+Both types of extensions can be configured by using Azure AD Connect for users who are managed on-premises, or Microsoft Graph APIs for cloud-only users.

+>- Custom security attributes in Azure AD (Preview)

+>- Microsoft Graph schema extensions

+>- Microsoft Graph open extensions

+To sync onPremisesExtensionAttributes or directory extensions from on-premises to Azure AD, [configure Azure AD Connect](../active-directory/hybrid/how-to-connect-sync-feature-directory-extensions.md).

+6. If the attribute mappings contain "reference" attributes, the service does more updates on the target system to create and link the referenced objects. For example, a user may have a "Manager" attribute in the target system, which is linked to another user created in the target system.

+6. If the attribute mappings contain "reference" attributes, the service does more updates on the target system to create and link the referenced objects. For example, a user may have a "Manager" attribute in the target system, which is linked to another user created in the target system.

+The provisioning service continues running back-to-back incremental cycles indefinitely, at intervals defined in the [tutorial specific to each application](../saas-apps/tutorial-list.md). Incremental cycles continue until one of the events occurs:

+- A new initial cycle is triggered using the **Restart provisioning** option in the Azure portal, or using the appropriate Microsoft Graph API command. The action clears any stored watermark and causes all source objects to be evaluated again. Also, the action doesn't break the links between source and target objects. To break the links, use [Restart synchronizationJob](/graph/api/synchronization-synchronizationjob-restart?view=graph-rest-beta&tabs=http&preserve-view=true) with the request:

+- The provisioning process goes into quarantine (see example) because of a high error rate, and stays in quarantine for more than four weeks. In this event, the service will be automatically disabled.

+The scenarios will trigger a disable or a delete:

+If one of the four events occurs and the target application doesn't support soft deletes, the provisioning service will send a DELETE request to permanently delete the user from the app.

+The table describes how you can configure deprovisioning actions with the Azure AD provisioning service. These rules are written with the non-gallery / custom application in mind, but generally apply to applications in the gallery. However, the behavior for gallery applications can differ as they've been optimized to meet the needs of the application. For example, the Azure AD provisioning service may always sende a request to hard delete users in certain applications rather than soft deleting, if the target application doesn't support soft deleting users.

+* If a user that was previously managed by the provisioning service is unassigned from an app, or from a group assigned to an app then a disable request is sent. At that point, the user isn't managed by the service and a delete request isn't sent when the user is deleted from the directory.

+## Known issue

+[FIDO2 security keys](../develop/support-fido2-authentication.md#mobile) on mobile devices and [registration for certificate-based authentication (CBA)](concept-certificate-based-authentication.md) aren't supported due to an issue that might surface when system-preferred MFA is enabled. Until a fix is available, we recommend not using FIDO2 security keys on mobile devices or registering for CBA. To disable system-preferred MFA for these users, you can either add them to an excluded group or remove them from an included group.

+Start by documenting which methods are available in the legacy MFA policy. Sign in to the [Azure portal](https://portal.azure.com) as a [Global Administrator](../roles/permissions-reference.md#global-administrator). Go to **Azure Active Directory** > **Users** > **All users** > **Per-user MFA** > **service settings** to view the settings. These settings are tenant-wide, so there's no need for user or group information.

+>[!NOTE]

+>Upload of new CAs will fail when any of the existing CAs are expired. Tenant Admin should delete the expired CAs and then upload the new CA.

+### Configure certification authorities(CA) using PowerShell

+>[!NOTE]

+>Upload of new CAs will fail when any of the existing CAs are expired. Tenant Admin should delete the expired CAs and then upload the new CA.

+ Title: View privileged role assignments in Azure AD Insights

+description: How to view current privileged role assignments in the Azure AD Insights tab.

+# View privileged role assignments in your organization (Preview)

+The **Azure AD Insights** tab shows you who is assigned to privileged roles in your organization. You can review a list of identities assigned to a privileged role and learn more about each identity.

+> [!NOTE]

+> Microsoft recommends that you keep two break glass accounts permanently assigned to the global administrator role. Make sure that these accounts don't require the same multi-factor authentication mechanism to sign in as other administrative accounts. This is described further in [Manage emergency access accounts in Microsoft Entra](../roles/security-emergency-access.md).

+> [!NOTE]

+> Keep role assignments permanent if a user has a an additional Microsoft account (for example, an account they use to sign in to Microsoft services like Skype, or Outlook.com). If you require multi-factor authentication to activate a role assignment, a user with an additional Microsoft account will be locked out.

+## View information in the Azure AD Insights tab

+1. From the Permissions Management home page, select the **Azure AD Insights** tab.

+2. Select **Review global administrators** to review the list of Global administrator role assignments.

+3. Select **Review highly privileged roles** or **Review service principals** to review information on principal role assignments for the following roles: *Application administrator*, *Cloud Application administrator*, *Exchange administrator*, *Intune administrator*, *Privileged role administrator*, *SharePoint administrator*, *Security administrator*, *User administrator*.

+## Next steps

+- For information about managing roles, policies and permissions requests in your organization, see [View roles/policies and requests for permission in the Remediation dashboard](ui-remediation.md).

+

+More information can be found about the problem by clicking **More Details** in the initial error page. Clicking **More Details** reveals troubleshooting information that is helpful when searching the Azure AD sign-in events for the specific failure event the user saw or when opening a support incident with Microsoft.

+

+ 

+1. Once the sign-in event that corresponds to the user's sign-in failure has been found select the **Conditional Access** tab. The Conditional Access tab shows the specific policy or policies that resulted in the sign-in interruption.

+ 1. To investigate further, drill down into the configuration of the policies by clicking on the **Policy Name**. Clicking the **Policy Name** shows the policy configuration user interface for the selected policy for review and editing.

+If you need to submit a support incident, provide the request ID and time and date from the sign-in event in the incident submission details. This information allows Microsoft support to find the specific event you're concerned about.

+In some specific scenarios, users are blocked because there are cloud apps with dependencies on resources blocked by Conditional Access policy.

+Access tokens enable clients to securely call protected web APIs. Web APIs use access tokens to perform authentication and authorization.

+Per the OAuth specification, access tokens are opaque strings without a set format. Some identity providers (IDPs) use GUIDs and others use encrypted blobs. The format of the access token can depend on the configuration of the API that accepts it.

+Custom APIs registered by developers on the Microsoft identity platform can choose from two different formats of JSON Web Tokens (JWTs) called `v1.0` and `v2.0`. Microsoft-developed APIs like Microsoft Graph or APIs in Azure have other proprietary token formats. These proprietary formats that can't be validated might be encrypted tokens, JWTs, or special JWT-like.

+The contents of the token are intended only for the API, which means that access tokens must be treated as opaque strings. For validation and debugging purposes *only*, developers can decode JWTs using a site like [jwt.ms](https://jwt.ms). Tokens that a Microsoft API receives might not always be a JWT that can be decoded.

+Clients should use the token response data that's returned with the access token for details on what's inside it. When the client requests an access token, the Microsoft identity platform also returns some metadata about the access token for the consumption of the application. This information includes the expiry time of the access token and the scopes for which it's valid. This data allows the application to do intelligent caching of access tokens without having to parse the access token itself.

+- v1.0 for Azure AD-only applications. The following example shows a v1.0 token (the keys are changed and personal information is removed, which prevents token validation):

+- v2.0 for applications that support consumer accounts. The following example shows a v2.0 token (the keys are changed and personal information is removed, which prevents token validation):

+Set the version for applications by providing the appropriate value to the `accessTokenAcceptedVersion` setting in the [app manifest](reference-app-manifest.md#manifest-reference). The values of `null` and `1` result in v1.0 tokens, and the value of `2` results in v2.0 tokens.

+An access token request involves two parties: the client, who requests the token, and the resource (Web API) that accepts the token. The resource that the token is intended for (its *audience*) is defined in the `aud` claim in a token. Clients use the token but shouldn't understand or attempt to parse it. Resources accept the token.

+The Microsoft identity platform supports issuing any token version from any version endpoint. For example, when the value of `accessTokenAcceptedVersion` is `2`, a client calling the v1.0 endpoint to get a token for that resource receives a v2.0 access token.

+JWTs contain the following pieces:

+- **Header** - Provides information about how to validate the token including information about the type of token and its signing method.

+The Microsoft identity platform uses some claims to help secure tokens for reuse. The description of `Opaque` marks these claims as not being for public consumption. These claims may or may not appear in a token, and new ones may be added without notice.

+| `alg` | String | Indicates the algorithm used to sign the token, for example, `RS256`. |

+| `kid` | String | Specifies the thumbprint for the public key used for validating the signature of the token. Emitted in both v1.0 and v2.0 access tokens. |

+| Claim | Format | Description |

+|-|--|-|

+| `aud` | String, an Application ID URI or GUID | Identifies the intended audience of the token. The API must validate this value and reject the token if the value doesn't match. In v2.0 tokens, this value is always the client ID of the API. In v1.0 tokens, it can be the client ID or the resource URI used in the request. The value can depend on how the client requested the token. |

+| `iss` | String, a security token service (STS) URI | Identifies the STS that constructs and returns the token, and the Azure AD tenant of the authenticated user. If the token issued is a v2.0 token (see the `ver` claim), the URI ends in `/v2.0`. The GUID that indicates that the user is a consumer user from a Microsoft account is `9188040d-6c67-4c5b-b112-36a304b66dad`. The application can use the GUID portion of the claim to restrict the set of tenants that can sign in to the application, if applicable. |

+|`idp`| String, usually an STS URI | Records the identity provider that authenticated the subject of the token. This value is identical to the value of the Issuer claim unless the user account isn't in the same tenant as the issuer, such as guests. Use the value of `iss` if the claim isn't present. For personal accounts being used in an organizational context (for instance, a personal account invited to an Azure AD tenant), the `idp` claim may be 'live.com' or an STS URI containing the Microsoft account tenant `9188040d-6c67-4c5b-b112-36a304b66dad`. |

+| `iat` | int, a Unix timestamp | Specifies when the authentication for this token occurred. |

+| `nbf` | int, a Unix timestamp | Specifies the time after which the JWT can be processed. |

+| `exp` | int, a Unix timestamp | Specifies the expiration time on or after which the JWT must not be accepted for processing. A resource may reject the token before this time as well. The rejection can occur for a required change in authentication or when a token is revoked. |

+| `aio` | Opaque String | An internal claim used by Azure AD to record data for token reuse. Resources shouldn't use this claim. |

+| `acr` | String, a `0` or `1`, only present in v1.0 tokens | A value of `0` for the "Authentication context class" claim indicates the end-user authentication didn't meet the requirements of ISO/IEC 29115. |

+| `amr` | JSON array of strings, only present in v1.0 tokens | Identifies the authentication method of the subject of the token. |

+| `appid` | String, a GUID, only present in v1.0 tokens | The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Azure AD. |

+| `azp` | String, a GUID, only present in v2.0 tokens | A replacement for `appid`. The application ID of the client using the token. The application can act as itself or on behalf of a user. The application ID typically represents an application object, but it can also represent a service principal object in Azure AD. |

+| `appidacr` | String, a `0`, `1`, or `2`, only present in v1.0 tokens | Indicates authentication method of the client. For a public client, the value is `0`. When you use the client ID and client secret, the value is `1`. When you use a client certificate for authentication, the value is `2`. |

+| `azpacr` | String, a `0`, `1`, or `2`, only present in v2.0 tokens | A replacement for `appidacr`. Indicates the authentication method of the client. For a public client, the value is `0`. When you use the client ID and client secret, the value is `1`. When you use a client certificate for authentication, the value is `2`. |

+| `preferred_username` | String, only present in v2.0 tokens. | The primary username that represents the user. The value could be an email address, phone number, or a generic username without a specified format. The value is mutable and might change over time. Since the value is mutable, don't use it to make authorization decisions. Use the value for username hints and in human-readable UI as a username. To receive this claim, use the `profile` scope. |

+| `name` | String | Provides a human-readable value that identifies the subject of the token. The value can vary, it's mutable, and is for display purposes only. To receive this claim, use the `profile` scope. |

+| `scp` | String, a space separated list of scopes | The set of scopes exposed by the application for which the client application has requested (and received) consent. The application should verify that these scopes are valid ones exposed by the application, and make authorization decisions based on the value of these scopes. Only included for user tokens. |

+| `roles` | Array of strings, a list of permissions | The set of permissions exposed by the application that the requesting application or user has been given permission to call. The [client credential flow](v2-oauth2-client-creds-grant-flow.md) uses this set of permission in place of user scopes for application tokens. For user tokens, this set of values contains the assigned roles of the user on the target application. |

+| `wids` | Array of [RoleTemplateID](../roles/permissions-reference.md#all-roles) GUIDs | Denotes the tenant-wide roles assigned to this user, from the section of roles present in [Azure AD built-in roles](../roles/permissions-reference.md#all-roles). The `groupMembershipClaims` property of the [application manifest](reference-app-manifest.md) configures this claim on a per-application basis. Set the claim to `All` or `DirectoryRole`. May not be present in tokens obtained through the implicit flow due to token length concerns. |

+| `groups` | JSON array of GUIDs | Provides object IDs that represent the group memberships of the subject. Safely use these unique values for managing access, such as enforcing authorization to access a resource. The `groupMembershipClaims` property of the [application manifest](reference-app-manifest.md) configures the groups claim on a per-application basis. A value of `null` excludes all groups, a value of `SecurityGroup` includes only Active Directory Security Group memberships, and a value of `All` includes both Security Groups and Microsoft 365 Distribution Lists. <br><br>See the `hasgroups` claim for details on using the `groups` claim with the implicit grant. For other flows, if the number of groups the user is in goes over 150 for SAML and 200 for JWT, then Azure AD adds an overage claim to the claim sources. The claim sources point to the Microsoft Graph endpoint that contains the list of groups for the user. |

+| `hasgroups` | Boolean | If present, always `true`, indicates whether the user is in at least one group. Used in place of the `groups` claim for JWTs in implicit grant flows if the full groups claim would extend the URI fragment beyond the URL length limits (currently six or more groups). Indicates that the client should use the Microsoft Graph API to determine the groups (`https://graph.microsoft.com/v1.0/users/{userID}/getMemberObjects`) of the user. |

+| `groups:src1` | JSON object | Includes a link to the full groups list for the user when token requests are too large for the token. For JWTs as a distributed claim, for SAML as a new claim in place of the `groups` claim. <br><br>**Example JWT Value**: <br> `"groups":"src1"` <br> `"_claim_sources`: `"src1" : { "endpoint" : "https://graph.microsoft.com/v1.0/users/{userID}/getMemberObjects" }` |

+| `sub` | String | The principal associated with the token. For example, the user of an application. This value is immutable, don't reassign or reuse. Use it to perform authorization checks safely, such as when using the token to access a resource, and can be used as a key in database tables. Because the subject is always present in the tokens that Azure AD issues, use this value in a general-purpose authorization system. The subject is a pairwise identifier that's unique to a particular application ID. If a single user signs into two different applications using two different client IDs, those applications receive two different values for the subject claim. Using the two different values depends on architecture and privacy requirements. See also the `oid` claim, which does remain the same across applications within a tenant. |

+| `oid` | String, a GUID | The immutable identifier for the requestor, which is the verified identity of the user or service principal. Use this value to also perform authorization checks safely and as a key in database tables. This ID uniquely identifies the requestor across applications. Two different applications signing in the same user receive the same value in the `oid` claim. The `oid` can be used when making queries to Microsoft online services, such as the Microsoft Graph. The Microsoft Graph returns this ID as the `id` property for a given user account. Because the `oid` allows multiple applications to correlate principals, to receive this claim for users use the `profile` scope. If a single user exists in multiple tenants, the user contains a different object ID in each tenant. Even though the user logs into each account with the same credentials, the accounts are different. |

+|`tid` | String, a GUID | Represents the tenant that the user is signing in to. For work and school accounts, the GUID is the immutable tenant ID of the organization that the user is signing in to. For sign-ins to the personal Microsoft account tenant (services like Xbox, Teams for Life, or Outlook), the value is `9188040d-6c67-4c5b-b112-36a304b66dad`. To receive this claim, the application must request the `profile` scope. |

+| `unique_name` | String, only present in v1.0 tokens | Provides a human readable value that identifies the subject of the token. This value can be different within a tenant and use it only for display purposes. |

+| `uti` | String | Token identifier claim, equivalent to `jti` in the JWT specification. Unique, per-token identifier that is case-sensitive. |

+| `rh` | Opaque String | An internal claim used by Azure to revalidate tokens. Resources shouldn't use this claim. |

+| `ver` | String, either `1.0` or `2.0` | Indicates the version of the access token. |

+The v1.0 tokens include the following claims if applicable, but not v2.0 tokens by default. To use these claims for v2.0, the application requests them using [optional claims](active-directory-optional-claims.md).

+| `pwd_url`| String | A URL where users can reset their password. |

+| `in_corp`| boolean | Signals if the client is signing in from the corporate network. |

+| `upn` | String | The username of the user. May be a phone number, email address, or unformatted string. Only use for display purposes and providing username hints in reauthentication scenarios. |

+| `rsa` | Authentication was based on the proof of an RSA key, for example with the [Microsoft Authenticator app](https://aka.ms/AA2kvvu). This value also indicates the use of a self-signed JWT with a service owned X509 certificate in authentication. |

+| `fed` | Indicates the use of a federated authentication assertion (such as JWT or SAML). |

+| `mfa` | Indicates the use of [Multi-factor authentication](../authentication/concept-mfa-howitworks.md). Includes the other authentication methods when this claim is present. |

+| `none` | Indicates no completed authentication. |

+The default lifetime of an access token is variable. When issued, the Microsoft identity platform assigns a random value ranging between 60-90 minutes (75 minutes on average) as the default lifetime of an access token. The variation improves service resilience by spreading access token demand over a time, which prevents hourly spikes in traffic to Azure AD.

+Tenants that don't use Conditional Access have a default access token lifetime of two hours for clients such as Microsoft Teams and Microsoft 365.

+Adjust the lifetime of an access token to control how often the client application expires the application session, and how often it requires the user to reauthenticate (either silently or interactively). To override the default access token lifetime variation, use [Configurable token lifetime (CTL)](active-directory-configurable-token-lifetimes.md).

+Apply default token lifetime variation to organizations that have Continuous Access Evaluation (CAE) enabled. Apply default token lifetime variation even if the organizations use CTL policies. The default token lifetime for long lived token lifetime ranges from 20 to 28 hours. When the access token expires, the client must use the refresh token to silently acquire a new refresh token and access token.

+Here's an example of how default token lifetime variation works with sign-in frequency. Let's say an organization sets sign-in frequency to occur every hour. When the token has lifetime ranging from 60-90 minutes due to token lifetime variation, the actual sign-in interval occurs anywhere between 1 hour to 2.5 hours.

+If a user with a token with a one hour lifetime performs an interactive sign-in at 59 minutes, there's no credential prompt because the sign-in is below the SIF threshold. If a new token has a lifetime of 90 minutes, the user wouldn't see a credential prompt for another hour and a half. During a silent renewal attempt, Azure AD requires a credential prompt because the total session length has exceeded the sign-in frequency setting of 1 hour. In this example, the time difference between credential prompts due to the SIF interval and token lifetime variation would be 2.5 hours.

+If none of the above scenarios apply, there's no need to validate the token, and may present a security and reliability risk when basing decisions on the validity of the token. Public clients like native or single-page applications don't benefit from validating tokens because the application communicates directly with the IDP where SSL protection ensures the tokens are valid.

+APIs and web applications must only validate tokens that have an `aud` claim that matches the application. Other resources may have custom token validation rules. For example, you can't validate tokens for Microsoft Graph according to these rules due to their proprietary format. Validating and accepting tokens meant for another resource is an example of the [confused deputy](https://cwe.mitre.org/data/definitions/441.html) problem.

+A JWT contains three segments separated by the `.` character. The first segment is the **header**, the second is the **body**, and the third is the **signature**. Use the signature segment to evaluate the authenticity of the token.

+Azure AD issues tokens signed using the industry standard asymmetric encryption algorithms, such as RS256. The header of the JWT contains information about the key and encryption method used to sign the token:

+The `alg` claim indicates the algorithm used to sign the token, while the `kid` claim indicates the particular public key that was used to validate the token.

+At any given point in time, Azure AD may sign an ID token using any one of a certain set of public-private key pairs. Azure AD rotates the possible set of keys on a periodic basis, so write the application to handle those key changes automatically. A reasonable frequency to check for updates to the public keys used by Azure AD is every 24 hours.

+- Includes a `jwks_uri`, which gives the location of the set of public keys that correspond to the private keys used to sign tokens. The JSON Web Key (JWK) located at the `jwks_uri` contains all of the public key information in use at that particular moment in time. [RFC 7517](https://tools.ietf.org/html/rfc7517) describes the JWK format. The application can use the `kid` claim in the JWT header to select the public key, from this document, which corresponds to the private key that has been used to sign a particular token. It can then do signature validation using the correct public key and the indicated algorithm.

+If the application has custom signing keys as a result of using the [claims-mapping](active-directory-claims-mapping.md) feature, append an `appid` query parameter that contains the application ID. For validation, use `jwks_uri` that points to the signing key information of the application. For example: `https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration?appid=6731de76-14a6-49ae-97bc-6eba6914391e` contains a `jwks_uri` of `https://login.microsoftonline.com/{tenant}/discovery/keys?appid=6731de76-14a6-49ae-97bc-6eba6914391e`.

+The business logic of an application determines how authorization should be handled. The general approach to authorization based on token claims, and which claims should be used, is described in the following sections.

+Next, to determine if the token subject, such as the user (or app itself for an app-only token), is authorized, either check for specific `sub` or `oid` claims, or check that the subject belongs to an appropriate role or group with the `roles`, `groups`, `wids` claims.

+The application defines the scopes and the absence of the `scp` claim means full actor permissions.

+Refresh tokens are invalidated or revoked at any time, for different reasons. The reasons fall into the categories of timeouts and revocations.

+Organizations can use [token lifetime configuration](active-directory-configurable-token-lifetimes.md) to alter the lifetime of refresh tokens Some tokens can go without use. For example, the user doesn't open the application for three months and then the token expires. Applications can encounter scenarios where the login server rejects a refresh token due to its age.

+- MaxInactiveTime: Specifies the amount of time that a token can be inactive.

+- MaxSessionAge: If MaxAgeSessionMultiFactor or MaxAgeSessionSingleFactor is set to something other than their default (Until-revoked), the user must reauthenticate after the time set in the MaxAgeSession*. Examples:

+ - A sensitive application has a MaxAgeSessionSingleFactor of one day. If a user logs in on Monday, and on Tuesday (after 25 hours have elapsed), they must reauthenticate.

+The server possibly revokes refresh tokens due to a change in credentials, or due to use or administrative action. Refresh tokens are in the classes of confidential clients and public clients.

+- Learn more about the [security tokens used in Azure AD](security-tokens.md).

+- Learn more about custom claims providers with the [custom claims provider reference](custom-claims-provider-reference.md) article.

+ The code starts with reading the incoming JSON object. Azure AD sends the [JSON object](./custom-claims-provider-reference.md) to your API. In this example, it reads the correlation ID value. Then, the code returns a collection of claims, including the original correlation ID, the version of your Azure Function, date of birth and custom role that is returned to Azure AD.

+- Work and school accounts (Azure AD provisioned accounts)

+- Personal accounts (such as Outlook.com or Hotmail.com)

+- Your customers who bring their own email or social identity (such as LinkedIn, Facebook, Google) via the Azure AD B2C offering

+ADAL Python acquires tokens for resources, but MSAL Python acquires tokens for scopes. The API surface in MSAL Python doesn't have resource parameter anymore. You would need to provide scopes as a list of strings that declare the desired permissions and resources that are requested. To see some example of scopes, see [Microsoft Graph's scopes](/graph/permissions-reference).

+You can add the `/.default` scope suffix to the resource to help migrate your apps from the v1.0 endpoint (ADAL) to the Microsoft identity platform (MSAL). For example, for the resource value of `https://graph.microsoft.com`, the equivalent scope value is `https://graph.microsoft.com/.default`. If the resource isn't in the URL form, but a resource ID of the form `XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX`, you can still use the scope value as `XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX/.default`.

+ADAL for Python uses the exception `AdalError` to indicate that there's been a problem. MSAL for Python typically uses error codes, instead. For more information, see [MSAL for Python error handling](msal-error-handling-python.md).

+| ADAL for Python API | MSAL for Python API |

+| -- | - |

+| [AuthenticationContext](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext) | [PublicClientApplication](https://msal-python.readthedocs.io/en/latest/#msal.PublicClientApplication.__init__) or [ConfidentialClientApplication](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.__init__) |

+| N/A | [PublicClientApplication.acquire_token_interactive()](https://msal-python.readthedocs.io/en/latest/#msal.PublicClientApplication.acquire_token_interactive) |

+| N/A | [ConfidentialClientApplication.initiate_auth_code_flow()](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.initiate_auth_code_flow) |

+| [acquire_token_with_authorization_code()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_token_with_authorization_code) | [ConfidentialClientApplication.acquire_token_by_auth_code_flow()](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.acquire_token_by_auth_code_flow) |

+| [acquire_token()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_token) | [PublicClientApplication.acquire_token_silent()](https://msal-python.readthedocs.io/en/latest/#msal.PublicClientApplication.acquire_token_silent) or [ConfidentialClientApplication.acquire_token_silent()](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.acquire_token_silent) |

+| [acquire_token_with_refresh_token()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_token_with_refresh_token) | These two helpers are intended to be used during [migration](#migrate-existing-refresh-tokens-for-msal-python) only: [PublicClientApplication.acquire_token_by_refresh_token()](https://msal-python.readthedocs.io/en/latest/#msal.PublicClientApplication.acquire_token_by_refresh_token) or [ConfidentialClientApplication.acquire_token_by_refresh_token()](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.acquire_token_by_refresh_token) |

+| [acquire_user_code()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_user_code) | [initiate_device_flow()](https://msal-python.readthedocs.io/en/latest/#msal.PublicClientApplication.initiate_device_flow) |

+| [acquire_token_with_device_code()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_token_with_device_code) and [cancel_request_to_get_token_with_device_code()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.cancel_request_to_get_token_with_device_code) | [acquire_token_by_device_flow()](https://msal-python.readthedocs.io/en/latest/#msal.PublicClientApplication.acquire_token_by_device_flow) |

+| [acquire_token_with_username_password()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_token_with_username_password) | [acquire_token_by_username_password()](https://msal-python.readthedocs.io/en/latest/#msal.PublicClientApplication.acquire_token_by_username_password) |

+| [acquire_token_with_client_credentials()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_token_with_client_credentials) and [acquire_token_with_client_certificate()](https://adal-python.readthedocs.io/en/latest/#adal.AuthenticationContext.acquire_token_with_client_certificate) | [acquire_token_for_client()](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.acquire_token_for_client) |

+| N/A | [acquire_token_on_behalf_of()](https://msal-python.readthedocs.io/en/latest/#msal.ConfidentialClientApplication.acquire_token_on_behalf_of) |

+| [TokenCache()](https://adal-python.readthedocs.io/en/latest/#adal.TokenCache) | [SerializableTokenCache()](https://msal-python.readthedocs.io/en/latest/#msal.SerializableTokenCache) |

+| N/A | Cache with persistence, available from [MSAL Extensions](https://github.com/marstr/original-microsoft-authentication-extensions-for-python) |

+MSAL abstracts the concept of refresh tokens. MSAL Python provides an in-memory token cache by default so that you don't need to store, lookup, or update refresh tokens. Users will also see fewer sign-in prompts because refresh tokens can usually be updated without user intervention. For more information about the token cache, see [Custom token cache serialization in MSAL for Python](msal-python-token-cache-serialization.md).

+HereΓÇÖs an example policy that requires users to authenticate less frequently in your web app. This policy sets the lifetime of the access to the service principal of your web app. Create the policy and assign it to your service principal. You also need to get the ObjectId of your service principal.

+ options.TokenValidationParameters.ValidAudiences = new[] { /* list of valid audiences */};

+>[!NOTE]

+> For information on specific roles that can perform these steps review [Azure AD built-in roles](../roles/permissions-reference.md)

+ - For applications that don't use Azure AD SaaS App Provisioning, use [Identity Manager (MIM)](/microsoft-identity-manager/mim-how-provision-users-adds) or a third party solution to automate the deprovisioning of users.

+## March 2023

+### Updated articles

+- [Invite internal users to B2B collaboration](invite-internal-users.md)

+- [Federation with SAML/WS-Fed identity providers for guest users](direct-federation.md)

+- [Add Azure Active Directory (Azure AD) as an identity provider for External Identities](azure-ad-account.md)

+- [Quickstart: Add a guest user with PowerShell](b2b-quickstart-invite-powershell.md)

+- [Billing model for Azure AD External Identities](external-identities-pricing.md)

+- [Tutorial: Enforce multi-factor authentication for B2B guest users](b2b-tutorial-require-mfa.md)

+- [External Identities documentation](index.yml)

+> [!NOTE]

+> The recommendation is to use a domain that has the appropriate DNS records to facilitate email validation, like SPF, DKIM, DMARC, and MX as this then complies with the [RFC compliance](https://www.ietf.org/rfc/rfc2142.txt) for sending and receiving email. Please see [Learn more about Exchange Online Email Routing](/exchange/mail-flow-best-practices/mail-flow-best-practices) for more information.

+| Admin confirmed service principal compromised | Offline | This detection indicates an admin has selected 'Confirm compromised' in the Risky Workload Identities UI or using riskyServicePrincipals API. To see which admin has confirmed this account compromised, check the accountΓÇÖs risk history (via UI or API). |

+| Malicious application | Offline | This detection combines alerts from Identity Protection and Microsoft Defender for Cloud Apps to indicate when Microsoft has disabled an application for violating our terms of service. We recommend [conducting an investigation](https://go.microsoft.com/fwlink/?linkid=2208429) of the application. Note: These applications will show `DisabledDueToViolationOfServicesAgreement` on the `disabledByMicrosoftStatus` property on the related [application](/graph/api/resources/application) and [service principal](/graph/api/resources/serviceprincipal) resource types in Microsoft Graph. To prevent them from being instantiated in your organization again in the future, you cannot delete these objects. |

+| Suspicious application | Offline | This detection indicates that Identity Protection or Microsoft Defender for Cloud Apps have identified an application that may be violating our terms of service but hasn't disabled it. We recommend [conducting an investigation](https://go.microsoft.com/fwlink/?linkid=2208429) of the application.|

+ GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=displayName eq '{appDisplayName}'

+ GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}

+ POST https://graph.microsoft.com/v1.0/servicePrincipals/{resource-servicePrincipal-id}/appRoleAssignedTo

+1. Get the enterprise application. Filter by displayName.

+ GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=displayName eq '{appDisplayName}'

+ ```http

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/{id}/appRoleAssignedTo

+ ```

+ DELETE https://graph.microsoft.com/v1.0/servicePrincipals/{resource-servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}

+ # [HTTP](#tab/http)

+ # [C#](#tab/csharp)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/csharp/list-serviceprincipal-csharp-snippets.md)]

+ # [JavaScript](#tab/javascript)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/javascript/list-serviceprincipal-javascript-snippets.md)]

+ # [Java](#tab/java)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/jav)]

+ # [Go](#tab/go)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/go/list-serviceprincipal-go-snippets.md)]

+ # [PowerShell](#tab/powershell)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/powershell/list-serviceprincipal-powershell-snippets.md)]

+ # [PHP](#tab/php)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/php/list-serviceprincipal-php-snippets.md)]

+

+

+ # [HTTP](#tab/http)

+ # [C#](#tab/csharp)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/csharp/delete-serviceprincipal-csharp-snippets.md)]

+ # [JavaScript](#tab/javascript)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/javascript/delete-serviceprincipal-javascript-snippets.md)]

+ # [Java](#tab/java)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/jav)]

+ # [Go](#tab/go)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/go/delete-serviceprincipal-go-snippets.md)]

+ # [PowerShell](#tab/powershell)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/powershell/delete-serviceprincipal-powershell-snippets.md)]

+ # [PHP](#tab/php)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/php/delete-serviceprincipal-php-snippets.md)]

+

+1. Get service principal using the object ID.

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/{id}

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/00063ffc-54e9-405d-b8f3-56124728e051

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/{id}/oauth2PermissionGrants

+ DELETE https://graph.microsoft.com/v1.0/oAuth2PermissionGrants/{id}

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipal-id}/appRoleAssignments

+ DELETE https://graph.microsoft.com/v1.0/servicePrincipals/{resource-servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/{id}

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/57443554-98f5-4435-9002-852986eea510

+ GET https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo

+ DELETE https://graph.microsoft.com/v1.0/servicePrincipals/{servicePrincipal-id}/appRoleAssignedTo/{appRoleAssignment-id}

+Replace ID with the object ID of the service principal that you want to restore.

+Replace ID with the object ID of the service principal that you want to restore.

+Replace ID with the object ID of the service principal that you want to restore.

+Replace ID with the object ID of the service principal that you want to restore.

+ # [HTTP](#tab/http)

+ # [C#](#tab/csharp)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/csharp/restore-directory-deleteditem-csharp-snippets.md)]

+

+ # [JavaScript](#tab/javascript)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/javascript/restore-directory-deleteditem-javascript-snippets.md)]

+

+ # [Java](#tab/java)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/jav)]

+

+ # [Go](#tab/go)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/go/restore-directory-deleteditem-go-snippets.md)]

+

+ # [PowerShell](#tab/powershell)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/powershell/restore-directory-deleteditem-powershell-snippets.md)]

+

+ # [PHP](#tab/php)

+ [!INCLUDE [sample-code](~/microsoft-graph/api-reference/v1.0/includes/snippets/php/restore-directory-deleteditem-php-snippets.md)]

+

+

+Replace ID with the object ID of the service principal that you want to restore.

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PHP](#tab/php)

+Create a resource group called **mi-test**. We use this resource group for all resources used in this tutorial.

+Depending on your API version, you have to take [different steps](qs-configure-template-windows-vm.md#user-assigned-managed-identity). If your apiVersion is 2018-06-01, your user-assigned managed identities are stored in the userAssignedIdentities dictionary format. The ```<identityName>``` value is the name of a variable that you define in the variables section of your template. In the variable, you point to the user assigned managed identity that you want to assign.

+In addition to the NuGet packages above, you also need to enable **Include prerelease** and then add **Azure.ResourceManager.CosmosDB**.

+ // Replace the placeholders with your own values

+ // Authenticate to Azure using Managed Identity (system-assigned or user-assigned)

+ // Create the Cosmos DB management client using the subscription ID and token credential

+ var managementClient = new CosmosDBManagementClient(tokenCredential)

+ {

+ SubscriptionId = subscriptionId

+ };

+ // Create the Cosmos DB data client using the account URL and token credential

+ var dataClient = new CosmosClient($"https://{accountName}.documents.azure.com:443/", tokenCredential);

+ // Create a new database using the management client

+ var createDatabaseOperation = await managementClient.SqlResources.StartCreateUpdateSqlDatabaseAsync(

+ resourceGroupName,

+ accountName,

+ databaseName,

+ // Create a new container using the management client

+ var createContainerOperation = await managementClient.SqlResources.StartCreateUpdateSqlContainerAsync(

+ resourceGroupName,

+ accountName,

+ databaseName,

+ containerName,

+ // Create a new item in the container using the data client

+ // Read back the item from the container using the data client

+ // Run a query to get all items from the container using the data client

+#### Symptom - Users are skipped because SMS sign-in is enabled on the user

+Users are skipped from synchronization. The scoping step includes the following filter with status false: "Filter external users.alternativeSecurityIds EQUALS 'None'"

+**Cause**

+If SMS sign-in is enabled for a user, they will be skipped by the provisioning service.

+**Solution**

+Disable SMS Sign-in for the users. The script below shows how you can disable SMS Sign-in using PowerShell.

+```

+##### Disable SMS Sign-in options for the users

+#### Import module

+Install-Module Microsoft.Graph.Users.Actions

+Install-Module Microsoft.Graph.Identity.SignIns

+Import-Module Microsoft.Graph.Users.Actions

+Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All", "UserAuthenticationMethod.Read.All","UserAuthenticationMethod.ReadWrite","UserAuthenticationMethod.ReadWrite.All"

+##### The value for phoneAuthenticationMethodId is 3179e48a-750b-4051-897c-87b9720928f7

+$phoneAuthenticationMethodId = "3179e48a-750b-4051-897c-87b9720928f7"

+#### Get the User Details

+$userId = "objectid_of_the_user_in_Azure_AD"

+#### validate the value for SmsSignInState

+$smssignin = Get-MgUserAuthenticationPhoneMethod -UserId $userId

+{

+ if($smssignin.SmsSignInState -eq "ready"){

+ #### Disable Sms Sign-In for the user is set to ready

+

+ Disable-MgUserAuthenticationPhoneMethodSmSign -UserId $userId -PhoneAuthenticationMethodId $phoneAuthenticationMethodId

+ Write-Host "SMS sign-in disabled for the user" -ForegroundColor Green

+ }

+ else{

+ Write-Host "SMS sign-in status not set or found for the user " -ForegroundColor Yellow

+ }

+}

+##### End the script

+```

+> |AzureActiveDirectoryInsufficientRights|When a B2B user in the target tenant has a role other than User, Helpdesk Admin, or User Account Admin, they cannot be deleted.| Remove the role(s) on the user in the target tenant in order to successfully delete the user in the target tenant.|

+> |AzureActiveDirectoryForbidden|External collaboration settings have blocked invitations.|Navigate to user settings and ensure that [external collaboration settings](../external-identities/external-collaboration-settings-configure.md) are permitted.|

+> |InvitationCreationFailureInvalidPropertyValue|Potential causes:<br/>* The Primary SMTP Address is an invalid value.<br/>* UserType is neither guest nor member<br/>* Group email Address is not supported | Potential solutions:<br/>* The Primary SMTP Address has an invalid value. Resolving this issue will likely require updating the mail property of the source user. For more information, see [Prepare for directory synchronization to Microsoft 365](https://aka.ms/DirectoryAttributeValidations)<br/>* Ensure that the userType property is provisioned as type guest or member. This can be fixed by checking your attribute mappings to understand how the userType attribute is mapped.<br/>* The email address address of the user matches with the email address of a group in the tenant. Update the email address for one of the two objects.|

+> |InvitationCreationFailureAmbiguousUser| The invited user has a proxy address that matches an internal user in the target tenant. The proxy address must be unique. | To resolve this error, delete the existing internal user in the target tenant or remove this user from sync scope.|

+ Title: Azure Active Directory SSO integration with Easy Metrics Auth0 Connector

+description: Learn how to configure single sign-on between Azure Active Directory and Easy Metrics Auth0 Connector.

+# Azure Active Directory SSO integration with Easy Metrics Auth0 Connector

+In this article, you learn how to integrate Easy Metrics Auth0 Connector with Azure Active Directory (Azure AD). This application is a bridge between Azure AD and Auth0, federating Authentication to Microsoft Azure AD for our customers. When you integrate Easy Metrics Auth0 Connector with Azure AD, you can:

+* Control in Azure AD who has access to Easy Metrics Auth0 Connector.

+* Enable your users to be automatically signed-in to Easy Metrics Auth0 Connector with their Azure AD accounts.

+* Manage your accounts in one central location - the Azure portal.

+You configure and test Azure AD single sign-on for Easy Metrics Auth0 Connector in a test environment. Easy Metrics Auth0 Connector supports only **SP** initiated single sign-on.

+> [!NOTE]

+> Identifier of this application is a fixed string value so only one instance can be configured in one tenant.

+## Prerequisites

+To integrate Azure Active Directory with Easy Metrics Auth0 Connector, you need:

+* An Azure AD user account. If you don't already have one, you can [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).

+* One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

+* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).

+* Easy Metrics Auth0 Connector single sign-on (SSO) enabled subscription.

+## Add application and assign a test user

+Before you begin the process of configuring single sign-on, you need to add the Easy Metrics Auth0 Connector application from the Azure AD gallery. You need a test user account to assign to the application and test the single sign-on configuration.

+### Add Easy Metrics Auth0 Connector from the Azure AD gallery

+Add Easy Metrics Auth0 Connector from the Azure AD application gallery to configure single sign-on with Easy Metrics Auth0 Connector. For more information on how to add application from the gallery, see the [Quickstart: Add application from the gallery](../manage-apps/add-application-portal.md).

+### Create and assign Azure AD test user

+Follow the guidelines in the [create and assign a user account](../manage-apps/add-application-portal-assign-users.md) article to create a test user account in the Azure portal called B.Simon.

+Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, and assign roles. The wizard also provides a link to the single sign-on configuration pane in the Azure portal. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides).

+## Configure Azure AD SSO

+Complete the following steps to enable Azure AD single sign-on in the Azure portal.

+1. In the Azure portal, on the **Easy Metrics Auth0 Connector** application integration page, find the **Manage** section and select **single sign-on**.

+1. On the **Select a single sign-on method** page, select **SAML**.

+1. On the **Set up single sign-on with SAML** page, select the pencil icon for **Basic SAML Configuration** to edit the settings.

+ 

+1. On the **Basic SAML Configuration** section, perform the following steps:

+ a. In the **Identifier** textbox, type the value:

+ `urn:auth0:easymetrics:ups-saml-sso`

+ b. In the **Reply URL** textbox, type the URL:

+ `https://easymetrics.auth0.com/login/callback?connection=ups-saml-sso&organization=org_T8ro1Kth3Gleygg5`

+ c. In the **Sign on URL** textbox, type the URL:

+ `https://azureapp.gcp-easymetrics.com`

+1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, find **Certificate (PEM)** and select **Download** to download the certificate and save it on your computer.

+ 

+## Configure Easy Metrics Auth0 Connector SSO

+To configure single sign-on on **Easy Metrics Auth0 Connector** side, you need to send the **Certificate (PEM)** to [Easy Metrics Auth0 Connector support team](mailto:support@easymetrics.com). They set this setting to have the SAML SSO connection set properly on both sides.

+### Create Easy Metrics Auth0 Connector test user

+In this section, you create a user called Britta Simon in Easy Metrics Auth0 Connector. Work with [Easy Metrics Auth0 Connector support team](mailto:support@easymetrics.com) to add the users in the Easy Metrics Auth0 Connector platform. Users must be created and activated before you use single sign-on.

+## Test SSO

+In this section, you test your Azure AD single sign-on configuration with following options.

+* Click on **Test this application** in Azure portal. This will redirect to Easy Metrics Auth0 Connector Sign-on URL where you can initiate the login flow.

+* Go to Easy Metrics Auth0 Connector Sign-on URL directly and initiate the login flow from there.

+* You can use Microsoft My Apps. When you click the Easy Metrics Auth0 Connector tile in the My Apps, this will redirect to Easy Metrics Auth0 Connector Sign-on URL. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).

+## Additional resources

+* [What is single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md)

+* [Plan a single sign-on deployment](../manage-apps/plan-sso-deployment.md).

+## Next steps

+Once you configure Easy Metrics Auth0 Connector you can enforce session control, which protects exfiltration and infiltration of your organizationΓÇÖs sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Cloud App Security](/cloud-app-security/proxy-deployment-aad).

+ Title: Azure Active Directory SSO integration with myMobilityHQ

+description: Learn how to configure single sign-on between Azure Active Directory and myMobilityHQ.

+# Azure Active Directory SSO integration with myMobilityHQ

+In this article, you learn how to integrate myMobilityHQ with Azure Active Directory (Azure AD). myMobilityHQ is the secure portal that allows your company mobility managers to see a real-time dashboard of the status of their expatriate tax program. When you integrate myMobilityHQ with Azure AD, you can:

+* Control in Azure AD who has access to myMobilityHQ.

+* Enable your users to be automatically signed-in to myMobilityHQ with their Azure AD accounts.

+* Manage your accounts in one central location - the Azure portal.

+You configure and test Azure AD single sign-on for myMobilityHQ in a test environment. myMobilityHQ supports only **SP** initiated single sign-on.

+## Prerequisites

+To integrate Azure Active Directory with myMobilityHQ, you need:

+* An Azure AD user account. If you don't already have one, you can [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).

+* One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

+* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).

+* myMobilityHQ single sign-on (SSO) enabled subscription.

+## Add application and assign a test user

+Before you begin the process of configuring single sign-on, you need to add the myMobilityHQ application from the Azure AD gallery. You need a test user account to assign to the application and test the single sign-on configuration.

+### Add myMobilityHQ from the Azure AD gallery

+Add myMobilityHQ from the Azure AD application gallery to configure single sign-on with myMobilityHQ. For more information on how to add application from the gallery, see the [Quickstart: Add application from the gallery](../manage-apps/add-application-portal.md).

+### Create and assign Azure AD test user

+Follow the guidelines in the [create and assign a user account](../manage-apps/add-application-portal-assign-users.md) article to create a test user account in the Azure portal called B.Simon.

+Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, and assign roles. The wizard also provides a link to the single sign-on configuration pane in the Azure portal. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides).

+## Configure Azure AD SSO

+Complete the following steps to enable Azure AD single sign-on in the Azure portal.

+1. In the Azure portal, on the **myMobilityHQ** application integration page, find the **Manage** section and select **single sign-on**.

+1. On the **Select a single sign-on method** page, select **SAML**.

+1. On the **Set up single sign-on with SAML** page, select the pencil icon for **Basic SAML Configuration** to edit the settings.

+ 

+1. On the **Basic SAML Configuration** section, perform the following steps:

+ a. In the **Identifier** textbox, type a value using one of the following patterns:

+ | **Identifier** |

+ ||

+ | `urn:auth0:prod:s<COMPANYNAME>` |

+ | `urn:auth0:stage:s<COMPANYNAME>` |

+ b. In the **Reply URL** textbox, type a URL using one of the following patterns:

+ | **Reply URL** |

+ ||

+ | `https://stage.vialto.auth0app.com/login/callback?connection=s<COMPANYNAME>` |

+ | `https://prod.vialto.auth0app.com/login/callback?connection=s<COMPANYNAME>` |

+ | `https://auth-stage.vialto.com/login/callback?connection=s<COMPANYNAME>` |

+ | `https://auth.vialto.com/login/callback?connection=s<COMPANYNAME>` |

+ c. In the **Sign on URL** textbox, type one of the following URLs:

+

+ | **Sign on URL** |

+ |-|

+ | `https://mymobilityhq-stage.vialto.com`|

+ | `https://mymobilityhq.vialto.com` |

+ > [!Note]

+ > These values are not real. Update these values with the actual Identifier and Reply URL. Contact [myMobilityHQ support team](mailto:gbl_vialto_iam_engineering_support@vialto.com) to get these values. You can also refer to the patterns shown in the Basic SAML Configuration section in the Azure portal.

+1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, click copy button to copy **App Federation Metadata Url** and save it on your computer.

+ 

+## Configure myMobilityHQ SSO

+To configure single sign-on on **myMobilityHQ** side, you need to send the **App Federation Metadata Url** to [myMobilityHQ support team](mailto:gbl_vialto_iam_engineering_support@vialto.com). They set this setting to have the SAML SSO connection set properly on both sides.

+### Create myMobilityHQ test user

+In this section, you create a user called Britta Simon in myMobilityHQ. Work with [myMobilityHQ support team](mailto:gbl_vialto_iam_engineering_support@vialto.com) to add the users in the myMobilityHQ platform. Users must be created and activated before you use single sign-on.

+## Test SSO

+In this section, you test your Azure AD single sign-on configuration with following options.

+* Click on **Test this application** in Azure portal. This will redirect to myMobilityHQ Sign-on URL where you can initiate the login flow.

+* Go to myMobilityHQ Sign-on URL directly and initiate the login flow from there.

+* You can use Microsoft My Apps. When you click the myMobilityHQ tile in the My Apps, this will redirect to myMobilityHQ Sign-on URL. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).

+## Additional resources

+* [What is single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md)

+* [Plan a single sign-on deployment](../manage-apps/plan-sso-deployment.md).

+## Next steps

+Once you configure myMobilityHQ you can enforce session control, which protects exfiltration and infiltration of your organizationΓÇÖs sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Cloud App Security](/cloud-app-security/proxy-deployment-aad).

+ Title: Azure Active Directory SSO integration with Proofpoint Security Awareness Training

+description: Learn how to configure single sign-on between Azure Active Directory and Proofpoint Security Awareness Training.

+# Azure Active Directory SSO integration with Proofpoint Security Awareness Training

+In this article, you learn how to integrate Proofpoint Security Awareness Training with Azure Active Directory (Azure AD). This application allows Azure AD to act as SAML IdP for authenticating users to Proofpoint Security Awareness Training. When you integrate Proofpoint Security Awareness Training with Azure AD, you can:

+* Control in Azure AD who has access to Proofpoint Security Awareness Training.

+* Enable your users to be automatically signed-in to Proofpoint Security Awareness Training with their Azure AD accounts.

+* Manage your accounts in one central location - the Azure portal.

+You configure and test Azure AD single sign-on for Proofpoint Security Awareness Training in a test environment. Proofpoint Security Awareness Training supports both **SP** and **IDP** initiated single sign-on and **Just In Time** user provisioning.

+## Prerequisites

+To integrate Azure Active Directory with Proofpoint Security Awareness Training, you need:

+* An Azure AD user account. If you don't already have one, you can [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).

+* One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

+* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).

+* Proofpoint Security Awareness Training single sign-on (SSO) enabled subscription.

+## Add application and assign a test user

+Before you begin the process of configuring single sign-on, you need to add the Proofpoint Security Awareness Training application from the Azure AD gallery. You need a test user account to assign to the application and test the single sign-on configuration.

+### Add Proofpoint Security Awareness Training from the Azure AD gallery

+Add Proofpoint Security Awareness Training from the Azure AD application gallery to configure single sign-on with Proofpoint Security Awareness Training. For more information on how to add application from the gallery, see the [Quickstart: Add application from the gallery](../manage-apps/add-application-portal.md).

+### Create and assign Azure AD test user

+Follow the guidelines in the [create and assign a user account](../manage-apps/add-application-portal-assign-users.md) article to create a test user account in the Azure portal called B.Simon.

+Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, and assign roles. The wizard also provides a link to the single sign-on configuration pane in the Azure portal. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides).

+## Configure Azure AD SSO

+Complete the following steps to enable Azure AD single sign-on in the Azure portal.

+1. In the Azure portal, on the **Proofpoint Security Awareness Training** application integration page, find the **Manage** section and select **single sign-on**.

+1. On the **Select a single sign-on method** page, select **SAML**.

+1. On the **Set up single sign-on with SAML** page, select the pencil icon for **Basic SAML Configuration** to edit the settings.

+ [ ](common/edit-urls.png#lightbox)

+1. On the **Basic SAML Configuration** section, perform the following steps:

+ a. In the **Identifier** textbox, type a URL using the following pattern:

+ `https://<SUBDOMAIN>.<ENVIRONMENT>/api/auth/saml/metadata`

+ b. In the **Reply URL** textbox, type a URL using the following pattern:

+ `https://<SUBDOMAIN>.<ENVIRONMENT>/api/auth/saml/SSO`

+1. If you wish to configure the application in **SP** initiated mode, then perform the following steps:

+ a. In the **Sign on URL** textbox, type a URL using the following pattern:

+ `https://<SUBDOMAIN>.<ENVIRONMENT>`

+ b. In the **Relay State** textbox, type a URL using the following pattern:

+ `https://<SUBDOMAIN>.<ENVIRONMENT>`

+ c. In the **Logout Url** textbox, type a URL using the following pattern:

+ `https://<SUBDOMAIN>.<ENVIRONMENT>/api/auth/saml/SingleLogout`

+

+ > [!NOTE]

+ > These values are not real. Update these values with the actual Identifier, Reply URL, Sign on URL, Relay State and Logout Url. Contact [Proofpoint Security Awareness Training Client support team](mailto:wst-support@proofpoint.com) to get these values. You can also refer to the patterns shown in the **Basic SAML Configuration** section in the Azure portal.

+1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, click copy button to copy **App Federation Metadata Url** and save it on your computer.

+ [ ](common/copy-metadataurl.png#lightbox)

+## Configure Proofpoint Security Awareness Training SSO

+To configure single sign-on on **Proofpoint Security Awareness Training** side, you need to send the **App Federation Metadata Url** to [Proofpoint Security Awareness Training support team](mailto:wst-support@proofpoint.com). They set this setting to have the SAML SSO connection set properly on both sides.

+### Create Proofpoint Security Awareness Training test user

+In this section, a user called B.Simon is created in Proofpoint Security Awareness Training. Proofpoint Security Awareness Training supports just-in-time user provisioning, which is enabled by default. There's no action item for you in this section. If a user doesn't already exist in Proofpoint Security Awareness Training, a new one is commonly created after authentication.

+## Test SSO

+In this section, you test your Azure AD single sign-on configuration with following options.

+#### SP initiated:

+* Click on **Test this application** in Azure portal. This will redirect to Proofpoint Security Awareness Training Sign-on URL where you can initiate the login flow.

+* Go to Proofpoint Security Awareness Training Sign-on URL directly and initiate the login flow from there.

+#### IDP initiated:

+* Click on **Test this application** in Azure portal and you should be automatically signed in to the Proofpoint Security Awareness Training for which you set up the SSO.

+You can also use Microsoft My Apps to test the application in any mode. When you click the Proofpoint Security Awareness Training tile in the My Apps, if configured in SP mode you would be redirected to the application sign-on page for initiating the login flow and if configured in IDP mode, you should be automatically signed in to the Proofpoint Security Awareness Training for which you set up the SSO. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).

+## Additional resources

+* [What is single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md)

+* [Plan a single sign-on deployment](../manage-apps/plan-sso-deployment.md).

+## Next steps

+Once you configure Proofpoint Security Awareness Training you can enforce session control, which protects exfiltration and infiltration of your organizationΓÇÖs sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Cloud App Security](/cloud-app-security/proxy-deployment-aad).

+ Title: Azure Active Directory SSO integration with SeattleTimesSSO

+description: Learn how to configure single sign-on between Azure Active Directory and SeattleTimesSSO.

+# Azure Active Directory SSO integration with SeattleTimesSSO

+In this article, you learn how to integrate SeattleTimesSSO with Azure Active Directory (Azure AD). This is the Institutional Subscription SSO for The Seattle Times. When you integrate SeattleTimesSSO with Azure AD, you can:

+* Control in Azure AD who has access to SeattleTimesSSO.

+* Enable your users to be automatically signed-in to SeattleTimesSSO with their Azure AD accounts.

+* Manage your accounts in one central location - the Azure portal.

+You configure and test Azure AD single sign-on for SeattleTimesSSO in a test environment. SeattleTimesSSO supports **IDP** initiated single sign-on.

+## Prerequisites

+To integrate Azure Active Directory with SeattleTimesSSO, you need:

+* An Azure AD user account. If you don't already have one, you can [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).

+* One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

+* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).

+* SeattleTimesSSO single sign-on (SSO) enabled subscription.

+## Add application and assign a test user

+Before you begin the process of configuring single sign-on, you need to add the SeattleTimesSSO application from the Azure AD gallery. You need a test user account to assign to the application and test the single sign-on configuration.

+### Add SeattleTimesSSO from the Azure AD gallery

+Add SeattleTimesSSO from the Azure AD application gallery to configure single sign-on with SeattleTimesSSO. For more information on how to add application from the gallery, see the [Quickstart: Add application from the gallery](../manage-apps/add-application-portal.md).

+### Create and assign Azure AD test user

+Follow the guidelines in the [create and assign a user account](../manage-apps/add-application-portal-assign-users.md) article to create a test user account in the Azure portal called B.Simon.

+Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, and assign roles. The wizard also provides a link to the single sign-on configuration pane in the Azure portal. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides).

+## Configure Azure AD SSO

+Complete the following steps to enable Azure AD single sign-on in the Azure portal.

+1. In the Azure portal, on the **SeattleTimesSSO** application integration page, find the **Manage** section and select **single sign-on**.

+1. On the **Select a single sign-on method** page, select **SAML**.

+1. On the **Set up single sign-on with SAML** page, select the pencil icon for **Basic SAML Configuration** to edit the settings.

+ 

+1. On the **Basic SAML Configuration** section, the user does not have to perform any step as the app is already pre-integrated with Azure.

+1. On the **Set-up single sign-on with SAML** page, in the **SAML Signing Certificate** section, find **Certificate (Base64)** and select **Download** to download the certificate and save it on your computer.

+ 

+1. On the **Set up SeattleTimesSSO** section, copy the appropriate URL(s) based on your requirement.

+ 

+## Configure SeattleTimesSSO SSO

+To configure single sign-on on **SeattleTimesSSO** side, you need to send the downloaded **Certificate (Base64)** and appropriate copied URLs from Azure portal to [SeattleTimesSSO support team](mailto:it-hostingadmin@seattletimes.com). They set this setting to have the SAML SSO connection set properly on both sides

+### Create SeattleTimesSSO test user

+In this section, you create a user called Britta Simon in SeattleTimesSSO. Work with [SeattleTimesSSO support team](mailto:it-hostingadmin@seattletimes.com) to add the users in the SeattleTimesSSO platform. Users must be created and activated before you use single sign-on.

+## Test SSO

+In this section, you test your Azure AD single sign-on configuration with following options.

+* Click on Test this application in Azure portal and you should be automatically signed in to the SeattleTimesSSO for which you set up the SSO.

+* You can use Microsoft My Apps. When you click the SeattleTimesSSO tile in the My Apps, you should be automatically signed in to the SeattleTimesSSO for which you set up the SSO. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).

+## Next steps

+Once you configure SeattleTimesSSO you can enforce session control, which protects exfiltration and infiltration of your organizationΓÇÖs sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Cloud App Security](/cloud-app-security/proxy-deployment-aad).

+ Title: Azure Active Directory SSO integration with Vera Suite

+description: Learn how to configure single sign-on between Azure Active Directory and Vera Suite.

+# Azure Active Directory SSO integration with Vera Suite

+In this article, you learn how to integrate Vera Suite with Azure Active Directory (Azure AD). Vera Suite helps auto dealers maintain cultures of safety, streamline operations and manage risk. Vera Suite offers dealership workforce and workplace compliance solutions for EHS, HR and F&I managers. When you integrate Vera Suite with Azure AD, you can:

+* Control in Azure AD who has access to Vera Suite.

+* Enable your users to be automatically signed-in to Vera Suite with their Azure AD accounts.

+* Manage your accounts in one central location - the Azure portal.

+You configure and test Azure AD single sign-on for Vera Suite in a test environment. Vera Suite supports **SP** initiated single sign-on and **Just In Time** user provisioning.

+> [!NOTE]

+> Identifier of this application is a fixed string value so only one instance can be configured in one tenant.

+## Prerequisites

+To integrate Azure Active Directory with Vera Suite, you need:

+* An Azure AD user account. If you don't already have one, you can [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).

+* One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

+* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).

+* Vera Suite single sign-on (SSO) enabled subscription.

+## Add application and assign a test user

+Before you begin the process of configuring single sign-on, you need to add the Vera Suite application from the Azure AD gallery. You need a test user account to assign to the application and test the single sign-on configuration.

+### Add Vera Suite from the Azure AD gallery

+Add Vera Suite from the Azure AD application gallery to configure single sign-on with Vera Suite. For more information on how to add application from the gallery, see the [Quickstart: Add application from the gallery](../manage-apps/add-application-portal.md).

+### Create and assign Azure AD test user

+Follow the guidelines in the [create and assign a user account](../manage-apps/add-application-portal-assign-users.md) article to create a test user account in the Azure portal called B.Simon.

+Alternatively, you can also use the [Enterprise App Configuration Wizard](https://portal.office.com/AdminPortal/home?Q=Docs#/azureadappintegration). In this wizard, you can add an application to your tenant, add users/groups to the app, and assign roles. The wizard also provides a link to the single sign-on configuration pane in the Azure portal. [Learn more about Microsoft 365 wizards.](/microsoft-365/admin/misc/azure-ad-setup-guides).

+## Configure Azure AD SSO

+Complete the following steps to enable Azure AD single sign-on in the Azure portal.

+1. In the Azure portal, on the **Vera Suite** application integration page, find the **Manage** section and select **single sign-on**.

+1. On the **Select a single sign-on method** page, select **SAML**.

+1. On the **Set up single sign-on with SAML** page, select the pencil icon for **Basic SAML Configuration** to edit the settings.

+ 

+1. On the **Basic SAML Configuration** section, perform the following steps:

+ a. In the **Identifier** textbox, type the URL:

+ `https://logon.mykpa.com/identity/Saml2/`

+ b. In the **Reply URL** textbox, type the URL:

+ `https://logon.mykpa.com/identity/Saml2/Acs`

+ c. In the **Sign on URL** textbox, type one of the following URLs:

+

+ | **Sign on URL** |

+ |-|

+ | `https://www.verasuite.com` |

+ | `https://logon.mykpa.com` |

+1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, click copy button to copy **App Federation Metadata Url** and save it on your computer.

+ 

+## Configure Vera Suite SSO

+To configure single sign-on on **Vera Suite** side, you need to send the **App Federation Metadata Url** to [Vera Suite support team](mailto:support@kpa.io). They set this setting to have the SAML SSO connection set properly on both sides.

+### Create Vera Suite test user

+In this section, a user called B.Simon is created in Vera Suite. Vera Suite supports just-in-time user provisioning, which is enabled by default. There's no action item for you in this section. If a user doesn't already exist in Vera Suite, a new one is commonly created after authentication.

+## Test SSO

+In this section, you test your Azure AD single sign-on configuration with following options.

+* Click on **Test this application** in Azure portal. This will redirect to Vera Suite Sign-on URL where you can initiate the login flow.

+* Go to Vera Suite Sign-on URL directly and initiate the login flow from there.

+* You can use Microsoft My Apps. When you click the Vera Suite tile in the My Apps, this will redirect to Vera Suite Sign-on URL. For more information about the My Apps, see [Introduction to the My Apps](../user-help/my-apps-portal-end-user-access.md).

+## Additional resources

+* [What is single sign-on with Azure Active Directory?](../manage-apps/what-is-single-sign-on.md)

+* [Plan a single sign-on deployment](../manage-apps/plan-sso-deployment.md).

+## Next steps

+Once you configure Vera Suite you can enforce session control, which protects exfiltration and infiltration of your organizationΓÇÖs sensitive data in real time. Session control extends from Conditional Access. [Learn how to enforce session control with Microsoft Cloud App Security](/cloud-app-security/proxy-deployment-aad).

+> Starting with Kubernetes version 1.26, in-tree persistent volume types *kubernetes.io/azure-disk* and *kubernetes.io/azure-file* are deprecated and will no longer be supported. Removing these drivers following their deprecation is not planned, however you should migrate to the corresponding CSI drivers *disks.csi.azure.com* and *file.csi.azure.com*. To review the migration options for your storage classes and upgrade your cluster to use Azure Disks and Azure Files CSI drivers, see [Migrate from in-tree to CSI drivers][migrate-from-in-tree-csi-drivers].

+> It is recommended to delete the corresponding PersistentVolumeClaim object instead of the PersistentVolume object when deleting a CSI volume. The external provisioner in the CSI driver will react to the deletion of the PersistentVolumeClaim and based on its reclamation policy, it will issue the DeleteVolume call against the CSI volume driver commands to delete the volume. The PersistentVolume object will then be deleted.

+>

+ image: ghcr.io/deislabs/containerd-wasm-shims/examples/slight-rust-hello:v0.3.3

+* This feature uses the built-in (service-level) all-access subscription (display name "Built-in all-access subscription") for debugging. The [**Allow tracing**](api-management-howto-api-inspector.md#verify-allow-tracing-setting) setting must be enabled in this subscription.

+An Azure API Management service instance can scale automatically based on a set of rules. This behavior can be enabled and configured through [Azure Monitor autoscale](../azure-monitor/autoscale/autoscale-overview.md#supported-services-for-autoscale) and is currently supported only in the **Standard** and **Premium** tiers of the Azure API Management service.

+> * In service tiers that support multiple scale units, you can also [manually scale](upgrade-and-scale.md) your API Management instance.

+> * An API Management service in the **Consumption** tier scales automatically based on the traffic - without any additional configuration needed.

+## Enable and configure autoscale for an API Management instance

+Follow these steps to configure autoscale for an Azure API Management service:

+1. Sign in to the [Azure portal](https://portal.azure.com), and navigate to your API Management instance.

+1. In the left menu, select **Scale out (auto-scale)**, and then select **Custom autoscale**.

+ :::image type="content" source="media/api-management-howto-autoscale/01.png" alt-text="Screenshot of scale-out options in the portal.":::

+1. In the **Default** scale condition, select **Scale based on a metric**, and then select **Add a rule**.

+ :::image type="content" source="media/api-management-howto-autoscale/04.png" alt-text="Screenshot of configuring the default scale condition in the portal.":::

+1. Define a new scale-out rule.

+ For example, a scale-out rule could trigger addition of 1 API Management unit, when the average capacity metric over the previous 30 minutes exceeds 80%. The following table provides configuration for such a rule.

+ | Metric source | Current resource | Define the rule based on the current API Management resource metrics. |

+ | Metric name | Capacity | Capacity metric is an API Management metric reflecting usage of resources by an Azure API Management instance. |

+ | Location | Select the primary location of the API Management instance | |

+ | Metric threshold | 80% | The threshold for the averaged capacity metric. |

+ | Duration (in minutes) | 30 | The timespan to average the capacity metric over is specific to usage patterns. The longer the duration, the smoother the reaction will be. Intermittent spikes will have less effect on the scale-out decision. However, it will also delay the scale-out trigger. |

+ | Time grain statistic | Average | |

+ |*Action* | | |

+ | Cool down (minutes) | 60 | It takes at least 20 minutes for the API Management service to scale out. In most cases, the cool down period of 60 minutes prevents from triggering many scale-outs. |

+1. Select **Add** to save the rule.

+1. To add another rule, select **Add a rule**.

+ This time, a scale-in rule needs to be defined. It will ensure resources aren't being wasted, when the usage of APIs decreases.

+1. Define a new scale-in rule.

+ For example, a scale-in rule could trigger a removal of 1 API Management unit when the average capacity metric over the previous 30 minutes has been lower than 35%. The following table provides configuration for such a rule.

+ | Metric source | Current resource | Define the rule based on the current API Management resource metrics. |

+ | Metric name | Capacity | Same metric as the one used for the scale-out rule. |

+ | Location | Select the primary location of the API Management instance | |

+ | Threshold | 35% | As with the scale-out rule, this value heavily depends on the usage patterns of the API Management instance. |

+ | Duration (in minutes) | 30 | Same value as the one used for the scale-out rule. |

+ | Time grain statistic | Average | |

+ | Operation | Decrease count by | Opposite to what was used for the scale-out rule. |

+ | Instance count | 1 | Same value as the one used for the scale-out rule. |

+ | Cool down (minutes) | 90 | Scale-in should be more conservative than a scale-out, so the cool down period should be longer. |

+1. Select **Add** to save the rule.

+1. In **Instance limits**, select the **Minimum**, **Maximum**, and **Default** number of API Management units.

+ > [!NOTE]

+ > API Management has a limit of units an instance can scale out to. The limit depends on the service tier.

+

+ :::image type="content" source="media/api-management-howto-autoscale/07.png" alt-text="Screenshot showing how to set instance limits in the portal.":::

+1. Select **Save**. Your autoscale has been configured.

+Azure Event Hubs is a highly scalable data ingress service that can ingest millions of events per second so that you can process and analyze the massive amounts of data produced by your connected devices and applications. Event Hubs acts as the "front door" for an event pipeline, and once data is collected into an event hub, it can be transformed and stored using any real-time analytics provider or batching/storage adapters. Event Hubs decouples the production of a stream of events from the consumption of those events, so that event consumers can access the events on their own schedule.

+## Prerequisites

+* An API Management service instance. If you don't have one, see [Create an API Management service instance](get-started-create-service-instance.md).

+* An Azure Event Hubs namespace and event hub. For detailed steps, see [Create an Event Hubs namespace and an event hub using the Azure portal](../event-hubs/event-hubs-create.md).

+ > [!NOTE]

+ > The Event Hubs resource **can be** in a different subscription or even a different tenant than the API Management resource

+## Configure access to the event hub

+To log events to the event hub, you need to configure credentials for access from API Management. API Management supports either of the two following access mechanisms:

+* An Event Hubs connection string

+* A managed identity for your API Management instance.

+### Option 1: Configure Event Hubs connection string

+To create an Event Hubs connection string, see [Get an Event Hubs connection string](../event-hubs/event-hubs-get-connection-string.md).

+* You can use a connection string for the Event Hubs namespace or for the specific event hub you use for logging from API Management.

+* The shared access policy for the connection string must enable at least **Send** permissions.

+### Option 2: Configure API Management managed identity

+> Using an API Management managed identity for logging events to an event hub is supported in API Management REST API version `2022-04-01-preview` or later.

+1. Enable a system-assigned or user-assigned [managed identity for API Management](api-management-howto-use-managed-service-identity.md) in your API Management instance.

+ * If you enable a user-assigned managed identity, take note of the identity's **Client ID**.

+1. Assign the identity the **Azure Event Hubs Data sender** role, scoped to the Event Hubs namespace or to the event hub used for logging. To assign the role, use the [Azure portal](../active-directory/managed-identities-azure-resources/howto-assign-access-portal.md) or other Azure tools.

+The next step is to configure a [logger](/rest/api/apimanagement/current-ga/logger) in your API Management service so that it can log events to the event hub.

+Create and manage API Management loggers by using the [API Management REST API](/rest/api/apimanagement/current-preview/logger/create-or-update) directly or by using tools including [Azure PowerShell](/powershell/module/az.apimanagement/new-azapimanagementlogger), a Bicep template, or an Azure Resource Management template.

+### Logger with connection string credentials

+For prerequisites, see [Configure Event Hubs connection string](#option-1-configure-event-hubs-connection-string).

+#### [PowerShell](#tab/PowerShell)

+The following example uses the [New-AzApiManagementLogger](/powershell/module/az.apimanagement/new-azapimanagementlogger) cmdlet to create a logger to an event hub by configuring a connection string.

+```powershell

+# API Management service-specific details

+$apimServiceName = "apim-hello-world"

+$resourceGroupName = "myResourceGroup"

+# Create logger

+$context = New-AzApiManagementContext -ResourceGroupName $resourceGroupName -ServiceName $apimServiceName

+New-AzApiManagementLogger -Context $context -LoggerId "ContosoLogger1" -Name "ApimEventHub" -ConnectionString "Endpoint=sb://<EventHubsNamespace>.servicebus.windows.net/;SharedAccessKeyName=<KeyName>;SharedAccessKey=<key>" -Description "Event hub logger with connection string"

+```

+#### [Bicep](#tab/bicep)

+Include a snippet similar to the following in your Bicep template.

+```Bicep

+resource ehLoggerWithConnectionString 'Microsoft.ApiManagement/service/loggers@2022-04-01-preview' = {

+ name: 'ContosoLogger1'

+ parent: '<APIManagementInstanceName>'

+ properties: {

+ loggerType: 'azureEventHub'

+ description: 'Event hub logger with connection string'

+ credentials: {

+ connectionString: 'Endpoint=sb://<EventHubsNamespace>.servicebus.windows.net/;SharedAccessKeyName=<KeyName>;SharedAccessKey=<key>'

+ name: 'ApimEventHub'

+ }

+}

+#### [ARM](#tab/arm)

+Include a JSON snippet similar to the following in your Azure Resource Manager template.

+```JSON

+{

+ "type": "Microsoft.ApiManagement/service/loggers",

+ "apiVersion": "2022-04-01-preview",

+ "name": "ContosoLogger1",

+ "properties": {

+ "loggerType": "azureEventHub",

+ "description": "Event hub logger with connection string",

+ "resourceId": "<EventHubsResourceID>"

+ "credentials": {

+ "connectionString": "Endpoint=sb://<EventHubsNamespace>/;SharedAccessKeyName=<KeyName>;SharedAccessKey=<key>",

+ "name": "ApimEventHub"

+ },

+ }

+}

+```

+### Logger with system-assigned managed identity credentials

+For prerequisites, see [Configure API Management managed identity](#option-2-configure-api-management-managed-identity).

+#### [PowerShell](#tab/PowerShell)

+Use the API Management [REST API](/rest/api/apimanagement/current-preview/logger/create-or-update) or a Bicep or ARM template to configure a logger to an event hub with system-assigned managed identity credentials.

+#### [Bicep](#tab/bicep)

+Include a snippet similar to the following in your Bicep template.

+```Bicep

+resource ehLoggerWithSystemAssignedIdentity 'Microsoft.ApiManagement/service/loggers@2022-04-01-preview' = {

+ name: 'ContosoLogger1'

+ parent: '<APIManagementInstanceName>'

+ properties: {

+ loggerType: 'azureEventHub'

+ description: 'Event hub logger with system-assigned managed identity'

+ credentials: {

+ endpointAddress: 'https://<EventHubsNamespace>.servicebus.windows.net/<EventHubName>'

+ identityClientId: 'systemAssigned'

+ name: 'ApimEventHub'

+ }

+ }

+}

+```

+#### [ARM](#tab/arm)

+Include a JSON snippet similar to the following in your Azure Resource Manager template.

+```JSON

+{

+ "type": "Microsoft.ApiManagement/service/loggers",

+ "apiVersion": "2022-04-01-preview",

+ "name": "ContosoLogger1",

+ "properties": {

+ "loggerType": "azureEventHub",

+ "description": "Event hub logger with system-assigned managed identity",

+ "resourceId": "<EventHubsResourceID>",

+ "credentials": {

+ "endpointAddress": "https://<EventHubsNamespace>.servicebus.windows.net/<EventHubName>",

+ "identityClientId": "SystemAssigned",

+ "name": "ApimEventHub"

+ },

+ }

+}

+```

+### Logger with user-assigned managed identity credentials

+For prerequisites, see [Configure API Management managed identity](#option-2-configure-api-management-managed-identity).

+#### [PowerShell](#tab/PowerShell)

+Use the API Management [REST API](/rest/api/apimanagement/current-preview/logger/create-or-update) or a Bicep or ARM template to configure a logger to an event hub with user-assigned managed identity credentials.

+#### [Bicep](#tab/bicep)

+Include a snippet similar the following in your Bicep template.

+```Bicep

+resource ehLoggerWithUserAssignedIdentity 'Microsoft.ApiManagement/service/loggers@2022-04-01-preview' = {

+ name: 'ContosoLogger1'

+ parent: '<APIManagementInstanceName>'

+ properties: {

+ loggerType: 'azureEventHub'

+ description: 'Event hub logger with user-assigned managed identity'

+ credentials: {

+ endpointAddress: 'https://<EventHubsNamespace>.servicebus.windows.net/<EventHubName>'

+ identityClientId: '<ClientID>'

+ name: 'ApimEventHub'

+ }

+ }

+}

+```

+#### [ARM](#tab/arm)

+Include a JSON snippet similar to the following in your Azure Resource Manager template.

+```JSON

+{

+ "type": "Microsoft.ApiManagement/service/loggers",

+ "apiVersion": "2022-04-01-preview",

+ "name": "ContosoLogger1",

+ "properties": {

+ "loggerType": "azureEventHub",

+ "description": "Event hub logger with user-assigned managed identity",

+ "resourceId": "<EventHubsResourceID>",

+ "credentials": {

+ "endpointAddress": "https://<EventHubsNamespace>.servicebus.windows.net/<EventHubName>",

+ "identityClientId": "<ClientID>",

+ "name": "ApimEventHub"

+ },

+ }

+}

+```

+## Configure log-to-eventhub policy

+Once your logger is configured in API Management, you can configure your [log-to-eventhub](log-to-eventhub-policy.md) policy to log the desired events. For example, use the `log-to-eventhub` policy in the inbound policy section to log requests, or in the outbound policy section to log responses.

+1. Browse to your API Management instance.

+1. Select **APIs**, and then select the API to which you want to add the policy. In this example, we're adding a policy to the **Echo API** in the **Unlimited** product.

+1. Select **All operations**.

+1. On the top of the screen, select the **Design** tab.

+1. In the Inbound processing or Outbound processing window, select the `</>` (code editor) icon. For more information, see [How to set or edit policies](set-edit-policies.md).

+1. Position your cursor in the `inbound` or `outbound` policy section.

+1. In the window on the right, select **Advanced policies** > **Log to EventHub**. This inserts the `log-to-eventhub` policy statement template.

+ ```xml

+ <log-to-eventhub logger-id="logger-id">

+ @{

+ return new JObject(

+ new JProperty("EventTime", DateTime.UtcNow.ToString()),

+ new JProperty("ServiceName", context.Deployment.ServiceName),

+ new JProperty("RequestId", context.RequestId),

+ new JProperty("RequestIp", context.Request.IpAddress),

+ new JProperty("OperationName", context.Operation.Name)

+ ).ToString();

+ }

+ </log-to-eventhub>

+ ```

+ 1. Replace `logger-id` with the name of the logger that you created in the previous step.

+ 1. You can use any expression that returns a string as the value for the `log-to-eventhub` element. In this example, a string in JSON format containing the date and time, service name, request ID, request IP address, and operation name is logged.

+1. Select **Save** to save the updated policy configuration. As soon as it's saved, the policy is active and events are logged to the designated event hub.

+> The maximum supported message size that can be sent to an event hub from this API Management policy is 200 kilobytes (KB). If a message that is sent to an event hub is larger than 200 KB, it will be automatically truncated, and the truncated message will be transferred to the event hub.

+3. On the **Enable real time insights from events** card, select **Start**.

+ * [Logger entity reference](/rest/api/apimanagement/current-preview/logger)

+ * [log-to-eventhub](log-to-eventhub-policy.md) policy reference

+description: Learn how to create system-assigned and user-assigned identities in API Management by using the Azure portal, PowerShell, and a Resource Manager template. Learn about supported scenarios with managed identities.

+### Log events to an event hub

+You can configure and use a system-assigned managed identity to access an event hub for logging events from an API Management instance. For more information, see [How to log events to Azure Event Hubs in Azure API Management](api-management-howto-log-event-hubs.md).

+### Log events to an event hub

+You can configure and use a user-assigned managed identity to access an event hub for logging events from an API Management instance. For more information, see [How to log events to Azure Event Hubs in Azure API Management](api-management-howto-log-event-hubs.md).

+> * In the **Standard** and **Premium** tiers of the API Management service, you can configure an instance to [scale automatically](api-management-howto-autoscale.md) based on a set of rules.

+> * API Management instances in the **Consumption** tier scale automatically based on the traffic. Currently, you cannot upgrade from or downgrade to the Consumption tier.

+1. Specify the new number of **Units** - use the slider if available, or select or type the number.

+| tenant-id | Tenant ID or URL of the Azure Active Directory service. Policy expressons are allowed.| Yes | N/A |

+| header-name | The name of the HTTP header holding the token. Policy expressions are allowed. | One of `header-name`, `query-parameter-name` or `token-value` must be specified. | `Authorization` |

+| query-parameter-name | The name of the query parameter holding the token. Policy expressions are allowed. | One of `header-name`, `query-parameter-name` or `token-value` must be specified. | N/A |

+| token-value | Expression returning a string containing the token. You must not return `Bearer` as part of the token value. Policy expressions are allowed. | One of `header-name`, `query-parameter-name` or `token-value` must be specified. | N/A |

+| failed-validation-httpcode | HTTP status code to return if the JWT doesn't pass validation. Policy expressions are allowed. | No | 401 |

+| failed-validation-error-message | Error message to return in the HTTP response body if the JWT doesn't pass validation. This message must have any special characters properly escaped. Policy expressions are allowed. | No | Default error message depends on validation issue, for example "JWT not present." |

+| output-token-variable-name | String. Name of context variable that will receive token value as an object of type [`Jwt`](api-management-policy-expressions.md) upon successful token validation. Policy expressions aren't allowed. | No | N/A |

+| name | Name of the claim as it is expected to appear in the token. Policy expressions are allowed.| Yes | N/A |

+| match | The `match` attribute on the `claim` element specifies whether every claim value in the policy must be present in the token for validation to succeed. Possible values are:<br /><br /> - `all` - every claim value in the policy must be present in the token for validation to succeed.<br /><br /> - `any` - at least one claim value must be present in the token for validation to succeed.<br/><br/>Policy expressions are allowed. | No | all |

+| separator | String. Specifies a separator (for example, ",") to be used for extracting a set of values from a multi-valued claim. Policy expressions are allowed. | No | N/A |

+> [!IMPORTANT]

+> **Beginning 31 March 2025, we'll no longer place Azure App Service web applications in disaster recovery mode in the event of a disaster in an Azure region.** We strongly encourage you to implement [commonly used disaster recovery techniques](./overview-disaster-recovery.md) to prevent loss of functionality or data for your web apps if there's a regional disaster.

+[Backup and restore](manage-backup.md)

+[Cesium]: https://www.cesium.com/

+<!--[Cesium code samples]: https://samples.azuremaps.com/?search=Cesium-->

+[Leaflet]: https://leafletjs.com/

+[Leaflet code samples]: https://samples.azuremaps.com/?search=leaflet

+[OpenLayers]: https://openlayers.org/

+<!--[OpenLayers code samples]: https://samples.azuremaps.com/?search=openlayers-->

+[OpenLayers plugin]: /samples/azure-samples/azure-maps-OpenLayers/azure-maps-OpenLayers-plugin

+[ng-azure-maps]: https://github.com/arnaudleclerc/ng-azure-maps

+[AzureMapsControl.Components]: https://github.com/arnaudleclerc/AzureMapsControl.Components

+[Azure Maps React Component]: https://github.com/WiredSolutions/react-azure-maps

+[Vue Azure Maps]: https://github.com/rickyruiz/vue-azure-maps

+[Contour layer code samples]: https://samples.azuremaps.com/?search=contour

+[Gridded Data Source module]: https://github.com/Azure-Samples/azure-maps-gridded-data-source

+[Animation module]: https://github.com/Azure-Samples/azure-maps-animations

+[Popup with Media Content]: https://samples.azuremaps.com/?sample=popup-with-media-content

+[Popups on Shapes]: https://samples.azuremaps.com/?sample=popups-on-shapes

+[Reusing Popup with Multiple Pins]: https://samples.azuremaps.com/?sample=reusing-popup-with-multiple-pins

+[Traffic overlay options]: https://samples.azuremaps.com/?sample=traffic-overlay-options

+[Traffic control]: https://samples.azuremaps.com/?sample=traffic-controls

+[Drawing tools module code samples]: https://samples.azuremaps.com#drawing-tools-module

+[free account]: https://azure.microsoft.com/free/

+[turf js]: https://turfjs.org

+¹ Azure Maps [Elevation services](/rest/api/maps/elevation) have been [deprecated](https://azure.microsoft.com/updates/azure-maps-elevation-apis-and-render-v2-dem-tiles-will-be-retired-on-5-may-2023). For more information on how to include this functionality in your Azure Maps, see [Create elevation data & services](elevation-data-services.md).

+* Azure Maps [Elevation services](/rest/api/maps/elevation) have been [deprecated](https://azure.microsoft.com/updates/azure-maps-elevation-apis-and-render-v2-dem-tiles-will-be-retired-on-5-may-2023). For more information on how to include this functionality in your Azure Maps, see [Create elevation data & services](elevation-data-services.md)

+[free account]: https://azure.microsoft.com/free/

+[Snap points to logical route path]: https://samples.azuremaps.com/?sample=snap-points-to-logical-route-path

+[Basic snap to road logic]: https://samples.azuremaps.com/?sample=basic-snap-to-road-logic

+[turf js]: https://turfjs.org

+[NetTopologySuite]: https://github.com/NetTopologySuite/NetTopologySuite

+¹ Azure Maps [Elevation services](/rest/api/maps/elevation) have been [deprecated](https://azure.microsoft.com/updates/azure-maps-elevation-apis-and-render-v2-dem-tiles-will-be-retired-on-5-may-2023). For more information on how to include this functionality in your Azure Maps, see [Create elevation data & services](elevation-data-services.md).

+[Azure Maps Q&A]: /answers/topics/azure-maps.html

+[Azure Maps Blog]: https://aka.ms/AzureMapsTechBlog

+Most web apps, which use Google Maps, are using the Google Maps V3 JavaScript SDK. The Azure Maps Web SDK is the suitable Azure-based SDK to migrate to. The Azure Maps Web SDK lets you customize interactive maps with your own content and imagery. You can run your app on both web or mobile applications. This control makes use of WebGL, allowing you to render large data sets with high performance. Develop with this SDK using JavaScript or TypeScript. This tutorial demonstrates:

+Also:

+> * Tips on how to make your application using more advanced features available in Azure Maps.

+If migrating an existing web application, check to see if it's using an open-source map control library. Examples of open-source map control library are: Cesium, Leaflet, and OpenLayers. You can still migrate your application, even if it uses an open-source map control library, and you don't want to use the Azure Maps Web SDK. In such case, connect your application to the Azure Maps tile services ([road tiles]

+\| [satellite tiles]). The following points detail on how to use Azure Maps in some commonly used open-source map control libraries.

+* Cesium - A 3D map control for the web. [Cesium documentation].

+* Leaflet ΓÇô Lightweight 2D map control for the web. [Leaflet code sample] \| [Leaflet documentation].

+* OpenLayers - A 2D map control for the web that supports projections. [OpenLayers documentation].

+* [ng-azure-maps] - Angular 10 wrapper around Azure maps.

+* [AzureMapsControl.Components] - An Azure Maps Blazor component.

+* [Azure Maps React Component] - A react wrapper for the Azure Maps control.

+* [Vue Azure Maps] - An Azure Maps component for Vue application.

+¹ Azure Maps [Elevation services](/rest/api/maps/elevation) have been [deprecated](https://azure.microsoft.com/updates/azure-maps-elevation-apis-and-render-v2-dem-tiles-will-be-retired-on-5-may-2023). For more information on how to include this functionality in your Azure Maps, see [Create elevation data & services](elevation-data-services.md).

+* In addition to providing a hosted endpoint for accessing the Azure Maps Web SDK, an npm package is available. For more information on how to Embed the Web SDK package into apps, see [Use the Azure Maps map control]. This package also includes TypeScript definitions.

+* You first need to create an instance of the Map class in Azure Maps. Wait for the maps `ready` or `load` event to fire before programmatically interacting with the map. This order ensures that all the map resources have been loaded and are ready to be accessed.

+* Both platforms use a similar tiling system for the base maps. The tiles in Google Maps are 256 pixels in dimension; however, the tiles in Azure Maps are 512 pixels in dimension. To get the same map view in Azure Maps as Google Maps, subtract Google Maps zoom level by the number one in Azure Maps.

+* Coordinates in Google Maps are referred to as `latitude,longitude`, while Azure Maps uses `longitude,latitude`. The Azure Maps format is aligned with the standard `[x, y]`, which is followed by most GIS platforms.

+* Shapes in the Azure Maps Web SDK are based on the GeoJSON schema. Helper classes are exposed through the [*atlas.data* namespace]. There's also the [*atlas.Shape*] class. Use this class to wrap GeoJSON objects, to make it easy to update and maintain the data bindable way.

+* Coordinates in Azure Maps are defined as Position objects. A coordinate is specified as a number array in the format `[longitude,latitude]`. Or, it's specified using new atlas.data.Position(longitude, latitude).

+ > The Position class has a static helper method for importing coordinates that are in "latitude, longitude" format. The [atlas.data.Position.fromLatLng] method can often be replaced with the `new google.maps.LatLng` method in Google Maps code.

+* Rather than specifying styling information on each shape that is added to the map, Azure Maps separates styles from the data. Data is stored in a data source, and is connected to rendering layers. Azure Maps code uses data sources to render the data. This approach provides enhanced performance benefit. Additionally, many layers support data-driven styling where business logic can be added to layer style options. This support changes how individual shapes are rendered within a layer based on properties defined in the shape.

+This collection has code samples for each platform, and each sample covers a common use case. It's intended to help you migrate your web application from Google Maps V3 JavaScript SDK to the Azure Maps Web SDK. Code samples related to web applications are provided in JavaScript. However, Azure Maps also provides TypeScript definitions as another option through an [npm module].

+* [Load a map]

+* [Localizing the map]

+* [Setting the map view]

+* [Adding a marker]

+* [Adding a custom marker]

+* [Adding a polyline]

+* [Adding a polygon]

+* [Display an info window]

+* [Import a GeoJSON file]

+* [Marker clustering]

+* [Add a heat map]

+* [Overlay a tile layer]

+* [Show traffic data]

+* [Add a ground overlay]

+* [Add KML data to the map]

+* Add a `div` tag to the body of the page, which acts as a placeholder for the map.

+* When referencing the `div` element in which the map renders, the `Map` class in Azure Maps only requires the `id` value while Google Maps requires a `HTMLElement` object.

+* An event handler is added in Azure Maps to monitor the `ready` event of the map instance. This event fires when the map has finished loading the WebGL context and all the needed resources. Add any code you want to run after the map completes loading, to this event handler.

+Running this code in a browser displays a map that looks like the following image:

+Running this code in a browser displays a map that looks like the following image:

+For more information on how to set up and use the Azure Maps map control in a web app, see [Use the Azure Maps map control].

+**More resources:**

+* For more information on navigation controls for rotating and pitching the map view, see [Add controls to a map].

+Here's an example of Google Maps with the language set to "fr-FR".

+Azure Maps provides two different ways of setting the language and regional view of the map. The first option is to add this information to the global *atlas* namespace. It results in all map control instances in your app defaulting to these settings. The following sets the language to French ("fr-FR") and the regional view to "Auto":

+For more information on supported languages, see [Localization support in Azure Maps].

+Here's an example of Azure Maps with the language set to "fr" and the user region set to "fr-FR".

+**More resources:**

+* [Choose a map style]

+* [Supported map styles]

+In Azure Maps, use HTML markers to display a point on the map. HTML markers are recommended for apps that only need to display a few points on the map. To use an HTML marker, create an instance of the `atlas.HtmlMarker` class. Set the text and position options, and add the marker to the map using the `map.markers.add` method.

+**More resources:**

+* [Create a data source]

+* [Add a Symbol layer]

+* [Add a Bubble layer]

+* [Clustering point data in the Web SDK]

+* [Add HTML Markers]

+* [Use data-driven style expressions]

+* [Symbol layer icon options]

+* [Symbol layer text option]

+* [HTML marker class]

+* [HTML marker options]

+You may use Custom images to represent points on a map. The following map uses a custom image to display a point on the map. The point is displayed at latitude: 51.5 and longitude: -0.2. The anchor offsets the position of the marker, so that the point of the pushpin icon aligns with the correct position on the map.

+**More resources:**

+* [Create a data source]

+* [Add a Symbol layer]

+* [Add HTML Markers]

+* [Use data-driven style expressions]

+* [Symbol layer icon options]

+* [Symbol layer text option]

+* [HTML marker class]

+* [HTML marker options]

+**More resources:**

+* [Add lines to the map]

+* [Line layer options]

+* [Use data-driven style expressions]

+**More resources:**

+* [Add a polygon to the map]

+* [Add a circle to the map]

+* [Polygon layer options]

+* [Line layer options]

+* [Use data-driven style expressions]

+**More resources:**

+* [Add a popup]

+* [Popup with Media Content]

+* [Popups on Shapes]

+* [Reusing Popup with Multiple Pins]

+* [Popup class]

+* [Popup options]

+Google Maps supports loading and dynamically styling GeoJSON data via the `google.maps.Data` class. The functionality of this class aligns more with the data-driven styling of Azure Maps. But, there's a key difference. With Google Maps, you specify a callback function. The business logic for styling each feature it processed individually in the UI thread. But in Azure Maps, layers support specifying data-driven expressions as styling options. These expressions are processed at render time on a separate thread. The Azure Maps approach improves rendering performance. This advantage is noticed when larger data sets need to be rendered quickly.

+The following examples load a GeoJSON feed of all earthquakes over the last seven days from the USGS. Earthquakes data renders as scaled circles on the map. The color and scale of each circle is based on the magnitude of each earthquake, which is stored in the `"mag"` property of each feature in the data set. If the magnitude is greater than or equal to five, the circle is red. If it's greater or equal to three, but less than five, the circle is orange. If it's less than three, the circle is green. The radius of each circle will be the exponential of the magnitude multiplied by 0.1.

+**More resources:**

+* [Add a Symbol layer]

+* [Add a Bubble layer]

+* [Clustering point data in the Web SDK]

+* [Use data-driven style expressions]

+When clustering is enabled, the data source sends clustered and unclustered data points to layers for rendering. The data source is capable of clustering hundreds of thousands of data points. A clustered data point has the following properties:

+| `point_count_abbreviated` | string | A string that abbreviates the `point_count` value if it's long. (for example, 4,000 becomes 4K) |

+| `getClusterChildren(clusterId: number)` | Promise&lt;Array&lt;Feature&lt;Geometry, any&gt; \| Shape&gt;&gt; | Retrieves the children of the given cluster on the next zoom level. These children may be a combination of shapes and subclusters. The subclusters are features with properties matching ClusteredProperties. |

+| `getClusterExpansionZoom(clusterId: number)` | Promise&lt;number&gt; | Calculates a zoom level at which the cluster starts expanding or break apart. |

+When rendering clustered data on the map, it's often best to use two or more layers. The following example uses three layers. A bubble layer for drawing scaled colored circles based on the size of the clusters. A symbol layer to render the cluster size as text. And, it uses a second symbol layer for rendering the unclustered points. For more information on other ways to render clustered data, see [Clustering point data in the Web SDK].

+**More resources:**

+* [Add a Symbol layer]

+* [Add a Bubble layer]

+* [Clustering point data in the Web SDK]

+* [Use data-driven style expressions]

+Load the GeoJSON data into a data source and connect the data source to a heat map layer. The property that is used for the weight can be passed into the `weight` option using an expression. Directly import GeoJSON data to Azure Maps using the `importDataFromUrl` function on the `DataSource` class.

+**More resources:**

+* [Add a heat map layer]

+* [Heat map layer class]

+* [Heat map layer options]

+* [Use data-driven style expressions]

+**More resources:**

+* [Add tile layers]

+* [Tile layer class]

+* [Tile layer options]

+If you select one of the traffic icons in Azure Maps, more information is displayed in a popup.

+**More resources:**

+* [Show traffic on the map]

+* [Traffic overlay options]

+Both Azure and Google maps support overlaying georeferenced images on the map. Georeferenced images move and scale as you pan and zoom the map. In Google Maps, georeferenced images are known as ground overlays while in Azure Maps they're referred to as image layers. They're great for building floor plans, overlaying old maps, or imagery from a drone.

+Running this code in a browser displays a map that looks like the following image:

+> If you only have north, south, east, west and rotation information, and you do not have coordinates for each corner of the image, you can use the static [`atlas.layer.ImageLayer.getCoordinatesFromEdges`] method.

+**More resources:**

+* [Overlay an image]

+* [Image layer class]

+Both Azure and Google maps can import and render KML, KMZ and GeoRSS data on the map. Azure Maps also supports GPX, GML, spatial CSV files, GeoJSON, Well Known Text (WKT), Web-Mapping Services (WMS), Web-Mapping Tile Services (WMTS), and Web Feature Services (WFS). Azure Maps reads the files locally into memory and in most cases can handle larger KML files.

+Running this code in a browser displays a map that looks like the following image:

+In Azure Maps, GeoJSON is the main data format used in the web SDK, more spatial data formats can be easily integrated in using the [spatial IO module]. This module has functions for both reading and writing spatial data and also includes a simple data layer that can easily render data from any of these spatial data formats. To read the data in a spatial data file, pass in a URL, or raw data as string or blob into the `atlas.io.read` function. This returns all the parsed data from the file that can then be added to the map. KML is a bit more complex than most spatial data format as it includes a lot more styling information. The `SpatialDataLayer` class supports most of these styles, however icons images have to be loaded into the map before loading the feature data, and ground overlays have to be added as layers to the map separately. When loading data via a URL, it should be hosted on a CORs enabled endpoint, or a proxy service should be passed in as an option into the read function.

+

+**More resources:**

+* [atlas.io.read function]

+* [SimpleDataLayer]

+* [SimpleDataLayerOptions]

+## More code samples

+The following are some more code samples related to Google Maps migration:

+* [Drawing tools]

+* [Limit Map to Two Finger Panning]

+* [Limit Scroll Wheel Zoom]

+* [Create a Fullscreen Control]

+* [Using the Azure Maps services module]

+* [Search for points of interest]

+* [Get information from a coordinate (reverse geocode)]

+* [Show directions from A to B]

+* [Search Autosuggest with JQuery UI]

+| `google.maps.Circle` | See [Add a circle to the map] |

+| `google.maps.places.PlacesService` | [f](/javascript/api/azure-maps-rest/atlas.service.searchurl) |

+Libraries add more functionality to the map. Many of these libraries are in

+[road tiles]: /rest/api/maps/render/getmaptile

+[satellite tiles]: /rest/api/maps/render/getmapimagerytile

+[Cesium documentation]: https://www.cesium.com/

+[Leaflet code sample]: https://samples.azuremaps.com/?sample=render-azure-maps-in-leaflet

+[Leaflet documentation]: https://leafletjs.com/

+[OpenLayers documentation]: https://openlayers.org/

+[ng-azure-maps]: https://github.com/arnaudleclerc/ng-azure-maps

+[AzureMapsControl.Components]: https://github.com/arnaudleclerc/AzureMapsControl.Components

+[Azure Maps React Component]: https://github.com/WiredSolutions/react-azure-maps

+[Vue Azure Maps]: https://github.com/rickyruiz/vue-azure-maps

+[*atlas.data* namespace]: /javascript/api/azure-maps-control/atlas.data

+[*atlas.Shape*]: /javascript/api/azure-maps-control/atlas.shape

+[atlas.data.Position.fromLatLng]: /javascript/api/azure-maps-control/atlas.data.position

+[npm module]: how-to-use-map-control.md

+[Load a map]: #load-a-map

+[Localizing the map]: #localizing-the-map

+[Setting the map view]: #setting-the-map-view

+[Adding a marker]: #adding-a-marker

+[Adding a custom marker]: #adding-a-custom-marker

+[Adding a polyline]: #adding-a-polyline

+[Adding a polygon]: #adding-a-polygon

+[Display an info window]: #display-an-info-window

+[Import a GeoJSON file]: #import-a-geojson-file

+[Marker clustering]: #marker-clustering

+[Add a heat map]: #add-a-heat-map

+[Overlay a tile layer]: #overlay-a-tile-layer

+[Show traffic data]: #show-traffic-data

+[Add a ground overlay]: #add-a-ground-overlay

+[Add KML data to the map]: #add-kml-data-to-the-map

+[Use the Azure Maps map control]: how-to-use-map-control.md

+[Add controls to a map]: map-add-controls.md

+[Localization support in Azure Maps]: supported-languages.md

+[Choose a map style]: choose-map-style.md

+[Supported map styles]: supported-map-styles.md

+[Create a data source]: create-data-source-web-sdk.md

+[Add a Symbol layer]: map-add-pin.md

+[Add a Bubble layer]: map-add-bubble-layer.md

+[Clustering point data in the Web SDK]: clustering-point-data-web-sdk.md

+[Add HTML Markers]: map-add-custom-html.md

+[Use data-driven style expressions]: data-driven-style-expressions-web-sdk.md

+[Symbol layer icon options]: /javascript/api/azure-maps-control/atlas.iconoptions

+[Symbol layer text option]: /javascript/api/azure-maps-control/atlas.textoptions

+[HTML marker class]: /javascript/api/azure-maps-control/atlas.htmlmarker

+[HTML marker options]: /javascript/api/azure-maps-control/atlas.htmlmarkeroptions

+[Add lines to the map]: map-add-line-layer.md

+[Line layer options]: /javascript/api/azure-maps-control/atlas.linelayeroptions

+[Add a polygon to the map]: map-add-shape.md

+[Add a circle to the map]: map-add-shape.md#add-a-circle-to-the-map

+[Polygon layer options]: /javascript/api/azure-maps-control/atlas.polygonlayeroptions

+[Add a popup]: map-add-popup.md

+[Popup with Media Content]: https://samples.azuremaps.com/?sample=popup-with-media-content

+[Popups on Shapes]: https://samples.azuremaps.com/?sample=popups-on-shapes

+[Reusing Popup with Multiple Pins]: https://samples.azuremaps.com/?sample=reusing-popup-with-multiple-pins

+[Popup class]: /javascript/api/azure-maps-control/atlas.popup

+[Popup options]: /javascript/api/azure-maps-control/atlas.popupoptions

+[spatial IO module]: /javascript/api/azure-maps-spatial-io/

+[Add a heat map layer]: map-add-heat-map-layer.md

+[Heat map layer class]: /javascript/api/azure-maps-control/atlas.layer.heatmaplayer

+[Heat map layer options]: /javascript/api/azure-maps-control/atlas.heatmaplayeroptions

+[Add tile layers]: map-add-tile-layer.md

+[Tile layer class]: /javascript/api/azure-maps-control/atlas.layer.tilelayer

+[Tile layer options]: /javascript/api/azure-maps-control/atlas.tilelayeroptions

+[Show traffic on the map]: map-show-traffic.md

+[Traffic overlay options]: https://samples.azuremaps.com/?sample=traffic-overlay-options

+[`atlas.layer.ImageLayer.getCoordinatesFromEdges`]: /javascript/api/azure-maps-control/atlas.layer.imagelayer#getcoordinatesfromedges-number--number--number--number--number-

+[Overlay an image]: map-add-image-layer.md

+[Image layer class]: /javascript/api/azure-maps-control/atlas.layer.imagelayer

+[atlas.io.read function]: /javascript/api/azure-maps-spatial-io/atlas.io#read-stringarraybufferblob--spatialdatareadoptions-

+[SimpleDataLayer]: /javascript/api/azure-maps-spatial-io/atlas.layer.simpledatalayer

+[SimpleDataLayerOptions]: /javascript/api/azure-maps-spatial-io/atlas.simpledatalayeroptions

+[Drawing tools]: map-add-drawing-toolbar.md

+[Limit Map to Two Finger Panning]: https://samples.azuremaps.com/?sample=limit-map-to-two-finger-panning

+[Limit Scroll Wheel Zoom]: https://samples.azuremaps.com/?sample=limit-scroll-wheel-zoom

+[Create a Fullscreen Control]: https://samples.azuremaps.com/?sample=fullscreen-control

+[Using the Azure Maps services module]: how-to-use-services-module.md

+[Search for points of interest]: map-search-location.md

+[Get information from a coordinate (reverse geocode)]: map-get-information-from-coordinate.md

+[Show directions from A to B]: map-route.md

+[Search Autosuggest with JQuery UI]: https://samples.azuremaps.com/?sample=search-autosuggest-and-jquery-ui

+This tutorial demonstrates how to:

+You'll also learn:

+| Google Maps service API | Azure Maps service API |

+|-||

+| Directions | [Route] |

+| Distance Matrix | [Route Matrix] |

+| Geocoding | [Search] |

+| Places Search | [Search] |

+| Place Autocomplete | [Search] |

+| Snap to Road | See [Calculate routes and directions] section. |

+| Speed Limits | See [Reverse geocode a coordinate] section. |

+| Static Map | [Render] |

+| Time Zone | [Time Zone] |

+| Elevation | [Elevation]¹ |

+¹ Azure Maps [Elevation services](/rest/api/maps/elevation) have been [deprecated](https://azure.microsoft.com/updates/azure-maps-elevation-apis-and-render-v2-dem-tiles-will-be-retired-on-5-may-2023). For more information on how to include this functionality in your Azure Maps, see [Create elevation data & services](elevation-data-services.md).

+* Geolocation - Azure Maps does have a service called Geolocation, but it provides IP Address to location information, but doesn't currently support cell tower or WiFi triangulation.

+* Places details and photos - Phone numbers and website URL are available in the Azure Maps search API.

+* Map URLs

+* Nearest Roads - This is achievable using the Web SDK as demonstrated in the [Basic snap to road logic] sample, but is not currently available as a service.

+* Static street view

+* [Spatial operations]: Offload complex spatial calculations and operations, such as geofencing, to a service.

+* [Traffic]: Access real-time traffic flow and incident data.

+* **[Free-form address geocoding]**: Specify a single address string and process the request immediately. "1 Microsoft way, Redmond, WA" is an example of a single address string. This API is recommended if you need to geocode individual addresses quickly.

+* **[Structured address geocoding]**: Specify the parts of a single address, such as the street name, city, country/region, and postal code and process the request immediately. This API is recommended if you need to geocode individual addresses quickly and the data is already parsed into its individual address parts.

+* **[Batch address geocoding]**: Create a request containing up to 10,000 addresses and have them processed over a period of time. All the addresses are geocoded in parallel on the server and when completed the full result set can be downloaded. This is recommended for geocoding large data sets.

+* **[Fuzzy search]**: This API combines address geocoding with point of interest search. This API takes in a free-form string. This string can be an address, place, landmark, point of interest, or point of interest category. This API process the request near real time. This API is recommended for applications where users search for addresses or points of interest in the same textbox.

+* **[Fuzzy batch search]**: Create a request containing up to 10,000 addresses, places, landmarks, or point of interests and have them processed over a period of time. All the data is processed in parallel on the server and when completed the full result set can be downloaded.

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+For more information on using the search service, see [Search for a location using Azure Maps Search services]. Be sure to review [best practices for search].

+* **[Address reverse geocoder]**: Specify a single geographic coordinate to get the approximate address corresponding to this coordinate. Processes the request near real time.

+* **[Cross street reverse geocoder]**: Specify a single geographic coordinate to get nearby cross street information and process the request immediately. For example, you may receive the following cross streets 1st Ave and Main St.

+* **[Batch address reverse geocoder]**: Create a request containing up to 10,000 coordinates and have them processed over a period of time. All data is processed in parallel on the server. When the request completes, you can download the full set of results.

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+For more information, see [best practices for search].

+* **[POI search]**: Search for points of interests by name. For example, "Starbucks".

+* **[POI category search]**: Search for points of interests by category. For example, "restaurant".

+* **[Nearby search]**: Searches for points of interests that are within a certain distance of a location.

+* **[Fuzzy search]**: This API combines address geocoding with point of interest search. This API takes in a free-form string that can be an address, place, landmark, point of interest, or point of interest category. It processes the request near real time. This API is recommended for applications where users search for addresses or points of interest in the same textbox.

+* **[Search within geometry]**: Search for points of interests that are within a specified geometry. For example, search a point of interest within a polygon.

+* **[Search along route]**: Search for points of interests that are along a specified route path.

+* **[Fuzzy batch search]**: Create a request containing up to 10,000 addresses, places, landmarks, or point of interests. Processed the request over a period of time. All data is processed in parallel on the server. When the request completes processing, you can download the full set of result.

+For more information, see [best practices for search].

+Use the Azure Maps [POI search] and [Fuzzy search] to search for points of interests by name or address.

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+Use the [Nearby search] API to retrieve nearby points of interests, in Azure Maps.

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+| `type` | `categorySet ΓÇô` For more information, see [supported search categories]. |

+* **[Calculate route]**: Calculate a route and have the request processed immediately. This API supports both `GET` and `POST` requests. `POST` requests are recommended when specifying a large number of waypoints or when using lots of the route options to ensure that the URL request doesn't become too long and cause issues. The `POST` Route Direction in Azure Maps has an option can that take in thousands of [supporting points] and use them to recreate a logical route path between them (snap to road).

+* **[Batch route]**: Create a request containing up to 1,000 route request and have them processed over a period of time. All the data is processed in parallel on the server and when completed the full result set can be downloaded.

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+In addition, the route service in Azure Maps supports [calculating routable ranges]. Calculating routable ranges is also known as isochrones. It entails generating a polygon covering an area that can be traveled to in any direction from an origin point. All under a specified amount of time or amount of fuel or charge.

+For more information, see [best practices for routing].

+Azure Maps provides an API for rendering the static map images with data overlaid. The [Map image render] API in Azure Maps is comparable to the static map API in Google Maps.

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+For more information, see [Render custom data on a raster map].

+* **[Map tile]**: Retrieve raster (PNG) and vector tiles for the base maps (roads, boundaries, background).

+* **[Map imagery tile]**: Retrieve aerial and satellite imagery tiles.

+> Many Google Maps applications were switched from interactive map experiences to static map images a few years ago. This was done as a cost saving method. In Azure Maps, it is usually more cost effective to use the interactive map control in the Web SDK. The interactive map control charges based the number of tile loads. Map tiles in Azure Maps are large. Often, it takes only a few tiles to recreate the same map view as a static map. Map tiles are cached automatically by the browser. As such, the interactive map control often generates a fraction of a transaction when reproducing a static map view. Panning and zooming will load more tiles; however, there are options in the map control to disable this behavior. The interactive map control also provides a lot more visualization options than the static map services.

+* `none` ΓÇô No icon is displayed, only labels are rendered.

+Add a red line opacity and pixel thickness to the map between the coordinates, in the URL parameter. For the following example, the line has a 50% opacity and a thickness of four pixels. The coordinates are longitude: -110, latitude: 45 and longitude: -100, latitude: 50.

+When it comes to path locations, Azure Maps requires the coordinates to be in "longitude latitude" format. Google Maps uses "latitude,longitude" format. A space, not a comma, separates longitude and latitude in the Azure Maps format. Azure Maps doesn't support encoded paths or addresses for points. For more information on how to Upload larger data sets as a GeoJSON file into the Azure Maps Data Storage API, see [Upload pins and path data].

+Add a red line opacity and pixel thickness between the coordinates, in the URL parameter. For the following example, the line has 50% opacity and a thickness of four pixels. The coordinates have the following values: longitude: -110, latitude: 45 and longitude: -100, latitude: 50.

+* **[Route matrix]**(/rest/api/maps/route/postroutematrixpreview): Asynchronously calculates travel times and distances for a set of origins and destinations. Supports up to 700 cells per request. That's the number of origins multiplied by the number of destinations. With that constraint in mind, examples of possible matrix dimensions are: 700x1, 50x10, 10x10, 28x25, 10x70.

+> A request to the distance matrix API can only be made using a `POST` request with the origin and destination information in the body of the request. Additionally, Azure Maps requires all origins and destinations to be coordinates. Addresses will need to be geocoded first.

+| `destinations` | `destination` ΓÇô specify in the `POST` request body as GeoJSON. |

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+| `origins` | `origins` ΓÇô specify in the `POST` request body as GeoJSON. |

+For more information, see [best practices for routing].

+* **[Time zone by coordinate]**(/rest/api/maps/timezone/gettimezonebycoordinates): Specify a coordinate and receive the time zone details of the coordinate.

+| `key` | `subscription-key` ΓÇô For more information, see [Authentication with Azure Maps]. |

+| `language` | `language` ΓÇô For more information, see [Localization support in Azure Maps]. |

+* **[Time zone by ID]**: Returns current, historical, and future time zone information for the specified IANA time zone ID.

+* **[Time zone Enum IANA]**: Returns a full list of IANA time zone IDs. Updates to the IANA service are reflected in the system within one day.

+* **[Time zone Enum Windows]**: Returns a full list of Windows Time Zone IDs.

+* **[Time zone IANA version]**: Returns the current IANA version number used by Azure Maps.

+* **[Time zone Windows to IANA]**: Returns a corresponding IANA ID, given a valid Windows Time Zone ID. Multiple IANA IDs may be returned for a single Windows ID.

+* JavaScript, TypeScript, Node.js ΓÇô [documentation] \| [npm package]

+* .NET Standard 2.0 ΓÇô [GitHub project] \| [NuGet package]

+[Route]: /rest/api/maps/route

+[Route Matrix]: /rest/api/maps/route/postroutematrixpreview

+[Search]: /rest/api/maps/search

+[Calculate routes and directions]: #calculate-routes-and-directions

+[Reverse geocode a coordinate]: #reverse-geocode-a-coordinate

+[Render]: /rest/api/maps/render/getmapimage

+[Time Zone]: /rest/api/maps/timezone

+[Elevation]: /rest/api/maps/elevation

+[Basic snap to road logic]: https://samples.azuremaps.com/?sample=basic-snap-to-road-logic

+[Spatial operations]: /rest/api/maps/spatial

+[Traffic]: /rest/api/maps/traffic

+[Search for a location using Azure Maps Search services]: how-to-search-for-address.md

+[best practices for search]: how-to-use-best-practices-for-search.md

+[Localization support in Azure Maps]: supported-languages.md

+[Authentication with Azure Maps]: azure-maps-authentication.md

+[supported search categories]: supported-search-categories.md

+[Free-form address geocoding]: /rest/api/maps/search/getsearchaddress

+[Structured address geocoding]: /rest/api/maps/search/getsearchaddressstructured

+[Batch address geocoding]: /rest/api/maps/search/postsearchaddressbatchpreview

+[Fuzzy search]: /rest/api/maps/search/getsearchfuzzy

+[Fuzzy batch search]: /rest/api/maps/search/postsearchfuzzybatchpreview

+[Address reverse geocoder]: /rest/api/maps/search/getsearchaddressreverse

+[Cross street reverse geocoder]: /rest/api/maps/search/getsearchaddressreversecrossstreet

+[Batch address reverse geocoder]: /rest/api/maps/search/postsearchaddressreversebatchpreview

+[POI search]: /rest/api/maps/search/getsearchpoi

+[POI category search]: /rest/api/maps/search/getsearchpoicategory

+[Nearby search]: /rest/api/maps/search/getsearchnearby

+[Search within geometry]: /rest/api/maps/search/postsearchinsidegeometry

+[Search along route]: /rest/api/maps/search/postsearchalongroute

+[supporting points]: /rest/api/maps/route/postroutedirections#supportingpoints

+[Calculate route]: /rest/api/maps/route/getroutedirections

+[Batch route]: /rest/api/maps/route/postroutedirectionsbatchpreview

+[calculating routable ranges]: /rest/api/maps/route/getrouterange

+[best practices for routing]: how-to-use-best-practices-for-routing.md

+[Map image render]: /rest/api/maps/render/getmapimagerytile

+[Render custom data on a raster map]: how-to-render-custom-data.md

+[Map tile]: /rest/api/maps/render/getmaptile

+[Map imagery tile]: /rest/api/maps/render/getmapimagerytile

+[Upload pins and path data]: how-to-render-custom-data.md#upload-pins-and-path-data

+[Time zone by ID]: /rest/api/maps/timezone/gettimezonebyid

+[Time zone Enum IANA]: /rest/api/maps/timezone/gettimezoneenumiana

+[Time zone Enum Windows]: /rest/api/maps/timezone/gettimezoneenumwindows

+[Time zone IANA version]: /rest/api/maps/timezone/gettimezoneianaversion

+[Time zone Windows to IANA]: /rest/api/maps/timezone/gettimezonewindowstoiana

+[documentation]: how-to-use-services-module.md

+[npm package]: https://www.npmjs.com/package/azure-maps-rest

+[GitHub project]: https://github.com/perfahlen/AzureMapsRestServices

+[NuGet package]: https://www.nuget.org/packages/AzureMapsRestToolkit

+This article provides insights on how to migrate web, mobile and server-based applications from Google Maps to the Microsoft Azure Maps platform. This tutorial includes comparative code samples, migration suggestions, and best practices for migrating to Azure Maps. This tutorial demonstrates:

+> For more information on authentication in Azure Maps, see [Manage authentication in Azure Maps].

+The table provides a high-level list of Azure Maps features, which correspond to Google Maps features. This list doesn't show all Azure Maps features. Other Azure Maps features include: accessibility, geofencing, isochrones, spatial operations, direct map tile access, batch services, and data coverage comparisons (that is, imagery coverage).

+¹ Azure Maps [Elevation services] have been [deprecated]. For more information how to include this functionality in your Azure Maps, see [Create elevation data & services].

+* Azure Maps allows data from its platform to be stored in Azure. Also, data can be cached elsewhere for up to six months as per the [terms of use].

+* [Azure Maps pricing page]

+* [Azure pricing calculator]

+* [Choose the right pricing tier in Azure Maps]

+* [Azure Maps term of use] - included in the Microsoft Online Services Terms.

+A high-level migration plan includes.

+2. If you don't already have one, create an [Azure subscription].

+3. Create an [Azure Maps account] and [subscription key] or [Azure Active Directory authentication].

+1. If you don't have an Azure subscription, create a [free account] before you begin.

+2. Sign in to the [Azure portal].

+3. Create an [Azure Maps account].

+4. Get your Azure Maps [subscription key] or [Azure Active Directory authentication] for enhanced security.

+* [Azure Maps product page]

+* [Azure Maps product documentation]

+* [Azure Maps Web SDK code samples]

+* [Azure Maps developer forums]

+* [Microsoft learning center shows]

+* [Azure Maps Blog]

+* [Azure Maps Q&A]

+Developers can seek migration support through the [Azure Maps developer forums] or through one of the many [Azure support options].

+[Azure subscription]: https://azure.com

+[Azure portal]: https://portal.azure.com/

+[Manage authentication in Azure Maps]: how-to-manage-authentication.md

+[Azure Active Directory authentication]: azure-maps-authentication.md#azure-ad-authentication

+[terms of use]: https://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=46

+[Azure Maps pricing page]: https://azure.microsoft.com/pricing/details/azure-maps/

+[Azure pricing calculator]: https://azure.microsoft.com/pricing/calculator/?service=azure-maps

+[Azure Maps term of use]: https://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=46

+[Choose the right pricing tier in Azure Maps]: choose-pricing-tier.md

+[Azure Maps product page]: https://azure.com/maps

+[Azure Maps product documentation]: https://aka.ms/AzureMapsDocs

+[Azure Maps Web SDK code samples]: https://aka.ms/AzureMapsSamples

+[Azure Maps developer forums]: https://aka.ms/AzureMapsForums

+[Microsoft learning center shows]: https://aka.ms/AzureMapsVideos

+[Azure Maps Blog]: https://aka.ms/AzureMapsBlog

+[Azure Maps Q&A]: https://aka.ms/AzureMapsFeedback

+[Azure support options]: https://azure.microsoft.com/support/options

+<!->

+[Elevation services]: /rest/api/maps/elevation

+[deprecated]: https://azure.microsoft.com/updates/azure-maps-elevation-apis-and-render-v2-dem-tiles-will-be-retired-on-5-may-2023

+[Create elevation data & services]: elevation-data-services.md

+### [3.0.0-preview.6] (March 31, 2023)

+#### Installation (3.0.0-preview.6)

+The preview is available on [npm][3.0.0-preview.6] and CDN.

+- **NPM:** Refer to the instructions at [azure-maps-control@3.0.0-preview.6][3.0.0-preview.6]

+- **CDN:** Reference the following CSS and JavaScript in the `<head>` element of an HTML file:

+ ```html

+ <link href="https://atlas.microsoft.com/sdk/javascript/mapcontrol/3.0.0-preview.6/atlas.min.css" rel="stylesheet" />

+ <script src="https://atlas.microsoft.com/sdk/javascript/mapcontrol/3.0.0-preview.6/atlas.min.js"></script>

+ ```

+#### New features (3.0.0-preview.6)

+- Optimized the internal style transform performance.

+#### Bug fixes (3.0.0-preview.6)

+- Resolved an issue where the first style set request was unauthenticated for `AAD` authentication.

+- Eliminated redundant requests during map initialization and on style changed events.

+### [2.2.6]

+#### Bug fixes (2.2.6)

+- Resolved an issue where the first style set request was unauthenticated for `AAD` authentication.

+- Eliminated redundant requests during map initialization and on style changed events.

+[3.0.0-preview.6]: https://www.npmjs.com/package/azure-maps-control/v/3.0.0-preview.6

+[2.2.6]: https://www.npmjs.com/package/azure-maps-control/v/2.2.6

+| [Render v1](/rest/api/maps/render)<br>[Render v2](/rest/api/maps/render-v2) | Yes, except for Terra maps (MapTile.GetTerraTile and layer=terra) which are non-billable.|<ul><li>15 tiles = 1 transaction, except microsoft.dem ([deprecated](https://azure.microsoft.com/updates/azure-maps-elevation-apis-and-render-v2-dem-tiles-will-be-retired-on-5-may-2023)) is one tile = 50 transactions</li><li>One request for Get Copyright = 1 transaction</li><li>One request for Get Map Attribution = 1 transaction</li><li>One request for Get Static Map = 1 transaction</li><li>One request for Get Map Tileset = 1 transaction</li></ul> <br> For Creator related usage, see the [Creator table](#azure-maps-creator). |<ul><li>Maps Base Map Tiles (Gen2 pricing)</li><li>Maps Imagery Tiles (Gen2 pricing)</li><li>Maps Static Map Images (Gen2 pricing)</li><li>Maps Traffic Tiles (Gen2 pricing)</li><li>Maps Weather Tiles (Gen2 pricing)</li><li>Standard Hybrid Aerial Imagery Transactions (Gen1 S0 pricing)</li><li>Standard Aerial Imagery Transactions (Gen1 S0 pricing)</li><li>Standard S1 Aerial Imagery Transactions (Gen1 S1 pricing)</li><li>Standard S1 Hybrid Aerial Imagery Transactions (Gen1 S1 pricing)</li><li>Standard S1 Rendering Transactions (Gen1 S1 pricing)</li><li>Standard S1 Tile Transactions (Gen1 S1 pricing)</li><li>Standard S1 Weather Tile Transactions (Gen1 S1 pricing)</li><li>Standard Tile Transactions (Gen1 S0 pricing)</li><li>Standard Weather Tile Transactions (Gen1 S0 pricing)</li><li>Maps Copyright (Gen2 pricing, Gen1 S0 pricing and Gen1 S1 pricing)</li></ul>|

+## SDK update guidance

+## Release notes

+Reference the release notes to see the current version of Application Insights SDKs and previous versions release dates.

+- [.NET SDKs (Including ASP.NET, ASP.NET Core, and Logging Adapters)](https://github.com/Microsoft/ApplicationInsights-dotnet/releases)

+- [Python](https://github.com/census-instrumentation/opencensus-python/blob/master/contrib/opencensus-ext-azure/CHANGELOG.md)

+- [Node.js](https://github.com/Microsoft/ApplicationInsights-node.js/releases)

+- [JavaScript](https://github.com/microsoft/ApplicationInsights-JS/releases)

+Our [Service Updates](https://azure.microsoft.com/updates/?service=application-insights) also summarize major Application Insights improvements.

+>[!NOTE]

+> [Export](../logs/logs-data-export.md) to Event Hub and Storage Account is not supported if the incoming LogMessage is not a valid JSON. For best performance, we recommend emitting container logs in JSON format.

+* To create a volume using customer-managed keys, you must select the *Standard* network features. You can't use customer-managed key volumes with volume configured using Basic network features. Follow instructions in [Set the Network Features option](configure-network-features.md#set-the-network-features-option) to create a volume.

+ * You need a private endpoint in each VNet you intend on using for Azure NetApp Files volumes

+ * The network security group on the Azure NetApp Files delegated subnet must allow incoming traffic from the subnet where the VM mounting Azure NetApp Files volumes is located.

+ * The network security group on the Azure NetApp Files delegated subnet must also allow outgoing traffic to the subnet where the private endpoint is located.

+1. After selecting the **Save** button, you'll receive a notification communicating the status of the operation. If the operation was not successful, an error message displays. Refer to [error messages and troubleshooting](#error-messages-and-troubleshooting) for assistance in resolving the error.

+## Prerequisites

+* Azure CLI. For more information, see [How to install the Azure CLI](/cli/azure/install-azure-cli).

+* After installing, sign in for the first time. For more information, see [How to sign into the Azure CLI](/cli/azure/get-started-with-azure-cli#how-to-sign-into-the-azure-cli).

+### Deploy resources by using storage operations

+### Deploy resources by using an ARM template or Bicep file

+The following example shows the Bicep file named `storage.bicep` that you're deploying:

+```bicep

+@minLength(3)

+@maxLength(11)

+param storagePrefix string

+var uniqueStorageName = concat(storagePrefix, uniqueString(resourceGroup().id))

+resource uniqueStorage 'Microsoft.Storage/storageAccounts@2022-09-01' = {

+ name: uniqueStorageName

+ location: 'eastus'

+ sku: {

+ name: 'Standard_LRS'

+ }

+ kind: 'StorageV2'

+ properties: {

+ supportsHttpsTrafficOnly: true

+ }

+}

+```

+## Prerequisites

+* Azure PowerShell. For more information, see [Install the Azure Az PowerShell module](/powershell/azure/install-az-ps).

+* After installing, sign in for the first time. For more information, see [Sign in](/powershell/azure/install-az-ps#sign-in).

+### Deploy resources by using storage operations

+### Deploy resources by using an ARM template or Bicep file

+The following example shows the Bicep file named `storage.bicep` that you're deploying:

+```bicep

+@minLength(3)

+@maxLength(11)

+param storagePrefix string

+var uniqueStorageName = concat(storagePrefix, uniqueString(resourceGroup().id))

+resource uniqueStorage 'Microsoft.Storage/storageAccounts@2022-09-01' = {

+ name: uniqueStorageName

+ location: 'eastus'

+ sku: {

+ name: 'Standard_LRS'

+ }

+ kind: 'StorageV2'

+ properties: {

+ supportsHttpsTrafficOnly: true

+ }

+}

+```

+To delete a lock, use [Remove-AzResourceLock](/powershell/module/az.resources/remove-azresourcelock).

+```azurepowershell-interactive

+$lockId = (Get-AzResourceLock -ResourceGroupName exampleGroup).LockId

+Remove-AzResourceLock -LockId $lockId

+```

+A connection string contains information about how to connect to Azure Signal Service (ASRS). In this article, you learn the basics of connection string and how to configure it in your application.

+## What is a connection string

+When an application needs to connect to Azure SignalR Service, it needs the following information:

+- The HTTP endpoint of the SignalR service instance.

+- The way to authenticate with the service endpoint.

+A connection string contains such information.

+## What a connection string looks like

+A connection string consists of a series of key/value pairs separated by semicolons(;). An equal sign(=) to connect each key and its value. Keys aren't case sensitive.

+> Endpoint=https://<resource_name>.service.signalr.net;AccessKey=<access_key>;Version=1.0;

+The connection string contains:

+- `Endpoint=https://<resource_name>.service.signalr.net`: The endpoint URL of the resource.

+- `AccessKey=<access_key>`: The key to authenticate with the service. When an access key is specified in the connection string, the SignalR Service SDK uses it to generate a token that is validated by the service.

+- `Version`: The version of the connection string. The default value is `1.0`.

+| Key | Description | Required | Default value| Example value

+| | | | | |

+| Endpoint | The URL of your ASRS instance. | Y | N/A |`https://foo.service.signalr.net` |

+| Port | The port that your ASRS instance is listening on. on. | N| 80/443, depends on the endpoint URI schema | 8080|

+| Version| The version of given connection. string. | N| 1.0 | 1.0 |

+| ClientEndpoint | The URI of your reverse proxy, such as the App Gateway or API. Management | N| null | `https://foo.bar` |

+| AuthType | The auth type. By default the service uses the AccessKey authorize requests. **Case insensitive** | N | null | Azure, azure.msi, azure.app |

+The local auth method is used when `AuthType` is set to null.

+| Key | Description| Required | Default value | Example value|

+| | | | | |

+| AccessKey | The key string in base64 format for building access token. | Y | null | ABCDEFGHIJKLMNOPQRSTUVWEXYZ0123456789+=/ |

+The Azure AD auth method is used when `AuthType` is set to `azure`, `azure.app` or `azure.msi`.

+| Key| Description| Required | Default value | Example value|

+| ClientId | A GUID of an Azure application or an Azure identity. | N| null| `00000000-0000-0000-0000-000000000000` |

+| TenantId | A GUID of an organization in Azure Active Directory. | N| null| `00000000-0000-0000-0000-000000000000` |

+| ClientSecret | The password of an Azure application instance. | N| null| `***********************.****************` |

+| ClientCertPath | The absolute path of a client certificate (cert) file to an Azure application instance. | N| null| `/usr/local/cert/app.cert` |

+A different `TokenCredential` is used to generate Azure AD tokens depending on the parameters you have given.

+ [DefaultAzureCredential](/dotnet/api/azure.identity.defaultazurecredential) is used.

+ ```text

+ 1. A user-assigned managed identity is used if `clientId` has been given in connection string.

+ Endpoint=xxx;AuthType=azure.msi;ClientId=<client_id>

+ - [ManagedIdentityCredential(clientId)](/dotnet/api/azure.identity.managedidentitycredential) is used.

+ 1. A system-assigned managed identity is used.

+ ```text

+ - [ManagedIdentityCredential()](/dotnet/api/azure.identity.managedidentitycredential) is used.

+ 1. [ClientSecretCredential(clientId, tenantId, clientSecret)](/dotnet/api/azure.identity.clientsecretcredential) is used if `clientSecret` is given.

+ ```text

+ Endpoint=xxx;AuthType=azure.msi;ClientId=<client_id>;clientSecret=<client_secret>>

+ 1. [ClientCertificateCredential(clientId, tenantId, clientCertPath)](/dotnet/api/azure.identity.clientcertificatecredential) is used if `clientCertPath` is given.

+ ```text

+ Endpoint=xxx;AuthType=azure.msi;ClientId=<client_id>;TenantId=<tenant_id>;clientCertPath=</path/to/cert>

+## How to get connection strings

+You see two connection strings (primary and secondary) in the following format:

+## Connect with an Azure AD application

+You can use an [Azure AD application](../active-directory/develop/app-objects-and-service-principals.md) to connect to your SignalR service. As long as the application has the right permission to access SignalR service, no access key is needed.

+To use Azure AD authentication, you need to remove `AccessKey` from connection string and add `AuthType=azure.app`. You also need to specify the credentials of your Azure AD application, including client ID, client secret and tenant ID. The connection string looks as follows:

+```text

+For more information about how to authenticate using Azure AD application, see [Authorize from Azure Applications](signalr-howto-authorize-application.md).

+## Authenticate with Managed identity

+You can also use a system assigned or user assigned [managed identity](../active-directory/managed-identities-azure-resources/overview.md) to authenticate with SignalR service.

+To use a system assigned identity, add `AuthType=azure.msi` to the connection string:

+```text

+The SignalR service SDK automatically uses the identity of your app server.

+To use a user assigned identity, include the client ID of the managed identity in the connection string:

+```text

+For more information about how to configure managed identity, see [Authorize from Managed Identity](signalr-howto-authorize-managed-identity.md).

+> It's highly recommended to use managed identity to authenticate with SignalR service as it's a more secure way compared to using access keys. If you don't use access keys authentication, consider completely disabling it (go to Azure portal -> Keys -> Access Key -> Disable). If you still use access keys, it's highly recommended to rotate them regularly. For more information, see [Rotate access keys for Azure SignalR Service](signalr-howto-key-rotation.md).

+### Use the connection string generator

+It may be cumbersome and error-prone to build connection strings manually. To avoid making mistakes, SignalR provides a connection string generator to help you generate a connection string that includes Azure AD identities like `clientId`, `tenantId`, etc. To use the tool open your SignalR instance in Azure portal, select **Connection strings** from the left side menu.

+In this page you can choose different authentication types (access key, managed identity or Azure AD application) and input information like client endpoint, client ID, client secret, etc. Then connection string is automatically generated. You can copy and use it in your application.

+> Information you enter won't be saved after you leave the page. You will need to copy and save your connection string to use in your application.

+For more information about how access tokens are generated and validated, see [Authenticate via Azure Active Directory Token](signalr-reference-data-plane-rest-api.md#authenticate-via-azure-active-directory-token-azure-ad-token) in [Azure SignalR service data plane REST API reference](signalr-reference-data-plane-rest-api.md) .

+A connection string contains the HTTP endpoint for app server to connect to SignalR service. The server returns the HTTP endpoint to the clients in a negotiate response, so the client can connect to the service.

+In some applications, there may be an extra component in front of SignalR service. All client connections need to go through that component first. For example, [Azure Application Gateway](../application-gateway/overview.md) is a common service that provides additional network security.

+In such case, the client needs to connect to an endpoint different than SignalR service. Instead of manually replacing the endpoint at the client side, you can add `ClientEndpoint` to connection string:

+```text

+The app server returns a response to the client's negotiate request containing the correct endpoint URL for the client to connect to. For more information about client connections, see [Azure SignalR Service internals](signalr-concept-internals.md#client-connections).

+Similarly, the server wants to make [server connections](signalr-concept-internals.md#azure-signalr-service-internals) or call [REST APIs](https://github.com/Azure/azure-signalr/blob/dev/docs/rest-api.md) to the service, the SignalR service may also be behind another service like [Azure Application Gateway](../application-gateway/overview.md). In that case, you can use `ServerEndpoint` to specify the actual endpoint for server connections and REST APIs:

+```text

+There are two ways to configure a connection string in your application.

+Or you can call `AddAzureSignalR()` without any arguments. The service SDK returns the connection string from a config named `Azure:SignalR:ConnectionString` in your [configuration provider](/dotnet/core/extensions/configuration-providers).

+In a local development environment, the configuration is stored in a file (*appsettings.json* or *secrets.json*) or environment variables. You can use one of the following ways to configure connection string:

+- Set an environment variable named `Azure__SignalR__ConnectionString` to the connection string. The colons need to be replaced with double underscore in the [environment variable configuration provider](/dotnet/core/extensions/configuration-providers#environment-variable-configuration-provider).

+In a production environment, you can use other Azure services to manage config/secrets like Azure [Key Vault](../key-vault/general/overview.md) and [App Configuration](../azure-app-configuration/overview.md). See their documentation to learn how to set up configuration provider for those services.

+> Even when you're directly setting a connection string using code, it's not recommended to hardcode the connection string in source code You should read the connection string from a secret store like key vault and pass it to `AddAzureSignalR()`.

+Azure SignalR Service also allows the server to connect to multiple service endpoints at the same time, so it can handle more connections that are beyond a service instance's limit. Also, when one service instance is down the other service instances can be used as backup. For more information about how to use multiple instances, see [Scale SignalR Service with multiple instances](signalr-howto-scale-multi-instances.md).

+- Through code:

+- Through configuration:

+ You can use any supported configuration provider (secret manager, environment variables, key vault, etc.) to store connection strings. Take secret manager as an example:

+ You can assign a name and type to each endpoint by using a different config name in the following format:

+ ```text

+Azure SignalR Service enables you to secure and control the level of access to your service endpoint based on the request type and subset of networks. When network rules are configured, only applications requesting data over the specified set of networks can access your SignalR Service.

+SignalR Service has a public endpoint that is accessible through the internet. You can also create [private endpoints for your Azure SignalR Service](howto-private-endpoints.md). A private endpoint assigns a private IP address from your VNet to the SignalR Service, and secures all traffic between your VNet and the SignalR Service over a private link. The SignalR Service network access control provides access control for both public and private endpoints.

+Optionally, you can choose to allow or deny certain types of requests for the public endpoint and each private endpoint. For example, you can block all [Server Connections](signalr-concept-internals.md#application-server-connections) from public endpoint and make sure they only originate from a specific VNet.

+An application that accesses a SignalR Service when network access control rules are in effect still requires proper authorization for the request.

+To completely deny all public traffic, first configure the public network rule to allow no request type. Then, you can configure rules that grant access to traffic from specific VNets. This configuration enables you to build a secure network boundary for your applications.

+In this scenario, you can configure the public network rule to only allow [Client Connections](signalr-concept-internals.md#client-connections) from the public network. You can then configure private network rules to allow other types of requests originating from a specific VNet. This configuration hides your app servers from the public network and establishes secure connections between your app servers and SignalR Service.

+You can manage network access control for SignalR Service through the Azure portal.

+1. Go to the SignalR Service instance you want to secure.

+1. Select **Network access control** from the left side menu.

+ > The default action is the action the service takes when no access control rule matches a request. For example, if the default action is **Deny**, then the request types that are not explicitly approved will be denied.

+1. Select **Save** to apply your changes.

+You can easily migrate a local ASP.NET Core SignalR or an ASP.NET SignalR application to work with SignalR Service, with by changing few lines of code.

+The diagram describes the typical architecture when you use the SignalR Service with your application server.

+## Application server connections

+A self-hosted ASP.NET Core SignalR application server listens to and connects clients directly.

+With SignalR Service, the application server no longer accepts persistent client connections, instead:

+1. The endpoint responds to client negotiation requests and redirect clients to SignalR Service.

+1. The clients connect to SignalR Service.

+Once the application server is started:

+- For ASP.NET Core SignalR: Azure SignalR Service SDK opens five WebSocket connections per hub to SignalR Service.

+- For ASP.NET SignalR: Azure SignalR Service SDK opens five WebSocket connections per hub to SignalR Service, and one per application WebSocket connection.

+The initial number of connections defaults to 5 and is configurable using the `InitialHubServerConnectionCount` option in the SignalR Service SDK. For more information, see [configuration](https://github.com/Azure/azure-signalr/blob/dev/docs/run-asp-net-core.md#maxhubserverconnectioncount).

+While the application server is connected to the SignalR service, the Azure SignalR service may send load-balancing messages to the server. Then, the SDK starts new server connections to the service for better performance. Messages to and from clients are multiplexed into these connections.

+Server connections are persistently connected to the SignalR Service. If a server connection is disconnected due to a network issue:

+- All clients served by this server connection disconnect. For more information, see [Data transmission between client and server](#data-transmission-between-client-and-server).

+- The server automatically reconnects the clients.

+When you use the SignalR Service, clients connect to the service instead of the application server.

+There are three steps to establish persistent connections between the client and the SignalR Service.

+1. A client sends a negotiate request to the application server.

+1. The application server uses Azure SignalR Service SDK to return a redirect response containing the SignalR Service URL and access token.

+1. After the client receives the redirect response, it uses the URL and access token to connect to SignalR Service.

+To learn more about ASP.NET Core SignalR's, see [Transport Protocols](https://github.com/aspnet/SignalR/blob/release/2.2/specs/TransportProtocols.md).

+## Data transmission between client and server

+When a client is connected to the SignalR Service, the service runtime finds a server connection to serve this client.

+- This step happens only once, and is a one-to-one mapping between the client and server connection.

+SignalR Service transmits data from the client to the pairing application server. Data from the application server is sent to the mapped clients.

+SignalR Service doesn't save or store customer data, all customer data received is transmitted to the target server or clients in real-time.

+The Azure SignalR Service acts as a logical transport layer between application server and clients. All persistent connections are offloaded to SignalR Service. As a result, the application server only needs to handle the business logic in the hub class, without worrying about client connections.

+## Next steps

+To learn more about Azure SignalR SDKs, see:

+- [ASP.NET Core SignalR](/aspnet/core/signalr/introduction)

+- [ASP.NET SignalR](/aspnet/signalr/overview/getting-started/introduction-to-signalr)

+- [ASP.NET code samples](https://github.com/aspnet/AzureSignalR-samples)

+The billing model for Azure SignalR Service is based on the number of connections and the number of outbound messages from the service. This article explains how messages and connections are defined and counted for billing.

+ * For long polling or server side events, the client can't send messages larger than 1 MB.

+ * There's no size limit for WebSocket for service.

+ * App server can set a limit for client message size. Default is 32 KB. For more information, see [Security considerations in ASP.NET Core SignalR](/aspnet/core/signalr/security?#buffer-management).

+ * For serverless, the message size is limited by upstream implementation, but under 1 MB is recommended.

+ * There's no limit to server message size, but under 16 MB is recommended.

+ * App server can set a limit for client message size. Default is 32 KB. For more information, see [Security considerations in ASP.NET Core SignalR](/aspnet/core/signalr/security?#buffer-management).

+ * Rest API: 1 MB for message body, 16 KB for headers.

+ * There's no limit for WebSocket, [management SDK persistent mode](https://github.com/Azure/azure-signalr/blob/dev/docs/management-sdk-guide.md), but under 16 MB is recommended.

+For WebSocket clients, large messages are split into smaller messages that are no more than 2 KB each and transmitted separately. SDKs handle message splitting and assembling. No developer efforts are needed.

+Messages sent into the service are inbound messages and messages sent out of the service are outbound messages. Only outbound messages from Azure SignalR Service are counted for billing. Ping messages between clients and servers are ignored.

+* When the application server broadcasts a 1-KB message to all connected clients, the message from the application server to the service is considered a free inbound message.

+* When *client A* sends a 1 KB inbound message to *client B*, without going through app server, the message is a free inbound message. The message routed from service to *client B* is billed as an outbound message.

+* If you have three clients and one application server, when one client sends a 4-KB message for the server broadcast to all clients, the billed message count is eight:

+ * One message from the service to the application server.

+ * Three messages from the service to the clients. Each message is counted as two 2-KB messages.

+## How connections are counted

+The Azure SignalR Service creates application server and client connections. By default, each application server starts with five initial connections per hub, and each client has one client connection.

+For example, assume that you have two application servers and you define five hubs in code. The server connection count is 50: (2 app servers * 5 hubs * 5 connections per hub).

+The connection count shown in the Azure portal includes server, client, diagnostic, and live trace connections. The connection types are defined in the following list:

+* **Server connection**: Connects Azure SignalR Service and the app server.

+* **Client connection**: Connects Azure SignalR Service and the client app.

+* **Diagnostic connection**: A special type of client connection that can produce a more detailed log, which might affect performance. This kind of client is designed for troubleshooting.

+* **Live trace connection**: Connects to the live trace endpoint and receives live traces of Azure SignalR Service.

+A live trace connection isn't counted as a client connection or as a server connection.

+ASP.NET SignalR calculates server connections in a different way. It includes one default hub in addition to hubs that you define. By default, each application server needs five more initial server connections. The initial connection count for the default hub stays consistent with other hubs.

+The service and the application server keep syncing connection status and making adjustments to server connections to get better performance and service stability. So you may see changes in the number of server connections in your running service.

+* [Aggregation types in Azure Monitor](../azure-monitor/essentials/metrics-supported.md#microsoftsignalrservicesignalr )

+* [ASP.NET Core SignalR configuration](/aspnet/core/signalr/configuration)

+* [JSON](https://www.json.org/)

+* [MessagePack](/aspnet/core/signalr/messagepackhubprotocol)

+This article describes:

+* The factors that affect SignalR application performance.

+* The typical performance in different use-case scenarios.

+* The environment and tools that you can use to generate a performance report.

+You can easily monitor your service in the Azure portal. From the **Metrics** page of your SignalR instance, you can select the **Server Load** metrics to see the "pressure" of your service.

+

+<kbd></kbd>

+The chart shows the computing pressure of your SignalR service. You can test your scenario and check this metric to decide whether to scale up. The latency inside SignalR service remains low if the Server Load is below 70%.

+*Default mode*: The default working mode when an Azure SignalR Service instance is created. Azure SignalR Service expects the app server to establish a connection with it before it accepts any client connections.

+* What is the typical Azure SignalR Service performance for each tier?

+* Does Azure SignalR Service meet my requirements for message throughput (for example, sending 100,000 messages per second)?

+* For my specific scenario, which tier is suitable for me? Or how can I select the proper tier?

+* What kind of app server (VM size) is suitable for me? How many of them should I deploy?

+* Evaluate your approximate requirement for the inbound or outbound messages.

+* Find the proper tiers by checking the performance table.

+Latency is the time span from the connection sending the message to receiving the response message from Azure SignalR Service. Take **echo** as an example. Every client connection adds a time stamp in the message. The app server's hub sends the original message back to the client. So the propagation delay is easily calculated by every client connection. The time stamp is attached for every message in **broadcast**, **send to group**, and **send to connection**.

+The following factors affect SignalR performance.

+* SKU tier (CPU/memory)

+* Number of connections

+* Message size

+* Message send rate

+* Transport type (WebSocket, Server-Sent-Event, or Long-Polling)

+* Use-case scenario (routing cost)

+* App server and service connections (in server mode)

+#### Computer resources

+Theoretically, Azure SignalR Service capacity is limited by compute resources: CPU, memory, and network. For example, more connections to Azure SignalR Service cause the service to use more memory. For larger message traffic (for example, every message is larger than 2,048 bytes), Azure SignalR Service needs to spend more CPU cycles to process traffic. Meanwhile, Azure network bandwidth also imposes a limit for maximum traffic.

+#### Transport type

+The transport type is another factor that affects performance. The three types are:

+* [WebSocket](https://en.wikipedia.org/wiki/WebSocket): WebSocket is a bidirectional and full-duplex communication protocol over a single TCP connection.

+* [Server-Sent-Event](https://en.wikipedia.org/wiki/Server-sent_events): Server-Sent-Event is a unidirectional protocol to push messages from server to client.

+* [Long-Polling](https://en.wikipedia.org/wiki/Push_technology): Long-Polling requires the clients to periodically poll information from the server through an HTTP request.

+For the same API under the same conditions, WebSocket has the best performance, Server-Sent-Event is slower, and Long-Polling is the slowest. Azure SignalR Service recommends WebSocket by default.

+#### Message routing cost

+The message routing cost also limits performance. Azure SignalR Service plays a role as a message router, which routes the message from a set of clients or servers to other clients or servers. A different scenario or API requires a different routing policy.

+For **echo**, the client sends a message to itself, and the routing destination is also itself. This pattern has the lowest routing cost. But for **broadcast**, **send to group**, and **send to connection**, Azure SignalR Service needs to look up the target connections through the internal distributed data structure. This extra processing uses more CPU, memory, and network bandwidth. As a result, performance is slower.

+In the default mode, the app server might also become a bottleneck for certain scenarios. The Azure SignalR SDK has to invoke the hub, while it maintains a live connection with every client through heartbeat signals.

+In serverless mode, the client sends a message by HTTP post, which isn't as efficient as WebSocket.

+#### Protocol

+Another factor is protocol: JSON and [MessagePack](https://msgpack.org/https://docsupdatetracker.net/index.html). MessagePack is smaller in size and delivered faster than JSON. MessagePack might not improve performance, though. The performance of Azure SignalR Service isn't sensitive to protocols because it doesn't decode the message payload during message forwarding from clients to servers or vice versa.

+Assume that the app server is powerful enough and isn't the performance bottleneck. Then, check the maximum inbound and outbound bandwidth for every tier.

+For a quick evaluation, assume the following default settings:

+* The transport type is WebSocket.

+* The message size is 2,048 bytes.

+* A message is sent every 1 second.

+* Azure SignalR Service is in the default mode.

+Every tier has its own maximum inbound bandwidth and outbound bandwidth. A smooth user experience isn't guaranteed after the inbound or outbound connection exceeds the limit.

+* *inboundConnections*: The number of connections sending the message.

+* *outboundConnections*: The number of connections receiving the message.

+* *messageSize*: The size of a single message (average value). A small message that's less than 1,024 bytes has a performance impact that's similar to a 1,024-byte message.

+* *sendInterval*: The time of sending one message. Typically it's 1 second per message, which means sending one message every second. A smaller interval means sending more message in a time period. For example, 0.5 second per message means sending two messages every second.

+* *Connections*: The committed maximum threshold for Azure SignalR Service for every tier. If the connection number is increased further, it suffers from connection throttling.

+The real use case is more complicated. It might send a message larger than 2,048 bytes, or the sending message rate isn't one message per second. Let's take Unit100's broadcast as an example to find how to evaluate its performance.

+For the use case of sending a message to clients, make sure that the app server isn't* the bottleneck. The following "Case study" section gives guidelines about how many app servers you need and how many server connections you should configure.

+For **broadcast**, when the web app receives the message, it broadcasts to all clients. The more clients there are to broadcast, the more message traffic there's to all clients. See the following diagram.

+* **Small group**: Every group has 10 connections. The group number is equal to (max

+* **Big group**: The group number is always 10. The group member count is equal to (max

+Sending high-density messages through the REST API isn't as efficient as using WebSocket. It requires you to build a new HTTP connection every time, and that's an extra cost in serverless mode.

+All clients establish WebSocket connections with Azure SignalR Service. Then some clients start broadcasting through the REST API. The message sending (inbound) is all through HTTP Post, which isn't efficient compared with WebSocket.

+ Title: Authorize managed identity requests to a SignalR resource

+# Authorize managed identity requests to a SignalR resource

+Azure SignalR Service supports Azure Active Directory (Azure AD) authorizing requests from Azure resources using [managed identities for Azure resources

+To learn how to create user-assigned managed identities, see [Create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md#create-a-user-assigned-managed-identity)

+1. Select **System-assigned managed identity**, search for a virtual machine to which you'd like to assign the role, and then select it.

+You can use either [DefaultAzureCredential](/dotnet/api/overview/azure/identity-readme#defaultazurecredential) or [ManagedIdentityCredential](/dotnet/api/azure.identity.managedidentitycredential) to configure your SignalR endpoints. However, the best practice is to use `ManagedIdentityCredential` directly.

+The system-assigned managed identity is used by default, but **make sure that you don't configure any environment variables** that the [EnvironmentCredential](/dotnet/api/azure.identity.environmentcredential) preserved if you were using `DefaultAzureCredential`. Otherwise it falls back to use `EnvironmentCredential` to make the request and it results to a `Unauthorized` response in most cases.

+If you only configure the service URI, then the `DefaultAzureCredential` is used. This class is useful when you want to share the same configuration on Azure and local development environments. To learn how `DefaultAzureCredential` works, see [DefaultAzureCredential](/dotnet/api/overview/azure/identity-readme#defaultazurecredential).

+In the Azure portal, use the following example to configure a `DefaultAzureCredential`. If you don't configure any [environment variables listed here](/dotnet/api/overview/azure/identity-readme#environment-variables), then the system-assigned identity is used to authenticate.

+Here's a config sample of `DefaultAzureCredential` in the `local.settings.json` file. At the local scope there's no managed identity, and the authentication via Visual Studio, Azure CLI, and Azure PowerShell accounts are attempted in order.

+If you want to use system-assigned identity independently and without the influence of [other environment variables](/dotnet/api/overview/azure/identity-readme#environment-variables), you should set the `credential` key with the connection name prefix to `managedidentity`. Here's an application settings sample:

+If you want to use user-assigned identity, you need to assign `clientId`in addition to the `serviceUri` and `credential` keys with the connection name prefix. Here's the application settings sample:

+ Title: Rotate access keys for Azure SignalR Service

+# Rotate access keys for Azure SignalR Service

+For security reasons and compliance requirements, it's important to routinely rotate your access keys. This article describes how to rotate access keys for Azure SignalR Service.

+Each Azure SignalR Service instance has a primary and a secondary key. They're used to authenticate SignalR clients when requests are made to the service. The keys are associated with the instance endpoint URL. Keep your keys secure, and rotate them regularly. You're provided with two access keys so that you can maintain connections by using one key while regenerating the other.

+1. Go to your SignalR instance in the [Azure portal](https://portal.azure.com/).

+1. Select **Keys** on the left side menu.

+A new key and corresponding connection string are created and displayed.

+The Azure SignalR Service can enforce a mandatory access key regeneration under certain situations. The service notifies customers of mandatory key regeneration via email and portal notification. If you receive this communication or encounter service failure due to an access key, rotate the keys by following the instructions in this guide.

+> [Azure SignalR Service authentication](./signalr-concept-authenticate-oauth.md)

+# Scale SignalR Service with multiple instances

+### Add multiple endpoints from config

+Configure with key `Azure:SignalR:ConnectionString` or `Azure:SignalR:ConnectionString:` for SignalR Service connection string.

+If the key starts with `Azure:SignalR:ConnectionString:`, it should be in the format `Azure:SignalR:ConnectionString:{Name}:{EndpointType}`, where `Name` and `EndpointType` are properties of the `ServiceEndpoint` object, and are accessible from code.

+### Add multiple endpoints from code

+A `ServicEndpoint` class describes the properties of an Azure SignalR Service endpoint.

+### Customize endpoint router

+1. Client request routing:

+2. Server message routing:

+ When sending a message to a specific *connection* and the target connection is routed to the current server, the message goes directly to that connected endpoint. Otherwise, the messages are broadcasted to every Azure SignalR endpoint.

+The following example defines a custom router that routes messages with a group starting with `east-` to the endpoint named `east`:

+The following example overrides the default negotiate behavior and selects the endpoint depending on the location of the app server.

+{ public override ServiceEndpoint GetNegotiateEndpoint(HttpContext context, IEnumerable<ServiceEndpoint> endpoints)

+### Add multiple endpoints from config

+Configuration with key `Azure:SignalR:ConnectionString` or `Azure:SignalR:ConnectionString:` for SignalR Service connection string.

+### Add multiple endpoints from code

+A `ServiceEndpoint` class describes the properties of an Azure SignalR Service endpoint.

+ // Note: this is just a demonstration of how to set options. Endpoints

+ // Having ConnectionStrings explicitly set inside the code is not encouraged.

+### Customize a router

+The following code is a custom negotiate example for ASP.NET SignalR:

+To enable an advanced router, SignalR server SDK provides multiple metrics to help server make smart decisions. The properties are under `ServiceEndpoint.EndpointMetrics`.

+|--|--|

+| `ClientConnectionCount` | Total count of concurrent client connections on all hubs for the service endpoint |

+| `ServerConnectionCount` | Total count of concurrent server connections on all hubs for the service endpoint |

+The following code is an example of customizing a router according to `ClientConnectionCount`.

+> Considering the time of connection set-up between server/service and client/service may be different, to ensure no message loss during the scale process, we have a staging period waiting for server connections to be ready before opening the new ServiceEndpoint to clients. Usually it takes seconds to complete and you'll be able to see a log message like `Succeed in adding endpoint: '{endpoint}'` which indicates the process complete.

+>

+> In some expected situations, like cross-region network issues or configuration inconsistencies on different app servers, the staging period may not finish correctly. In these cases, it's suggested to restart the app server when you find the scaling process not working correctly.

+>

+> The default timeout period for the scale is 5 minutes, and it can be customized by changing the value in `ServiceOptions.ServiceScaleTimeout`. If you have a lot of app servers, it's suggested to extend the value a little bit more.

+Primary endpoints are preferred endpoints to receive client traffic because they've have more reliable network connections. Secondary endpoints have less reliable network connections and are used only for server to client traffic. For example, secondary endpoints are used for broadcasting messages instead of client to server traffic.

+In cross-region cases, the network can be unstable. For an app server located in *East US*, the SignalR Service endpoint located in the same *East US* region is `primary` and endpoints in other regions marked as `secondary`. In this configuration, service endpoints in other regions can **receive** messages from this *East US* app server, but no **cross-region** clients are routed to this app server. The following diagram shows the architecture:

+When a client tries `/negotiate` with the app server with a default router, the SDK **randomly selects** one endpoint from the set of available `primary` endpoints. When the primary endpoint isn't available, the SDK then **randomly selects** from all available `secondary` endpoints. The endpoint is marked as **available** when the connection between server and the service endpoint is alive.

+In a cross-region scenario, when a client tries `/negotiate` with the app server hosted in *East US*, by default it always returns the `primary` endpoint located in the same region. When all *East US* endpoints aren't available, the router redirects the client to endpoints in other regions. The following [failover](#failover) section describes the scenario in detail.

+## Failover

+When no `primary` endpoint is available, the client's `/negotiate` picks from the available `secondary` endpoints. This failover mechanism requires that each endpoint serves as a `primary` endpoint to at least one app server.

+

+You can use multiple endpoints in high availability and disaster recovery scenarios.

+In addition to the classic client-server pattern, Azure SignalR Service provides a set of REST APIs so that you can easily integrate real-time functionality into your serverless architecture.

+## Typical serverless Architecture with Azure Functions

+The following diagram shows a typical serverless architecture using Azure SignalR Service with Azure Functions.

+- The `negotiate` function returns a negotiation response and redirects all clients to SignalR Service.

+- The `broadcast` function calls SignalR Service's REST API. The SignalR Service broadcasts the message to all connected clients.

+In a serverless architecture, clients still have persistent connections to the SignalR Service.

+SignalR Service disconnects any client that sends messages because it's an invalid operation.

+The following table shows all supported versions of REST API. You can also find the swagger file for each version of REST API.

+The available APIs are listed as following.

+| - | - |

+| [Broadcast a message to all clients connected to target hub.](./swagger/signalr-data-plane-rest-v1.md#broadcast-a-message-to-all-clients-connected-to-target-hub) | `POST /api/v1/hubs/{hub}` |

+| [Broadcast a message to all clients belong to the target user.](./swagger/signalr-data-plane-rest-v1.md#broadcast-a-message-to-all-clients-belong-to-the-target-user) | `POST /api/v1/hubs/{hub}/users/{id}` |

+| [Send message to the specific connection.](./swagger/signalr-data-plane-rest-v1.md#send-message-to-the-specific-connection) | `POST /api/v1/hubs/{hub}/connections/{connectionId}` |

+| [Check if the connection with the given connectionId exists.](./swagger/signalr-data-plane-rest-v1.md#check-if-the-connection-with-the-given-connectionid-exists) | `GET /api/v1/hubs/{hub}/connections/{connectionId}` |

+| [Close the client connection.](./swagger/signalr-data-plane-rest-v1.md#close-the-client-connection) | `DELETE /api/v1/hubs/{hub}/connections/{connectionId}` |

+| [Broadcast a message to all clients within the target group.](./swagger/signalr-data-plane-rest-v1.md#broadcast-a-message-to-all-clients-within-the-target-group) | `POST /api/v1/hubs/{hub}/groups/{group}` |

+| [Check if there are any client connections inside the given group.](./swagger/signalr-data-plane-rest-v1.md#check-if-there-are-any-client-connections-inside-the-given-group) | `GET /api/v1/hubs/{hub}/groups/{group}` |

+| [Check if there are any client connections connected for the given user.](./swagger/signalr-data-plane-rest-v1.md#check-if-there-are-any-client-connections-connected-for-the-given-user) | `GET /api/v1/hubs/{hub}/users/{user}` |

+| [Add a connection to the target group.](./swagger/signalr-data-plane-rest-v1.md#add-a-connection-to-the-target-group) | `PUT /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` |

+| [Remove a connection from the target group.](./swagger/signalr-data-plane-rest-v1.md#remove-a-connection-from-the-target-group) | `DELETE /api/v1/hubs/{hub}/groups/{group}/connections/{connectionId}` |

+| [Check whether a user exists in the target group.](./swagger/signalr-data-plane-rest-v1.md#check-whether-a-user-exists-in-the-target-group) | `GET /api/v1/hubs/{hub}/groups/{group}/users/{user}` |

+| [Add a user to the target group.](./swagger/signalr-data-plane-rest-v1.md#add-a-user-to-the-target-group) | `PUT /api/v1/hubs/{hub}/groups/{group}/users/{user}` |

+| [Remove a user from the target group.](./swagger/signalr-data-plane-rest-v1.md#remove-a-user-from-the-target-group) | `DELETE /api/v1/hubs/{hub}/groups/{group}/users/{user}` |

+| [Remove a user from all groups.](./swagger/signalr-data-plane-rest-v1.md#remove-a-user-from-all-groups) | `DELETE /api/v1/hubs/{hub}/users/{user}/groups` |

+`aud` | true | Needs to be the same as your HTTP request URL, trailing slash and query parameters not included. For example, a broadcast request's audience should look like: `https://example.service.signalr.net/api/v1/hubs/myhub`.

+The difference is, in this scenario, the JWT Token is generated by Azure Active Directory. For more information, see [Learn how to generate Azure AD Tokens](../active-directory/develop/reference-v2-libraries.md)

+You could also use **Role Based Access Control (RBAC)** to authorize the request from your client/server to SignalR Service. For more information, see [Authorize access with Azure Active Directory for Azure SignalR Service](./signalr-concept-authorize-azure-active-directory.md)

+As shown in the [architecture section](#serverless), you should implement a `negotiate` function that returns a redirect negotiation response so that clients can connect to the service.

+The `accessToken` is generated using the same algorithm described in the [authentication section](#authenticate-via-azure-signalr-service-accesskey). The only difference is the `aud` claim should be the same as `url`.

+You should host your negotiate API in `https://<hub_url>/negotiate` so you can still use SignalR client to connect to the hub url. Read more about redirecting client to Azure SignalR Service at [here](./signalr-concept-internals.md#client-connections).

+In order to the call user-related REST API, each of your clients should identify themselves to SignalR Service. Otherwise SignalR Service can't find target connections from a given user ID.

+Then SignalR Service uses the value of `nameid` claim as the user ID of each client connection.

+If you want to send messages larger than 1 MB, use the Management SDK with `persistent` mode.

+Thoroughly review [Before you begin](#before-you-begin) and [Prerequisites](#prerequisites) first. Then, we'll walk you through the two typical deployment topologies:

+> [!NOTE]

+>- If you've existing custom Azure Resource Graph (ARG) queries written on classic alerts data, you'll need to update these queries to fetch information from Azure Monitor-based alerts. You can use the *AlertsManagementResources* table in ARG to query Azure Monitor alerts data.

+>- If you send classic alerts to Log Analytics workspace/Storage account/Event Hub via diagnostics settings, you'll also need to update these automation. To send the fired Azure Monitor based alerts to a destination of your choice, you can create an alert processing rule and action group that routes these alerts to a logic app, webhook, or runbook that in turn sends these alerts to the required destination.

+For certain scenarios, you might want to suppress notifications for a particular window of time when backups are going to fail. This is especially important for database backups, where log backups could happen as frequently as every 15 minutes, and you don't want to receive a separate notification every 15 minutes for each failure occurrence. In such a scenario, you can create a second alert processing rule that exists alongside the main alert processing rule used for sending notifications. The second alert processing rule won't be linked to an action group, but is used to specify the time for notification types that should be suppressed.

+ You can also select more granular filters if you want to suppress notifications only for a particular backup item. For example, if you want to suppress notifications for *testdb1* database in the Virtual Machine *VM1*, you can specify filters "where Alert Context (payload) contains `/subscriptions/00000000-0000-0000-0000-0000000000000/resourceGroups/testRG/providers/Microsoft.Compute/virtualMachines/VM1/providers/Microsoft.RecoveryServices/backupProtectedItem/SQLDataBase;MSSQLSERVER;testdb1`".

+Learn more about [Azure Backup monitoring and reporting](monitoring-and-alerts-overview.md).

+ Title: Copy a custom model

+description: This article explains how to copy a custom model to another workspace using the Azure Cognitive Services Custom Translator.

+# Copy a custom model

+Copying a model to other workspaces enables model lifecycle management (for example, development → test → production) and increases usage scalability while reducing the training cost.

+## Copy model to another workspace

+ > [!Note]

+ >

+ > To copy model from one workspace to another, you must have an **Owner** role in both workspaces.

+ >

+ > The copied model cannot be recopied. You can only rename, delete, or publish a copied model.

+1. After successful model training, select the **Model details** blade.

+1. Select the **Model Name** to copy.

+1. Select **Copy to workspace**.

+1. Fill out the target details.

+1. Select **Copy model**.

+1. A notification panel shows the copy progress. The process should complete fairly quickly:

+1. Complete the **workspace**, **project**, and **model name** sections of the copy model dialog window:

+ :::image type="content" source="../media/how-to/copy-model-1.png" alt-text="Screenshot illustrating the copy model dialog window.":::

+1. A **notifications** window displays the copy process status:

+ :::image type="content" source="../media/how-to/copy-model-2.png" alt-text="Screenshot illustrating notification that the copy model is in process.":::

+1. A **model details** window appears when the copy process is complete.

+ :::image type="content" source="../media/how-to/copy-model-3.png" alt-text="Screenshot illustrating the copy complete dialog window.":::

+ > [!Note]

+ >

+ > A dropdown list displays the list of workspaces available to use. Otherwise, click **Create a new workspace**.

+ > If selected workspace contains a project for the same language pair, it can be selected from the Project dropdown list, otherwise, click **Create a new project** to create one.

+1. After **Copy model** completion, a copied model is available in the target workspace and ready to publish. A **Copied model** watermark is appended to the model name.

+## Next steps

+> [!div class="nextstepaction"]

+> [Learn how to publish/deploy a custom model](publish-model.md).

+ Title: "Platform upgrade - Custom Translator"

+description: Custom Translator v1.0 upgrade

+# Custom Translator platform upgrade

+> [!CAUTION]

+>

+> On June 02, 2023, Microsoft will retire the Custom Translator v1.0 model platform. Existing v1.0 models must migrate to the v2.0 platform for continued processing and support.

+Following measured and consistent high-quality results using models trained on the Custom Translator v2.0 platform, the v1.0 platform will be retired. Custom Translator v2.0 delivers significant improvements in many domains compared to both standard and Custom v1.0 platform translations. Migrate your v1.0 models to the v2.0 platform by June 02, 2023.

+## Custom Translator v1.0 upgrade timeline

+* **May 01, 2023** → Custom Translator v1.0 model publishing ends. There's no downtime during the v1.0 model migration. All model publishing and in-flight translation requests will continue without disruption until June 02, 2023.

+* **May 01, 2023 through June 02, 2023** → Customers voluntarily migrate to v2.0 models.

+* **June 08, 2023** → Remaining v1.0 published models migrate automatically and are published by the Custom Translator team.

+## Upgrade to v2.0

+* **Check to see if you have published v1.0 models**. After signing in to the Custom Translator portal, you'll see a message indicating that you have v1.0 models to upgrade. You can also check to see if a current workspace has v1.0 models by selecting **Workspace settings** and scrolling to the bottom of the page.

+* **Use the upgrade wizard**. Follow the steps listed in **Upgrade to the latest version** wizard. Depending on your training data size, it may take from a few hours to a full day to upgrade your models to the v2.0 platform.

+## Unpublished and opt-out published models

+* For unpublished models, save the model data (training, testing, dictionary) and delete the project.

+* For published models that you don't want to upgrade, save your model data (training, testing, dictionary), unpublish the model, and delete the project.

+## Next steps

+For more support, visit [Azure Cognitive Services support and help options](../../cognitive-services-support-options.md).

+- Azure OpenAI

+| Named Entity Recognition (NER) | `2021-06-01*`, `2022-10-01-preview`, `2023-02-01-preview**` |

+* New model version ('2023-01-01-preview') for Text Analytics for health featuring new [entity categories](./text-analytics-for-health/concepts/health-entity-categories.md) for social determinants of health.

+* New model version ('2023-02-01-preview') for named entity recognition features improved accuracy.

+ Title: 'Quickstart: Deploy your first container app with containerapp up'

+description: Deploy your first application to Azure Container Apps using the Azure CLI containerapp up command.

+# Quickstart: Deploy your first container app with containerapp up

+In this quickstart, you create and deploy your first container app using the `az containerapp up` command.

+## Setup

+To sign in to Azure from the CLI, run the following command and follow the prompts to complete the authentication process.

+# [Bash](#tab/bash)

+az login

+az login

+Ensure you're running the latest version of the CLI via the upgrade command.

+# [Bash](#tab/bash)

+```azurecli

+az upgrade

+```

+# [Azure PowerShell](#tab/azure-powershell)

+az upgrade

+Next, install or update the Azure Container Apps extension for the CLI.

+az extension add --name containerapp --upgrade

+az extension add --name containerapp --upgrade

+Register the `Microsoft.App` and `Microsoft.OperationalInsights` namespaces if you haven't already registered them in your Azure subscription.

+```azurecli

+az provider register --namespace Microsoft.App

+```

+```azurecli

+az provider register --namespace Microsoft.OperationalInsights

+```

+# [Azure PowerShell](#tab/azure-powershell)

+az provider register --namespace Microsoft.App

+```azurepowershell

+az provider register --namespace Microsoft.OperationalInsights

+```

+Now that your Azure CLI setup is complete, you can define the environment variables that are used throughout this article.

+## Create and deploy the container app

+Create and deploy your first container app with the `containerapp up` command. This command will:

+- Create the resource group

+- Create the Container Apps environment

+- Create the Log Analytics workspace

+- Create and deploy the container app using a public container image

+Note that if any of these resources already exist, the command will use them instead of creating new ones.

+az containerapp up \

+ --name my-container-app \

+ --resource-group my-container-apps \

+ --location centralus \

+ --environment 'my-container-apps' \

+ --image mcr.microsoft.com/azuredocs/containerapps-helloworld:latest \

+ --target-port 80 \

+ --ingress external \

+ --query properties.configuration.ingress.fqdn

+```powershell

+az containerapp up `

+ --name my-container-app `

+ --resource-group my-container-apps `

+ --location centralus `

+ --environment my-container-apps `

+ --image mcr.microsoft.com/azuredocs/containerapps-helloworld:latest `

+ --target-port 80 `

+ --ingress external `

+ --query properties.configuration.ingress.fqdn

+> [!NOTE]

+> Make sure the value for the `--image` parameter is in lower case.

+By setting `--ingress` to `external`, you make the container app available to public requests.

+## Verify deployment

+The `up` command returns the fully qualified domain name for the container app. Copy this location to a web browser.

+The following message is displayed when the container app is deployed:

+## Clean up resources

+If you're not going to continue to use this application, run the following command to delete the resource group along with all the resources created in this quickstart.

+>[!CAUTION]

+> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this quickstart exist in the specified resource group, they will also be deleted.

+```azurecli

+az group delete --name my-container-apps

+```

+ Title: "Quickstart: Build and deploy your app from a repository to Azure Container Apps"

+description: Build your container app from a local or GitHub source repository and deploy in Azure Container Apps using az containerapp up.

+zone_pivot_groups: container-apps-image-build-from-repo

+# Quickstart: Build and deploy your container app from a repository in Azure Container Apps

+In this quickstart, you create a backend web API service that returns a static collection of music albums. After completing this quickstart, you can continue to [Tutorial: Communication between microservices in Azure Container Apps](communicate-between-microservices.md) to learn how to deploy a front end application that calls the API.

+> [!NOTE]

+> You can also build and deploy this sample application using the `az containerapp up` command. For more information, see [Tutorial: Build and deploy your app to Azure Container Apps](tutorial-code-to-cloud.md).

+The following screenshot shows the output from the album API service you deploy.

+To complete this project, you need the following items:

+| GitHub Account | Get one for [free](https://github.com/join). |

+| Azure account | If you don't have one, [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). You need the *Contributor* or *Owner* permission on the Azure subscription to proceed. <br><br>Refer to [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md?tabs=current) for details. |

+| GitHub Account | Get one for [free](https://github.com/join). |

+## Setup

+To sign in to Azure from the CLI, run the following command and follow the prompts to complete the authentication process.

+# [Bash](#tab/bash)

+```azurecli

+az login

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+az login

+Ensure you're running the latest version of the CLI via the upgrade command.

+# [Bash](#tab/bash)

+```azurecli

+az upgrade

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+az upgrade

+Next, install or update the Azure Container Apps extension for the CLI.

+az extension add --name containerapp --upgrade

+az extension add --name containerapp --upgrade

+Register the `Microsoft.App` and `Microsoft.OperationalInsights` namespaces if you haven't already registered them in your Azure subscription.

+az provider register --namespace Microsoft.App

+```

+```azurecli

+az provider register --namespace Microsoft.OperationalInsights

+az provider register --namespace Microsoft.App

+```

+```azurepowershell

+az provider register --namespace Microsoft.OperationalInsights

+Now that your Azure CLI setup is complete, you can define the environment variables that are used throughout this article.

+# [Bash](#tab/bash)

+Define the following variables in your bash shell.

+```azurecli

+RESOURCE_GROUP="album-containerapps"

+LOCATION="canadacentral"

+ENVIRONMENT="env-album-containerapps"

+API_NAME="album-api"

+FRONTEND_NAME="album-ui"

+GITHUB_USERNAME="<YOUR_GITHUB_USERNAME>"

+```

+Before you run this command, make sure to replace `<YOUR_GITHUB_USERNAME>` with your GitHub username.

+Next, define a container registry name unique to you.

+ACR_NAME="acaalbums"$GITHUB_USERNAME

+Define the following variables in your PowerShell console.

+```powershell

+$RESOURCE_GROUP="album-containerapps"

+$LOCATION="canadacentral"

+$ENVIRONMENT="env-album-containerapps"

+$API_NAME="album-api"

+$FRONTEND_NAME="album-ui"

+$GITHUB_USERNAME="<YOUR_GITHUB_USERNAME>"

+```

+Before you run this command, make sure to replace `<YOUR_GITHUB_USERNAME>` with your GitHub username.

+Next, define a container registry name unique to you.

+```powershell

+$ACR_NAME="acaalbums"+$GITHUB_USERNAME

+```

+Define the following variables in your bash shell.

+RESOURCE_GROUP="album-containerapps"

+LOCATION="canadacentral"

+ENVIRONMENT="env-album-containerapps"

+API_NAME="album-api"

+Define the following variables in your PowerShell console.

+$RESOURCE_GROUP="album-containerapps"

+$LOCATION="canadacentral"

+$ENVIRONMENT="env-album-containerapps"

+$API_NAME="album-api"

+## Prepare the GitHub repository

+In a browser window, go to the GitHub repository for your preferred language and fork the repository.

+# [C#](#tab/csharp)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-csharp) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-csharp.git code-to-cloud

+# [Go](#tab/go)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-go) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-go.git code-to-cloud

+```

+# [JavaScript](#tab/javascript)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-javascript) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-javascript.git code-to-cloud

+# [Python](#tab/python)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-python) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-python.git code-to-cloud

+## Build and deploy the container app

+Build and deploy your first container app from your local git repository with the `containerapp up` command. This command will:

+- Create the resource group

+- Create an Azure Container Registry

+- Build the container image and push it to the registry

+- Create the Container Apps environment with a Log Analytics workspace

+- Create and deploy the container app using a public container image

+The `up` command uses the Docker file in the root of the repository to build the container image. The target port is defined by the EXPOSE instruction in the Docker file. A Docker file isn't required to build a container app.

+az containerapp up \

+ --location $LOCATION \

+ --source code-to-cloud/src

+# [Azure PowerShell](#tab/azure-powershell)

+```powershell

+az containerapp up `

+ --name $API_NAME `

+ --resource-group $RESOURCE_GROUP `

+ --location $LOCATION `

+ --environment $ENVIRONMENT `

+ --source code-to-cloud/src

+```

+## Build and deploy the container app

+Build and deploy your first container app from your forked GitHub repository with the `containerapp up` command. This command will:

+- Create the resource group

+- Create an Azure Container Registry

+- Build the container image and push it to the registry

+- Create the Container Apps environment with a Log Analytics workspace

+- Create and deploy the container app using a public container image

+- Create a GitHub Action workflow to build and deploy the container app

+The `up` command uses the Docker file in the root of the repository to build the container image. The target port is defined by the EXPOSE instruction in the Docker file. A Docker file isn't required to build a container app.

+Replace the `<YOUR_GITHUB_REPOSITORY_NAME>` with your GitHub repository name in the form of `https://github.com/<owner>/<repository-name>` or `<owner>/<repository-name>`.

+# [Bash](#tab/bash)

+```azurecli

+az containerapp up \

+ --name $API_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --location $LOCATION \

+ --environment $ENVIRONMENT \

+ --context-path ./src \

+ --repo <YOUR_GITHUB_REPOSITORY_NAME>

+# [Azure PowerShell](#tab/azure-powershell)

+```powershell

+az containerapp up `

+ --name $API_NAME `

+ --resource-group $RESOURCE_GROUP `

+ --location $LOCATION `

+ --environment $ENVIRONMENT `

+ --context-path ./src `

+ --repo <YOUR_GITHUB_REPOSITORY_NAME>

+Using the URL and the user code displayed in the terminal, go to the GitHub device activation page in a browser and enter the user code to the page. Follow the prompts to authorize the Azure CLI to access your GitHub repository.

+The `up` command creates a GitHub Action workflow in your repository *.github/workflows* folder. The workflow is triggered to build and deploy your container app when you push changes to the repository.

+Copy the FQDN to a web browser. From your web browser, go to the `/albums` endpoint of the FQDN.

+If you're not going to continue on to the [Deploy a frontend](communicate-between-microservices.md) tutorial, you can remove the Azure resources created during this quickstart with the following command.

+>[!CAUTION]

+> The following command deletes the specified resource group and all resources contained within it. If the group contains resources outside the scope of this quickstart, they are also deleted.

+```powershell

+az group delete --name $RESOURCE_GROUP

+ Title: "Tutorial: Build and deploy your app to Azure Container Apps"

+description: Build and deploy your app to Azure Container Apps with az containerapp create command.

+zone_pivot_groups: container-apps-image-build-type

+# Tutorial: Build and deploy your app to Azure Container Apps

+This article demonstrates how to build and deploy a microservice to Azure Container Apps from a source repository using the programming language of your choice.

+This tutorial is the first in a series of articles that walk you through how to use core capabilities within Azure Container Apps. The first step is to create a back end web API service that returns a static collection of music albums.

+> [!NOTE]

+> You can also build and deploy this app using the [az containerapp up](/cli/azure/containerapp#az_containerapp_up) by following the instructions in the [Quickstart: Build and deploy an app to Azure Container Apps from a repository](quickstart-code-to-cloud.md) article. The `az containerapp up` command is a fast and convenient way to build and deploy your app to Azure Container Apps using a single command. However, it doesn't provide the same level of customization for your container app.

+ The next tutorial in the series will build and deploy the front end web application to Azure Container Apps.

+The following screenshot shows the output from the album API deployed in this tutorial.

+## Prerequisites

+To complete this project, you need the following items:

+| Requirement | Instructions |

+|--|--|

+| Azure account | If you don't have one, [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). You need the *Contributor* or *Owner* permission on the Azure subscription to proceed. <br><br>Refer to [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md?tabs=current) for details. |

+| GitHub Account | Sign up for [free](https://github.com/join). |

+| git | [Install git](https://git-scm.com/downloads) |

+| Azure CLI | Install the [Azure CLI](/cli/azure/install-azure-cli).|

+| Requirement | Instructions |

+|--|--|

+| Azure account | If you don't have one, [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). You need the *Contributor* or *Owner* permission on the Azure subscription to proceed. Refer to [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md?tabs=current) for details. |

+| GitHub Account | Sign up for [free](https://github.com/join). |

+| git | [Install git](https://git-scm.com/downloads) |

+| Azure CLI | Install the [Azure CLI](/cli/azure/install-azure-cli).|

+| Docker Desktop | Docker provides installers that configure the Docker environment on [macOS](https://docs.docker.com/docker-for-mac/), [Windows](https://docs.docker.com/docker-for-windows/), and [Linux](https://docs.docker.com/engine/installation/#supported-platforms). <br><br>From your command prompt, type `docker` to ensure Docker is running. |

+Now that your Azure CLI setup is complete, you can define the environment variables that are used throughout this article.

+## Prepare the GitHub repository

+Navigate to the repository for your preferred language and fork the repository.

+# [C#](#tab/csharp)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-csharp) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-csharp.git code-to-cloud

+```

+# [Go](#tab/go)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-go) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-go.git code-to-cloud

+```

+# [JavaScript](#tab/javascript)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-javascript) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-javascript.git code-to-cloud

+```

+# [Python](#tab/python)

+Select the **Fork** button at the top of the [album API repo](https://github.com/azure-samples/containerapps-albumapi-python) to fork the repo to your account.

+Now you can clone your fork of the sample repository.

+Use the following git command to clone your forked repo into the *code-to-cloud* folder:

+```git

+git clone https://github.com/$GITHUB_USERNAME/containerapps-albumapi-python.git code-to-cloud

+```

+Next, change the directory into the root of the cloned repo.

+```console

+cd code-to-cloud/src

+```

+## Create an Azure resource group

+Create a resource group to organize the services related to your container app deployment.

+# [Bash](#tab/bash)

+```azurecli

+az group create \

+ --name $RESOURCE_GROUP \

+ --location "$LOCATION"

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+New-AzResourceGroup -Location $Location -Name $ResourceGroup

+```

+## Create an Azure Container Registry

+Next, create an Azure Container Registry (ACR) instance in your resource group to store the album API container image once it's built.

+# [Bash](#tab/bash)

+```azurecli

+az acr create \

+ --resource-group $RESOURCE_GROUP \

+ --name $ACR_NAME \

+ --sku Basic \

+ --admin-enabled true

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+$acr = New-AzContainerRegistry -ResourceGroupName $ResourceGroup -Name $ACRName -Sku Basic -EnableAdminUser

+```

+## Build your application

+With [ACR tasks](../container-registry/container-registry-tasks-overview.md), you can build and push the docker image for the album API without installing Docker locally.

+### Build the container with ACR

+Run the following command to initiate the image build and push process using ACR. The `.` at the end of the command represents the docker build context, meaning this command should be run within the *src* folder where the Dockerfile is located.

+# [Bash](#tab/bash)

+```azurecli

+az acr build --registry $ACR_NAME --image $API_NAME .

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+az acr build --registry $ACRName --image $APIName .

+```

+Output from the `az acr build` command shows the upload progress of the source code to Azure and the details of the `docker build` and `docker push` operations.

+## Build your application

+The following steps, demonstrate how to build your container image locally using Docker and push the image to the new container registry.

+### Build the container with Docker

+The following command builds a container image for the album API and tags it with the fully qualified name of the ACR login server. The `.` at the end of the command represents the docker build context, meaning this command should be run within the *src* folder where the Dockerfile is located.

+# [Bash](#tab/bash)

+```azurecli

+docker build --tag $ACR_NAME.azurecr.io/$API_NAME .

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```powershell

+docker build --tag "$ACRName.azurecr.io/$APIName" .

+```

+### Push the image to your container registry

+First, sign in to your Azure Container Registry.

+# [Bash](#tab/bash)

+```azurecli

+az acr login --name $ACR_NAME

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```powershell

+az acr login --name $ACRName

+```

+Now, push the image to your registry.

+# [Bash](#tab/bash)

+```azurecli

+docker push $ACR_NAME.azurecr.io/$API_NAME

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```powershell

+docker push "$ACRName.azurecr.io/$APIName"

+```

+## Create a Container Apps environment

+The Azure Container Apps environment acts as a secure boundary around a group of container apps.

+Create the Container Apps environment using the following command.

+# [Bash](#tab/bash)

+```azurecli

+az containerapp env create \

+ --name $ENVIRONMENT \

+ --resource-group $RESOURCE_GROUP \

+ --location "$LOCATION"

+```

+# [Azure PowerShell](#tab/azure-powershell)

+A Log Analytics workspace is required for the Container Apps environment. The following commands create a Log Analytics workspace and save the workspace ID and primary shared key to variables.

+```azurepowershell

+$WorkspaceArgs = @{

+ Name = 'my-album-workspace'

+ ResourceGroupName = $ResourceGroup

+ Location = $Location

+ PublicNetworkAccessForIngestion = 'Enabled'

+ PublicNetworkAccessForQuery = 'Enabled'

+}

+New-AzOperationalInsightsWorkspace @WorkspaceArgs

+$WorkspaceId = (Get-AzOperationalInsightsWorkspace -ResourceGroupName $ResourceGroup -Name $WorkspaceArgs.Name).CustomerId

+$WorkspaceSharedKey = (Get-AzOperationalInsightsWorkspaceSharedKey -ResourceGroupName $ResourceGroup -Name $WorkspaceArgs.Name).PrimarySharedKey

+```

+To create the environment, run the following command:

+```azurepowershell

+$EnvArgs = @{

+ EnvName = $Environment

+ ResourceGroupName = $ResourceGroup

+ Location = $Location

+ AppLogConfigurationDestination = 'log-analytics'

+ LogAnalyticConfigurationCustomerId = $WorkspaceId

+ LogAnalyticConfigurationSharedKey = $WorkspaceSharedKey

+}

+New-AzContainerAppManagedEnv @EnvArgs

+```

+## Deploy your image to a container app

+Now that you have an environment created, you can create and deploy your container app with the `az containerapp create` command.

+Create and deploy your container app with the following command.

+# [Bash](#tab/bash)

+```azurecli

+az containerapp create \

+ --name $API_NAME \

+ --resource-group $RESOURCE_GROUP \

+ --environment $ENVIRONMENT \

+ --image $ACR_NAME.azurecr.io/$API_NAME \

+ --target-port 3500 \

+ --ingress 'external' \

+ --registry-server $ACR_NAME.azurecr.io \

+ --query properties.configuration.ingress.fqdn

+```

+* By setting `--ingress` to `external`, your container app is accessible from the public internet.

+* The `target-port` is set to `3500` to match the port that the container is listening to for requests.

+* Without a `query` property, the call to `az containerapp create` returns a JSON response that includes a rich set of details about the application. Adding a query parameter filters the output to just the app's fully qualified domain name (FQDN).

+# [Azure PowerShell](#tab/azure-powershell)

+To create the container app, create template objects that you pass in as arguments to the `New-AzContainerApp` command.

+Create a template object to define your container image parameters.

+```azurepowershell

+$ImageParams = @{

+ Name = $APIName

+ Image = $ACRName + '.azurecr.io/' + $APIName + ':latest'

+}

+$TemplateObj = New-AzContainerAppTemplateObject @ImageParams

+```

+You need run the following command to get your registry credentials.

+```azurepowershell

+$RegistryCredentials = Get-AzContainerRegistryCredential -Name $ACRName -ResourceGroupName $ResourceGroup

+```

+Create a registry credential object to define your registry information, and a secret object to define your registry password. The `PasswordSecretRef` refers to the `Name` in the secret object.

+```azurepowershell

+$RegistryArgs = @{

+ Server = $ACRName + '.azurecr.io'

+ PasswordSecretRef = 'registrysecret'

+ Username = $RegistryCredentials.Username

+}

+$RegistryObj = New-AzContainerAppRegistryCredentialObject @RegistryArgs

+$SecretObj = New-AzContainerAppSecretObject -Name 'registrysecret' -Value $RegistryCredentials.Password

+```

+Get your environment ID.

+```azurepowershell

+$EnvId = (Get-AzContainerAppManagedEnv -EnvName $Environment -ResourceGroup $ResourceGroup).Id

+```

+Create the container app.

+```azurepowershell

+$AppArgs = @{

+ Name = $APIName

+ Location = $Location

+ ResourceGroupName = $ResourceGroup

+ ManagedEnvironmentId = $EnvId

+ TemplateContainer = $TemplateObj

+ ConfigurationRegistry = $RegistryObj

+ ConfigurationSecret = $SecretObj

+ IngressTargetPort = 3500

+ IngressExternal = $true

+}

+$MyApp = New-AzContainerApp @AppArgs

+# show the app's fully qualified domain name (FQDN).

+$MyApp.IngressFqdn

+```

+* By setting `IngressExternal` to `external`, your container app is accessible from the public internet.

+* The `IngressTargetPort` parameter is set to `3500` to match the port that the container is listening to for requests.

+## Verify deployment

+Copy the FQDN to a web browser. From your web browser, navigate to the `/albums` endpoint of the FQDN.

+## Clean up resources

+If you're not going to continue on to the [Communication between microservices](communicate-between-microservices.md) tutorial, you can remove the Azure resources created during this quickstart. Run the following command to delete the resource group along with all the resources created in this quickstart.

+# [Bash](#tab/bash)

+```azurecli

+az group delete --name $RESOURCE_GROUP

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+Remove-AzResourceGroup -Name $ResourceGroup -Force

+```

+> [!TIP]

+> Having issues? Let us know on GitHub by opening an issue in the [Azure Container Apps repo](https://github.com/microsoft/azure-container-apps).

+## Next steps

+This quickstart is the entrypoint for a set of progressive tutorials that showcase the various features within Azure Container Apps. Continue on to learn how to enable communication from a web front end that calls the API you deployed in this article.

+> [!div class="nextstepaction"]

+> [Tutorial: Communication between microservices](communicate-between-microservices.md)

+ Title: 'Tutorial: Deploy your first container app'

+description: Deploy your first application to Azure Container Apps.

+ms.devlang: azurecli

+# Tutorial: Deploy your first container app

+The Azure Container Apps service enables you to run microservices and containerized applications on a serverless platform. With Container Apps, you enjoy the benefits of running containers while you leave behind the concerns of manually configuring cloud infrastructure and complex container orchestrators.

+In this tutorial, you create a secure Container Apps environment and deploy your first container app.

+> [!NOTE]

+> You can also deploy this app using the [az containerapp up](/cli/azure/containerapp#az_containerapp_up) by following the instructions in the [Quickstart: Deploy your first container app with containerapp up](get-started.md) article. The `az containerapp up` command is a fast and convenient way to build and deploy your app to Azure Container Apps using a single command. However, it doesn't provide the same level of customization for your container app.

+## Prerequisites

+- An Azure account with an active subscription.

+ - If you don't have one, you [can create one for free](https://azure.microsoft.com/free/).

+- Install the [Azure CLI](/cli/azure/install-azure-cli).

+# [Bash](#tab/bash)

+To create the environment, run the following command:

+```azurecli

+az containerapp env create \

+ --name $CONTAINERAPPS_ENVIRONMENT \

+ --resource-group $RESOURCE_GROUP \

+ --location $LOCATION

+```

+# [Azure PowerShell](#tab/azure-powershell)

+A Log Analytics workspace is required for the Container Apps environment. The following commands create a Log Analytics workspace and save the workspace ID and primary shared key to variables.

+```azurepowershell

+$WorkspaceArgs = @{

+ Name = 'myworkspace'

+ ResourceGroupName = $ResourceGroupName

+ Location = $Location

+ PublicNetworkAccessForIngestion = 'Enabled'

+ PublicNetworkAccessForQuery = 'Enabled'

+}

+New-AzOperationalInsightsWorkspace @WorkspaceArgs

+$WorkspaceId = (Get-AzOperationalInsightsWorkspace -ResourceGroupName $ResourceGroupName -Name $WorkspaceArgs.Name).CustomerId

+$WorkspaceSharedKey = (Get-AzOperationalInsightsWorkspaceSharedKey -ResourceGroupName $ResourceGroupName -Name $WorkspaceArgs.Name).PrimarySharedKey

+```

+To create the environment, run the following command:

+```azurepowershell

+$EnvArgs = @{

+ EnvName = $ContainerAppsEnvironment

+ ResourceGroupName = $ResourceGroupName

+ Location = $Location

+ AppLogConfigurationDestination = 'log-analytics'

+ LogAnalyticConfigurationCustomerId = $WorkspaceId

+ LogAnalyticConfigurationSharedKey = $WorkspaceSharedKey

+}

+New-AzContainerAppManagedEnv @EnvArgs

+```

+## Create a container app

+Now that you have an environment created, you can deploy your first container app. With the `containerapp create` command, deploy a container image to Azure Container Apps.

+# [Bash](#tab/bash)

+```azurecli

+az containerapp create \

+ --name my-container-app \

+ --resource-group $RESOURCE_GROUP \

+ --environment $CONTAINERAPPS_ENVIRONMENT \

+ --image mcr.microsoft.com/azuredocs/containerapps-helloworld:latest \

+ --target-port 80 \

+ --ingress 'external' \

+ --query properties.configuration.ingress.fqdn

+```

+> [!NOTE]

+> Make sure the value for the `--image` parameter is in lower case.

+By setting `--ingress` to `external`, you make the container app available to public requests.

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+$ImageParams = @{

+ Name = 'my-container-app'

+ Image = 'mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'

+}

+$TemplateObj = New-AzContainerAppTemplateObject @ImageParams

+$EnvId = (Get-AzContainerAppManagedEnv -EnvName $ContainerAppsEnvironment -ResourceGroupName $ResourceGroupName).Id

+$AppArgs = @{

+ Name = 'my-container-app'

+ Location = $Location

+ ResourceGroupName = $ResourceGroupName

+ ManagedEnvironmentId = $EnvId

+ IdentityType = 'SystemAssigned'

+ TemplateContainer = $TemplateObj

+ IngressTargetPort = 80

+ IngressExternal = $true

+}

+New-AzContainerApp @AppArgs

+```

+> [!NOTE]

+> Make sure the value for the `Image` parameter is in lower case.

+By setting `IngressExternal` to `$true`, you make the container app available to public requests.

+## Verify deployment

+# [Bash](#tab/bash)

+The `create` command returns the fully qualified domain name for the container app. Copy this location to a web browser.

+# [Azure PowerShell](#tab/azure-powershell)

+Get the fully qualified domain name for the container app.

+```azurepowershell

+(Get-AzContainerApp -Name $AppArgs.Name -ResourceGroupName $ResourceGroupName).IngressFqdn

+```

+Copy this location to a web browser.

+ The following message is displayed when the container app is deployed:

+## Clean up resources

+If you're not going to continue to use this application, run the following command to delete the resource group along with all the resources created in this tutorial.

+>[!CAUTION]

+> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this tutorial exist in the specified resource group, they will also be deleted.

+# [Bash](#tab/bash)

+```azurecli

+az group delete --name $RESOURCE_GROUP

+```

+# [Azure PowerShell](#tab/azure-powershell)

+```azurepowershell

+Remove-AzResourceGroup -Name $ResourceGroupName -Force

+```

+> [!TIP]

+> Having issues? Let us know on GitHub by opening an issue in the [Azure Container Apps repo](https://github.com/microsoft/azure-container-apps).

+## Next steps

+> [!div class="nextstepaction"]

+> [Communication between microservices](communicate-between-microservices.md)

+For example :

+- If you purchase a Basic tier registry, it includes a storage of 10 GB. The price you pay here is $0.167 per day. Prices are calculated based on US dollars.

+- If you have a Basic tier registry and use 25 GB storage, you are paying $0.003/day*15 = $0.045 per day for the additional 15 GB.

+- So, the pricing for the Basic ACR with 25 GB storage is $0.167+$0.045= 0.212 USD per day with other related charges like networking, builds, etc, according to the [Pricing - Container Registry.](https://azure.microsoft.com/pricing/details/container-registry/)

+User-Assigned Identity is tied to a specified Cosmos DB account, whenever we assign a User-Assigned Identity to an account, ARM forwards the request to managed service identities to make this connection. Currently we carry over user-identity information from the source database account to the target database account during the restore (for both Continuous and Periodic backup restore) of CMK + User-Assigned Identity,

+

+Since the identity metadata is bound with the source database account and restore workflow doesn't re-scope identity to the target database account. This will cause the restored database accounts to be in a bad state, and become inaccessible after the source account is deleted and identityΓÇÖs renew time is expired.

+Here's an example diagram showing how a tag is inherited.

+### To enable tag inheritance in the Azure portal for an EA billing account

+1. Select a scope.

+1. In the left menu under **Settings**, select **Manage billing account**.

+1. Under **Tag inheritance**, select **Edit**.

+ :::image type="content" source="./media/enable-tag-inheritance/edit-tag-inheritance.png" alt-text="Screenshot showing the Edit option for Tag inheritance for an EA billing account." lightbox="./media/enable-tag-inheritance/edit-tag-inheritance.png" :::

+1. In the Tag inheritance (Preview) window, select **Automatically apply subscription and resource group tags to new data**.

+ :::image type="content" source="./media/enable-tag-inheritance/automatically-apply-tags-new-usage-data.png" alt-text="Screenshot showing the Automatically apply subscription and resource group tags to new data option for a billing account." lightbox="./media/enable-tag-inheritance/automatically-apply-tags-new-usage-data.png":::

+### To enable tag inheritance in the Azure portal for an MCA billing profile

+1. In the Azure portal, search for **Cost Management** and select it (the green hexagon-shaped symbol, *not* Cost Management + Billing).

+1. Select a scope.

+1. In the left menu under **Settings**, select **Manage billing profile**.

+1. Under **Tag inheritance**, select **Edit**.

+ :::image type="content" source="./media/enable-tag-inheritance/edit-tag-inheritance-billing-profile.png" alt-text="Screenshot showing the Edit option for Tag inheritance for an MCA billing profile." lightbox="./media/enable-tag-inheritance/edit-tag-inheritance-billing-profile.png":::

+1. In the Tag inheritance (Preview) window, select **Automatically apply subscription and resource group tags to new data**.

+ :::image type="content" source="./media/enable-tag-inheritance/automatically-apply-tags-new-usage-data-billing-profile.png" alt-text="Screenshot showing the Automatically apply subscription and resource group tags to new data option for a billing profile." lightbox="./media/enable-tag-inheritance/automatically-apply-tags-new-usage-data-billing-profile.png":::

+### To enable tag inheritance in the Azure portal for a subscription

+1. In the Azure portal, search for **Cost Management** and select it (the green hexagon-shaped symbol, *not* Cost Management + Billing).

+1. Select a subscription scope.

+1. In the left menu under **Settings**, select **Manage subscription**.

+1. Under **Tag inheritance**, select **Edit**.

+ :::image type="content" source="./media/enable-tag-inheritance/edit-tag-inheritance-subscription.png" alt-text="Screenshot showing the Edit option for Tag inheritance for a subscription." lightbox="./media/enable-tag-inheritance/edit-tag-inheritance-subscription.png":::

+1. In the Tag inheritance (Preview) window, select **Automatically apply subscription and resource group tags to new data**.

+ :::image type="content" source="./media/enable-tag-inheritance/automatically-apply-tags-new-usage-data-subscription.png" alt-text="Screenshot showing the Automatically apply subscription and resource group tags to new data option for a subscription." lightbox="./media/enable-tag-inheritance/automatically-apply-tags-new-usage-data-subscription.png":::

+ Title: Copy and transform data in Azure Cosmos DB analytical store

+description: Learn how to transform data in Azure Cosmos DB analytical store using Azure Data Factory and Azure Synapse Analytics.

+# Copy and transform data in Azure Cosmos DB analytical store by using Azure Data Factory

+> [!div class="op_single_selector" title1="Select the version of Data Factory service you are using:"]

+> * [Current version](connector-azure-cosmos-analytical-store.md)

+This article outlines how to use Data Flow to transform data in Azure Cosmos DB analytical store. To learn more, read the introductory articles for [Azure Data Factory](introduction.md) and [Azure Synapse Analytics](../synapse-analytics/overview-what-is.md).

+>[!NOTE]

+>The Azure Cosmos DB analytical store connector supports [change data capture](concepts-change-data-capture.md) Azure Cosmos DB API for NoSQL and Azure Cosmos DB API for Mongo DB, currently in public preview.

+## Supported capabilities

+This Azure Cosmos DB for NoSQL connector is supported for the following capabilities:

+| Supported capabilities|IR | Managed private endpoint|

+|| --| --|

+|[Mapping data flow](concepts-data-flow-overview.md) (source/sink)|&#9312; |Γ£ô |

+<small>*&#9312; Azure integration runtime &#9313; Self-hosted integration runtime*</small>

+## Mapping data flow properties

+When transforming data in mapping data flow, you can read and write to collections in Azure Cosmos DB. For more information, see the [source transformation](data-flow-source.md) and [sink transformation](data-flow-sink.md) in mapping data flows.

+> [!Note]

+> The Azure Cosmos DB analytical store is found with the [Azure Cosmos DB for NoSQL](connector-azure-cosmos-db.md) dataset type.

+### Source transformation

+Settings specific to Azure Cosmos DB are available in the **Source Options** tab of the source transformation.

+**Include system columns:** If true, ```id```, ```_ts```, and other system columns will be included in your data flow metadata from Azure Cosmos DB. When updating collections, it is important to include this so that you can grab the existing row ID.

+**Page size:** The number of documents per page of the query result. Default is "-1" which uses the service dynamic page up to 1000.

+**Throughput:** Set an optional value for the number of RUs you'd like to apply to your Azure Cosmos DB collection for each execution of this data flow during the read operation. Minimum is 400.

+**Preferred regions:** Choose the preferred read regions for this process.

+**Change feed:** If true, you will get data from [Azure Cosmos DB change feed](../cosmos-db/change-feed.md) which is a persistent record of changes to a container in the order they occur from last run automatically. When you set it true, do not set both **Infer drifted column types** and **Allow schema drift** as true at the same time. For more details, see [Azure Cosmos DB change feed](#azure-cosmos-db-change-feed).

+**Start from beginning:** If true, you will get initial load of full snapshot data in the first run, followed by capturing changed data in next runs. If false, the initial load will be skipped in the first run, followed by capturing changed data in next runs. The setting is aligned with the same setting name in [Azure Cosmos DB reference](https://github.com/Azure/azure-cosmosdb-spark/wiki/Configuration-references#reading-cosmosdb-collection-change-feed). For more details, see [Azure Cosmos DB change feed](#azure-cosmos-db-change-feed).

+### Sink transformation

+Settings specific to Azure Cosmos DB are available in the **Settings** tab of the sink transformation.

+**Update method:** Determines what operations are allowed on your database destination. The default is to only allow inserts. To update, upsert, or delete rows, an alter-row transformation is required to tag rows for those actions. For updates, upserts and deletes, a key column or columns must be set to determine which row to alter.

+**Collection action:** Determines whether to recreate the destination collection prior to writing.

+* None: No action will be done to the collection.

+* Recreate: The collection will get dropped and recreated

+**Batch size**: An integer that represents how many objects are being written to Azure Cosmos DB collection in each batch. Usually, starting with the default batch size is sufficient. To further tune this value, note:

+- Azure Cosmos DB limits single request's size to 2MB. The formula is "Request Size = Single Document Size * Batch Size". If you hit error saying "Request size is too large", reduce the batch size value.

+- The larger the batch size, the better throughput the service can achieve, while make sure you allocate enough RUs to empower your workload.

+**Partition key:** Enter a string that represents the partition key for your collection. Example: ```/movies/title```

+**Throughput:** Set an optional value for the number of RUs you'd like to apply to your Azure Cosmos DB collection for each execution of this data flow. Minimum is 400.

+**Write throughput budget:** An integer that represents the RUs you want to allocate for this Data Flow write operation, out of the total throughput allocated to the collection.

+## Azure Cosmos DB change feed

+Azure Data Factory can get data from [Azure Cosmos DB change feed](../cosmos-db/change-feed.md) by enabling it in the mapping data flow source transformation. With this connector option, you can read change feeds and apply transformations before loading transformed data into destination datasets of your choice. You do not have to use Azure functions to read the change feed and then write custom transformations. You can use this option to move data from one container to another, prepare change feed driven material views for fit purpose or automate container backup or recovery based on change feed, and enable many more such use cases using visual drag and drop capability of Azure Data Factory.

+Make sure you keep the pipeline and activity name unchanged, so that the checkpoint can be recorded by ADF for you to get changed data from the last run automatically. If you change your pipeline name or activity name, the checkpoint will be reset, which leads you to start from beginning or get changes from now in the next run.

+When you debug the pipeline, this feature works the same. Be aware that the checkpoint will be reset when you refresh your browser during the debug run. After you are satisfied with the pipeline result from debug run, you can go ahead to publish and trigger the pipeline. At the moment when you first time trigger your published pipeline, it automatically restarts from the beginning or gets changes from now on.

+In the monitoring section, you always have the chance to rerun a pipeline. When you are doing so, the changed data is always captured from the previous checkpoint of your selected pipeline run.

+In addition, Azure Cosmos DB analytical store now supports Change Data Capture (CDC) for Azure Cosmos DB API for NoSQL and Azure Cosmos DB API for Mongo DB (public preview). Azure Cosmos DB analytical store allows you to efficiently consume a continuous and incremental feed of changed (inserted, updated, and deleted) data from analytical store.

+## Next steps

+Get started with [change data capture in Azure Cosmos DB analytical store ](../cosmos-db/get-started-change-data-capture.md).

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+| <*format*> | No | String | Either a [single format specifier](/dotnet/standard/base-types/standard-date-and-time-format-strings) or a [custom format pattern](/dotnet/standard/base-types/custom-date-and-time-format-strings). The default format for the timestamp is ["o"](/dotnet/standard/base-types/standard-date-and-time-format-strings) (yyyy-MM-ddTHH:mm:ss.fffffffK), which complies with [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) and preserves time zone information. |

+## Prerequisites

+[Create a virtual network](../virtual-network/quick-create-portal.md) in the same subscription as the Azure Data Manager for Agriculture Preview instance. This virtual network will allow automatic approval of the Private Link endpoint.

+ Title: Azure Stack Edge 2303 release notes

+description: Describes critical open issues and resolutions for the Azure Stack Edge running 2303 release.

+

+# Azure Stack Edge 2303 release notes

+The following release notes identify the critical open issues and the resolved issues for the 2303 release for your Azure Stack Edge devices. Features and issues that correspond to a specific model of Azure Stack Edge are called out wherever applicable.

+The release notes are continuously updated, and as critical issues requiring a workaround are discovered, they're added. Before you deploy your device, carefully review the information contained in the release notes.

+This article applies to the **Azure Stack Edge 2303** release, which maps to software version **2.2.2257.1113**.

+## Supported update paths

+This software can be applied to your device if you're running **Azure Stack Edge 2207 or later** (2.2.2026.5318).

+You can update to the latest version using the following update paths:

+| Current version | Update to | Then apply |

+| --| --| --|

+|2205 and earlier |2207 |2303

+|2207 and later |2303 |

+## What's new

+The 2303 release has the following new features and enhancements:

+- Starting March 2023, Azure Stack Edge devices are required to be on the 2301 release or later to create a Kubernetes cluster. In preparation for this requirement, it is highly recommended that you update to the latest version as soon as possible.

+- You can deploy Azure Kubernetes service (AKS) on an Azure Stack Edge cluster. This feature is supported only for SAP and PMEC customers. For more information, see [Deploy AKS on Azure Stack Edge](azure-stack-edge-deploy-aks-on-azure-stack-edge.md).

+## Issues fixed in this release

+| No. | Feature | Issue |

+| | | |

+|**1.**|Core Azure Stack Edge platform and Azure Kubernetes Service (AKS) on Azure Stack Edge |Critical bug fixes to improve workload availability during two-node Azure Stack Edge update of core Azure Stack Edge platform and AKS on Azure Stack Edge. |

+<!--## Known issues in this release

+| No. | Feature | Issue | Workaround/comments |

+| | | | |

+|**1.**|Need known issues in 2303 |-->

+## Known issues from previous releases

+The following table provides a summary of known issues carried over from the previous releases.

+| No. | Feature | Issue | Workaround/comments |

+| | | | |

+| **1.** |Azure Stack Edge Pro + Azure SQL | Creating SQL database requires Administrator access. |Do the following steps instead of Steps 1-2 in [Create-the-sql-database](../iot-edge/tutorial-store-data-sql-server.md#create-the-sql-database). <br> 1. In the local UI of your device, enable compute interface. Select **Compute > Port # > Enable for compute > Apply.**<br> 2. Download `sqlcmd` on your client machine from [SQL command utility](/sql/tools/sqlcmd-utility). <br> 3. Connect to your compute interface IP address (the port that was enabled), adding a ",1401" to the end of the address.<br> 4. Final command will look like this: sqlcmd -S {Interface IP},1401 -U SA -P "Strong!Passw0rd". After this, steps 3-4 from the current documentation should be identical. |

+| **2.** |Refresh| Incremental changes to blobs restored via **Refresh** are NOT supported |For Blob endpoints, partial updates of blobs after a Refresh, may result in the updates not getting uploaded to the cloud. For example, sequence of actions such as:<br> 1. Create blob in cloud. Or delete a previously uploaded blob from the device.<br> 2. Refresh blob from the cloud into the appliance using the refresh functionality.<br> 3. Update only a portion of the blob using Azure SDK REST APIs. These actions can result in the updated sections of the blob to not get updated in the cloud. <br>**Workaround**: Use tools such as robocopy, or regular file copy through Explorer or command line, to replace entire blobs.|

+|**3.**|Throttling|During throttling, if new writes to the device aren't allowed, writes by the NFS client fail with a "Permission Denied" error.| The error will show as below:<br>`hcsuser@ubuntu-vm:~/nfstest$ mkdir test`<br>mkdir: can't create directory 'test': Permission deniedΓÇï|

+|**4.**|Blob Storage ingestion|When using AzCopy version 10 for Blob storage ingestion, run AzCopy with the following argument: `Azcopy <other arguments> --cap-mbps 2000`| If these limits aren't provided for AzCopy, it could potentially send a large number of requests to the device, resulting in issues with the service.|

+|**5.**|Tiered storage accounts|The following apply when using tiered storage accounts:<br> - Only block blobs are supported. Page blobs aren't supported.<br> - There's no snapshot or copy API support.<br> - Hadoop workload ingestion through `distcp` isn't supported as it uses the copy operation heavily.||

+|**6.**|NFS share connection|If multiple processes are copying to the same share, and the `nolock` attribute isn't used, you may see errors during the copy.ΓÇï|The `nolock` attribute must be passed to the mount command to copy files to the NFS share. For example: `C:\Users\aseuser mount -o anon \\10.1.1.211\mnt\vms Z:`.|

+|**7.**|Kubernetes cluster|When applying an update on your device that is running a Kubernetes cluster, the Kubernetes virtual machines will restart and reboot. In this instance, only pods that are deployed with replicas specified are automatically restored after an update. |If you have created individual pods outside a replication controller without specifying a replica set, these pods won't be restored automatically after the device update. You'll need to restore these pods.<br>A replica set replaces pods that are deleted or terminated for any reason, such as node failure or disruptive node upgrade. For this reason, we recommend that you use a replica set even if your application requires only a single pod.|

+|**8.**|Kubernetes cluster|Kubernetes on Azure Stack Edge Pro is supported only with Helm v3 or later. For more information, go to [Frequently asked questions: Removal of Tiller](https://v3.helm.sh/docs/faq/).|

+|**9.**|Kubernetes |Port 31000 is reserved for Kubernetes Dashboard. Port 31001 is reserved for Edge container registry. Similarly, in the default configuration, the IP addresses 172.28.0.1 and 172.28.0.10, are reserved for Kubernetes service and Core DNS service respectively.|Don't use reserved IPs.|

+|**10.**|Kubernetes |Kubernetes doesn't currently allow multi-protocol LoadBalancer services. For example, a DNS service that would have to listen on both TCP and UDP. |To work around this limitation of Kubernetes with MetalLB, two services (one for TCP, one for UDP) can be created on the same pod selector. These services use the same sharing key and spec.loadBalancerIP to share the same IP address. IPs can also be shared if you have more services than available IP addresses. <br> For more information, see [IP address sharing](https://metallb.universe.tf/usage/#ip-address-sharing).|

+|**11.**|Kubernetes cluster|Existing Azure IoT Edge marketplace modules may require modifications to run on IoT Edge on Azure Stack Edge device.|For more information, see [Run existing IoT Edge modules from Azure Stack Edge Pro FPGA devices on Azure Stack Edge Pro GPU device](azure-stack-edge-gpu-modify-fpga-modules-gpu.md).|

+|**12.**|Kubernetes |File-based bind mounts aren't supported with Azure IoT Edge on Kubernetes on Azure Stack Edge device.|IoT Edge uses a translation layer to translate `ContainerCreate` options to Kubernetes constructs. Creating `Binds` maps to `hostpath` directory and thus file-based bind mounts can't be bound to paths in IoT Edge containers. If possible, map the parent directory.|

+|**13.**|Kubernetes |If you bring your own certificates for IoT Edge and add those certificates on your Azure Stack Edge device after the compute is configured on the device, the new certificates aren't picked up.|To work around this problem, you should upload the certificates before you configure compute on the device. If the compute is already configured, [Connect to the PowerShell interface of the device and run IoT Edge commands](azure-stack-edge-gpu-connect-powershell-interface.md#use-iotedge-commands). Restart `iotedged` and `edgehub` pods.|

+|**14.**|Certificates |In certain instances, certificate state in the local UI may take several seconds to update. |The following scenarios in the local UI may be affected. <br> - **Status** column in **Certificates** page. <br> - **Security** tile in **Get started** page. <br> - **Configuration** tile in **Overview** page.<br> |

+|**15.**|Certificates|Alerts related to signing chain certificates aren't removed from the portal even after uploading new signing chain certificates.| |

+|**16.**|Web proxy |NTLM authentication-based web proxy isn't supported. ||

+|**17.**|Internet Explorer|If enhanced security features are enabled, you may not be able to access local web UI pages. | Disable enhanced security, and restart your browser.|

+|**18.**|Kubernetes |Kubernetes doesn't support ":" in environment variable names that are used by .NET applications. This is also required for Event Grid IoT Edge module to function on Azure Stack Edge device and other applications. For more information, see [ASP.NET core documentation](/aspnet/core/fundamentals/configuration/?tabs=basicconfiguration#environment-variables).|Replace ":" by double underscore. For more information,see [Kubernetes issue](https://github.com/kubernetes/kubernetes/issues/53201)|

+|**19.** |Azure Arc + Kubernetes cluster |By default, when resource `yamls` are deleted from the Git repository, the corresponding resources aren't deleted from the Kubernetes cluster. |To allow the deletion of resources when they're deleted from the git repository, set `--sync-garbage-collection` in Arc OperatorParams. For more information, see [Delete a configuration](../azure-arc/kubernetes/tutorial-use-gitops-connected-cluster.md#additional-parameters). |

+|**20.**|NFS |Applications that use NFS share mounts on your device to write data should use Exclusive write. That ensures the writes are written to the disk.| |

+|**21.**|Compute configuration |Compute configuration fails in network configurations where gateways or switches or routers respond to Address Resolution Protocol (ARP) requests for systems that don't exist on the network.| |

+|**22.**|Compute and Kubernetes |If Kubernetes is set up first on your device, it claims all the available GPUs. Hence, it isn't possible to create Azure Resource Manager VMs using GPUs after setting up the Kubernetes. |If your device has 2 GPUs, then you can create one VM that uses the GPU and then configure Kubernetes. In this case, Kubernetes will use the remaining available one GPU. |

+|**23.**|Custom script VM extension |There's a known issue in the Windows VMs that were created in an earlier release and the device was updated to 2103. <br> If you add a custom script extension on these VMs, the Windows VM Guest Agent (Version 2.7.41491.901 only) gets stuck in the update causing the extension deployment to time out. | To work around this issue: <br> 1. Connect to the Windows VM using remote desktop protocol (RDP). <br> 2. Make sure that the `waappagent.exe` is running on the machine: `Get-Process WaAppAgent`. <br> 3. If the `waappagent.exe` isn't running, restart the `rdagent` service: `Get-Service RdAgent` \| `Restart-Service`. Wait for 5 minutes.<br> 4. While the `waappagent.exe` is running, kill the `WindowsAzureGuest.exe` process. <br> 5. After you kill the process, the process starts running again with the newer version. <br> 6. Verify that the Windows VM Guest Agent version is 2.7.41491.971 using this command: `Get-Process WindowsAzureGuestAgent` \| `fl ProductVersion`.<br> 7. [Set up custom script extension on Windows VM](azure-stack-edge-gpu-deploy-virtual-machine-custom-script-extension.md). |

+|**24.**|Multi-Process Service (MPS) |When the device software and the Kubernetes cluster are updated, the MPS setting isn't retained for the workloads. |[Re-enable MPS](azure-stack-edge-gpu-connect-powershell-interface.md#connect-to-the-powershell-interface) and redeploy the workloads that were using MPS. |

+|**25.**|Wi-Fi |Wi-Fi doesn't work on Azure Stack Edge Pro 2 in this release. |

+|**26.**|Azure IoT Edge |The managed Azure IoT Edge solution on Azure Stack Edge is running on an older, obsolete IoT Edge runtime that is at end of life. For more information, see [IoT Edge v1.1 EoL: What does that mean for me?](https://techcommunity.microsoft.com/t5/internet-of-things-blog/iot-edge-v1-1-eol-what-does-that-mean-for-me/ba-p/3662137). Although the solution does not stop working past end of life, there are no plans to update it. |To run the latest version of Azure IoT Edge [LTSs](../iot-edge/version-history.md#version-history) with the latest updates and features on their Azure Stack Edge, we **recommend** that you deploy a [customer self-managed IoT Edge solution](azure-stack-edge-gpu-deploy-iot-edge-linux-vm.md) that runs on a Linux VM. For more information, see [Move workloads from managed IoT Edge on Azure Stack Edge to an IoT Edge solution on a Linux VM](azure-stack-edge-move-to-self-service-iot-edge.md). |

+|**27.**|AKS on Azure Stack Edge |When you update your AKS on Azure Stack Edge deployment from a previous preview version to 2303 release, there is an additional nodepool rollout. |The update may take longer. |

+|**28.**|Azure portal |When the Arc deployment fails in this release, you will see a generic *NO PARAM* error code, as all the errors are not propagated in the portal. |There is no workaround for this behavior in this release. |

+|**29.**|AKS on Azure Stack Edge |In this release, you can't modify the virtual networks once the AKS cluster is deployed on your Azure Stack Edge cluster.| To modify the virtual network, you will need to delete the AKS cluster, then modify virtual networks, and then recreate AKS cluster on your Azure Stack Edge. |

+|**30.**|AKS on Azure Stack Edge |In this release, attaching the PVC takes a long time. As a result, some pods that use persistent volumes (PVs) come up slowly after the host reboots. |A workaround is to restart the nodepool VM by connecting via the Windows PowerShell interface of the device. |

+## Next steps

+- [Update your device](azure-stack-edge-gpu-install-update.md)

+The current update is Update 2303. This update installs two updates, the device update followed by Kubernetes updates.

+The associated versions for this update are:

+- Device software version: Azure Stack Edge 2303 (2.2.2257.1113)

+- Device Kubernetes version: Azure Stack Kubernetes Edge 2303 (2.2.2257.1113)

+For information on what's new in this update, go to [Release notes](azure-stack-edge-gpu-2303-release-notes.md).

+**To apply 2303 update, your device must be running version 2207 or later.**

+- You can update to 2207 from 2106 or later, and then install 2303.

+If you have Azure Kubernetes service deployed and your Azure Stack Edge device and Kubernetes versions are either 2207 or 2209, you must update in multiple steps to apply 2303.

+Use the following steps to update your Azure Stack Edge version and Kubernetes version to 2303:

+1. Update your device version to 2303.

+1. Update your Kubernetes version to 2303.

+If you are running 2210, you can update both your device version and Kubernetes version directly to 2303.

+In Azure portal, the process will require two clicks, the first update gets your device version to 2303 and your Kubernetes version to 2210, and the second update gets your Kubernetes version upgraded to 2303.

+From the local UI, you will have to run each update separately: update the device version to 2303, then update Kubernetes version to 2210, and then update Kubernetes version to 2303.

+ The update listing appears as **Azure Stack Edge Update 2303**.

+6. After the restart is complete, you are taken to the **Sign in** page. To verify that the device software has been updated, in the local web UI, go to **Maintenance** > **Software update**. For the current release, the displayed software version should be **Azure Stack Edge 2303**.

+- [What information does Defender for DevOps store about me and my enterprise, and where is the data stored and processed?](#what-information-does-defender-for-devops-store-about-me-and-my-enterprise-and-where-is-the-data-stored-and-processed)

+### What information does Defender for DevOps store about me and my enterprise, and where is the data stored and processed?

+Defender for DevOps connects to your source code management system, for example, Azure DevOps, GitHub, to provide a central console for your DevOps resources and security posture. Defender for DevOps processes and stores the following information:

+Data is stored within the region your connector is created in and flows into [Microsoft Defender for Cloud](defender-for-cloud-introduction.md). You should consider which region to create your connector in, for any data residency requirements as you design and create your DevOps connector.

+- [Overview of Defender for DevOps](defender-for-devops-introduction.md)

+### I have a large Azure DevOps organization with many repositories. Can I still onboard?

+Yes, there is no limit to how many Azure DevOps repositories you can onboard to Defender for DevOps.

+However, there are two main implications when onboarding large organizations ΓÇô speed and throttling. The speed of discovery for your DevOps repositories is determined by the number of projects for each connector (approximately 100 projects per hour). Throttling can happen because Azure DevOps API calls have a [global rate limit](https://learn.microsoft.com/azure/devops/integrate/concepts/rate-limits?view=azure-devops) and we limit the calls for project discovery to use a small portion of overall quota limits.

+Consider using an alternative Azure DevOps identity (i.e., an Organization Administrator account used as a service account) to avoid individual accounts from being throttled when onboarding large organizations. Below are some scenarios of when to use an alternate identity to onboard a Defender for DevOps connector:

+- Large number of Azure DevOps Organizations and Projects (~500 Projects or more).

+- Large number of concurrent builds which peak during work hours.

+- Authorized user is a [Power Platform](https://learn.microsoft.com/power-platform/) user making additional Azure DevOps API calls, using up the global rate limit quotas.

+Once you have onboarded the Azure DevOps repositories using this account and [configured and ran the Microsoft Security DevOps Azure DevOps extension](https://learn.microsoft.com/azure/defender-for-cloud/azure-devops-extension) in your CI/CD pipeline, then the scanning results will appear near instantaneously in Microsoft Defender for Cloud.

+### Using trusted Microsoft service for routing events to Event Hubs and Service Bus endpoints

+Azure Digital Twins can connect to Event Hubs and Service Bus endpoints for sending event data, using those resources' public endpoints. However, if those resources are bound to a VNet, connectivity to the resources are blocked by default. As a result, this configuration prevents Azure Digital Twins from sending event data to your resources.

+To resolve this, enable connectivity from your Azure Digital Twins instance to your Event Hubs or Service Bus resources through the the *trusted Microsoft service* option (see [Trusted Microsoft services for Event Hubs](../event-hubs/event-hubs-ip-filtering.md#trusted-microsoft-services) and [Trusted Microsoft services for Service Bus](../service-bus-messaging/service-bus-service-endpoints.md#trusted-microsoft-services)).

+You'll need to complete the following steps to enable the trusted Microsoft service connection.

+1. Your Azure Digital Twins instance must use a **system-assigned managed identity**. This allows other services to find your instance as a trusted Microsoft service. For instructions to set up a system-managed identity on the instance, see [Enable managed identity for the instance](how-to-create-endpoints.md#1-enable-managed-identity-for-the-instance).

+1. Once a system-assigned managed identity is provisioned, grant permission for your instance's managed identity to access your Event Hubs or Service Bus endpoint (this feature is not supported in Event Grid). For instructions to assign the proper roles, see [Assign Azure roles to the identity](how-to-create-endpoints.md#2-assign-azure-roles-to-the-identity).

+1. For Event Hubs and Service Bus endpoints that have firewall configurations in place, make sure you enable the **Allow trusted Microsoft services to bypass this firewall** setting.

+ Title: How to create a custom Azure for Classroom Tenant and Billing Profile

+description: This article shows you how to make a custom tenant and billing profile for educators in your organization

+# Create a custom Tenant and Billing Profile for Microsoft for Teaching Paid

+This article is meant for IT Admins utilizing Azure for Classroom. When signing up for this offer, you should already have a tenant and billing profile created, but this article is meant to help walk you through how to create a custom tenant and billing profile and associate them with an educator.

+## Prerequisites

+- Be signed up for Azure for Classroom

+## Create a new tenant

+This section walks you through how to create a new tenant and associate it with your university tenant using multi-tenant

+1. Go to the Azure portal and search for "Azure Active Directory"

+2. Create a new tenant in the "Manage tenants" tab

+3. Fill in and Finalize Tenant information

+4. After the tenant has been created copy the Tenant ID of the new tenant

+## Associate new tenant with university tenant

+1. Go to "Cost Management" and click on "Access control (IAM)

+2. Click on "Associated billing tenants"

+3. Click "Add" and add the Tenant ID of the newly created tenant

+4. Check the box for Billing management

+1. Click "Add" to finalize the association between the newly created tenant and university tenant

+## Invite Educator to the newly created tenant

+This section walks through how to add an Educator to the newly created tenant.

+1. Switch tenants to the newly created tenant

+2. Go to "Users" in the new tenant

+3. Invite a user to this tenant

+1. Change the role to "Global administrator"

+1. Tell the Educator to accept the invitation to this tenant

+2. After the Educator has joined the tenant, go into the tenant properties and click Yes under the Access management for Azure resources.

+Now that you've created a custom Tenant, you can go into Education Hub and begin distributing credit to Educators to use in labs.

+## Next steps

+> [!div class="nextstepaction"]

+> [Create an assignment and allocate credit](create-assignment-allocate-credit.md)