |

+| Polarization | Link polarization (RHCP, LHCP, Dual, or Linear Vertical). |

+| **Channels** | |

+| Center Frequency | The channel center frequency in MHz. |

+| Bandwidth | The channel bandwidth in MHz. |

+| Endpoint | The name, IP address, port, and protocol of the data delivery endpoint. |

+| Demodulation Configuration | Copy of the modem configuration file such as Kratos QRadio or Kratos QuantumRx. Only valid for downlink directions. If provided, the modem connects to the customer endpoint and sends demodulated data instead of a VITA.49 stream. |

+| Modulation Configuration | Copy of the modem configuration file such as Kratos QRadio. Only valid for uplink directions. If provided, the modem connects to the customer endpoint and accepts commands from the customer instead of a VITA.49 stream. |

+## Example of dual-polarization downlink contact profile

+Refer to the example below to understand how to specify an RHCP channel and an LHCP channel if your mission requires dual-polarization on downlink. To find this information about your contact profile, navigate to the contact profile resource overview in Azure portal and click 'JSON view.'

+## Create a contact profile

+Follow these instructions to create a contact profile [via the Azure portal](contact-profile.md) or [use the Azure Orbital Ground Station API](/rest/api/orbital//azureorbitalgroundstation/contact-profiles/create-or-update/).

+## Modify or delete a contact profile

+To modify or delete a contact profile via the [Azure portal](https://aka.ms/orbital/portal), navigate to the contact profile resource.

+You can also use the Azure Orbital Ground Station API to [modify](/rest/api/orbital/azureorbitalgroundstation/contact-profiles/create-or-update) or [delete](/rest/api/orbital/azureorbitalgroundstation/contact-profiles/delete) a contact profile.

+## Configure a contact profile for applicable partner ground stations

+After onboarding with a partner ground station network, you receive a name that identifies your configuration file. When [creating your contact profile](contact-profile.md), add this configuration name to your link in the 'Third-Party Configuration" parameter. This links your contact profile to the partner network.

+To establish connectivity with your spacecraft, schedule and execute a contact on a ground station. A contact, sometimes called a ground station 'pass,' can only occur when the spacecraft passes over a specified ground station while orbiting. You can find available contact opportunities and schedule contacts for your spacecraft through the Azure Orbital Ground Station [API](/rest/api/orbital/) or [Azure portal](https://aka.ms/orbital/portal).

+Contacts are scheduled for a particular combination of a [spacecraft](spacecraft-object.md) and [contact profile](concepts-contact-profile.md). When you schedule a contact for a spacecraft, a contact resource is created under your spacecraft resource in your Azure resource group. The contact is only associated with that particular spacecraft and can't be transferred to another spacecraft, resource group, or region.

+## Schedule a contact

+Use the [Azure portal](https://aka.ms/orbital/portal) or [Azure Orbital Ground Station API](/rest/api/orbital/) to [create a contact resource](schedule-contact.md) for your spacecraft resource.

+In order to cancel a scheduled contact, you must delete the contact resource.

+To delete a contact resource via the [Azure portal](https://aka.ms/orbital/portal):

+2. In the **Spacecraft** page, click the spacecraft associated with the scheduled contact.

+3. Click **Contacts** from the left menu bar in the spacecraftΓÇÖs overview page.

+4. Click the contact to be deleted.

+5. Click **Delete** from the top bar of the contact's configuration view.

+Alternatively, use the Contacts REST Operation Group to [delete a contact](/rest/api/orbital/azureorbitalgroundstation/contacts/delete/) with the Azure Orbital Ground Station API.

+- [Update the spacecraft TLE](update-tle.md)

+Learn how to create a [contact profile](concepts-contact-profile.md) with Azure Orbital Ground Station to save and reuse contact configurations. To schedule a contact, you must have a contact profile resource and [spacecraft resource](spacecraft-object.md).

+- A delegated subnet that is created in the relevant VNET and resource group. See [prepare network for Azure Orbital Ground Station integration](prepare-network.md).

+- To collect telemetry during the contact, [create an event hub](receive-real-time-telemetry.md). [Learn more about Azure Event Hubs](../event-hubs/event-hubs-about.md).

+## Azure portal method

+1. Sign in to the [Azure portal - Orbital](https://aka.ms/orbital/portal).

+2. In the Azure portal search box, enter **Contact Profiles**. Select **Contact Profiles** in the search results. Alternatively, navigate to the Azure Orbital service and click **Contact profiles** in the left column.

+3. In the **Contact Profiles** page, click **Create**.

+4. In **Create Contact Profile Resource**, enter or select the following information in the **Basics** tab:

+5. Click **Next**. In the **Links** pane, click **Add new Link**.

+6. In the **Add Link** page, enter or select the following information per link direction:

+7. Click **Add Channel**. In the **Add Channel** pane, enter or select the following information per channel:

+8. Click **Submit** to add the channel. After adding all channels, click **Submit** to add the link.

+9. If a mission requires third-party providers, click the **Third-Party Configuration** tab.

+## API method

+Use the Contact Profiles REST Operation Group to [create a contact profile](/rest/api/orbital/azureorbitalgroundstation/contact-profiles/create-or-update/) in the Azure Orbital Ground Station API.

+- [Initiate ground station licensing](initiate-licensing.md) ahead of launch to ensure you can communicate with your spacecraft.

+- [Configure a contact profile](contact-profile.md) with links and channels.

+- [Prepare for launch](prepare-for-launch.md) with RF compatibility testing and enrollment in Launch Window Scheduling (in preview).

+- [Schedule contacts](schedule-contact.md) with your spacecraft.

+- [Receive real-time antenna telemetry](receive-real-time-telemetry.md) from ground station passes.

+ Title: Use Confluent Access Management in the Azure portal

+description: This article describes how to use Confluent Access Management in the Azure portal to add, delete and manage users.

+subservice: confluent

+# CustomerIntent: As an organization admin, I want to manage user permissions in Apache Kafka on Confluent Cloud so that I can add, delete and manage users.

+# How to manage user permissions in a Confluent organization

+User access management is a feature that enables the organization admin to add, view and remove users and roles inside a Confluent organization. By managing user permissions, you can ensure that only authorized users can access and perform actions on your Confluent Cloud resources.

+This guide presents step by step instructions to manage users and roles in Apache Kafka on Confluent Cloud - An Azure Native ISV Service, via Azure portal.

+The following actions are supported:

+* Adding a user to a Confluent organization.

+* Viewing a user's role permissions in a Confluent organization.

+* Adding or removing role permissions assigned to a user in a Confluent organization.

+## Prerequisites

+* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free)

+* An existing Confluent organization.

+* Required permission: Azure subscription Owner, or subscription Contributor with minimum permission AccountAdmin in the Confluent Organization.

+## Add a user to a Confluent organization

+Follow the steps below to add a user to a Confluent organization.

+1. Open your Confluent organization in the Azure portal and select **Confluent Account and Access** from the left menu. The page shows a list of users who currently belong to this Confluent organization. The same list is visible under **Accounts & access** in the Confluent portal.

+ :::image type="content" source="media/manage-access/account-and-access.png" alt-text="Screenshot of the Azure platform showing the Confluent Account and Access menu.":::

+ > [!TIP]

+ > If you get the error "You do not have enough permissions on the organization to perform this operation", make sure that you have the required permissions. You must be a subscription Owner or Contributor.

+1. Select **Add User**. A new pane opens with a list of users who belong to your tenant.

+ :::image type="content" source="media/manage-access/add-user.png" alt-text="Screenshot of the Azure platform showing the Add user option.":::

+1. Select the user you want to add and select **Add User**.

+ :::image type="content" source="media/manage-access/select-user-to-add.png"alt-text="Screenshot of the Azure platform showing choosing a user to add.":::

+1. A notification indicates that the user has been added. The newly added user is listed in the Confluent Account and Access page and in the Confluent portal.

+## View a user's permissions

+Review permissions assigned to a user in their Confluent resource.

+1. The Confluent Account and Access page shows the list of users in your current Confluent organization. Select **Manage Permissions** on the right end of the user you want to see the permissions for.

+1. A pane opens, showing permissions. It shows that the newly added user doesn't have any permission in this Confluent organization yet. Optionally select the chevron next to the organization to expand into user permissions view for all environments and clusters.

+ :::image type="content" source="media/manage-access/view-roles.png"alt-text="Screenshot of the Azure platform showing roles attributed to a user.":::

+## Assign a permission to a user

+Give the new user some permissions in your Confluent organization.

+1. In your Confluent organization, select **Confluent Account and Access** from the left menu and select **Manage Permissions** on the right end of the user you want to assign a permission to.

+1. Select **Add Role** to get a list of role permissions available.

+ :::image type="content" source="media/manage-access/add-role.png"alt-text="Screenshot of the Azure platform showing the Add Role option.":::

+1. Check the list of role permissions available, select the one you want to assign to the user, then select **Add Role**.

+ :::image type="content" source="media/manage-access/select-role.png"alt-text="Screenshot of the Azure platform showing how to assign a role to a user.":::

+1. A notification indicates that the new user role has been added. The list of assigned roles for the user is updated with the newly added role.

+## Remove a user's permissions

+Remove a permission assigned to a user in the Confluent organization.

+1. In your Confluent organization, select **Confluent Account and Access** from the left menu and select **Manage Permissions** on the right end of the user whose permission you want to remove.

+1. In **Manage Permissions**, select **Remove Role**.

+ :::image type="content" source="media/manage-access/remove-role.png"alt-text="Screenshot of the Azure platform showing selecting a Confluent organization role to remove.":::

+1. Under **Enter Role Name to be removed**, enter the name of the role you want to remove. Optionally select the copy icon next to the name of the role to copy and then paste it in the text box. Select **Remove Role**.

+

+ :::image type="content" source="media/manage-access/confirm-role-removal.png"alt-text="Screenshot of the Azure platform showing confirmation of Confluent organization role removal.":::

+1. The role is removed and you see the refreshed roles.

+## Related content

+* For help with troubleshooting, see [Troubleshooting Apache Kafka on Confluent Cloud solutions](troubleshoot.md).

+* If you need to contact support, see [Get support for Confluent Cloud resource](get-support.md).

+* To learn more about managing Confluent Cloud, go to [Manage the Confluent Cloud resource](manage.md).

+* For help with troubleshooting, see [Troubleshooting Apache Kafka on Confluent Cloud solutions](troubleshoot.md).

+* If you need to contact support, see [Get support for Confluent Cloud resource](get-support.md).

+* To learn about managing user permissions, go to [How to manage user permissions in a Confluent organization](manage.md).

+After you create a server for the compute tier, you can change the number of vCores (up or down) and the storage size (up) in seconds. You also can independently adjust the backup retention period up or down. For more information, see the [Scaling resources](./concepts-scaling-resources.md) page.

+|_Top_ |Focus your attention on top queries - those issued by clients.

+|_None_ |If set to None, Query Store won't capture any new queries. You've already captured a query set and time window that you want to investigate and you want to eliminate the distractions that other queries may introduce. _None_ is suitable for testing and bench-marking environments. _None_ should be used with caution as you might miss the opportunity to track and optimize important new queries. |

+The **pg_qs.retention_period_in_days** parameter specifies in days the data retention period for Query Store. Older query and statistics data is deleted. By default, Query Store is configured to retain the data for seven days. Avoid keeping historical data you don't plan to use. Increase the value if you need to keep data longer.

+You can use Query Store in a wide variety of scenarios in which tracking and maintaining predictable workload performance is critical. Consider the following examples:

+- Identifying and tuning top expensive queries

+- A/B testing

+- Keeping performance stable during upgrades

+- Identifying and improving improvised workloads

+## Identify and tune expensive queries

+### Identify longest running queries

+Use Query Store views on the azure_sys database of your server to quickly identify the longest running queries. These queries typically tend to consume the most resources. Optimizing your longest running queries can improve performance by freeing up resources used by other queries running on your system.

+### Target queries with performance deltas

+### Tune expensive queries

+When you identify a query with suboptimal performance, the action you take depends on the nature of the problem:

+- Consider rewriting expensive queries. For example, take advantage of query parameterization and reduce the use of dynamic SQL. Implement optimal logic when reading data like applying data filtering on database side, not on application side.

+## A/B testing

+Use Query Store to compare workload performance before and after an application change you plan to introduce or before and after migration. Example scenarios for using Query Store to assess the impact of changes to workload performance:

+- Migration between PostgreSQL versions.

+- Rolling out a new version of an application.

+- Adding additional resources to the server.

+- Creating missing indexes on tables referenced by expensive queries.

+- Migration from Single Server to Flex Server.

+In any of these scenarios, apply the following workflow:

+1. Run your workload with Query Store before the planned change to generate a performance baseline.

+1. Apply application change(s) at the controlled moment in time.

+1. Continue running the workload long enough to generate performance image of the system after the change.

+1. Compare results from before and after the change.

+1. Decide whether to keep the change or rollback.

+## Identify and improve improvised workloads

+Some workloads don't have dominant queries that you can tune to improve overall application performance. Those workloads are typically characterized with a relatively large number of unique queries, each of them consuming a portion of system resources. Each unique query is executed infrequently, so individually their runtime consumption isn't critical. On the other hand, given that the application is generating new queries all the time, a significant portion of system resources is spent on query compilation, which isn't optimal. Usually, this situation happens if your application generates queries (instead of using stored procedures or parameterized queries) or if it relies on object-relational mapping frameworks that generate queries by default.

+If you are in control of the application code, you might consider rewriting the data access layer to use stored procedures or parameterized queries. However, this situation can be also be improved without application changes by forcing query parameterization for the entire database (all queries) or for the individual query templates with the same query hash.

+## Next step

+> [!div class="nextstepaction"]

+> [best practices for using Query Store](concepts-query-store-best-practices.md)

+> [!IMPORTANT]

+## Enable Query Store

+Query Store is an opt-in feature, so it isn't enabled by default on a server. Query store is enabled or disabled globally for all databases on a given server and can't be turned on or off per database.

+> [!IMPORTANT]

+> Do not enable Query Store on Burstable pricing tier as it would cause performance impact.

+1. Select **Server Parameters** in the **Settings** section of the menu.

+1. Search for the `pg_qs.query_capture_mode` parameter.

+1. Set the value to `TOP` or `ALL` and **Save**.

+1. Set the value to `ALL` and **Save**.

+- Understanding waits nature for a particular query

+```sql

+## Find wait queries

+| | |

+| High Buffer IO waits | Find the queries with a high number of physical reads in Query Store. If they match the queries with high IO waits, consider introducing an index on the underlying entity, in order to do seeks instead of scans. This would minimize the IO overhead of the queries. Check the **Performance Recommendations** for your server in the portal to see if there are index recommendations for this server that would optimize the queries. |

+| High Memory waits | Find the top memory consuming queries in Query Store. These queries are probably delaying further progress of the affected queries. Check the **Performance Recommendations** for your server in the portal to see if there are index recommendations that would optimize these queries. |

+| **Parameter** | **Description** | **Default** | **Range** |

+| | | | |

+| pg_qs.store_query_plans | Turns saving query plans on or off for pg_qs | off | on, off |

+| pg_qs.max_plan_size | Sets the maximum number of bytes that will be saved for query plan text for pg_qs; longer plans will be truncated. | 7500 | 100 - 10k |

+The following options apply specifically to wait statistics.

+| **Parameter** | **Description** | **Default** | **Range** |

+| | | | |

+| pgms_wait_sampling.query_capture_mode | Sets which statements are tracked for wait stats. | none | none, all |

+> [!NOTE]

+Queries are normalized by looking at their structure after removing literals and constants. If two queries are identical except for literal values, they'll have the same queryId.

+This view returns all the data in Query Store. There's one row for each distinct database ID, user ID, and query ID.

+| **Name** | **Type** | **References** | **Description** |

+| | | | |

+| runtime_stats_entry_id | bigint | | ID from the runtime_stats_entries table |

+| user_id | oid | pg_authid.oid | OID of user who executed the statement |

+| db_id | oid | pg_database.oid | OID of database in which the statement was executed |

+| query_id | bigint | | Internal hash code, computed from the statement's parse tree |

+| query_sql_text | varchar(10000) | | Text of a representative statement. Different queries with the same structure are clustered together; this text is the text for the first of the queries in the cluster. The default query text length is 6000 and can be modified using query store parameter `pg_qs.max_query_text_length`. |

+| plan_id | bigint | | ID of the plan corresponding to this query |

+| start_time | timestamp | | Queries are aggregated by time buckets - the time span of a bucket is 15 minutes by default. This is the start time corresponding to the time bucket for this entry. |

+| end_time | timestamp | | End time corresponding to the time bucket for this entry. |

+| calls | bigint | | Number of times the query executed |